derpcat: it's alive!

UA 605 PDX-ORD en route to Ireland. yay not buying the wifi.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

Author: bradfitz

derpcat/derpcat.go

@@ -5,10 +5,13 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"io"
 	"log"
 	"net"
 	"net/netip"
+	"slices"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/fxamacker/cbor/v2"
@@ -24,8 +27,10 @@ import (
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/netmap"
+	"tailscale.com/util/cmpx"
 	"tailscale.com/util/mak"
 	"tailscale.com/wgengine"
+	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/netstack"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg"
@@ -53,6 +58,9 @@ type locoBackend struct {
 	dm         *tailcfg.DERPMap
 	logf       logger.Logf
 	serverPub  key.NodePublic // non-zero if we're a client (server's public key)
+
+	mu      sync.Mutex
+	clients map[key.NodePublic]*tailcfg.Node // for the server
 }
 
 func (b *locoBackend) Close() error {
@@ -105,9 +113,20 @@ func NewServer(priv key.NodePrivate, logf logger.Logf, regs ...*tailcfg.DERPRegi
 	}
 	ns.ProcessLocalIPs = true
 	ns.ProcessSubnets = true
+	ns.GetTCPHandlerForFlow = func(src, dst netip.AddrPort) (handler func(net.Conn), intercept bool) {
+		logf("XXX connection from %v to %v", src, dst)
+		if dst.Port() != 80 {
+			return nil, true // sends RST
+		}
+		return func(c net.Conn) {
+			io.WriteString(c, "Hello from port 80\n")
+			c.Close()
+		}, true
+	}
 	lb.ns = ns
 
 	e := sys.Engine.Get()
+	e.SetFilter(filter.NewAllowAllForTest(logf)) // TODO: trashy
 	dialer.UseNetstackForIP = func(ip netip.Addr) bool {
 		_, ok := e.PeerForIP(ip)
 		return ok
@@ -220,15 +239,20 @@ func (lb *locoBackend) Start() error {
 	}
 	if lb.serverPub.IsZero() {
 		// We're the server. (hence the serverPub is zero)
+		discoPriv := lb.priv.AsDiscoPrivate()
+		mc.SetDisco(discoPriv)
+		mc.BeDerpCatServer(lb.onMeow)
+
 		nm.SelfNode = (&tailcfg.Node{
 			ID:         1,
 			StableID:   "1",
 			Name:       "server.derpcat.",
 			User:       100,
 			Key:        lb.pub,
-			DiscoKey:   mc.DiscoPublicKey(), // TODO: change how disco works
+			DiscoKey:   discoPriv.Public(),
 			Addresses:  []netip.Prefix{lb.addrPrefix},
 			AllowedIPs: []netip.Prefix{lb.addrPrefix},
+			DERP:       "127.3.3.40:1",
 		}).View()
 	} else {
 		// We're the client.
@@ -241,20 +265,23 @@ func (lb *locoBackend) Start() error {
 			Name:      "client.derpcat.",
 			User:      100,
 			Key:       lb.pub,
-			DiscoKey:  mc.DiscoPublicKey(), // TODO: change how disco works
+			DiscoKey:  mc.DiscoPublicKey(),
 			Addresses: []netip.Prefix{lb.addrPrefix},
+			DERP:      "127.3.3.40:1",
 		}).View()
 		nm.Peers = append(nm.Peers, (&tailcfg.Node{
 			ID:         1,
 			StableID:   "1",
 			Name:       "server.derpcat.",
 			User:       100,
 			Key:        lb.serverPub,
-			DiscoKey:   key.NewDisco().Public(), // TODO: change how disco works. This is dummy placeholder to placate magicsock for now
+			DiscoKey:   lb.serverPub.AsDiscoPublic(),
 			Addresses:  []netip.Prefix{serverAddrPrefix},
 			AllowedIPs: []netip.Prefix{serverAddrPrefix},
+			DERP:       "127.3.3.40:1",
 		}).View())
 	}
+	nm.Addresses = nm.SelfNode.Addresses().AsSlice() // dumb redundant field for now
 	e.SetNetworkMap(nm)
 	mc.SetNetworkUp(true)
 	lb.logf("NetworkMap: %v", logger.AsJSON(nm))
@@ -285,6 +312,71 @@ func (lb *locoBackend) Start() error {
 	return nil
 }
 
+func (b *locoBackend) onMeow(src key.NodePublic, discoPub key.DiscoPublic) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if _, ok := b.clients[src]; ok {
+		return
+	}
+	id := len(b.clients) + 2 // server id ID 1, clients are IDs 2, 3, ...
+	mak.Set(&b.clients, src, &tailcfg.Node{
+		ID:         tailcfg.NodeID(id),
+		StableID:   tailcfg.StableNodeID(fmt.Sprint(id)),
+		Name:       fmt.Sprintf("client%d.derpcat.", id),
+		User:       100,
+		Key:        src,
+		DiscoKey:   discoPub,
+		Addresses:  []netip.Prefix{pfxOf(dcAddrForKey(src))},
+		AllowedIPs: []netip.Prefix{pfxOf(dcAddrForKey(src))},
+		DERP:       "127.3.3.40:1",
+	})
+
+	nm := &netmap.NetworkMap{
+		PrivateKey: b.priv,
+		SelfNode: (&tailcfg.Node{
+			ID:         1,
+			StableID:   "1",
+			Name:       "server.derpcat.",
+			User:       100,
+			Key:        b.pub,
+			DiscoKey:   b.priv.AsDiscoPrivate().Public(), // TODO: cache
+			Addresses:  []netip.Prefix{b.addrPrefix},
+			AllowedIPs: []netip.Prefix{b.addrPrefix},
+			DERP:       "127.3.3.40:1",
+		}).View(),
+	}
+	nm.Addresses = nm.SelfNode.Addresses().AsSlice() // dumb redundant field for now
+	for _, n := range b.clients {
+		nm.Peers = append(nm.Peers, n.View())
+	}
+	slices.SortFunc(nm.Peers, func(a, b tailcfg.NodeView) int {
+		return cmpx.Compare(a.ID(), b.ID())
+	})
+	eng := b.sys.Engine.Get()
+	eng.SetNetworkMap(nm)
+
+	wgConf := &wgcfg.Config{
+		Name:       "self",
+		PrivateKey: b.priv,
+		Addresses:  []netip.Prefix{b.addrPrefix},
+		MTU:        1280,
+		Peers:      []wgcfg.Peer{}, // TODO: add peers dynamically as they disco to us
+	}
+	for _, p := range b.clients {
+		wgConf.Peers = append(wgConf.Peers, wgcfg.Peer{
+			PublicKey:  p.Key,
+			AllowedIPs: p.AllowedIPs,
+		})
+	}
+	routerConf := &router.Config{
+		LocalAddrs: []netip.Prefix{b.addrPrefix},
+	}
+	dnsConf := &dns.Config{}
+	if err := eng.Reconfig(wgConf, routerConf, dnsConf); err != nil {
+		panic(fmt.Sprintf("e.Reconfig: %v", err))
+	}
+}
+
 func (b *locoBackend) Status() *ipnstate.Status {
 	mc := b.sys.MagicSock.Get()
 	eng := b.sys.Engine.Get()
@@ -372,11 +464,14 @@ func NewClient(logf logger.Logf, server ConnBlob) (*Client, error) {
 	if err != nil {
 		return nil, fmt.Errorf("newNetstack: %w", err)
 	}
-	ns.ProcessLocalIPs = false
-	ns.ProcessSubnets = false
+	ns.ProcessLocalIPs = true // required to even reply to TCP SYNs client sends out
+	ns.GetTCPHandlerForFlow = func(src, dst netip.AddrPort) (handler func(net.Conn), intercept bool) {
+		return nil, true // don't accept any incoming connections to client
+	}
 	lb.ns = ns
 
 	e := sys.Engine.Get()
+	e.SetFilter(filter.NewAllowAllForTest(logf)) // TODO: trashy
 	dialer.UseNetstackForIP = func(ip netip.Addr) bool {
 		_, ok := e.PeerForIP(ip)
 		return ok
@@ -391,8 +486,9 @@ func NewClient(logf logger.Logf, server ConnBlob) (*Client, error) {
 	}, nil
 }
 
-func (c *Client) Start() error { return c.lb.Start() }
-func (c *Client) Close() error { return c.lb.Close() }
+func (c *Client) PublicKey() key.NodePublic { return c.lb.pub }
+func (c *Client) Start() error              { return c.lb.Start() }
+func (c *Client) Close() error              { return c.lb.Close() }
 
 type PingResult struct {
 	Latency time.Duration
@@ -422,3 +518,7 @@ func (c *Client) Ping(ctx context.Context) (PingResult, error) {
 		return zero, ctx.Err()
 	}
 }
+
+func pfxOf(a netip.Addr) netip.Prefix {
+	return netip.PrefixFrom(a, a.BitLen())
+}

derpcat/derpcat_test.go

@@ -2,8 +2,13 @@ package derpcat
 
 import (
 	"context"
+	"errors"
+	"io"
+	"net"
 	"testing"
+	"time"
 
+	"tailscale.com/tstest"
 	"tailscale.com/tstest/integration"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
@@ -20,7 +25,7 @@ func mkLogger(t testing.TB, name string) logger.Logf {
 }
 
 func TestDERPCat(t *testing.T) {
-	dm := integration.RunDERPAndSTUN(t, mkLogger(t, "derpstun"), "127.0.0.1")
+	derper, dm := integration.RunDERPAndSTUN(t, mkLogger(t, "derpstun"), "127.0.0.1")
 	t.Logf("DERPMap: %v", logger.AsJSON(dm))
 
 	reg := dm.Regions[1]
@@ -40,6 +45,15 @@ func TestDERPCat(t *testing.T) {
 		t.Fatalf("server Start: %v", err)
 	}
 
+	if err := tstest.WaitFor(5*time.Second, func() error {
+		if derper.IsClientConnectedForTest(priv.Public()) {
+			return nil
+		}
+		return errors.New("server not connected to derper")
+	}); err != nil {
+		t.Fatal(err)
+	}
+
 	c, err := NewClient(mkLogger(t, "client"), s.ConnBlob())
 	if err != nil {
 		t.Fatalf("NewClient: %v", err)
@@ -49,9 +63,33 @@ func TestDERPCat(t *testing.T) {
 	}
 	t.Cleanup(func() { c.Close() })
 
+	if false {
+		if err := tstest.WaitFor(5*time.Second, func() error {
+			if derper.IsClientConnectedForTest(c.PublicKey()) {
+				return nil
+			}
+			return errors.New("server not connected to derper")
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	t.Logf("Client is %v", c.PublicKey())
+
 	pi, err := c.Ping(context.Background())
 	if err != nil {
 		t.Fatalf("Ping: %v", err)
 	}
 	t.Logf("got ping: %+v", pi)
+
+	time.Sleep(1 * time.Second)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	conn, err := c.lb.sys.Dialer.Get().UserDial(ctx, "tcp", net.JoinHostPort(s.lb.addr.String(), "80"))
+	if err != nil {
+		t.Fatalf("UserDial = %v, %v", conn, err)
+	}
+	all, err := io.ReadAll(conn)
+	t.Logf("Got: %q, %v", all, err)
 }

tstest/integration/integration.go

@@ -293,7 +293,7 @@ func exe() string {
 // RunDERPAndSTUN runs a local DERP and STUN server for tests, returning the derpMap
 // that clients should use. This creates resources that must be cleaned up with the
 // returned cleanup function.
-func RunDERPAndSTUN(t testing.TB, logf logger.Logf, ipAddress string) (derpMap *tailcfg.DERPMap) {
+func RunDERPAndSTUN(t testing.TB, logf logger.Logf, ipAddress string) (derpServer *derp.Server, derpMap *tailcfg.DERPMap) {
 	t.Helper()
 
 	d := derpserver.New(key.NewNode(), logf)
@@ -344,7 +344,7 @@ func RunDERPAndSTUN(t testing.TB, logf logger.Logf, ipAddress string) (derpMap *
 		ln.Close()
 	})
 
-	return m
+	return d, m
 }
 
 // LogCatcher is a minimal logcatcher for the logtail upload client.

types/key/node.go

@@ -378,3 +378,11 @@ func (k NodePublic) WireGuardGoString() string {
 	b[second+3] = b64((k.k[31] << 2) & 63)
 	return string(b)
 }
+
+func (k NodePrivate) AsDiscoPrivate() DiscoPrivate {
+	return DiscoPrivate(k)
+}
+
+func (k NodePublic) AsDiscoPublic() DiscoPublic {
+	return DiscoPublic(k)
+}