Add DERP generate_204 endpoint for captive portal detection.

.github/workflows/test-integration-v2-TestDERPValidateEmbedded.yaml

@@ -0,0 +1,67 @@
+# DO NOT EDIT, generated with cmd/gh-action-integration-generator/main.go
+# To regenerate, run "go generate" in cmd/gh-action-integration-generator/
+
+name: Integration Test v2 - TestDERPValidateEmbedded
+
+on: [pull_request]
+
+concurrency:
+ group: ${{ github.workflow }}-$${{ github.head_ref || github.run_id }}
+ cancel-in-progress: true
+
+jobs:
+ TestDERPValidateEmbedded:
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@v3
+ with:
+ fetch-depth: 2
+
+ - uses: DeterminateSystems/nix-installer-action@main
+ - uses: DeterminateSystems/magic-nix-cache-action@main
+ - uses: satackey/action-docker-layer-caching@main
+ continue-on-error: true
+
+ - name: Get changed files
+ id: changed-files
+ uses: tj-actions/changed-files@v34
+ with:
+ files: |
+ *.nix
+ go.*
+ **/*.go
+ integration_test/
+ config-example.yaml
+
+ - name: Run TestDERPValidateEmbedded
+ uses: Wandalen/wretry.action@master
+ if: steps.changed-files.outputs.any_changed == 'true'
+ with:
+ attempt_limit: 5
+ command: |
+ nix develop --command -- docker run \
+ --tty --rm \
+ --volume ~/.cache/hs-integration-go:/go \
+ --name headscale-test-suite \
+ --volume $PWD:$PWD -w $PWD/integration \
+ --volume /var/run/docker.sock:/var/run/docker.sock \
+ --volume $PWD/control_logs:/tmp/control \
+ golang:1 \
+ go run gotest.tools/gotestsum@latest -- ./... \
+ -failfast \
+ -timeout 120m \
+ -parallel 1 \
+ -run "^TestDERPValidateEmbedded$"
+
+ - uses: actions/upload-artifact@v3
+ if: always() && steps.changed-files.outputs.any_changed == 'true'
+ with:
+ name: logs
+ path: "control_logs/*.log"
+
+ - uses: actions/upload-artifact@v3
+ if: always() && steps.changed-files.outputs.any_changed == 'true'
+ with:
+ name: pprof
+ path: "control_logs/*.pprof.tar"

hscontrol/app.go

@@ -469,6 +469,11 @@ func (h *Headscale) createRouter(grpcMux *grpcRuntime.ServeMux) *mux.Router {
  router.HandleFunc("/derp", h.DERPServer.DERPHandler)
  router.HandleFunc("/derp/probe", derpServer.DERPProbeHandler)
  router.HandleFunc("/bootstrap-dns", derpServer.DERPBootstrapDNSHandler(h.DERPMap))
+
+ // Only add to main muxer if running on port 80
+ if strings.HasSuffix(h.cfg.Addr, ":80") {
+ router.HandleFunc("/generate_204", derpServer.DERPNoContextHandler)
+ }
  }
 
  apiRouter := router.PathPrefix("/api").Subrouter()
@@ -696,6 +701,31 @@ func (h *Headscale) Serve() error {
  log.Info().
  Msgf("listening and serving HTTP on: %s", h.cfg.Addr)
 
+ // If headscale is not listening on port 80 and embedded DERP server
+ // is enabled, run a small http endpoint for generate204.
+ // This is not configurable as captive portal busting requires http/80.
+ if h.cfg.DERP.ServerEnabled || !strings.HasSuffix(h.cfg.Addr, ":80") {
+ httpDerpMux := http.NewServeMux()
+ httpDerpMux.HandleFunc("/generate_204", derpServer.DERPNoContextHandler)
+
+ addr := "0.0.0.0:80"
+ httpDerpServer := &http.Server{
+ Addr: addr,
+ Handler: httpDerpMux,
+ ReadTimeout: types.HTTPReadTimeout,
+ }
+
+ httpDerpListener, err := net.Listen("tcp", addr)
+ if err != nil {
+ return fmt.Errorf("binding port 80 for DERP HTTP endpoint: %w", err)
+ }
+
+ errorGroup.Go(func() error { return httpDerpServer.Serve(httpDerpListener) })
+
+ log.Info().
+ Msgf("listening and serving HTTP DERP generate_204 on: %s", addr)
+ }
+
  promMux := http.NewServeMux()
  promMux.Handle("/metrics", promhttp.Handler())
 

hscontrol/derp/server/derp_server.go

@@ -26,6 +26,10 @@ import (
 // headers and it will begin writing & reading the DERP protocol immediately
 // following its HTTP request.
 const fastStartHeader = "Derp-Fast-Start"
+const (
+ noContentChallengeHeader = "X-Tailscale-Challenge"
+ noContentResponseHeader = "X-Tailscale-Response"
+)
 
 type DERPServer struct {
  serverURL string
@@ -204,6 +208,43 @@ func DERPProbeHandler(
  }
 }
 
+// DERPNoContextHandler is the endpoint clients use to determine if they are behind a captive portal
+// Clients challenge this with the X-Tailscale-Challenge header and expect the challenge value within X-Tailscale-Response
+// https://github.com/tailscale/tailscale/blob/955e2fcbfb4fe7ff9b8dbd665ba24ef2008c676e/cmd/derper/derper.go#L324
+func DERPNoContextHandler(
+ writer http.ResponseWriter,
+ req *http.Request,
+) {
+ switch req.Method {
+ case http.MethodHead, http.MethodGet:
+ if challenge := req.Header.Get(noContentChallengeHeader); challenge != "" {
+ badChar := strings.IndexFunc(challenge, func(r rune) bool {
+ return !isChallengeChar(r)
+ }) != -1
+ if len(challenge) <= 64 && !badChar {
+ writer.Header().Set(noContentResponseHeader, "response "+challenge)
+ }
+ }
+ writer.WriteHeader(http.StatusNoContent)
+ default:
+ writer.WriteHeader(http.StatusMethodNotAllowed)
+ _, err := writer.Write([]byte("bogus captive portal method"))
+ if err != nil {
+ log.Error().
+ Caller().
+ Err(err).
+ Msg("Failed to write response")
+ }
+ }
+}
+
+func isChallengeChar(c rune) bool {
+ // Semi-randomly chosen as a limited set of valid characters
+ return ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z') ||
+ ('0' <= c && c <= '9') ||
+ c == '.' || c == '-' || c == '_'
+}
+
 // DERPBootstrapDNSHandler implements the /bootsrap-dns endpoint
 // Described in https://github.com/tailscale/tailscale/issues/1405,
 // this endpoint provides a way to help a client when it fails to start up

integration/embedded_derp_test.go

@@ -1,16 +1,19 @@
 package integration
 
 import (
+ "encoding/json"
  "fmt"
  "log"
  "net/url"
+ "strings"
  "testing"
 
  "github.com/juanfont/headscale/hscontrol/util"
  "github.com/juanfont/headscale/integration/dockertestutil"
  "github.com/juanfont/headscale/integration/hsic"
  "github.com/juanfont/headscale/integration/tsic"
  "github.com/ory/dockertest/v3"
+ "tailscale.com/ipn/ipnstate"
 )
 
 type EmbeddedDERPServerScenario struct {
@@ -55,7 +58,7 @@ func TestDERPServerScenario(t *testing.T) {
  spec,
  hsic.WithConfigEnv(headscaleConfig),
  hsic.WithTestName("derpserver"),
- hsic.WithExtraPorts([]string{"3478/udp"}),
+ hsic.WithExtraPorts("3478/udp"),
  hsic.WithTLS(),
  hsic.WithHostnameAsServerURL(),
  )
@@ -80,6 +83,82 @@ func TestDERPServerScenario(t *testing.T) {
  t.Logf("%d successful pings out of %d", success, len(allClients)*len(allIps))
 }
 
+func TestDERPValidateEmbedded(t *testing.T) {
+ IntegrationSkip(t)
+
+ scenario, err := NewScenario()
+ assertNoErr(t, err)
+ // defer scenario.Shutdown()
+
+ spec := map[string]int{
+ "user1": 1,
+ }
+
+ headscaleConfig := map[string]string{
+ "HEADSCALE_DERP_URLS": "",
+ "HEADSCALE_DERP_SERVER_ENABLED": "true",
+ "HEADSCALE_DERP_SERVER_REGION_ID": "999",
+ "HEADSCALE_DERP_SERVER_REGION_CODE": "headscale",
+ "HEADSCALE_DERP_SERVER_REGION_NAME": "Headscale Embedded DERP",
+ "HEADSCALE_DERP_SERVER_STUN_LISTEN_ADDR": "0.0.0.0:3478",
+ "HEADSCALE_DERP_SERVER_PRIVATE_KEY_PATH": "/tmp/derp.key",
+
+ // Magic DNS breaks the docker DNS system which means
+ // DERP cannot look up the DERP server for some things.
+ "HEADSCALE_DNS_CONFIG_MAGIC_DNS": "0",
+
+ // Envknob for enabling DERP debug logs
+ "DERP_DEBUG_LOGS": "true",
+ "DERP_PROBER_DEBUG_LOGS": "true",
+ }
+
+ err = scenario.CreateHeadscaleEnv(
+ spec,
+ []tsic.Option{},
+ hsic.WithConfigEnv(headscaleConfig),
+ hsic.WithTestName("derpvalidate"),
+ hsic.WithExtraPorts("3478/udp", "80/tcp"),
+ hsic.WithTLS(),
+ hsic.WithHostnameAsServerURL(),
+ )
+ assertNoErrHeadscaleEnv(t, err)
+
+ allClients, err := scenario.ListTailscaleClients()
+ assertNoErrListClients(t, err)
+
+ err = scenario.WaitForTailscaleSync()
+ assertNoErrSync(t, err)
+
+ assertClientsState(t, allClients)
+
+ if len(allClients) != 1 {
+ t.Fatalf("expected 1 client, got: %d", len(allClients))
+ }
+
+ client := allClients[0]
+
+ var derpReport ipnstate.DebugDERPRegionReport
+ stdout, stderr, err := client.Execute([]string{"tailscale", "debug", "derp", "999"})
+ if err != nil {
+ t.Fatalf("executing debug derp report, stderr: %s, err: %s", stderr, err)
+ }
+
+ t.Logf("DERP report: \n%s", stdout)
+
+ err = json.Unmarshal([]byte(stdout), &derpReport)
+ if err != nil {
+ t.Fatalf("unmarshalling debug derp report, content: %s, err: %s", stdout, err)
+ }
+
+ for _, warn := range derpReport.Warnings {
+ if strings.Contains(warn, "captive portal check") {
+ t.Errorf(
+ "derp report contains warning about portal check, generate_204 endpoint not working",
+ )
+ }
+ }
+}
+
 func (s *EmbeddedDERPServerScenario) CreateHeadscaleEnv(
  users map[string]int,
  opts ...hsic.Option,

integration/hsic/hsic.go

@@ -112,12 +112,14 @@ func WithConfigEnv(configEnv map[string]string) Option {
 // WithPort sets the port on where to run Headscale.
 func WithPort(port int) Option {
  return func(hsic *HeadscaleInContainer) {
+ hsic.env["HEADSCALE_LISTEN_ADDR"] = fmt.Sprintf("0.0.0.0:%d", port)
+ hsic.env["HEADSCALE_SERVER_URL"] = fmt.Sprintf("http://headscale:%d", port)
  hsic.port = port
  }
 }
 
 // WithExtraPorts exposes additional ports on the container (e.g. 3478/udp for STUN).
-func WithExtraPorts(ports []string) Option {
+func WithExtraPorts(ports ...string) Option {
  return func(hsic *HeadscaleInContainer) {
  hsic.extraPorts = ports
  }