chore: fix CI and add dial timeout (#7)

Author: deansheather

.github/workflows/release.yaml

@@ -48,7 +48,7 @@ jobs:
 
       - uses: actions/setup-go@v3
         with:
-          go-version: "~1.19"
+          go-version: "~1.20"
 
       - name: Build tunneld and Docker images
         id: build
@@ -59,17 +59,24 @@ jobs:
           make clean
           make -j build/tunneld build/tunneld.tag
 
-          echo "docker_tag=$(cat build/tunneld.tag)" >> $GITHUB_OUTPUT
+          image_tag=$(cat build/tunneld.tag)
+          if [[ "$image_tag" == "" ]]; then
+            echo "No tag found in build/tunneld.tag"
+            exit 1
+          fi
+
+          echo "docker_tag=${image_tag}" >> $GITHUB_OUTPUT
 
       - name: Push Docker image
         if: ${{ !github.event.inputs.dry_run && !github.event.inputs.snapshot }}
         run: |
           set -euxo pipefail
 
-          docker push "${{ steps.build.outputs.docker_tag }}"
+          image_tag="${{ steps.build.outputs.docker_tag }}"
+          docker push "$image_tag"
 
           latest_tag="ghcr.io/coder/wgtunnel/tunneld:latest"
-          docker tag "${{ steps.build.outputs.docker_tag }}" "$latest_tag"
+          docker tag "$image_tag" "$latest_tag"
           docker push "$latest_tag"
 
       - name: ls build

.github/workflows/wgtunnel.yaml

@@ -34,7 +34,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v3
         with:
-          go-version: "~1.19"
+          go-version: "~1.20"
       - name: Check for unstaged files
         run: ./scripts/check_unstaged.sh
 
@@ -46,11 +46,11 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v3
         with:
-          go-version: "~1.19"
+          go-version: "~1.20"
       - name: golangci-lint
         uses: golangci/[email protected]
         with:
-          version: v1.48.0
+          version: v1.51.0
 
   test:
     runs-on: ubuntu-latest
@@ -60,13 +60,13 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v3
         with:
-          go-version: "~1.19"
+          go-version: "~1.20"
       - name: Install gotestsum
         uses: jaxxstorm/[email protected]
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           repo: gotestyourself/gotestsum
-          tag: v1.7.0
+          tag: v1.9.0
       - name: Test
         run: make test

Makefile

@@ -45,7 +45,9 @@ build/tunneld build/tunnel: build/%: $(shell find . -type f -name '*.go')
 
 # build/tunneld.tag generates the Docker image for tunneld.
 build/tunneld.tag: build/tunneld
-	tag="ghcr.io/coder/wgtunnel/tunneld:$(VERSION)"
+	# Dev versions contain plus signs which are illegal in Docker tags.
+	version="$(VERSION)"
+	tag="ghcr.io/coder/wgtunnel/tunneld:$${version//+/-}"
 
 	# make a temp directory, copy the binary into it, and build the image.
 	temp_dir=$$(mktemp -d)

scripts/version.sh

@@ -13,9 +13,6 @@
 set -euo pipefail
 cd "$(dirname "$0")"
 
-# TODO: remove this after the first tag has been made
-export WGTUNNEL_FORCE_VERSION="0.1.0"
-
 if [[ "${WGTUNNEL_FORCE_VERSION:-}" != "" ]]; then
 	echo "$WGTUNNEL_FORCE_VERSION"
 	exit 0

tunneld/api.go

@@ -201,6 +201,18 @@ func (api *API) handleTunnelMW(next http.Handler) http.Handler {
 			return
 		}
 
+		dialCtx, dialCancel := context.WithTimeout(ctx, api.Options.PeerDialTimeout)
+		defer dialCancel()
+
+		nc, err := api.wgNet.DialContextTCPAddrPort(dialCtx, netip.AddrPortFrom(ip, tunnelsdk.TunnelPort))
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusBadGateway, tunnelsdk.Response{
+				Message: "Failed to dial peer.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+
 		span := trace.SpanFromContext(ctx)
 		span.SetAttributes(attribute.Bool("proxy_request", true))
 
@@ -212,11 +224,6 @@ func (api *API) handleTunnelMW(next http.Handler) http.Handler {
 			},
 			Transport: &http.Transport{
 				DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
-					nc, err := api.wgNet.DialContextTCPAddrPort(ctx, netip.AddrPortFrom(ip, tunnelsdk.TunnelPort))
-					if err != nil {
-						return nil, err
-					}
-
 					return &tracingConnWrapper{
 						Conn: nc,
 						span: span,

tunneld/options.go

@@ -8,6 +8,7 @@ import (
 	"net/netip"
 	"net/url"
 	"strings"
+	"time"
 
 	"golang.org/x/xerrors"
 	"golang.zx2c4.com/wireguard/device"
@@ -17,7 +18,8 @@ import (
 )
 
 const (
-	DefaultWireguardMTU = 1280
+	DefaultWireguardMTU    = 1280
+	DefaultPeerDialTimeout = 10 * time.Second
 )
 
 var (
@@ -57,6 +59,10 @@ type Options struct {
 	// IPs will be generated within this network. Must be a IPv6 CIDR and have
 	// at least 64 bits of space available. Defaults to fcca::/16.
 	WireguardNetworkPrefix netip.Prefix
+
+	// PeerDialTimeout is the timeout for dialing a peer on a request. Defaults
+	// to 10 seconds.
+	PeerDialTimeout time.Duration
 }
 
 // Validate checks that the options are valid and populates default values for
@@ -107,6 +113,10 @@ func (options *Options) Validate() error {
 		return xerrors.New("WireguardServerIP must be contained within WireguardNetworkPrefix")
 	}
 
+	if options.PeerDialTimeout <= 0 {
+		options.PeerDialTimeout = DefaultPeerDialTimeout
+	}
+
 	return nil
 }
 

tunneld/options_test.go

@@ -6,6 +6,7 @@ import (
 	"net/url"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 	"golang.zx2c4.com/wireguard/device"
@@ -38,6 +39,7 @@ func Test_Option(t *testing.T) {
 				WireguardMTU:           tunneld.DefaultWireguardMTU + 1,
 				WireguardServerIP:      netip.MustParseAddr("feed::1"),
 				WireguardNetworkPrefix: netip.MustParsePrefix("feed::1/64"),
+				PeerDialTimeout:        1 * time.Second,
 			}
 
 			clone := o

tunneld/tunneld_test.go

@@ -299,6 +299,58 @@ func TestCompatibility(t *testing.T) {
 	})
 }
 
+func TestTimeout(t *testing.T) {
+	t.Parallel()
+
+	td, client := createTestTunneld(t, &tunneld.Options{
+		BaseURL: &url.URL{
+			Scheme: "http",
+			Host:   "localhost.com",
+		},
+		WireguardEndpoint:      "",              // generated automatically
+		WireguardPort:          0,               // generated automatically
+		WireguardKey:           tunnelsdk.Key{}, // generated automatically
+		WireguardServerIP:      tunneld.DefaultWireguardServerIP,
+		WireguardNetworkPrefix: tunneld.DefaultWireguardNetworkPrefix,
+		PeerDialTimeout:        time.Second,
+	})
+	require.NotNil(t, td)
+
+	// Start a tunnel.
+	key, err := tunnelsdk.GeneratePrivateKey()
+	require.NoError(t, err, "generate private key")
+	tunnel, err := client.LaunchTunnel(context.Background(), tunnelsdk.TunnelConfig{
+		Log: slogtest.
+			Make(t, &slogtest.Options{IgnoreErrors: true}).
+			Named("tunnel_client"),
+		PrivateKey: key,
+	})
+	require.NoError(t, err, "launch tunnel")
+
+	// Close the tunnel.
+	err = tunnel.Close()
+	require.NoError(t, err, "close tunnel")
+	<-tunnel.Wait()
+
+	// Requests should fail in roughly 1 second.
+	c := tunnelHTTPClient(client)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	u := *tunnel.URL
+	u.Path = "/test/1"
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	require.NoError(t, err)
+
+	now := time.Now()
+	res, err := c.Do(req)
+	require.NoError(t, err)
+	require.WithinDuration(t, now.Add(time.Second), time.Now(), 2*time.Second)
+	defer res.Body.Close()
+	require.Equal(t, http.StatusBadGateway, res.StatusCode)
+}
+
 func freeUDPPort(t *testing.T) uint16 {
 	t.Helper()
 

tunnelsdk/tunnel.go

@@ -21,7 +21,7 @@ import (
 
 // TunnelPort is the port in the virtual wireguard network stack that the
 // listener is listening on.
-const TunnelPort = 8080
+const TunnelPort = 8090
 
 // TunnelVersion is the version of the tunnel URL specification.
 type TunnelVersion int