Skip to content

Conversation

@thirdeyenick
Copy link
Contributor

@thirdeyenick thirdeyenick commented Mar 26, 2025

This ensures that nodes which have a base domain set, will have a dot appended to their FQDN. This way, nodes in a netmap will look the same as they do when using tailscale.com services.

Fixes: #2501

  • have read the CONTRIBUTING.md file
  • raised a GitHub issue or discussed it on the projects chat beforehand
  • added unit tests
  • added integration tests
  • updated documentation if needed
  • updated CHANGELOG.md

@kradalby
Copy link
Collaborator

I've approved to all tests will run, lets see how that goes and if something more needs to be updated. Can you add a changelog entry?

@kradalby
Copy link
Collaborator

I see that there failures in TestResolveMagicDNS, postgres) (pull_request), I imagine that is related, do you have the opportunity to take a look at those?

@thirdeyenick
Copy link
Contributor Author

Yeah, I noticed that as well. I am currently trying to run the integration tests locally, so that I can verify my changes. Will look into it.

@thirdeyenick
Copy link
Contributor Author

I did some change to the TestResolveMagicDNS test, but I don't know if this will resolve all the issues. I tried to run make test_integration, but it failed with a different error after quite a lot of time.

@thirdeyenick
Copy link
Contributor Author

Is there anything I can help here with? I am not sure the TestValidateResolvConf issues are related to my changes.

Copy link
Collaborator

@kradalby kradalby left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good, you can ignore TestValidateResolvConf

[#2493](https://github.com/juanfont/headscale/pull/2493)
- If a OIDC provider doesn't include the `email_verified` claim in its ID
tokens, Headscale will attempt to get it from the UserInfo endpoint.
- node FQDNs in the netmap will now contain a dot (".") at the end. This aligns
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

link to pr please

@kradalby
Copy link
Collaborator

kradalby commented Apr 2, 2025

There is a couple of go test failures blocking merge, could you have a look?

@thirdeyenick
Copy link
Contributor Author

There is a couple of go test failures blocking merge, could you have a look?

I'll have a look.

@ghost
Copy link

ghost commented Apr 7, 2025

Pull Request Revisions

RevisionDescription
r4
Node FQDNs now end with dotModified node FQDN generation to append a dot (".") at the end, aligning with Tailscale's behavior across multiple files
r3
Renamed buffer struct fieldsRenamed buffer struct's buffer field to store and updated method variable names accordingly
r2
Added goroutine-safe buffer implementationIntroduced a thread-safe buffer struct with synchronized Write and String methods to prevent race conditions during command execution
r1
Added dot suffix to node FQDNsModified node FQDN generation to append a trailing dot, aligning with Tailscale's behavior across multiple files and tests
✅ AI review completed for r4

@thirdeyenick
Copy link
Contributor Author

I fixed the TestNodeFQDN test now.

I also had a look into the failing TestExpireNode test, but found it to be flaky when running locally. I did a bit of debugging and to me it seems there is a change in behavior depending on the client version. In the test always the node with ID 1 gets expired on the headscale control container, but ID 1 might relate to any client version. I found that, if the expired node key belongs to the 1.62 or 1.64 client the test passes as the node key can still be found in the network map of all peers (marked as expired though). Starting with the 1.78 client version it seems that the client automatically creates a new node key and the old expired one vanishes from the network map on all the peers. Not sure how to fix this test, but maybe one could always test the "head" version of the client and make sure that the expired node key doesn't exist in the network map anymore?

Comment on lines 34 to 53
type buffer struct {
buffer bytes.Buffer
mutex sync.Mutex
}

// Write appends the contents of p to the buffer, growing the buffer as needed. It returns
// the number of bytes written.
func (s *buffer) Write(p []byte) (n int, err error) {
s.mutex.Lock()
defer s.mutex.Unlock()
return s.buffer.Write(p)
}

// String returns the contents of the unread portion of the buffer
// as a string. If the Buffer is a nil pointer, it returns "<nil>".
func (s *buffer) String() string {
s.mutex.Lock()
defer s.mutex.Unlock()
return s.buffer.String()
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The error message in String() method indicates it will return "" if the Buffer is a nil pointer, but the implementation doesn't handle this case. Consider adding a nil check at the beginning of the method or removing this comment if nil buffers aren't expected in your usage pattern.

This ensures that nodes which have a base domain set, will have a dot appended to their FQDN.

Resolves: juanfont#2501
Waiting a bit more than the TTL of the OIDC token seems to remove some flakiness of this test. This furthermore makes use of a go func safe buffer which should avoid race conditions.
@thirdeyenick
Copy link
Contributor Author

I fixed the TestNodeFQDN test now.

I also had a look into the failing TestExpireNode test, but found it to be flaky when running locally. I did a bit of debugging and to me it seems there is a change in behavior depending on the client version. In the test always the node with ID 1 gets expired on the headscale control container, but ID 1 might relate to any client version. I found that, if the expired node key belongs to the 1.62 or 1.64 client the test passes as the node key can still be found in the network map of all peers (marked as expired though). Starting with the 1.78 client version it seems that the client automatically creates a new node key and the old expired one vanishes from the network map on all the peers. Not sure how to fix this test, but maybe one could always test the "head" version of the client and make sure that the expired node key doesn't exist in the network map anymore?

Hi @kradalby , do you have any opinion on this? Or should this just be left as it is?

@kradalby
Copy link
Collaborator

kradalby commented Apr 10, 2025

Hi @kradalby , do you have any opinion on this? Or should this just be left as it is?

sorry I've been swamped, I think it sounds fine for now, I cant recall any specific client changes, but we will likely drop support for some of those clients with our 10 last client goal, so lets not spend that much effort on it for now.

If the tests (even with reruns) passes now, this one should be good.

@kradalby kradalby merged commit 1099890 into juanfont:main Apr 11, 2025
269 of 276 checks passed
@korpa
Copy link

korpa commented May 28, 2025

A couple of months ago, I built my private support for tailscale serve as discussed in #1921

After patching my changes to headscale v0.26.0, tailscale serve didn't work anymore. In the logs of tailscaled on the node I run tailscale serve, I got following error when accessing the domain https://xxx.yyy.net:

cert("xxx.yyy.net"): getCertPEM: invalid domain "xxx.yyy.net"; must be one of ["xxx.yyy.net."]

After reverting this change, tailscale serve works great again. Just want to let you know in preparation for #2527

rbollampally added a commit to rbollampally/headscale that referenced this pull request Jul 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Question] Node names in netmap do not have a dot appended to their FQDN

3 participants