test(coderd/healthcheck/derphealth): use local STUN server (#29435)

Replace the public Google STUN fixture with Tailscale's in-process
test server. Use `STUNTestIP` to make intentionally unhealthy nodes fail
without DNS access or waiting for the UDP probe timeout.

Rationale: These tests validate STUN reachability and health
aggregation, not public NAT behavior. A local STUN server provides the
required protocol response without an external network dependency.

Refs:
https://linear.app/codercom/issue/PLAT-495
This commit is contained in:
George K
2026-09-16 14:52:21 -07:00
committed by GitHub
parent 6967259af4
commit 73d0835b8b
+18 -6
View File
@@ -15,6 +15,7 @@ import (
"tailscale.com/derp"
"tailscale.com/derp/derphttp"
"tailscale.com/ipn"
"tailscale.com/net/stun/stuntest"
"tailscale.com/tailcfg"
"tailscale.com/types/key"
@@ -366,6 +367,7 @@ func TestDERP(t *testing.T) {
t.Run("STUNOnly/WarnsNoDERP", func(t *testing.T) {
t.Parallel()
stunPort := serveSTUN(t)
var (
ctx = context.Background()
@@ -378,8 +380,9 @@ func TestDERP(t *testing.T) {
Nodes: []*tailcfg.DERPNode{{
Name: "999stun0",
RegionID: 999,
HostName: "stun.l.google.com",
STUNPort: 19302,
IPv4: "127.0.0.1",
IPv6: "none",
STUNPort: stunPort,
STUNOnly: true,
InsecureForTests: true,
ForceHTTP: true,
@@ -433,6 +436,7 @@ func TestDERP(t *testing.T) {
t.Run("STUNOnly/OneBadOneGood", func(t *testing.T) {
t.Parallel()
goodSTUNPort := serveSTUN(t)
var (
ctx = context.Background()
@@ -446,7 +450,7 @@ func TestDERP(t *testing.T) {
Nodes: []*tailcfg.DERPNode{{
Name: "badstun",
RegionID: 999,
HostName: "badstun.example.com",
STUNTestIP: "not-an-ip",
STUNPort: 19302,
STUNOnly: true,
InsecureForTests: true,
@@ -454,8 +458,9 @@ func TestDERP(t *testing.T) {
}, {
Name: "goodstun",
RegionID: 999,
HostName: "stun.l.google.com",
STUNPort: 19302,
IPv4: "127.0.0.1",
IPv6: "none",
STUNPort: goodSTUNPort,
STUNOnly: true,
InsecureForTests: true,
ForceHTTP: true,
@@ -509,7 +514,7 @@ func TestDERP(t *testing.T) {
Nodes: []*tailcfg.DERPNode{{
Name: "badstun",
RegionID: 999,
HostName: "badstun.example.com",
STUNTestIP: "not-an-ip",
STUNPort: 19302,
STUNOnly: true,
InsecureForTests: true,
@@ -539,6 +544,13 @@ func TestDERP(t *testing.T) {
})
}
func serveSTUN(t testing.TB) int {
t.Helper()
addr, cleanup := stuntest.Serve(t)
t.Cleanup(cleanup)
return addr.Port
}
func tsDERPMap(ctx context.Context, t testing.TB) *tailcfg.DERPMap {
req, err := http.NewRequestWithContext(ctx, "GET", ipn.DefaultControlURL+"/derpmap/default", nil)
require.NoError(t, err)