client/web: switch to custom fork of gorilla/csrf

This fork removes the dependency on the html/template package, so we
should be able to enable the web client on mobile in the near future.

Updates #10261

Signed-off-by: Will Norris <will@tailscale.com>

Makefile

@@ -3,8 +3,6 @@ SYNO_ARCH ?= "amd64"
 SYNO_DSM ?= "7"
 TAGS ?= "latest"
 
-PLATFORM ?= "flyio" ## flyio==linux/amd64. Set to "" to build all platforms.
-
 vet: ## Run go vet
 	./tool/go vet ./...
 
@@ -90,7 +88,7 @@ publishdevimage: ## Build and publish tailscale image to location specified by $
 	@test "${REPO}" != "ghcr.io/tailscale/tailscale" || (echo "REPO=... must not be ghcr.io/tailscale/tailscale" && exit 1)
 	@test "${REPO}" != "tailscale/k8s-operator" || (echo "REPO=... must not be tailscale/k8s-operator" && exit 1)
 	@test "${REPO}" != "ghcr.io/tailscale/k8s-operator" || (echo "REPO=... must not be ghcr.io/tailscale/k8s-operator" && exit 1)
-	TAGS="${TAGS}" REPOS=${REPO} PLATFORM=${PLATFORM} PUSH=true TARGET=client ./build_docker.sh
+	TAGS="${TAGS}" REPOS=${REPO} PUSH=true TARGET=client ./build_docker.sh
 
 publishdevoperator: ## Build and publish k8s-operator image to location specified by ${REPO}
 	@test -n "${REPO}" || (echo "REPO=... required; e.g. REPO=ghcr.io/${USER}/tailscale" && exit 1)
@@ -98,7 +96,7 @@ publishdevoperator: ## Build and publish k8s-operator image to location specifie
 	@test "${REPO}" != "ghcr.io/tailscale/tailscale" || (echo "REPO=... must not be ghcr.io/tailscale/tailscale" && exit 1)
 	@test "${REPO}" != "tailscale/k8s-operator" || (echo "REPO=... must not be tailscale/k8s-operator" && exit 1)
 	@test "${REPO}" != "ghcr.io/tailscale/k8s-operator" || (echo "REPO=... must not be ghcr.io/tailscale/k8s-operator" && exit 1)
-	TAGS="${TAGS}" REPOS=${REPO} PLATFORM=${PLATFORM} PUSH=true TARGET=operator ./build_docker.sh
+	TAGS="${TAGS}" REPOS=${REPO} PUSH=true TARGET=operator ./build_docker.sh
 
 help: ## Show this help
 	@echo "\nSpecify a command. The choices are:\n"

build_docker.sh

@@ -32,7 +32,6 @@ PUSH="${PUSH:-false}"
 TARGET="${TARGET:-${DEFAULT_TARGET}}"
 TAGS="${TAGS:-${DEFAULT_TAGS}}"
 BASE="${BASE:-${DEFAULT_BASE}}"
-PLATFORM="${PLATFORM:-}" # default to all platforms
 
 case "$TARGET" in
   client)
@@ -51,7 +50,6 @@ case "$TARGET" in
       --tags="${TAGS}" \
       --repos="${REPOS}" \
       --push="${PUSH}" \
-      --target="${PLATFORM}" \
       /usr/local/bin/containerboot
     ;;
   operator)
@@ -67,7 +65,6 @@ case "$TARGET" in
       --tags="${TAGS}" \
       --repos="${REPOS}" \
       --push="${PUSH}" \
-      --target="${PLATFORM}" \
       /usr/local/bin/operator
     ;;
   *)

client/web/auth.go

@@ -8,7 +8,6 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"errors"
-	"fmt"
 	"net/http"
 	"net/url"
 	"strings"
@@ -233,55 +232,3 @@ func (s *Server) newSessionID() (string, error) {
 	}
 	return "", errors.New("too many collisions generating new session; please refresh page")
 }
-
-type peerCapabilities map[capFeature]bool // value is true if the peer can edit the given feature
-
-// canEdit is true if the peerCapabilities grant edit access
-// to the given feature.
-func (p peerCapabilities) canEdit(feature capFeature) bool {
-	if p == nil {
-		return false
-	}
-	if p[capFeatureAll] {
-		return true
-	}
-	return p[feature]
-}
-
-type capFeature string
-
-const (
-	// The following values should not be edited.
-	// New caps can be added, but existing ones should not be changed,
-	// as these exact values are used by users in tailnet policy files.
-
-	capFeatureAll      capFeature = "*"        // grants peer management of all features
-	capFeatureFunnel   capFeature = "funnel"   // grants peer serve/funnel management
-	capFeatureSSH      capFeature = "ssh"      // grants peer SSH server management
-	capFeatureSubnet   capFeature = "subnet"   // grants peer subnet routes management
-	capFeatureExitNode capFeature = "exitnode" // grants peer ability to advertise-as and use exit nodes
-	capFeatureAccount  capFeature = "account"  // grants peer ability to turn on auto updates and log out of node
-)
-
-type capRule struct {
-	CanEdit []string `json:"canEdit,omitempty"` // list of features peer is allowed to edit
-}
-
-// toPeerCapabilities parses out the web ui capabilities from the
-// given whois response.
-func toPeerCapabilities(whois *apitype.WhoIsResponse) (peerCapabilities, error) {
-	caps := peerCapabilities{}
-	if whois == nil {
-		return caps, nil
-	}
-	rules, err := tailcfg.UnmarshalCapJSON[capRule](whois.CapMap, tailcfg.PeerCapabilityWebUI)
-	if err != nil {
-		return nil, fmt.Errorf("failed to unmarshal capability: %v", err)
-	}
-	for _, c := range rules {
-		for _, f := range c.CanEdit {
-			caps[capFeature(strings.ToLower(f))] = true
-		}
-	}
-	return caps, nil
-}

client/web/src/components/login-toggle.tsx

@@ -95,16 +95,9 @@ function LoginPopoverContent({
   const [canConnectOverTS, setCanConnectOverTS] = useState<boolean>(false)
   const [isRunningCheck, setIsRunningCheck] = useState<boolean>(false)
 
-  // Whether the current page is loaded over HTTPS.
-  // If it is, then the connectivity check to the management client
-  // will fail with a mixed-content error.
-  const isHTTPS = window.location.protocol === "https:"
-
   const checkTSConnection = useCallback(() => {
-    if (auth.viewerIdentity || isHTTPS) {
-      // Skip the connectivity check if we either already know we're connected over Tailscale,
-      // or know the connectivity check will fail because the current page is loaded over HTTPS.
-      setCanConnectOverTS(true)
+    if (auth.viewerIdentity) {
+      setCanConnectOverTS(true) // already connected over ts
       return
     }
     // Otherwise, test connection to the ts IP.
@@ -118,7 +111,7 @@ function LoginPopoverContent({
         setIsRunningCheck(false)
       })
       .catch(() => setIsRunningCheck(false))
-  }, [auth.viewerIdentity, isRunningCheck, node.IPv4, isHTTPS])
+  }, [auth.viewerIdentity, isRunningCheck, node.IPv4])
 
   /**
    * Checking connection for first time on page load.
@@ -200,14 +193,6 @@ function LoginPopoverContent({
                     You can see most of this device's details. To make changes,
                     you need to sign in.
                   </p>
-                  {isHTTPS && (
-                    // we don't know if the user can connect over TS, so
-                    // provide extra tips in case they have trouble.
-                    <p className="text-gray-500 text-xs font-semibold pt-2">
-                      Make sure you are connected to your tailnet, and that your
-                      policy file allows access.
-                    </p>
-                  )}
                   <SignInButton auth={auth} onClick={handleSignInClick} />
                 </>
               )}

client/web/web.go

@@ -22,7 +22,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/gorilla/csrf"
+	"github.com/tailscale/csrf"
 	"tailscale.com/client/tailscale"
 	"tailscale.com/client/tailscale/apitype"
 	"tailscale.com/clientupdate"
@@ -450,11 +450,10 @@ type authResponse struct {
 // viewerIdentity is the Tailscale identity of the source node
 // connected to this web client.
 type viewerIdentity struct {
-	LoginName     string           `json:"loginName"`
-	NodeName      string           `json:"nodeName"`
-	NodeIP        string           `json:"nodeIP"`
-	ProfilePicURL string           `json:"profilePicUrl,omitempty"`
-	Capabilities  peerCapabilities `json:"capabilities"` // features peer is allowed to edit
+	LoginName     string `json:"loginName"`
+	NodeName      string `json:"nodeName"`
+	NodeIP        string `json:"nodeIP"`
+	ProfilePicURL string `json:"profilePicUrl,omitempty"`
 }
 
 // serverAPIAuth handles requests to the /api/auth endpoint
@@ -465,16 +464,10 @@ func (s *Server) serveAPIAuth(w http.ResponseWriter, r *http.Request) {
 	session, whois, status, sErr := s.getSession(r)
 
 	if whois != nil {
-		caps, err := toPeerCapabilities(whois)
-		if err != nil {
-			http.Error(w, sErr.Error(), http.StatusInternalServerError)
-			return
-		}
 		resp.ViewerIdentity = &viewerIdentity{
 			LoginName:     whois.UserProfile.LoginName,
 			NodeName:      whois.Node.Name,
 			ProfilePicURL: whois.UserProfile.ProfilePicURL,
-			Capabilities:  caps,
 		}
 		if addrs := whois.Node.Addresses; len(addrs) > 0 {
 			resp.ViewerIdentity.NodeIP = addrs[0].Addr().String()

client/web/web_test.go

@@ -450,7 +450,6 @@ func TestServeAuth(t *testing.T) {
 		NodeName:      remoteNode.Node.Name,
 		NodeIP:        remoteIP,
 		ProfilePicURL: user.ProfilePicURL,
-		Capabilities:  peerCapabilities{},
 	}
 
 	testControlURL := &defaultControlURL
@@ -1098,163 +1097,6 @@ func TestRequireTailscaleIP(t *testing.T) {
 	}
 }
 
-func TestPeerCapabilities(t *testing.T) {
-	// Testing web.toPeerCapabilities
-	toPeerCapsTests := []struct {
-		name     string
-		whois    *apitype.WhoIsResponse
-		wantCaps peerCapabilities
-	}{
-		{
-			name:     "empty-whois",
-			whois:    nil,
-			wantCaps: peerCapabilities{},
-		},
-		{
-			name: "no-webui-caps",
-			whois: &apitype.WhoIsResponse{
-				CapMap: tailcfg.PeerCapMap{
-					tailcfg.PeerCapabilityDebugPeer: []tailcfg.RawMessage{},
-				},
-			},
-			wantCaps: peerCapabilities{},
-		},
-		{
-			name: "one-webui-cap",
-			whois: &apitype.WhoIsResponse{
-				CapMap: tailcfg.PeerCapMap{
-					tailcfg.PeerCapabilityWebUI: []tailcfg.RawMessage{
-						"{\"canEdit\":[\"ssh\",\"subnet\"]}",
-					},
-				},
-			},
-			wantCaps: peerCapabilities{
-				capFeatureSSH:    true,
-				capFeatureSubnet: true,
-			},
-		},
-		{
-			name: "multiple-webui-cap",
-			whois: &apitype.WhoIsResponse{
-				CapMap: tailcfg.PeerCapMap{
-					tailcfg.PeerCapabilityWebUI: []tailcfg.RawMessage{
-						"{\"canEdit\":[\"ssh\",\"subnet\"]}",
-						"{\"canEdit\":[\"subnet\",\"exitnode\",\"*\"]}",
-					},
-				},
-			},
-			wantCaps: peerCapabilities{
-				capFeatureSSH:      true,
-				capFeatureSubnet:   true,
-				capFeatureExitNode: true,
-				capFeatureAll:      true,
-			},
-		},
-		{
-			name: "case=insensitive-caps",
-			whois: &apitype.WhoIsResponse{
-				CapMap: tailcfg.PeerCapMap{
-					tailcfg.PeerCapabilityWebUI: []tailcfg.RawMessage{
-						"{\"canEdit\":[\"SSH\",\"sUBnet\"]}",
-					},
-				},
-			},
-			wantCaps: peerCapabilities{
-				capFeatureSSH:    true,
-				capFeatureSubnet: true,
-			},
-		},
-		{
-			name: "random-canEdit-contents-dont-error",
-			whois: &apitype.WhoIsResponse{
-				CapMap: tailcfg.PeerCapMap{
-					tailcfg.PeerCapabilityWebUI: []tailcfg.RawMessage{
-						"{\"canEdit\":[\"unknown-feature\"]}",
-					},
-				},
-			},
-			wantCaps: peerCapabilities{
-				"unknown-feature": true,
-			},
-		},
-		{
-			name: "no-canEdit-section",
-			whois: &apitype.WhoIsResponse{
-				CapMap: tailcfg.PeerCapMap{
-					tailcfg.PeerCapabilityWebUI: []tailcfg.RawMessage{
-						"{\"canDoSomething\":[\"*\"]}",
-					},
-				},
-			},
-			wantCaps: peerCapabilities{},
-		},
-	}
-	for _, tt := range toPeerCapsTests {
-		t.Run("toPeerCapabilities-"+tt.name, func(t *testing.T) {
-			got, err := toPeerCapabilities(tt.whois)
-			if err != nil {
-				t.Fatalf("unexpected: %v", err)
-			}
-			if diff := cmp.Diff(got, tt.wantCaps); diff != "" {
-				t.Errorf("wrong caps; (-got+want):%v", diff)
-			}
-		})
-	}
-
-	// Testing web.peerCapabilities.canEdit
-	canEditTests := []struct {
-		name        string
-		caps        peerCapabilities
-		wantCanEdit map[capFeature]bool
-	}{
-		{
-			name: "empty-caps",
-			caps: nil,
-			wantCanEdit: map[capFeature]bool{
-				capFeatureAll:      false,
-				capFeatureFunnel:   false,
-				capFeatureSSH:      false,
-				capFeatureSubnet:   false,
-				capFeatureExitNode: false,
-				capFeatureAccount:  false,
-			},
-		},
-		{
-			name: "some-caps",
-			caps: peerCapabilities{capFeatureSSH: true, capFeatureAccount: true},
-			wantCanEdit: map[capFeature]bool{
-				capFeatureAll:      false,
-				capFeatureFunnel:   false,
-				capFeatureSSH:      true,
-				capFeatureSubnet:   false,
-				capFeatureExitNode: false,
-				capFeatureAccount:  true,
-			},
-		},
-		{
-			name: "wildcard-in-caps",
-			caps: peerCapabilities{capFeatureAll: true, capFeatureAccount: true},
-			wantCanEdit: map[capFeature]bool{
-				capFeatureAll:      true,
-				capFeatureFunnel:   true,
-				capFeatureSSH:      true,
-				capFeatureSubnet:   true,
-				capFeatureExitNode: true,
-				capFeatureAccount:  true,
-			},
-		},
-	}
-	for _, tt := range canEditTests {
-		t.Run("canEdit-"+tt.name, func(t *testing.T) {
-			for f, want := range tt.wantCanEdit {
-				if got := tt.caps.canEdit(f); got != want {
-					t.Errorf("wrong canEdit(%s); got=%v, want=%v", f, got, want)
-				}
-			}
-		})
-	}
-}
-
 var (
 	defaultControlURL   = "https://controlplane.tailscale.com"
 	testAuthPath        = "/a/12345"

cmd/k8s-operator/deploy/chart/templates/deployment.yaml

@@ -59,6 +59,8 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+            - name: ENABLE_CONNECTOR
+              value: "{{ .Values.enableConnector }}"
             - name: CLIENT_ID_FILE
               value: /oauth/client_id
             - name: CLIENT_SECRET_FILE

cmd/k8s-operator/deploy/chart/values.yaml

@@ -8,11 +8,11 @@ oauth: {}
   # clientId: ""
   # clientSecret: ""
 
-# installCRDs determines whether tailscale.com CRDs should be installed as part
-# of chart installation. We do not use Helm's CRD installation mechanism as that
-# does not allow for upgrading CRDs.
-# https://helm.sh/docs/chart_best_practices/custom_resource_definitions/
-installCRDs: "true"
+# enableConnector determines whether the operator should reconcile
+# connector.tailscale.com custom resources. If set to true you have to install
+# connector CRD in a separate step.
+# You can do so by running 'kubectl apply -f ./cmd/k8s-operator/deploy/crds'.
+enableConnector: "false"
 
 operatorConfig:
   image:

cmd/k8s-operator/deploy/manifests/operator.yaml

@@ -27,132 +27,6 @@ metadata:
     name: proxies
     namespace: tailscale
 ---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-    annotations:
-        controller-gen.kubebuilder.io/version: v0.13.0
-    name: connectors.tailscale.com
-spec:
-    group: tailscale.com
-    names:
-        kind: Connector
-        listKind: ConnectorList
-        plural: connectors
-        shortNames:
-            - cn
-        singular: connector
-    scope: Cluster
-    versions:
-        - additionalPrinterColumns:
-            - description: CIDR ranges exposed to tailnet by a subnet router defined via this Connector instance.
-              jsonPath: .status.subnetRoutes
-              name: SubnetRoutes
-              type: string
-            - description: Whether this Connector instance defines an exit node.
-              jsonPath: .status.isExitNode
-              name: IsExitNode
-              type: string
-            - description: Status of the deployed Connector resources.
-              jsonPath: .status.conditions[?(@.type == "ConnectorReady")].reason
-              name: Status
-              type: string
-          name: v1alpha1
-          schema:
-            openAPIV3Schema:
-                properties:
-                    apiVersion:
-                        description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-                        type: string
-                    kind:
-                        description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-                        type: string
-                    metadata:
-                        type: object
-                    spec:
-                        description: ConnectorSpec describes the desired Tailscale component.
-                        properties:
-                            exitNode:
-                                description: ExitNode defines whether the Connector node should act as a Tailscale exit node. Defaults to false. https://tailscale.com/kb/1103/exit-nodes
-                                type: boolean
-                            hostname:
-                                description: Hostname is the tailnet hostname that should be assigned to the Connector node. If unset, hostname defaults to <connector name>-connector. Hostname can contain lower case letters, numbers and dashes, it must not start or end with a dash and must be between 2 and 63 characters long.
-                                pattern: ^[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$
-                                type: string
-                            subnetRouter:
-                                description: SubnetRouter defines subnet routes that the Connector node should expose to tailnet. If unset, none are exposed. https://tailscale.com/kb/1019/subnets/
-                                properties:
-                                    advertiseRoutes:
-                                        description: AdvertiseRoutes refer to CIDRs that the subnet router should make available. Route values must be strings that represent a valid IPv4 or IPv6 CIDR range. Values can be Tailscale 4via6 subnet routes. https://tailscale.com/kb/1201/4via6-subnets/
-                                        items:
-                                            format: cidr
-                                            type: string
-                                        minItems: 1
-                                        type: array
-                                required:
-                                    - advertiseRoutes
-                                type: object
-                            tags:
-                                description: Tags that the Tailscale node will be tagged with. Defaults to [tag:k8s]. To autoapprove the subnet routes or exit node defined by a Connector, you can configure Tailscale ACLs to give these tags the necessary permissions. See https://tailscale.com/kb/1018/acls/#auto-approvers-for-routes-and-exit-nodes. If you specify custom tags here, you must also make the operator an owner of these tags. See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator. Tags cannot be changed once a Connector node has been created. Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
-                                items:
-                                    pattern: ^tag:[a-zA-Z][a-zA-Z0-9-]*$
-                                    type: string
-                                type: array
-                        type: object
-                        x-kubernetes-validations:
-                            - message: A Connector needs to be either an exit node or a subnet router, or both.
-                              rule: has(self.subnetRouter) || self.exitNode == true
-                    status:
-                        description: ConnectorStatus describes the status of the Connector. This is set and managed by the Tailscale operator.
-                        properties:
-                            conditions:
-                                description: List of status conditions to indicate the status of the Connector. Known condition types are `ConnectorReady`.
-                                items:
-                                    description: ConnectorCondition contains condition information for a Connector.
-                                    properties:
-                                        lastTransitionTime:
-                                            description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
-                                            format: date-time
-                                            type: string
-                                        message:
-                                            description: Message is a human readable description of the details of the last transition, complementing reason.
-                                            type: string
-                                        observedGeneration:
-                                            description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Connector.
-                                            format: int64
-                                            type: integer
-                                        reason:
-                                            description: Reason is a brief machine readable explanation for the condition's last transition.
-                                            type: string
-                                        status:
-                                            description: Status of the condition, one of ('True', 'False', 'Unknown').
-                                            type: string
-                                        type:
-                                            description: Type of the condition, known values are (`SubnetRouterReady`).
-                                            type: string
-                                    required:
-                                        - status
-                                        - type
-                                    type: object
-                                type: array
-                                x-kubernetes-list-map-keys:
-                                    - type
-                                x-kubernetes-list-type: map
-                            isExitNode:
-                                description: IsExitNode is set to true if the Connector acts as an exit node.
-                                type: boolean
-                            subnetRoutes:
-                                description: SubnetRoutes are the routes currently exposed to tailnet via this Connector instance.
-                                type: string
-                        type: object
-                required:
-                    - spec
-                type: object
-          served: true
-          storage: true
-          subresources:
-            status: {}
----
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -286,6 +160,8 @@ spec:
                       valueFrom:
                         fieldRef:
                             fieldPath: metadata.namespace
+                    - name: ENABLE_CONNECTOR
+                      value: "false"
                     - name: CLIENT_ID_FILE
                       value: /oauth/client_id
                     - name: CLIENT_SECRET_FILE

cmd/k8s-operator/generate/main.go

@@ -18,49 +18,15 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-const (
-	operatorDeploymentFilesPath = "cmd/k8s-operator/deploy"
-	crdPath                     = operatorDeploymentFilesPath + "/crds/tailscale.com_connectors.yaml"
-	helmTemplatesPath           = operatorDeploymentFilesPath + "/chart/templates"
-	crdTemplatePath             = helmTemplatesPath + "/connectors.yaml"
-
-	helmConditionalStart = "{{ if .Values.installCRDs -}}\n"
-	helmConditionalEnd   = "{{- end -}}"
-)
-
 func main() {
-	if len(os.Args) < 2 {
-		log.Fatalf("usage ./generate [staticmanifests|helmcrd]")
-	}
 	repoRoot := "../../"
-	switch os.Args[1] {
-	case "helmcrd": // insert CRD to Helm templates behind a installCRDs=true conditional check
-		log.Print("Adding Connector CRD to Helm templates")
-		if err := generate("./"); err != nil {
-			log.Fatalf("error adding Connector CRD to Helm templates: %v", err)
-		}
-		return
-	case "staticmanifests": // generate static manifests from Helm templates (including the CRD)
-	default:
-		log.Fatalf("unknown option %s, known options are 'staticmanifests', 'helmcrd'", os.Args[1])
-	}
-	log.Printf("Inserting CRD into the Helm templates")
-	if err := generate(repoRoot); err != nil {
-		log.Fatalf("error adding Connector CRD to Helm templates: %v", err)
-	}
-	defer func() {
-		if err := cleanup(repoRoot); err != nil {
-			log.Fatalf("error cleaning up generated resources")
-		}
-	}()
-	log.Print("Templating Helm chart contents")
-	helmTmplCmd := exec.Command("./tool/helm", "template", "operator", "./cmd/k8s-operator/deploy/chart",
+	cmd := exec.Command("./tool/helm", "template", "operator", "./cmd/k8s-operator/deploy/chart",
 		"--namespace=tailscale")
-	helmTmplCmd.Dir = repoRoot
+	cmd.Dir = repoRoot
 	var out bytes.Buffer
-	helmTmplCmd.Stdout = &out
-	helmTmplCmd.Stderr = os.Stderr
-	if err := helmTmplCmd.Run(); err != nil {
+	cmd.Stdout = &out
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
 		log.Fatalf("error templating helm manifests: %v", err)
 	}
 
@@ -88,6 +54,7 @@ func main() {
 		if err != nil {
 			log.Fatalf("failed read from input data: %v", err)
 		}
+
 		bytes, err := yaml.Marshal(document)
 		if err != nil {
 			log.Fatalf("failed to marshal YAML document: %v", err)
@@ -105,35 +72,3 @@ func main() {
 		log.Fatalf("error writing new file: %v", err)
 	}
 }
-
-func generate(baseDir string) error {
-	log.Print("Placing Connector CRD into Helm templates..")
-	chartBytes, err := os.ReadFile(filepath.Join(baseDir, crdPath))
-	if err != nil {
-		return fmt.Errorf("error reading CRD contents: %w", err)
-	}
-	// Place a new temporary Helm template file with the templated CRD
-	// contents into Helm templates.
-	file, err := os.Create(filepath.Join(baseDir, crdTemplatePath))
-	if err != nil {
-		return fmt.Errorf("error creating CRD template file: %w", err)
-	}
-	if _, err := file.Write([]byte(helmConditionalStart)); err != nil {
-		return fmt.Errorf("error writing helm if statement start: %w", err)
-	}
-	if _, err := file.Write(chartBytes); err != nil {
-		return fmt.Errorf("error writing chart bytes: %w", err)
-	}
-	if _, err := file.Write([]byte(helmConditionalEnd)); err != nil {
-		return fmt.Errorf("error writing helm if-statement end: %w", err)
-	}
-	return nil
-}
-
-func cleanup(baseDir string) error {
-	log.Print("Cleaning up CRD from Helm templates")
-	if err := os.Remove(filepath.Join(baseDir, crdTemplatePath)); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("error cleaning up CRD template: %w", err)
-	}
-	return nil
-}

cmd/k8s-operator/generate/main_test.go

@@ -1,68 +0,0 @@
-// Copyright (c) Tailscale Inc & AUTHORS
-// SPDX-License-Identifier: BSD-3-Clause
-
-//go:build !plan9 && !windows
-
-package main
-
-import (
-	"bytes"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func Test_generate(t *testing.T) {
-	base, err := os.Getwd()
-	base = filepath.Join(base, "../../../")
-	if err != nil {
-		t.Fatalf("error getting current working directory: %v", err)
-	}
-	defer cleanup(base)
-	if err := generate(base); err != nil {
-		t.Fatalf("CRD template generation: %v", err)
-	}
-
-	tempDir := t.TempDir()
-	helmCLIPath := filepath.Join(base, "tool/helm")
-	helmChartTemplatesPath := filepath.Join(base, "cmd/k8s-operator/deploy/chart")
-	helmPackageCmd := exec.Command(helmCLIPath, "package", helmChartTemplatesPath, "--destination", tempDir, "--version", "0.0.1")
-	helmPackageCmd.Stderr = os.Stderr
-	helmPackageCmd.Stdout = os.Stdout
-	if err := helmPackageCmd.Run(); err != nil {
-		t.Fatalf("error packaging Helm chart: %v", err)
-	}
-	helmPackagePath := filepath.Join(tempDir, "tailscale-operator-0.0.1.tgz")
-	helmLintCmd := exec.Command(helmCLIPath, "lint", helmPackagePath)
-	helmLintCmd.Stderr = os.Stderr
-	helmLintCmd.Stdout = os.Stdout
-	if err := helmLintCmd.Run(); err != nil {
-		t.Fatalf("Helm chart linter failed: %v", err)
-	}
-
-	// Test that default Helm install contains the CRD
-	installContentsWithCRD := bytes.NewBuffer([]byte{})
-	helmTemplateWithCRDCmd := exec.Command(helmCLIPath, "template", helmPackagePath)
-	helmTemplateWithCRDCmd.Stderr = os.Stderr
-	helmTemplateWithCRDCmd.Stdout = installContentsWithCRD
-	if err := helmTemplateWithCRDCmd.Run(); err != nil {
-		t.Fatalf("templating Helm chart with CRDs failed: %v", err)
-	}
-	if !strings.Contains(installContentsWithCRD.String(), "name: connectors.tailscale.com") {
-		t.Errorf("CRD not found in default chart install")
-	}
-
-	// Test that CRD can be excluded from Helm chart install
-	installContentsWithoutCRD := bytes.NewBuffer([]byte{})
-	helmTemplateWithoutCRDCmd := exec.Command(helmCLIPath, "template", helmPackagePath, "--set", "installCRDs=false")
-	helmTemplateWithoutCRDCmd.Stderr = os.Stderr
-	helmTemplateWithoutCRDCmd.Stdout = installContentsWithoutCRD
-	if err := helmTemplateWithoutCRDCmd.Run(); err != nil {
-		t.Fatalf("templating Helm chart without CRDs failed: %v", err)
-	}
-	if strings.Contains(installContentsWithoutCRD.String(), "name: connectors.tailscale.com") {
-		t.Errorf("CRD found in chart install that should not contain a CRD")
-	}
-}

cmd/k8s-operator/operator.go

@@ -45,7 +45,7 @@ import (
 )
 
 // Generate static manifests for deploying Tailscale operator on Kubernetes from the operator's Helm chart.
-//go:generate go run tailscale.com/cmd/k8s-operator/generate staticmanifests
+//go:generate go run tailscale.com/cmd/k8s-operator/generate
 
 // Generate Connector CustomResourceDefinition yaml from its Go types.
 //go:generate go run sigs.k8s.io/controller-tools/cmd/controller-gen crd schemapatch:manifests=./deploy/crds output:dir=./deploy/crds paths=../../k8s-operator/apis/...
@@ -62,6 +62,7 @@ func main() {
 		priorityClassName = defaultEnv("PROXY_PRIORITY_CLASS_NAME", "")
 		tags              = defaultEnv("PROXY_TAGS", "tag:k8s")
 		tsFirewallMode    = defaultEnv("PROXY_FIREWALL_MODE", "")
+		tsEnableConnector = defaultBool("ENABLE_CONNECTOR", false)
 	)
 
 	var opts []kzap.Opts
@@ -92,7 +93,7 @@ func main() {
 	maybeLaunchAPIServerProxy(zlog, restConfig, s, mode)
 	// TODO (irbekrm): gather the reconciler options into an opts struct
 	// rather than passing a million of them in one by one.
-	runReconcilers(zlog, s, tsNamespace, restConfig, tsClient, image, priorityClassName, tags, tsFirewallMode)
+	runReconcilers(zlog, s, tsNamespace, restConfig, tsClient, image, priorityClassName, tags, tsFirewallMode, tsEnableConnector)
 }
 
 // initTSNet initializes the tsnet.Server and logs in to Tailscale. It uses the
@@ -200,7 +201,7 @@ waitOnline:
 
 // runReconcilers starts the controller-runtime manager and registers the
 // ServiceReconciler. It blocks forever.
-func runReconcilers(zlog *zap.SugaredLogger, s *tsnet.Server, tsNamespace string, restConfig *rest.Config, tsClient *tailscale.Client, image, priorityClassName, tags, tsFirewallMode string) {
+func runReconcilers(zlog *zap.SugaredLogger, s *tsnet.Server, tsNamespace string, restConfig *rest.Config, tsClient *tailscale.Client, image, priorityClassName, tags, tsFirewallMode string, enableConnector bool) {
 	var (
 		isDefaultLoadBalancer = defaultBool("OPERATOR_DEFAULT_LOAD_BALANCER", false)
 	)
@@ -221,7 +222,9 @@ func runReconcilers(zlog *zap.SugaredLogger, s *tsnet.Server, tsNamespace string
 				&appsv1.StatefulSet{}: nsFilter,
 			},
 		},
-		Scheme: tsapi.GlobalScheme,
+	}
+	if enableConnector {
+		mgrOpts.Scheme = tsapi.GlobalScheme
 	}
 	mgr, err := manager.New(restConfig, mgrOpts)
 	if err != nil {
@@ -275,20 +278,22 @@ func runReconcilers(zlog *zap.SugaredLogger, s *tsnet.Server, tsNamespace string
 		startlog.Fatalf("could not create controller: %v", err)
 	}
 
-	connectorFilter := handler.EnqueueRequestsFromMapFunc(managedResourceHandlerForType("connector"))
-	err = builder.ControllerManagedBy(mgr).
-		For(&tsapi.Connector{}).
-		Watches(&appsv1.StatefulSet{}, connectorFilter).
-		Watches(&corev1.Secret{}, connectorFilter).
-		Complete(&ConnectorReconciler{
-			ssr:      ssr,
-			recorder: eventRecorder,
-			Client:   mgr.GetClient(),
-			logger:   zlog.Named("connector-reconciler"),
-			clock:    tstime.DefaultClock{},
-		})
-	if err != nil {
-		startlog.Fatal("could not create connector reconciler: %v", err)
+	if enableConnector {
+		connectorFilter := handler.EnqueueRequestsFromMapFunc(managedResourceHandlerForType("subnetrouter"))
+		err = builder.ControllerManagedBy(mgr).
+			For(&tsapi.Connector{}).
+			Watches(&appsv1.StatefulSet{}, connectorFilter).
+			Watches(&corev1.Secret{}, connectorFilter).
+			Complete(&ConnectorReconciler{
+				ssr:      ssr,
+				recorder: eventRecorder,
+				Client:   mgr.GetClient(),
+				logger:   zlog.Named("connector-reconciler"),
+				clock:    tstime.DefaultClock{},
+			})
+		if err != nil {
+			startlog.Fatal("could not create connector reconciler: %v", err)
+		}
 	}
 	startlog.Infof("Startup complete, operator running, version: %s", version.Long())
 	if err := mgr.Start(signals.SetupSignalHandler()); err != nil {

cmd/k8s-operator/sts.go

@@ -214,19 +214,18 @@ const maxStatefulSetNameLength = 63 - 10 - 1
 // generation will NOT result in a StatefulSet name longer than 52 chars.
 // This is done because of https://github.com/kubernetes/kubernetes/issues/64023.
 func statefulSetNameBase(parent string) string {
+
 	base := fmt.Sprintf("ts-%s-", parent)
+
+	// Calculate what length name GenerateName returns for this base.
 	generator := names.SimpleNameGenerator
-	for {
-		generatedName := generator.GenerateName(base)
-		excess := len(generatedName) - maxStatefulSetNameLength
-		if excess <= 0 {
-			return base
-		}
-		base = base[:len(base)-1-excess]   // cut off the excess chars
-		if !strings.HasSuffix(base, "-") { // dash may have been cut by the generator
-			base = base + "-"
-		}
+	generatedName := generator.GenerateName(base)
+
+	if excess := len(generatedName) - maxStatefulSetNameLength; excess > 0 {
+		base = base[:len(base)-excess-1] // take extra char off to make space for hyphen
+		base = base + "-"                // re-instate hyphen
 	}
+	return base
 }
 
 func (a *tailscaleSTSReconciler) reconcileHeadlessService(ctx context.Context, logger *zap.SugaredLogger, sts *tailscaleSTSConfig) (*corev1.Service, error) {

cmd/k8s-operator/sts_test.go

@@ -6,9 +6,6 @@
 package main
 
 import (
-	"fmt"
-	"regexp"
-	"strings"
 	"testing"
 )
 
@@ -22,20 +19,32 @@ import (
 // https://github.com/kubernetes/kubernetes/blob/v1.28.4/staging/src/k8s.io/apiserver/pkg/storage/names/generate.go#L45.
 // https://github.com/kubernetes/kubernetes/pull/116430
 func Test_statefulSetNameBase(t *testing.T) {
-	// Service name lengths can be 1 - 63 chars, be paranoid and test them all.
-	var b strings.Builder
-	for b.Len() < 63 {
-		if _, err := b.WriteString("a"); err != nil {
-			t.Fatalf("error writing to string builder: %v", err)
-		}
-		baseLength := len(b.String())
-		if baseLength > 43 {
-			baseLength = 43 // currently 43 is the max base length
-		}
-		wantsNameR := regexp.MustCompile(`^ts-a{` + fmt.Sprint(baseLength) + `}-$`) // to match a string like ts-aaaa-
-		gotName := statefulSetNameBase(b.String())
-		if !wantsNameR.MatchString(gotName) {
-			t.Fatalf("expected string %s to match regex %s ", gotName, wantsNameR.String()) // fatal rather than error as this test is called 63 times
-		}
+	tests := []struct {
+		name string
+		in   string
+		out  string
+	}{
+		{
+			name: "43 chars",
+			in:   "oidhexl9o832hcbhyg4uz6o0s7u9uae54h5k8ofs9xb",
+			out:  "ts-oidhexl9o832hcbhyg4uz6o0s7u9uae54h5k8ofs9xb-",
+		},
+		{
+			name: "44 chars",
+			in:   "oidhexl9o832hcbhyg4uz6o0s7u9uae54h5k8ofs9xbo",
+			out:  "ts-oidhexl9o832hcbhyg4uz6o0s7u9uae54h5k8ofs9xb-",
+		},
+		{
+			name: "42 chars",
+			in:   "oidhexl9o832hcbhyg4uz6o0s7u9uae54h5k8ofs9x",
+			out:  "ts-oidhexl9o832hcbhyg4uz6o0s7u9uae54h5k8ofs9x-",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := statefulSetNameBase(tt.in); got != tt.out {
+				t.Errorf("stsNamePrefix(%s) = %q, want %s", tt.in, got, tt.out)
+			}
+		})
 	}
 }

cmd/tailscale/depaware.txt

@@ -19,8 +19,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
    L    github.com/google/nftables/internal/parseexprfunc            from github.com/google/nftables+
    L    github.com/google/nftables/xt                                from github.com/google/nftables/expr+
         github.com/google/uuid                                       from tailscale.com/util/quarantine+
-        github.com/gorilla/csrf                                      from tailscale.com/client/web
-        github.com/gorilla/securecookie                              from github.com/gorilla/csrf
+        github.com/gorilla/securecookie                              from github.com/tailscale/csrf
         github.com/hdevalence/ed25519consensus                       from tailscale.com/tka+
    L    github.com/josharian/native                                  from github.com/mdlayher/netlink+
    L 💣 github.com/jsimonetti/rtnetlink                              from tailscale.com/net/interfaces+
@@ -38,10 +37,10 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         github.com/peterbourgon/ff/v3                                from github.com/peterbourgon/ff/v3/ffcli
         github.com/peterbourgon/ff/v3/ffcli                          from tailscale.com/cmd/tailscale/cli
         github.com/peterbourgon/ff/v3/internal                       from github.com/peterbourgon/ff/v3
-        github.com/pkg/errors                                        from github.com/gorilla/csrf
         github.com/skip2/go-qrcode                                   from tailscale.com/cmd/tailscale/cli
         github.com/skip2/go-qrcode/bitset                            from github.com/skip2/go-qrcode+
         github.com/skip2/go-qrcode/reedsolomon                       from github.com/skip2/go-qrcode
+        github.com/tailscale/csrf                                    from tailscale.com/client/web
    W 💣 github.com/tailscale/go-winio                                from tailscale.com/safesocket
    W 💣 github.com/tailscale/go-winio/internal/fs                    from github.com/tailscale/go-winio
    W 💣 github.com/tailscale/go-winio/internal/socket                from github.com/tailscale/go-winio
@@ -260,8 +259,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         hash/adler32                                                 from compress/zlib
         hash/crc32                                                   from compress/gzip+
         hash/maphash                                                 from go4.org/mem
-        html                                                         from tailscale.com/ipn/ipnstate+
-        html/template                                                from github.com/gorilla/csrf
+        html                                                         from tailscale.com/ipn/ipnstate
         image                                                        from github.com/skip2/go-qrcode+
         image/color                                                  from github.com/skip2/go-qrcode+
         image/png                                                    from github.com/skip2/go-qrcode
@@ -291,7 +289,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         os/exec                                                      from github.com/toqueteos/webbrowser+
         os/signal                                                    from tailscale.com/cmd/tailscale/cli
         os/user                                                      from tailscale.com/util/groupmember+
-        path                                                         from html/template+
+        path                                                         from archive/tar+
         path/filepath                                                from crypto/x509+
         reflect                                                      from crypto/x509+
         regexp                                                       from github.com/tailscale/goupnp/httpu+
@@ -307,8 +305,6 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         syscall                                                      from crypto/rand+
         testing                                                      from tailscale.com/util/syspolicy
         text/tabwriter                                               from github.com/peterbourgon/ff/v3/ffcli+
-        text/template                                                from html/template
-        text/template/parse                                          from html/template+
         time                                                         from compress/gzip+
         unicode                                                      from bytes+
         unicode/utf16                                                from encoding/asn1+

cmd/tailscaled/depaware.txt

@@ -95,8 +95,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/google/nftables/internal/parseexprfunc            from github.com/google/nftables+
    L    github.com/google/nftables/xt                                from github.com/google/nftables/expr+
         github.com/google/uuid                                       from tailscale.com/clientupdate
-        github.com/gorilla/csrf                                      from tailscale.com/client/web
-        github.com/gorilla/securecookie                              from github.com/gorilla/csrf
+        github.com/gorilla/securecookie                              from github.com/tailscale/csrf
         github.com/hdevalence/ed25519consensus                       from tailscale.com/tka+
    L 💣 github.com/illarion/gonotify                                 from tailscale.com/net/dns
    L    github.com/insomniacslk/dhcp/dhcpv4                          from tailscale.com/net/tstun
@@ -130,18 +129,19 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
    L    github.com/pierrec/lz4/v4/internal/lz4errors                 from github.com/pierrec/lz4/v4+
    L    github.com/pierrec/lz4/v4/internal/lz4stream                 from github.com/pierrec/lz4/v4
    L    github.com/pierrec/lz4/v4/internal/xxh32                     from github.com/pierrec/lz4/v4/internal/lz4stream
-        github.com/pkg/errors                                        from github.com/gorilla/csrf
   LD    github.com/pkg/sftp                                          from tailscale.com/ssh/tailssh
   LD    github.com/pkg/sftp/internal/encoding/ssh/filexfer           from github.com/pkg/sftp
    L 💣 github.com/safchain/ethtool                                  from tailscale.com/net/netkernelconf
    W 💣 github.com/tailscale/certstore                               from tailscale.com/control/controlclient
+        github.com/tailscale/csrf                                    from tailscale.com/client/web
    W 💣 github.com/tailscale/go-winio                                from tailscale.com/safesocket
    W 💣 github.com/tailscale/go-winio/internal/fs                    from github.com/tailscale/go-winio
    W 💣 github.com/tailscale/go-winio/internal/socket                from github.com/tailscale/go-winio
    W    github.com/tailscale/go-winio/internal/stringbuffer          from github.com/tailscale/go-winio/internal/fs
    W    github.com/tailscale/go-winio/pkg/guid                       from github.com/tailscale/go-winio+
         github.com/tailscale/golang-x-crypto/acme                    from tailscale.com/ipn/ipnlocal
-  LD    github.com/tailscale/golang-x-crypto/internal/poly1305       from github.com/tailscale/golang-x-crypto/ssh
+  LD    github.com/tailscale/golang-x-crypto/chacha20                from github.com/tailscale/golang-x-crypto/ssh
+  LD 💣 github.com/tailscale/golang-x-crypto/internal/alias          from github.com/tailscale/golang-x-crypto/chacha20
   LD    github.com/tailscale/golang-x-crypto/ssh                     from tailscale.com/ipn/ipnlocal+
   LD    github.com/tailscale/golang-x-crypto/ssh/internal/bcrypt_pbkdf from github.com/tailscale/golang-x-crypto/ssh
         github.com/tailscale/goupnp                                  from github.com/tailscale/goupnp/dcps/internetgateway2+
@@ -402,10 +402,11 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         golang.org/x/crypto/cryptobyte                               from crypto/ecdsa+
         golang.org/x/crypto/cryptobyte/asn1                          from crypto/ecdsa+
         golang.org/x/crypto/curve25519                               from github.com/tailscale/golang-x-crypto/ssh+
+  LD    golang.org/x/crypto/ed25519                                  from github.com/tailscale/golang-x-crypto/ssh
         golang.org/x/crypto/hkdf                                     from crypto/tls+
         golang.org/x/crypto/nacl/box                                 from tailscale.com/types/key
         golang.org/x/crypto/nacl/secretbox                           from golang.org/x/crypto/nacl/box
-        golang.org/x/crypto/poly1305                                 from github.com/tailscale/wireguard-go/device+
+        golang.org/x/crypto/poly1305                                 from github.com/tailscale/golang-x-crypto/ssh+
         golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
   LD    golang.org/x/crypto/ssh                                      from tailscale.com/ssh/tailssh+
         golang.org/x/exp/constraints                                 from github.com/dblohm7/wingoes/pe+
@@ -492,7 +493,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         hash/fnv                                                     from tailscale.com/wgengine/magicsock+
         hash/maphash                                                 from go4.org/mem
         html                                                         from tailscale.com/ipn/ipnlocal+
-        html/template                                                from github.com/gorilla/csrf
         io                                                           from bufio+
         io/fs                                                        from crypto/x509+
         io/ioutil                                                    from github.com/godbus/dbus/v5+
@@ -538,8 +538,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         syscall                                                      from crypto/rand+
         testing                                                      from tailscale.com/util/syspolicy
         text/tabwriter                                               from runtime/pprof
-        text/template                                                from html/template
-        text/template/parse                                          from html/template+
         time                                                         from compress/gzip+
         unicode                                                      from bytes+
         unicode/utf16                                                from crypto/x509+

derp/derp_server.go

@@ -1573,17 +1573,6 @@ func (c *sclient) sendMeshUpdates() error {
 	c.s.mu.Lock()
 	defer c.s.mu.Unlock()
 
-	// allow all happened-before mesh update request goroutines to complete, if
-	// we don't finish the task we'll queue another below.
-drainUpdates:
-	for {
-		select {
-		case <-c.meshUpdate:
-		default:
-			break drainUpdates
-		}
-	}
-
 	writes := 0
 	for _, pcs := range c.peerStateChange {
 		if c.bw.Available() <= frameHeaderLen+keyLen {

flake.nix

@@ -120,4 +120,4 @@
   in
     flake-utils.lib.eachDefaultSystem (system: flakeForSystem nixpkgs system);
 }
-# nix-direnv cache busting line: sha256-8PtzUS8VL1p7KnqSx6Y55tOl41KYOhJfe52V4qMB3Yw=
+# nix-direnv cache busting line: sha256-uMVRdgO/HTs0CKqWPUFEL/rFvzio1vblTUaz5Cgi+5Q=

go.mod

@@ -61,14 +61,15 @@ require (
 	github.com/safchain/ethtool v0.3.0
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e
+	github.com/tailscale/csrf v0.0.0-20240109230941-966d36861f16
 	github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502
 	github.com/tailscale/goexpect v0.0.0-20210902213824-6e8c725cea41
-	github.com/tailscale/golang-x-crypto v0.0.0-20240108194725-7ce1f622c780
+	github.com/tailscale/golang-x-crypto v0.0.0-20230713185742-f0b76a10a08e
 	github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05
 	github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a
 	github.com/tailscale/mkctr v0.0.0-20240102155253-bf50773ba734
 	github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85
-	github.com/tailscale/web-client-prebuilt v0.0.0-20240109232428-26bf65339dda
+	github.com/tailscale/web-client-prebuilt v0.0.0-20231213172531-a4fa669015b2
 	github.com/tailscale/wireguard-go v0.0.0-20231121184858-cc193a0b3272
 	github.com/tc-hib/winres v0.2.1
 	github.com/tcnksm/go-httpstat v0.2.0
@@ -79,14 +80,14 @@ require (
 	go.uber.org/zap v1.26.0
 	go4.org/mem v0.0.0-20220726221520-4f986261bf13
 	go4.org/netipx v0.0.0-20230824141953-6213f710f925
-	golang.org/x/crypto v0.17.1-0.20240102205709-08396bb92b82
+	golang.org/x/crypto v0.15.0
 	golang.org/x/exp v0.0.0-20230905200255-921286631fa9
 	golang.org/x/mod v0.14.0
 	golang.org/x/net v0.18.0
 	golang.org/x/oauth2 v0.12.0
 	golang.org/x/sync v0.5.0
 	golang.org/x/sys v0.15.0
-	golang.org/x/term v0.15.0
+	golang.org/x/term v0.14.0
 	golang.org/x/time v0.3.0
 	golang.org/x/tools v0.15.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
@@ -114,7 +115,7 @@ require (
 	github.com/dave/brenda v1.1.0 // indirect
 	github.com/gobuffalo/flect v1.0.2 // indirect
 	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
-	github.com/gorilla/securecookie v1.1.1 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
 )
 
 require (
@@ -224,7 +225,6 @@ require (
 	github.com/gordonklaus/ineffassign v0.0.0-20230107090616-13ace0543b28 // indirect
 	github.com/goreleaser/chglog v0.5.0 // indirect
 	github.com/goreleaser/fileglob v1.3.0 // indirect
-	github.com/gorilla/csrf v1.7.1
 	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
 	github.com/gostaticanalysis/comment v1.4.2 // indirect
 	github.com/gostaticanalysis/forcetypeassert v0.1.0 // indirect

go.mod.sri

@@ -1 +1 @@
-sha256-8PtzUS8VL1p7KnqSx6Y55tOl41KYOhJfe52V4qMB3Yw=
+sha256-uMVRdgO/HTs0CKqWPUFEL/rFvzio1vblTUaz5Cgi+5Q=

go.sum

@@ -496,10 +496,8 @@ github.com/goreleaser/fileglob v1.3.0 h1:/X6J7U8lbDpQtBvGcwwPS6OpzkNVlVEsFUVRx9+
 github.com/goreleaser/fileglob v1.3.0/go.mod h1:Jx6BoXv3mbYkEzwm9THo7xbr5egkAraxkGorbJb4RxU=
 github.com/goreleaser/nfpm/v2 v2.33.1 h1:EkdAzZyVhAI9JC1vjmjjbmnNzyH1J6Cu4JCsA7YcQuc=
 github.com/goreleaser/nfpm/v2 v2.33.1/go.mod h1:8wwWWvJWmn84xo/Sqiv0aMvEGTHlHZTXTEuVSgQpkIM=
-github.com/gorilla/csrf v1.7.1 h1:Ir3o2c1/Uzj6FBxMlAUB6SivgVMy1ONXwYgXn+/aHPE=
-github.com/gorilla/csrf v1.7.1/go.mod h1:+a/4tCmqhG6/w4oafeAZ9pEa3/NZOWYVbD9fV0FwIQA=
-github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
-github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
@@ -882,14 +880,16 @@ github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c h1:+aPplB
 github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c/go.mod h1:SbErYREK7xXdsRiigaQiQkI9McGRzYMvlKYaP3Nimdk=
 github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e h1:PtWT87weP5LWHEY//SWsYkSO3RWRZo4OSWagh3YD2vQ=
 github.com/tailscale/certstore v0.1.1-0.20231202035212-d3fa0460f47e/go.mod h1:XrBNfAFN+pwoWuksbFS9Ccxnopa15zJGgXRFN90l3K4=
+github.com/tailscale/csrf v0.0.0-20240109230941-966d36861f16 h1:ALxSJ4KoXENNx1f3L+LD/QuY/FpWadzAMtWIa1Po+jk=
+github.com/tailscale/csrf v0.0.0-20240109230941-966d36861f16/go.mod h1:DkNNZmUscMpGHYJVVqyAqMVY6goWltxvnDSMKuDsxlU=
 github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502 h1:34icjjmqJ2HPjrSuJYEkdZ+0ItmGQAQ75cRHIiftIyE=
 github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502/go.mod h1:p9lPsd+cx33L3H9nNoecRRxPssFKUwwI50I3pZ0yT+8=
 github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 h1:Gzfnfk2TWrk8Jj4P4c1a3CtQyMaTVCznlkLZI++hok4=
 github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55/go.mod h1:4k4QO+dQ3R5FofL+SanAUZe+/QfeK0+OIuwDIRu2vSg=
 github.com/tailscale/goexpect v0.0.0-20210902213824-6e8c725cea41 h1:/V2rCMMWcsjYaYO2MeovLw+ClP63OtXgCF2Y1eb8+Ns=
 github.com/tailscale/goexpect v0.0.0-20210902213824-6e8c725cea41/go.mod h1:/roCdA6gg6lQyw/Oz6gIIGu3ggJKYhF+WC/AQReE5XQ=
-github.com/tailscale/golang-x-crypto v0.0.0-20240108194725-7ce1f622c780 h1:U0J2CUrrTcc2wmr9tSLYEo+USfwNikRRsmxVLD4eZ7E=
-github.com/tailscale/golang-x-crypto v0.0.0-20240108194725-7ce1f622c780/go.mod h1:ikbF+YT089eInTp9f2vmvy4+ZVnW5hzX1q2WknxSprQ=
+github.com/tailscale/golang-x-crypto v0.0.0-20230713185742-f0b76a10a08e h1:JyeJF/HuSwvxWtsR1c0oKX1lzaSH5Wh4aX+MgiStaGQ=
+github.com/tailscale/golang-x-crypto v0.0.0-20230713185742-f0b76a10a08e/go.mod h1:DjoeCULdP6vTJ/xY+nzzR9LaUHprkbZEpNidX0aqEEk=
 github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05 h1:4chzWmimtJPxRs2O36yuGRW3f9SYV+bMTTvMBI0EKio=
 github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05/go.mod h1:PdCqy9JzfWMJf1H5UJW2ip33/d4YkoKN0r67yKH1mG8=
 github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a h1:SJy1Pu0eH1C29XwJucQo73FrleVK6t4kYz4NVhp34Yw=
@@ -898,8 +898,8 @@ github.com/tailscale/mkctr v0.0.0-20240102155253-bf50773ba734 h1:93cvKHbvsPK3MKf
 github.com/tailscale/mkctr v0.0.0-20240102155253-bf50773ba734/go.mod h1:6v53VHLmLKUaqWMpSGDeRWhltLSCEteMItYoiKLpdJk=
 github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85 h1:zrsUcqrG2uQSPhaUPjUQwozcRdDdSxxqhNgNZ3drZFk=
 github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85/go.mod h1:NzVQi3Mleb+qzq8VmcWpSkcSYxXIg0DkI6XDzpVkhJ0=
-github.com/tailscale/web-client-prebuilt v0.0.0-20240109232428-26bf65339dda h1:S+2mKvqj3K84d7qCX7MEjMsCiNXbEzXQ+ZvGdHsvAyc=
-github.com/tailscale/web-client-prebuilt v0.0.0-20240109232428-26bf65339dda/go.mod h1:agQPE6y6ldqCOui2gkIh7ZMztTkIQKH049tv8siLuNQ=
+github.com/tailscale/web-client-prebuilt v0.0.0-20231213172531-a4fa669015b2 h1:lR1voET3dwe3CxacGAiva4k08TXtQ6Dlmult4JILlj4=
+github.com/tailscale/web-client-prebuilt v0.0.0-20231213172531-a4fa669015b2/go.mod h1:agQPE6y6ldqCOui2gkIh7ZMztTkIQKH049tv8siLuNQ=
 github.com/tailscale/wireguard-go v0.0.0-20231121184858-cc193a0b3272 h1:zwsem4CaamMdC3tFoTpzrsUSMDPV0K6rhnQdF7kXekQ=
 github.com/tailscale/wireguard-go v0.0.0-20231121184858-cc193a0b3272/go.mod h1:BOm5fXUBFM+m9woLNBoxI9TaBXXhGNP50LX/TGIvGb4=
 github.com/tc-hib/winres v0.2.1 h1:YDE0FiP0VmtRaDn7+aaChp1KiF4owBiJa5l964l5ujA=
@@ -1004,8 +1004,8 @@ golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.17.1-0.20240102205709-08396bb92b82 h1:Im4GabMwJDxh7eJBIF8XGVAyhmlqdBQmZV49AzWdKEk=
-golang.org/x/crypto v0.17.1-0.20240102205709-08396bb92b82/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
+golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1207,8 +1207,8 @@ golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.14.0 h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=
+golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

safesocket/safesocket_darwin.go

@@ -16,8 +16,6 @@ import (
 	"strings"
 	"sync"
 	"time"
-
-	"tailscale.com/version"
 )
 
 func init() {
@@ -74,7 +72,7 @@ func localTCPPortAndTokenDarwin() (port int, token string, err error) {
 
 	if dir := os.Getenv("TS_MACOS_CLI_SHARED_DIR"); dir != "" {
 		// First see if we're running as the non-AppStore "macsys" variant.
-		if version.IsMacSysExt() {
+		if strings.Contains(os.Getenv("HOME"), "/Containers/io.tailscale.ipn.macsys/") {
 			if port, token, err := localTCPPortAndTokenMacsys(); err == nil {
 				return port, token, nil
 			}

shell.nix

@@ -16,4 +16,4 @@
 ) {
   src =  ./.;
 }).shellNix
-# nix-direnv cache busting line: sha256-8PtzUS8VL1p7KnqSx6Y55tOl41KYOhJfe52V4qMB3Yw=
+# nix-direnv cache busting line: sha256-uMVRdgO/HTs0CKqWPUFEL/rFvzio1vblTUaz5Cgi+5Q=

tailcfg/tailcfg.go

@@ -1341,9 +1341,6 @@ const (
 	PeerCapabilityWakeOnLAN PeerCapability = "https://tailscale.com/cap/wake-on-lan"
 	// PeerCapabilityIngress grants the ability for a peer to send ingress traffic.
 	PeerCapabilityIngress PeerCapability = "https://tailscale.com/cap/ingress"
-	// PeerCapabilityWebUI grants the ability for a peer to edit features from the
-	// device Web UI.
-	PeerCapabilityWebUI PeerCapability = "tailscale.com/cap/webui"
 )
 
 // NodeCapMap is a map of capabilities to their optional values. It is valid for

util/httphdr/auth.go

@@ -1,81 +0,0 @@
-// Copyright (c) Tailscale Inc & AUTHORS
-// SPDX-License-Identifier: BSD-3-Clause
-
-package httphdr
-
-import (
-	"bytes"
-	"encoding/base64"
-	"fmt"
-	"strings"
-)
-
-// TODO: Must authorization parameters be valid UTF-8?
-
-// AuthScheme is an authorization scheme per RFC 7235.
-// Per section 2.1, the "Authorization" header is formatted as:
-//
-//	Authorization: <auth-scheme> <auth-parameter>
-//
-// A scheme implementation must self-report the <auth-scheme> name and
-// provide the ability to marshal and unmarshal the <auth-parameter>.
-//
-// For concrete implementations, see [Basic] and [Bearer].
-type AuthScheme interface {
-	// AuthScheme is the authorization scheme name.
-	// It must be valid according to RFC 7230, section 3.2.6.
-	AuthScheme() string
-
-	// MarshalAuth marshals the authorization parameter for the scheme.
-	MarshalAuth() (string, error)
-
-	// UnmarshalAuth unmarshals the authorization parameter for the scheme.
-	UnmarshalAuth(string) error
-}
-
-// BasicAuth is the Basic authorization scheme as defined in RFC 2617.
-type BasicAuth struct {
-	Username string // must not contain ':' per section 2
-	Password string
-}
-
-func (BasicAuth) AuthScheme() string { return "Basic" }
-
-func (a BasicAuth) MarshalAuth() (string, error) {
-	if strings.IndexByte(a.Username, ':') >= 0 {
-		return "", fmt.Errorf("invalid username: contains a colon")
-	}
-	return base64.StdEncoding.EncodeToString([]byte(a.Username + ":" + a.Password)), nil
-}
-
-func (a *BasicAuth) UnmarshalAuth(s string) error {
-	b, err := base64.StdEncoding.DecodeString(s)
-	if err != nil {
-		return fmt.Errorf("invalid basic authorization: %w", err)
-	}
-	i := bytes.IndexByte(b, ':')
-	if i < 0 {
-		return fmt.Errorf("invalid basic authorization: missing a colon")
-	}
-	a.Username = string(b[:i])
-	a.Password = string(b[i+len(":"):])
-	return nil
-}
-
-// BearerAuth is the Bearer Token authorization scheme as defined in RFC 6750.
-type BearerAuth struct {
-	Token string // usually a base64-encoded string per section 2.1
-}
-
-func (BearerAuth) AuthScheme() string { return "Bearer" }
-
-func (a BearerAuth) MarshalAuth() (string, error) {
-	// TODO: Verify that token is valid base64?
-	return a.Token, nil
-}
-
-func (a *BearerAuth) UnmarshalAuth(s string) error {
-	// TODO: Verify that token is valid base64?
-	a.Token = s
-	return nil
-}

util/httpio/context.go

@@ -1,43 +0,0 @@
-// Copyright (c) Tailscale Inc & AUTHORS
-// SPDX-License-Identifier: BSD-3-Clause
-
-package httpio
-
-import (
-	"context"
-	"net/http"
-
-	"tailscale.com/util/httphdr"
-)
-
-type headerKey struct{}
-
-// WithHeader specifies the HTTP header to use with a client request.
-// It only affects [Do], [Get], [Post], [Put], and [Delete].
-//
-// Example usage:
-//
-//	ctx = httpio.WithHeader(ctx, http.Header{"DD-API-KEY": ...})
-func WithHeader(ctx context.Context, hdr http.Header) context.Context {
-	return context.WithValue(ctx, headerKey{}, hdr)
-}
-
-type authKey struct{}
-
-// WithAuth specifies an "Authorization" header to use with a client request.
-// This takes precedence over any "Authorization" header that may be present
-// in the [http.Header] provided to [WithHeader].
-// It only affects [Do], [Get], [Post], [Put], and [Delete].
-//
-// Example usage:
-//
-//	ctx = httpio.WithAuth(ctx, httphdr.BasicAuth{
-//		Username: "admin",
-//		Password: "password",
-//	})
-func WithAuth(ctx context.Context, auth httphdr.AuthScheme) context.Context {
-	return context.WithValue(ctx, authKey{}, auth)
-}
-
-// TODO: Add extraction functionality to retrieve the original
-// *http.Request and http.ResponseWriter for use with [Handler].

util/httpio/endpoint.go

@@ -1,93 +0,0 @@
-// Copyright (c) Tailscale Inc & AUTHORS
-// SPDX-License-Identifier: BSD-3-Clause
-
-package httpio
-
-import (
-	"context"
-	"strings"
-)
-
-// Endpoint annotates an HTTP method and path with input and output types.
-//
-// The intent is to declare this in a shared package between client and server
-// implementations as a means to structurally describe how they interact.
-//
-// Example usage:
-//
-//	package tsapi
-//
-//	const BaseURL = "https://api.tailscale.com/api/v2/"
-//
-//	var (
-//		GetDevice    = httpio.Endpoint[GetDeviceRequest, GetDeviceResponse]{Method: "GET", Pattern: "/device/{DeviceID}"}.WithHost(BaseURL)
-//		DeleteDevice = httpio.Endpoint[DeleteDeviceRequest, DeleteDeviceResponse]{Method: "DELETE", Pattern: "/device/{DeviceID}"}.WithHost(BaseURL)
-//	)
-//
-//	type GetDeviceRequest struct {
-//		ID     int      `urlpath:"DeviceID"`
-//		Fields []string `urlquery:"fields"`
-//		...
-//	}
-//	type GetDeviceResponse struct {
-//		ID        int          `json:"id"`
-//		Addresses []netip.Addr `json:"addresses"`
-//		...
-//	}
-//	type DeleteDeviceRequest struct { ... }
-//	type DeleteDeviceResponse struct { ... }
-//
-// Example usage by client code:
-//
-//	ctx = httpio.WithAuth(ctx, ...)
-//	device, err := tsapi.GetDevice.Do(ctx, {ID: 1234})
-//
-// Example usage by server code:
-//
-//	mux := http.NewServeMux()
-//	mux.Handle(tsapi.GetDevice.String(), checkAuth(httpio.Handler(getDevice)))
-//	mux.Handle(tsapi.DeleteDevice.String(), checkAuth(httpio.Handler(deleteDevice)))
-//
-//	func checkAuth(http.Handler) http.Handler { ... }
-//	func getDevice(ctx context.Context, in GetDeviceRequest) (out GetDeviceResponse, err error) { ... }
-//	func deleteDevice(ctx context.Context, in DeleteDeviceRequest) (out DeleteDeviceResponse, err error) { ... }
-type Endpoint[In Request, Out Response] struct {
-	// Method is a valid HTTP method (e.g., "GET").
-	Method string
-	// Pattern must be a pattern that complies with [mux.ServeMux.Handle] and
-	// not be preceded by a method or host (e.g., "/api/v2/device/{DeviceID}").
-	// It must start with a leading "/".
-	Pattern string
-}
-
-// String returns a combination of the method and pattern,
-// which is a valid pattern for [mux.ServeMux.Handle].
-func (e Endpoint[In, Out]) String() string { return e.Method + " " + e.Pattern }
-
-// Do performs an HTTP call to the target endpoint at the specified host.
-// The hostPrefix must be a URL prefix containing the scheme and host,
-// but not contain any URL query parameters (e.g., "https://api.tailscale.com/api/v2/").
-func (e Endpoint[In, Out]) Do(ctx context.Context, hostPrefix string, in In, opts ...Option) (out Out, err error) {
-	return Do[In, Out](ctx, e.Method, strings.TrimRight(hostPrefix, "/")+e.Pattern, in, opts...)
-}
-
-// TODO: Should hostPrefix be a *url.URL?
-
-// WithHost constructs a [HostedEndpoint],
-// which is an HTTP endpoint hosted at a particular URL prefix.
-func (e Endpoint[In, Out]) WithHost(hostPrefix string) HostedEndpoint[In, Out] {
-	return HostedEndpoint[In, Out]{Prefix: hostPrefix, Endpoint: e}
-}
-
-// HostedEndpoint is an HTTP endpoint hosted under a particular URL prefix.
-type HostedEndpoint[In Request, Out Response] struct {
-	// Prefix is a URL prefix containing the scheme, host, and
-	// an optional path prefix (e.g., "https://api.tailscale.com/api/v2/").
-	Prefix string
-	Endpoint[In, Out]
-}
-
-// Do performs an HTTP call to the target hosted endpoint.
-func (e HostedEndpoint[In, Out]) Do(ctx context.Context, in In, opts ...Option) (out Out, err error) {
-	return Do[In, Out](ctx, e.Method, strings.TrimSuffix(e.Prefix, "/")+e.Pattern, in, opts...)
-}

util/httpio/httpio.go

@@ -1,121 +0,0 @@
-// Copyright (c) Tailscale Inc & AUTHORS
-// SPDX-License-Identifier: BSD-3-Clause
-
-// Package httpio assists in handling HTTP operations on structured
-// input and output types. It automatically handles encoding of data
-// in the URL path, URL query parameters, and the HTTP body.
-package httpio
-
-import (
-	"context"
-	"net/http"
-
-	"tailscale.com/util/httpm"
-)
-
-// Request is a structured Go type that contains fields representing arguments
-// in the URL path, URL query parameters, and optionally the HTTP request body.
-//
-// Typically, this is a Go struct:
-//
-//   - with fields tagged as `urlpath` to represent arguments in the URL path
-//     (e.g., "/tailnet/{tailnetId}/devices/{deviceId}").
-//     See [tailscale.com/util/httpio/urlpath] for details.
-//
-//   - with fields tagged as `urlquery` to represent URL query parameters
-//     (e.g., "?after=18635&limit=5").
-//     See [tailscale.com/util/httpio/urlquery] for details.
-//
-//   - with possibly other fields used to serialize as the HTTP body.
-//     By default, [encoding/json] is used to marshal the entire struct value.
-//     To prevent fields specific to `urlpath` or `urlquery` from being marshaled
-//     as part of the body, explicitly ignore those fields with `json:"-"`.
-//     An HTTP body is only populated if there are any exported fields
-//     without the `urlpath` or `urlquery` struct tags.
-//
-// Since GET and DELETE methods usually have no associated body,
-// requests for such methods often only have `urlpath` and `urlquery` fields.
-//
-// Example GET request type:
-//
-//	type GetDevicesRequest struct {
-//		TailnetID tailcfg.TailnetID `urlpath:"tailnetId"`
-//
-//		Limit uint             `urlquery:"limit"`
-//		After tailcfg.DeviceID `urlquery:"after"`
-//	}
-//
-// Example PUT request type:
-//
-//	type PutDeviceRequest struct {
-//		TailnetID tailcfg.TailnetID `urlpath:"tailnetId" json:"-"`
-//		DeviceID  tailcfg.DeviceID  `urlpath:"deviceId" json:"-"`
-//
-//		Hostname string       `json:"hostname,omitempty"``
-//		IPv4     netip.IPAddr `json:"ipv4,omitzero"``
-//	}
-//
-// By convention, request struct types are named "{Method}{Resource}Request",
-// where {Method} is the HTTP method (e.g., "Post, "Get", "Put", "Delete", etc.)
-// and {Resource} is some resource acted upon (e.g., "Device", "Routes", etc.).
-type Request = any
-
-// Response is a structured Go type to represent the HTTP response body.
-//
-// By default, [encoding/json] is used to unmarshal the response value.
-// Unlike [Request], there is no support for `urlpath` and `urlquery` struct tags.
-//
-// Example response type:
-//
-//	type GetDevicesResponses struct {
-//		Devices []Device       `json:"devices"`
-//		Error   ErrorResponse  `json:"error"`
-//	}
-//
-// By convention, response struct types are named "{Method}{Resource}Response",
-// where {Method} is the HTTP method (e.g., "Post, "Get", "Put", "Delete", etc.)
-// and {Resource} is some resource acted upon (e.g., "Device", "Routes", etc.).
-type Response = any
-
-// Handler wraps a caller-provided handle function that operates on
-// concrete input and output types and returns a [http.Handler] function.
-func Handler[In Request, Out Response](handle func(ctx context.Context, in In) (out Out, err error), opts ...Option) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// TODO: How do we respond to the user if err is non-nil?
-		// Do we default to status 500?
-		panic("not implemented")
-	})
-}
-
-// TODO: Should url be a *url.URL? In the usage below, the caller should not pass query parameters.
-
-// Post performs a POST call to the provided url with the given input
-// and returns the response output.
-func Post[In Request, Out Response](ctx context.Context, url string, in In, opts ...Option) (Out, error) {
-	return Do[In, Out](ctx, httpm.POST, url, in, opts...)
-}
-
-// Get performs a GET call to the provided url with the given input
-// and returns the response output.
-func Get[In Request, Out Response](ctx context.Context, url string, in In, opts ...Option) (Out, error) {
-	return Do[In, Out](ctx, httpm.GET, url, in, opts...)
-}
-
-// Put performs a PUT call to the provided url with the given input
-// and returns the response output.
-func Put[In Request, Out Response](ctx context.Context, url string, in In, opts ...Option) (Out, error) {
-	return Do[In, Out](ctx, httpm.PUT, url, in, opts...)
-}
-
-// Delete performs a DELETE call to the provided url with the given input
-// and returns the response output.
-func Delete[In Request, Out Response](ctx context.Context, url string, in In, opts ...Option) (Out, error) {
-	return Do[In, Out](ctx, httpm.DELETE, url, in, opts...)
-}
-
-// Do performs an HTTP method call to the provided url with the given input
-// and returns the response output.
-func Do[In Request, Out Response](ctx context.Context, method, url string, in In, opts ...Option) (out Out, err error) {
-	// TOOD: If the server returned a non-2xx code, we should report a Go error.
-	panic("not implemented")
-}

util/httpio/options.go

@@ -1,44 +0,0 @@
-// Copyright (c) Tailscale Inc & AUTHORS
-// SPDX-License-Identifier: BSD-3-Clause
-
-package httpio
-
-import (
-	"io"
-	"net/http"
-)
-
-// Option is an option to alter the behavior of [httpio] functionality.
-type Option interface{ option() }
-
-// WithClient specifies the [http.Client] to use in client-initiated requests.
-// It only affects [Do], [Get], [Post], [Put], and [Delete].
-// It has no effect on [Handler].
-func WithClient(c *http.Client) Option {
-	panic("not implemented")
-}
-
-// WithMarshaler specifies an marshaler to use for a particular "Content-Type".
-//
-// For client-side requests (e.g., [Do], [Get], [Post], [Put], and [Delete]),
-// the first specified encoder is used to specify the "Content-Type" and
-// to marshal the HTTP request body.
-//
-// For server-side responses (e.g., [Handler]), the first match between
-// the client-provided "Accept" header is used to select the encoder to use.
-// If no match is found, the first specified encoder is used regardless.
-//
-// If no encoder is specified, by default the "application/json" content type
-// is used with the [encoding/json] as the marshal implementation.
-func WithMarshaler(contentType string, marshal func(io.Writer, any) error) Option {
-	panic("not implemented")
-}
-
-// WithUnmarshaler specifies an unmarshaler to use for a particular "Content-Type".
-//
-// For both client-side responses and server-side requests,
-// the provided "Content-Type" header is used to select which decoder to use.
-// If no match is found, the first specified encoder is used regardless.
-func WithUnmarshaler(contentType string, unmarshal func(io.Reader, any) error) Option {
-	panic("not implemented")
-}

util/httpio/urlpath/urlpath.go

@@ -1,10 +0,0 @@
-// Package urpath TODO
-package urlpath
-
-// option is an option to alter behavior of Marshal and Unmarshal.
-// Currently, there are no defined options.
-type option interface{ option() }
-
-func Marshal(pattern string, val any, opts ...option) (path string, err error)
-
-func Unmarshal(pattern, path string, val any, opts ...option) (err error)

util/httpio/urlquery/urlquery.go

@@ -1,10 +0,0 @@
-// Package urlquery TODO
-package urlquery
-
-// option is an option to alter behavior of Marshal and Unmarshal.
-// Currently, there are no defined options.
-type option interface{ option() }
-
-func Marshal(val any, opts ...option) (query string, err error)
-
-func Unmarshal(query string, val any, opts ...option) (err error)

version/mkversion/mkversion.go

@@ -199,13 +199,6 @@ func tailscaleModuleRef(modBs []byte) (string, error) {
 }
 
 func mkOutput(v verInfo) (VersionInfo, error) {
-	if override := os.Getenv("TS_VERSION_OVERRIDE"); override != "" {
-		var err error
-		v.major, v.minor, v.patch, err = parseVersion(override)
-		if err != nil {
-			return VersionInfo{}, fmt.Errorf("failed to parse TS_VERSION_OVERRIDE: %w", err)
-		}
-	}
 	var changeSuffix string
 	if v.minor%2 == 1 {
 		// Odd minor numbers are unstable builds.

wgengine/router/router_windows.go

@@ -12,7 +12,6 @@ import (
 	"net/netip"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"slices"
 	"strings"
 	"sync"
@@ -156,13 +155,6 @@ type firewallTweaker struct {
 	// stop makes fwProc exit when closed.
 	fwProcWriter  io.WriteCloser
 	fwProcEncoder *json.Encoder
-
-	// The path to the 'netsh.exe' binary, populated during the first call
-	// to runFirewall.
-	//
-	// not protected by mu; netshPath is only mutated inside netshPathOnce
-	netshPathOnce sync.Once
-	netshPath     string
 }
 
 func (ft *firewallTweaker) clear() { ft.set(nil, nil, nil) }
@@ -193,43 +185,10 @@ func (ft *firewallTweaker) set(cidrs []string, routes, localRoutes []netip.Prefi
 	go ft.doAsyncSet()
 }
 
-// getNetshPath returns the path that should be used to execute netsh.
-//
-// We've seen a report from a customer that we're triggering the "cannot run
-// executable found relative to current directory" protection that was added to
-// prevent running possibly attacker-controlled binaries. To mitigate this,
-// first try looking up the path to netsh.exe in the System32 directory
-// explicitly, and then fall back to the prior behaviour of passing "netsh" to
-// os/exec.Command.
-func (ft *firewallTweaker) getNetshPath() string {
-	ft.netshPathOnce.Do(func() {
-		// The default value is the old approach: just run "netsh" and
-		// let os/exec resolve that into a full path.
-		ft.netshPath = "netsh"
-
-		path, err := windows.KnownFolderPath(windows.FOLDERID_System, 0)
-		if err != nil {
-			ft.logf("getNetshPath: error getting FOLDERID_System: %v", err)
-			return
-		}
-
-		expath := filepath.Join(path, "netsh.exe")
-		if _, err := os.Stat(expath); err == nil {
-			ft.netshPath = expath
-			return
-		} else if !os.IsNotExist(err) {
-			ft.logf("getNetshPath: error checking for existence of %q: %v", expath, err)
-		}
-
-		// Keep default
-	})
-	return ft.netshPath
-}
-
 func (ft *firewallTweaker) runFirewall(args ...string) (time.Duration, error) {
 	t0 := time.Now()
 	args = append([]string{"advfirewall", "firewall"}, args...)
-	cmd := exec.Command(ft.getNetshPath(), args...)
+	cmd := exec.Command("netsh", args...)
 	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
 	b, err := cmd.CombinedOutput()
 	if err != nil {

wgengine/router/router_windows_test.go

@@ -1,19 +0,0 @@
-// Copyright (c) Tailscale Inc & AUTHORS
-// SPDX-License-Identifier: BSD-3-Clause
-
-package router
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-func TestGetNetshPath(t *testing.T) {
-	ft := &firewallTweaker{
-		logf: t.Logf,
-	}
-	path := ft.getNetshPath()
-	if !filepath.IsAbs(path) {
-		t.Errorf("expected absolute path for netsh.exe: %q", path)
-	}
-}