net/netns, net/interfaces: move defaultRouteInterface, add Android fallback

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

.github/workflows/cross-darwin.yml

@@ -19,7 +19,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v1
       with:
-        go-version: 1.15
+        go-version: 1.14
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/cross-freebsd.yml

@@ -19,7 +19,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v1
       with:
-        go-version: 1.15
+        go-version: 1.14
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/cross-openbsd.yml

@@ -19,7 +19,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v1
       with:
-        go-version: 1.15
+        go-version: 1.14
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/cross-windows.yml

@@ -19,7 +19,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v1
       with:
-        go-version: 1.15
+        go-version: 1.14
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/depaware.yml

@@ -1,28 +0,0 @@
-name: depaware
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - '*'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Set up Go
-      uses: actions/setup-go@v1
-      with:
-        go-version: 1.15
-
-    - name: Check out code
-      uses: actions/checkout@v1
-
-    - name: depaware tailscaled
-      run: go run github.com/tailscale/depaware --check tailscale.com/cmd/tailscaled
-
-    - name: depaware tailscale
-      run: go run github.com/tailscale/depaware --check tailscale.com/cmd/tailscale

.github/workflows/license.yml

@@ -16,7 +16,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v1
       with:
-        go-version: 1.15
+        go-version: 1.14
 
     - name: Check out code
       uses: actions/checkout@v1

.github/workflows/linux.yml

@@ -19,7 +19,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v1
       with:
-        go-version: 1.15
+        go-version: 1.14
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/linux32.yml

@@ -19,7 +19,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v1
       with:
-        go-version: 1.15
+        go-version: 1.14
       id: go
 
     - name: Check out code into the Go module directory

.github/workflows/staticcheck.yml

@@ -16,7 +16,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v1
       with:
-        go-version: 1.15
+        go-version: 1.14
 
     - name: Check out code
       uses: actions/checkout@v1

.github/workflows/windows.yml

@@ -1,52 +0,0 @@
-name: Windows
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - '*'
-
-jobs:
-  test:
-    runs-on: windows-latest
-
-    if: "!contains(github.event.head_commit.message, '[ci skip]')"
-
-    steps:
-
-    - name: Install Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.15.x
-
-    - name: Checkout code
-      uses: actions/checkout@v2
-
-    - name: Restore Cache
-      uses: actions/cache@v2
-      with:
-        path: ~/go/pkg/mod
-        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          ${{ runner.os }}-go-
-
-    - name: Test
-      run: go test ./...
-
-    - uses: k0kubun/action-slack@v2.0.0
-      with:
-        payload: |
-          {
-            "attachments": [{
-              "text": "${{ job.status }}: ${{ github.workflow }} <https://github.com/${{ github.repository }}/commit/${{ github.sha }}/checks|${{ env.COMMIT_DATE }} #${{ env.COMMIT_NUMBER_OF_DAY }}> " +
-                      "(<https://github.com/${{ github.repository }}/commit/${{ github.sha }}|" + "${{ github.sha }}".substring(0, 10) + ">) " +
-                      "of ${{ github.repository }}@" + "${{ github.ref }}".split('/').reverse()[0] + " by ${{ github.event.head_commit.committer.name }}",
-              "color": "danger"
-            }]
-          }
-      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-      if: failure() && github.event_name == 'push'
-

.gitignore

@@ -1,6 +1,5 @@
 # Binaries for programs and plugins
 *~
-*.tmp
 *.exe
 *.dll
 *.so
@@ -19,7 +18,3 @@ cmd/tailscaled/tailscaled
 
 # Dependency directories (remove the comment below to include it)
 # vendor/
-
-# direnv config, this may be different for other people so it's probably safer
-# to make this nonspecific.
-.envrc

Dockerfile

@@ -21,7 +21,7 @@
 #     $ docker exec tailscaled tailscale status
 
 
-FROM golang:1.15-alpine AS build-env
+FROM golang:1.14-alpine AS build-env
 
 WORKDIR /go/src/tailscale
 

Makefile

@@ -1,18 +1,7 @@
 usage:
 	echo "See Makefile"
 
-vet:
-	go vet ./...
-
-updatedeps:
-	go run github.com/tailscale/depaware --update tailscale.com/cmd/tailscaled
-	go run github.com/tailscale/depaware --update tailscale.com/cmd/tailscale
-
-depaware:
-	go run github.com/tailscale/depaware --check tailscale.com/cmd/tailscaled
-	go run github.com/tailscale/depaware --check tailscale.com/cmd/tailscale
-
-check: staticcheck vet depaware
+check: staticcheck
 
 staticcheck:
 	go run honnef.co/go/tools/cmd/staticcheck -- $$(go list ./... | grep -v tempfork)

README.md

@@ -30,20 +30,8 @@ wrappers that are not open source.
 go install tailscale.com/cmd/tailscale{,d}
 ```
 
-If you're packaging Tailscale for distribution, use `build_dist.sh`
-instead, to burn commit IDs and version info into the binaries:
-
-```
-./build_dist.sh tailscale.com/cmd/tailscale
-./build_dist.sh tailscale.com/cmd/tailscaled
-```
-
-If your distro has conventions that preclude the use of
-`build_dist.sh`, please do the equivalent of what it does in your
-distro's way, so that bug reports contain useful version information.
-
 We only guarantee to support the latest Go release and any Go beta or
-release candidate builds (currently Go 1.15) in module mode. It might
+release candidate builds (currently Go 1.14) in module mode. It might
 work in earlier Go versions or in GOPATH mode, but we're making no
 effort to keep those working.
 

VERSION.txt

@@ -1 +0,0 @@
-1.3.0

build_dist.sh

@@ -1,16 +0,0 @@
-#!/usr/bin/env sh
-#
-# Runs `go build` with flags configured for binary distribution. All
-# it does differently from `go build` is burn git commit and version
-# information into the binaries, so that we can track down user
-# issues.
-#
-# If you're packaging Tailscale for a distro, please consider using
-# this script, or executing equivalent commands in your
-# distro-specific build system.
-
-set -eu
-
-eval $(./version/version.sh)
-
-exec go build -tags xversion -ldflags "-X tailscale.com/version.Long=${VERSION_LONG} -X tailscale.com/version.Short=${VERSION_SHORT} -X tailscale.com/version.GitCommit=${VERSION_GIT_HASH}" "$@"

cmd/cloner/cloner.go

@@ -33,7 +33,6 @@ var (
 	flagTypes     = flag.String("type", "", "comma-separated list of types; required")
 	flagOutput    = flag.String("output", "", "output file; required")
 	flagBuildTags = flag.String("tags", "", "compiler build tags to apply")
-	flagCloneFunc = flag.Bool("clonefunc", false, "add a top-level Clone func")
 )
 
 func main() {
@@ -87,8 +86,8 @@ func main() {
 					}
 					pkg := typeNameObj.Pkg()
 					gen(buf, imports, typeName, typ, pkg)
-					found = true
 				}
+				found = true
 			}
 		}
 		if !found {
@@ -96,31 +95,6 @@ func main() {
 		}
 	}
 
-	w := func(format string, args ...interface{}) {
-		fmt.Fprintf(buf, format+"\n", args...)
-	}
-	if *flagCloneFunc {
-		w("// Clone duplicates src into dst and reports whether it succeeded.")
-		w("// To succeed, <src, dst> must be of types <*T, *T> or <*T, **T>,")
-		w("// where T is one of %s.", *flagTypes)
-		w("func Clone(dst, src interface{}) bool {")
-		w("	switch src := src.(type) {")
-		for _, typeName := range typeNames {
-			w("	case *%s:", typeName)
-			w("		switch dst := dst.(type) {")
-			w("		case *%s:", typeName)
-			w("			*dst = *src.Clone()")
-			w("			return true")
-			w("		case **%s:", typeName)
-			w("			*dst = src.Clone()")
-			w("			return true")
-			w("		}")
-		}
-		w("	}")
-		w("	return false")
-		w("}")
-	}
-
 	contents := new(bytes.Buffer)
 	fmt.Fprintf(contents, header, *flagTypes, pkg.Name)
 	fmt.Fprintf(contents, "import (\n")
@@ -169,19 +143,7 @@ func gen(buf *bytes.Buffer, imports map[string]struct{}, name string, typ *types
 
 	switch t := typ.Underlying().(type) {
 	case *types.Struct:
-		// We generate two bits of code simultaneously while we walk the struct.
-		// One is the Clone method itself, which we write directly to buf.
-		// The other is a variable assignment that will fail if the struct
-		// changes without the Clone method getting regenerated.
-		// We write that to regenBuf, and then append it to buf at the end.
-		regenBuf := new(bytes.Buffer)
-		writeRegen := func(format string, args ...interface{}) {
-			fmt.Fprintf(regenBuf, format+"\n", args...)
-		}
-		writeRegen("// A compilation failure here means this code must be regenerated, with command:")
-		writeRegen("//   tailscale.com/cmd/cloner -type %s", *flagTypes)
-		writeRegen("var _%sNeedsRegeneration = %s(struct {", name, name)
-
+		_ = t
 		name := typ.Obj().Name()
 		fmt.Fprintf(buf, "// Clone makes a deep copy of %s.\n", name)
 		fmt.Fprintf(buf, "// The result aliases no memory with the original.\n")
@@ -197,9 +159,6 @@ func gen(buf *bytes.Buffer, imports map[string]struct{}, name string, typ *types
 		for i := 0; i < t.NumFields(); i++ {
 			fname := t.Field(i).Name()
 			ft := t.Field(i).Type()
-
-			writeRegen("\t%s %s", fname, importedName(ft))
-
 			if !containsPointers(ft) {
 				continue
 			}
@@ -261,10 +220,6 @@ func gen(buf *bytes.Buffer, imports map[string]struct{}, name string, typ *types
 		}
 		writef("return dst")
 		fmt.Fprintf(buf, "}\n\n")
-
-		writeRegen("}{})\n")
-
-		buf.Write(regenBuf.Bytes())
 	}
 }
 

cmd/derper/derper.go

@@ -7,13 +7,11 @@ package main // import "tailscale.com/cmd/derper"
 
 import (
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"expvar"
 	"flag"
 	"fmt"
-	"html"
 	"io"
 	"io/ioutil"
 	"log"
@@ -63,7 +61,7 @@ func loadConfig() config {
 	}
 	b, err := ioutil.ReadFile(*configPath)
 	switch {
-	case errors.Is(err, os.ErrNotExist):
+	case os.IsNotExist(err):
 		return writeNewConfig()
 	case err != nil:
 		log.Fatal(err)
@@ -187,15 +185,6 @@ func main() {
 			certManager.Email = "security@tailscale.com"
 		}
 		httpsrv.TLSConfig = certManager.TLSConfig()
-		letsEncryptGetCert := httpsrv.TLSConfig.GetCertificate
-		httpsrv.TLSConfig.GetCertificate = func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
-			cert, err := letsEncryptGetCert(hi)
-			if err != nil {
-				return nil, err
-			}
-			cert.Certificate = append(cert.Certificate, s.MetaCert())
-			return cert, nil
-		}
 		go func() {
 			err := http.ListenAndServe(":80", certManager.HTTPHandler(tsweb.Port80Handler{Main: mux}))
 			if err != nil {
@@ -230,10 +219,10 @@ func debugHandler(s *derp.Server) http.Handler {
 <h1>DERP debug</h1>
 <ul>
 `)
-		f("<li><b>Hostname:</b> %v</li>\n", html.EscapeString(*hostname))
+		f("<li><b>Hostname:</b> %v</li>\n", *hostname)
 		f("<li><b>Uptime:</b> %v</li>\n", tsweb.Uptime())
 		f("<li><b>Mesh Key:</b> %v</li>\n", s.HasMeshKey())
-		f("<li><b>Version:</b> %v</li>\n", html.EscapeString(version.Long))
+		f("<li><b>Version:</b> %v</li>\n", version.LONG)
 
 		f(`<li><a href="/debug/vars">/debug/vars</a> (Go)</li>
    <li><a href="/debug/varz">/debug/varz</a> (Prometheus)</li>

cmd/microproxy/microproxy.go

@@ -19,7 +19,6 @@ import (
 	"net/http/httputil"
 	"net/url"
 	"path/filepath"
-	"strings"
 	"sync"
 	"time"
 
@@ -34,7 +33,6 @@ var (
 	logCollection = flag.String("logcollection", "", "If non-empty, logtail collection to log to")
 	nodeExporter  = flag.String("node-exporter", "http://localhost:9100", "URL of the local prometheus node exporter")
 	goVarsURL     = flag.String("go-vars-url", "http://localhost:8383/debug/vars", "URL of a local Go server's /debug/vars endpoint")
-	insecure      = flag.Bool("insecure", false, "serve over http, for development")
 )
 
 func main() {
@@ -67,15 +65,12 @@ func main() {
 	httpsrv := &http.Server{
 		Addr:    *addr,
 		Handler: mux,
+		TLSConfig: &tls.Config{
+			GetCertificate: ch.GetCertificate,
+		},
 	}
 
-	if !*insecure {
-		httpsrv.TLSConfig = &tls.Config{GetCertificate: ch.GetCertificate}
-		err = httpsrv.ListenAndServeTLS("", "")
-	} else {
-		err = httpsrv.ListenAndServe()
-	}
-	if err != nil && err != http.ErrServerClosed {
+	if err := httpsrv.ListenAndServeTLS("", ""); err != nil && err != http.ErrServerClosed {
 		log.Fatal(err)
 	}
 }
@@ -93,16 +88,7 @@ func promPrint(w io.Writer, prefix string, obj map[string]interface{}) {
 		case map[string]interface{}:
 			promPrint(w, k, v)
 		case float64:
-			const saveConfigReject = "control_save_config_rejected_"
-			const saveConfig = "control_save_config_"
-			switch {
-			case strings.HasPrefix(k, saveConfigReject):
-				fmt.Fprintf(w, "control_save_config_rejected{reason=%q} %f\n", k[len(saveConfigReject):], v)
-			case strings.HasPrefix(k, saveConfig):
-				fmt.Fprintf(w, "control_save_config{reason=%q} %f\n", k[len(saveConfig):], v)
-			default:
-				fmt.Fprintf(w, "%s %f\n", k, v)
-			}
+			fmt.Fprintf(w, "%s %f\n", k, v)
 		default:
 			fmt.Fprintf(w, "# Skipping key %q, unhandled type %T\n", k, v)
 		}

cmd/tailscale/cli/cli.go

@@ -31,8 +31,7 @@ func ActLikeCLI() bool {
 		return false
 	}
 	switch os.Args[1] {
-	case "up", "down", "status", "netcheck", "ping", "version",
-		"debug",
+	case "up", "status", "netcheck", "version",
 		"-V", "--version", "-h", "--help":
 		return true
 	}
@@ -58,21 +57,14 @@ change in the future.
 `),
 		Subcommands: []*ffcli.Command{
 			upCmd,
-			downCmd,
 			netcheckCmd,
 			statusCmd,
-			pingCmd,
 			versionCmd,
 		},
 		FlagSet: rootfs,
 		Exec:    func(context.Context, []string) error { return flag.ErrHelp },
 	}
 
-	// Don't advertise the debug command, but it exists.
-	if strSliceContains(args, "debug") {
-		rootCmd.Subcommands = append(rootCmd.Subcommands, debugCmd)
-	}
-
 	if err := rootCmd.Parse(args); err != nil {
 		return err
 	}
@@ -134,12 +126,3 @@ func pump(ctx context.Context, bc *ipn.BackendClient, conn net.Conn) {
 		bc.GotNotifyMsg(msg)
 	}
 }
-
-func strSliceContains(ss []string, s string) bool {
-	for _, v := range ss {
-		if v == s {
-			return true
-		}
-	}
-	return false
-}

cmd/tailscale/cli/debug.go

@@ -1,175 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package cli
-
-import (
-	"context"
-	"crypto/tls"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"log"
-	"net/http"
-	"net/http/httptrace"
-	"net/url"
-	"os"
-	"time"
-
-	"github.com/peterbourgon/ff/v2/ffcli"
-	"tailscale.com/derp/derphttp"
-	"tailscale.com/derp/derpmap"
-	"tailscale.com/net/interfaces"
-	"tailscale.com/net/tshttpproxy"
-	"tailscale.com/tailcfg"
-	"tailscale.com/types/key"
-	"tailscale.com/wgengine/monitor"
-)
-
-var debugCmd = &ffcli.Command{
-	Name: "debug",
-	Exec: runDebug,
-	FlagSet: (func() *flag.FlagSet {
-		fs := flag.NewFlagSet("debug", flag.ExitOnError)
-		fs.BoolVar(&debugArgs.monitor, "monitor", false, "If true, run link monitor forever. Precludes all other options.")
-		fs.StringVar(&debugArgs.getURL, "get-url", "", "If non-empty, fetch provided URL.")
-		fs.StringVar(&debugArgs.derpCheck, "derp", "", "if non-empty, test a DERP ping via named region code")
-		return fs
-	})(),
-}
-
-var debugArgs struct {
-	monitor   bool
-	getURL    string
-	derpCheck string
-}
-
-func runDebug(ctx context.Context, args []string) error {
-	if len(args) > 0 {
-		return errors.New("unknown arguments")
-	}
-	if debugArgs.derpCheck != "" {
-		return checkDerp(ctx, debugArgs.derpCheck)
-	}
-	if debugArgs.monitor {
-		return runMonitor(ctx)
-	}
-	if debugArgs.getURL != "" {
-		return getURL(ctx, debugArgs.getURL)
-	}
-	return errors.New("only --monitor is available at the moment")
-}
-
-func runMonitor(ctx context.Context) error {
-	dump := func() {
-		st, err := interfaces.GetState()
-		if err != nil {
-			log.Printf("error getting state: %v", err)
-			return
-		}
-		j, _ := json.MarshalIndent(st, "", "    ")
-		os.Stderr.Write(j)
-	}
-	mon, err := monitor.New(log.Printf, func() {
-		log.Printf("Link monitor fired. State:")
-		dump()
-	})
-	if err != nil {
-		return err
-	}
-	log.Printf("Starting link change monitor; initial state:")
-	dump()
-	mon.Start()
-	log.Printf("Started link change monitor; waiting...")
-	select {}
-}
-
-func getURL(ctx context.Context, urlStr string) error {
-	if urlStr == "login" {
-		urlStr = "https://login.tailscale.com"
-	}
-	log.SetOutput(os.Stdout)
-	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
-		GetConn:           func(hostPort string) { log.Printf("GetConn(%q)", hostPort) },
-		GotConn:           func(info httptrace.GotConnInfo) { log.Printf("GotConn: %+v", info) },
-		DNSStart:          func(info httptrace.DNSStartInfo) { log.Printf("DNSStart: %+v", info) },
-		DNSDone:           func(info httptrace.DNSDoneInfo) { log.Printf("DNSDoneInfo: %+v", info) },
-		TLSHandshakeStart: func() { log.Printf("TLSHandshakeStart") },
-		TLSHandshakeDone:  func(cs tls.ConnectionState, err error) { log.Printf("TLSHandshakeDone: %+v, %v", cs, err) },
-		WroteRequest:      func(info httptrace.WroteRequestInfo) { log.Printf("WroteRequest: %+v", info) },
-	})
-	req, err := http.NewRequestWithContext(ctx, "GET", urlStr, nil)
-	if err != nil {
-		return fmt.Errorf("http.NewRequestWithContext: %v", err)
-	}
-	proxyURL, err := tshttpproxy.ProxyFromEnvironment(req)
-	if err != nil {
-		return fmt.Errorf("tshttpproxy.ProxyFromEnvironment: %v", err)
-	}
-	log.Printf("proxy: %v", proxyURL)
-	tr := &http.Transport{
-		Proxy:              func(*http.Request) (*url.URL, error) { return proxyURL, nil },
-		ProxyConnectHeader: http.Header{},
-		DisableKeepAlives:  true,
-	}
-	if proxyURL != nil {
-		auth, err := tshttpproxy.GetAuthHeader(proxyURL)
-		if err == nil && auth != "" {
-			tr.ProxyConnectHeader.Set("Proxy-Authorization", auth)
-		}
-		const truncLen = 20
-		if len(auth) > truncLen {
-			auth = fmt.Sprintf("%s...(%d total bytes)", auth[:truncLen], len(auth))
-		}
-		log.Printf("tshttpproxy.GetAuthHeader(%v) for Proxy-Auth: = %q, %v", proxyURL, auth, err)
-	}
-	res, err := tr.RoundTrip(req)
-	if err != nil {
-		return fmt.Errorf("Transport.RoundTrip: %v", err)
-	}
-	defer res.Body.Close()
-	return res.Write(os.Stdout)
-}
-
-func checkDerp(ctx context.Context, derpRegion string) error {
-	dmap := derpmap.Prod()
-	getRegion := func() *tailcfg.DERPRegion {
-		for _, r := range dmap.Regions {
-			if r.RegionCode == derpRegion {
-				return r
-			}
-		}
-		for _, r := range dmap.Regions {
-			log.Printf("Known region: %q", r.RegionCode)
-		}
-		log.Fatalf("unknown region %q", derpRegion)
-		panic("unreachable")
-	}
-
-	priv1 := key.NewPrivate()
-	priv2 := key.NewPrivate()
-
-	c1 := derphttp.NewRegionClient(priv1, log.Printf, getRegion)
-	c2 := derphttp.NewRegionClient(priv2, log.Printf, getRegion)
-
-	c2.NotePreferred(true) // just to open it
-
-	m, err := c2.Recv()
-	log.Printf("c2 got %T, %v", m, err)
-
-	t0 := time.Now()
-	if err := c1.Send(priv2.Public(), []byte("hello")); err != nil {
-		return err
-	}
-	fmt.Println(time.Since(t0))
-
-	m, err = c2.Recv()
-	log.Printf("c2 got %T, %v", m, err)
-	if err != nil {
-		return err
-	}
-	log.Printf("ok")
-	return err
-}

cmd/tailscale/cli/down.go

@@ -1,66 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package cli
-
-import (
-	"context"
-	"log"
-	"time"
-
-	"github.com/peterbourgon/ff/v2/ffcli"
-	"tailscale.com/ipn"
-)
-
-var downCmd = &ffcli.Command{
-	Name:       "down",
-	ShortUsage: "down",
-	ShortHelp:  "Disconnect from Tailscale",
-
-	Exec: runDown,
-}
-
-func runDown(ctx context.Context, args []string) error {
-	if len(args) > 0 {
-		log.Fatalf("too many non-flag arguments: %q", args)
-	}
-
-	c, bc, ctx, cancel := connect(ctx)
-	defer cancel()
-
-	timer := time.AfterFunc(5*time.Second, func() {
-		log.Fatalf("timeout running stop")
-	})
-	defer timer.Stop()
-
-	bc.SetNotifyCallback(func(n ipn.Notify) {
-		if n.ErrMessage != nil {
-			log.Fatal(*n.ErrMessage)
-		}
-		if n.Status != nil {
-			cur := n.Status.BackendState
-			switch cur {
-			case "Stopped":
-				log.Printf("already stopped")
-				cancel()
-			default:
-				log.Printf("was in state %q", cur)
-			}
-			return
-		}
-		if n.State != nil {
-			log.Printf("now in state %q", *n.State)
-			if *n.State == ipn.Stopped {
-				cancel()
-			}
-			return
-		}
-	})
-
-	bc.RequestStatus()
-	bc.SetWantRunning(false)
-	pump(ctx, bc, c)
-
-	return nil
-}

cmd/tailscale/cli/netcheck.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/peterbourgon/ff/v2/ffcli"
 	"tailscale.com/derp/derpmap"
+	"tailscale.com/net/dnscache"
 	"tailscale.com/net/netcheck"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
@@ -43,7 +44,9 @@ var netcheckArgs struct {
 }
 
 func runNetcheck(ctx context.Context, args []string) error {
-	c := &netcheck.Client{}
+	c := &netcheck.Client{
+		DNSCache: dnscache.Get(),
+	}
 	if netcheckArgs.verbose {
 		c.Logf = logger.WithPrefix(log.Printf, "netcheck: ")
 		c.Verbose = true
@@ -122,35 +125,20 @@ func printReport(dm *tailcfg.DERPMap, report *netcheck.Report) error {
 	if len(report.RegionLatency) == 0 {
 		fmt.Printf("\t* Nearest DERP: unknown (no response to latency probes)\n")
 	} else {
-		fmt.Printf("\t* Nearest DERP: %v\n", dm.Regions[report.PreferredDERP].RegionName)
+		fmt.Printf("\t* Nearest DERP: %v (%v)\n", report.PreferredDERP, dm.Regions[report.PreferredDERP].RegionCode)
 		fmt.Printf("\t* DERP latency:\n")
 		var rids []int
 		for rid := range dm.Regions {
 			rids = append(rids, rid)
 		}
-		sort.Slice(rids, func(i, j int) bool {
-			l1, ok1 := report.RegionLatency[rids[i]]
-			l2, ok2 := report.RegionLatency[rids[j]]
-			if ok1 != ok2 {
-				return ok1 // defined things sort first
-			}
-			if !ok1 {
-				return rids[i] < rids[j]
-			}
-			return l1 < l2
-		})
+		sort.Ints(rids)
 		for _, rid := range rids {
 			d, ok := report.RegionLatency[rid]
 			var latency string
 			if ok {
 				latency = d.Round(time.Millisecond / 10).String()
 			}
-			r := dm.Regions[rid]
-			var derpNum string
-			if netcheckArgs.verbose {
-				derpNum = fmt.Sprintf("derp%d, ", rid)
-			}
-			fmt.Printf("\t\t- %3s: %-7s (%s%s)\n", r.RegionCode, latency, derpNum, r.RegionName)
+			fmt.Printf("\t\t- %v, %3s = %s\n", rid, dm.Regions[rid].RegionCode, latency)
 		}
 	}
 	return nil

cmd/tailscale/cli/ping.go

@@ -1,130 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package cli
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"log"
-	"net"
-	"strings"
-	"time"
-
-	"github.com/peterbourgon/ff/v2/ffcli"
-	"tailscale.com/ipn"
-	"tailscale.com/ipn/ipnstate"
-)
-
-var pingCmd = &ffcli.Command{
-	Name:       "ping",
-	ShortUsage: "ping <hostname-or-IP>",
-	ShortHelp:  "Ping a host at the Tailscale layer, see how it routed",
-	LongHelp: strings.TrimSpace(`
-
-The 'tailscale ping' command pings a peer node at the Tailscale layer
-and reports which route it took for each response. The first ping or
-so will likely go over DERP (Tailscale's TCP relay protocol) while NAT
-traversal finds a direct path through.
-
-If 'tailscale ping' works but a normal ping does not, that means one
-side's operating system firewall is blocking packets; 'tailscale ping'
-does not inject packets into either side's TUN devices.
-
-By default, 'tailscale ping' stops after 10 pings or once a direct
-(non-DERP) path has been established, whichever comes first.
-
-The provided hostname must resolve to or be a Tailscale IP
-(e.g. 100.x.y.z) or a subnet IP advertised by a Tailscale
-relay node.
-
-`),
-	Exec: runPing,
-	FlagSet: (func() *flag.FlagSet {
-		fs := flag.NewFlagSet("ping", flag.ExitOnError)
-		fs.BoolVar(&pingArgs.verbose, "verbose", false, "verbose output")
-		fs.BoolVar(&pingArgs.untilDirect, "until-direct", true, "stop once a direct path is established")
-		fs.IntVar(&pingArgs.num, "c", 10, "max number of pings to send")
-		fs.DurationVar(&pingArgs.timeout, "timeout", 5*time.Second, "timeout before giving up on a ping")
-		return fs
-	})(),
-}
-
-var pingArgs struct {
-	num         int
-	untilDirect bool
-	verbose     bool
-	timeout     time.Duration
-}
-
-func runPing(ctx context.Context, args []string) error {
-	c, bc, ctx, cancel := connect(ctx)
-	defer cancel()
-
-	if len(args) != 1 {
-		return errors.New("usage: ping <hostname-or-IP>")
-	}
-	hostOrIP := args[0]
-	var ip string
-	var res net.Resolver
-	if addrs, err := res.LookupHost(ctx, hostOrIP); err != nil {
-		return fmt.Errorf("error looking up IP of %q: %v", hostOrIP, err)
-	} else if len(addrs) == 0 {
-		return fmt.Errorf("no IPs found for %q", hostOrIP)
-	} else {
-		ip = addrs[0]
-	}
-	if pingArgs.verbose && ip != hostOrIP {
-		log.Printf("lookup %q => %q", hostOrIP, ip)
-	}
-
-	ch := make(chan *ipnstate.PingResult, 1)
-	bc.SetNotifyCallback(func(n ipn.Notify) {
-		if n.ErrMessage != nil {
-			log.Fatal(*n.ErrMessage)
-		}
-		if pr := n.PingResult; pr != nil && pr.IP == ip {
-			ch <- pr
-		}
-	})
-	go pump(ctx, bc, c)
-
-	n := 0
-	anyPong := false
-	for {
-		n++
-		bc.Ping(ip)
-		timer := time.NewTimer(pingArgs.timeout)
-		select {
-		case <-timer.C:
-			fmt.Printf("timeout waiting for ping reply\n")
-		case pr := <-ch:
-			timer.Stop()
-			if pr.Err != "" {
-				return errors.New(pr.Err)
-			}
-			latency := time.Duration(pr.LatencySeconds * float64(time.Second)).Round(time.Millisecond)
-			via := pr.Endpoint
-			if pr.DERPRegionID != 0 {
-				via = fmt.Sprintf("DERP(%s)", pr.DERPRegionCode)
-			}
-			anyPong = true
-			fmt.Printf("pong from %s (%s) via %v in %v\n", pr.NodeName, pr.NodeIP, via, latency)
-			if pr.Endpoint != "" && pingArgs.untilDirect {
-				return nil
-			}
-			time.Sleep(time.Second)
-		case <-ctx.Done():
-			return ctx.Err()
-		}
-		if n == pingArgs.num {
-			if !anyPong {
-				return errors.New("no reply")
-			}
-			return nil
-		}
-	}
-}

cmd/tailscale/cli/status.go

@@ -33,7 +33,6 @@ var statusCmd = &ffcli.Command{
 		fs.BoolVar(&statusArgs.json, "json", false, "output in JSON format (WARNING: format subject to change)")
 		fs.BoolVar(&statusArgs.web, "web", false, "run webserver with HTML showing status")
 		fs.BoolVar(&statusArgs.active, "active", false, "filter output to only peers with active sessions (not applicable to web mode)")
-		fs.BoolVar(&statusArgs.self, "self", true, "show status of local machine")
 		fs.StringVar(&statusArgs.listen, "listen", "127.0.0.1:8384", "listen address; use port 0 for automatic")
 		fs.BoolVar(&statusArgs.browser, "browser", true, "Open a browser in web mode")
 		return fs
@@ -46,7 +45,6 @@ var statusArgs struct {
 	listen  string // in web mode, webserver address to listen on, empty means auto
 	browser bool   // in web mode, whether to open browser
 	active  bool   // in CLI mode, filter output to only peers with active sessions
-	self    bool   // in CLI mode, show status of local machine
 }
 
 func runStatus(ctx context.Context, args []string) error {
@@ -127,17 +125,16 @@ func runStatus(ctx context.Context, args []string) error {
 		return err
 	}
 
-	if st.BackendState == ipn.Stopped.String() {
-		fmt.Println("Tailscale is stopped.")
-		os.Exit(1)
-	}
-
 	var buf bytes.Buffer
 	f := func(format string, a ...interface{}) { fmt.Fprintf(&buf, format, a...) }
-	printPS := func(ps *ipnstate.PeerStatus) {
+	for _, peer := range st.Peers() {
+		ps := st.Peer[peer]
 		active := peerActive(ps)
+		if statusArgs.active && !active {
+			continue
+		}
 		f("%s %-7s %-15s %-18s tx=%8d rx=%8d ",
-			ps.PublicKey.ShortString(),
+			peer.ShortString(),
 			ps.OS,
 			ps.TailAddr,
 			ps.SimpleHostName(),
@@ -163,18 +160,6 @@ func runStatus(ctx context.Context, args []string) error {
 		}
 		f("\n")
 	}
-
-	if statusArgs.self && st.Self != nil {
-		printPS(st.Self)
-	}
-	for _, peer := range st.Peers() {
-		ps := st.Peer[peer]
-		active := peerActive(ps)
-		if statusArgs.active && !active {
-			continue
-		}
-		printPS(ps)
-	}
 	os.Stdout.Write(buf.Bytes())
 	return nil
 }

cmd/tailscale/cli/up.go

@@ -7,7 +7,6 @@ package cli
 import (
 	"bytes"
 	"context"
-	"errors"
 	"flag"
 	"fmt"
 	"log"
@@ -16,7 +15,6 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
-	"sync"
 
 	"github.com/peterbourgon/ff/v2/ffcli"
 	"github.com/tailscale/wireguard-go/wgcfg"
@@ -24,10 +22,18 @@ import (
 	"tailscale.com/ipn"
 	"tailscale.com/tailcfg"
 	"tailscale.com/version"
-	"tailscale.com/version/distro"
 	"tailscale.com/wgengine/router"
 )
 
+// globalStateKey is the ipn.StateKey that tailscaled loads on
+// startup.
+//
+// We have to support multiple state keys for other OSes (Windows in
+// particular), but right now Unix daemons run with a single
+// node-global state. To keep open the option of having per-user state
+// later, the global state key doesn't look like a username.
+const globalStateKey = "_daemon"
+
 var upCmd = &ffcli.Command{
 	Name:       "up",
 	ShortUsage: "up [flags]",
@@ -47,38 +53,31 @@ specify any flags, options are reset to their default.
 		upf.BoolVar(&upArgs.acceptDNS, "accept-dns", true, "accept DNS configuration from the admin panel")
 		upf.BoolVar(&upArgs.singleRoutes, "host-routes", true, "install host routes to other Tailscale nodes")
 		upf.BoolVar(&upArgs.shieldsUp, "shields-up", false, "don't allow incoming connections")
-		upf.BoolVar(&upArgs.forceReauth, "force-reauth", false, "force reauthentication")
 		upf.StringVar(&upArgs.advertiseTags, "advertise-tags", "", "ACL tags to request (comma-separated, e.g. eng,montreal,ssh)")
 		upf.StringVar(&upArgs.authKey, "authkey", "", "node authorization key")
 		upf.StringVar(&upArgs.hostname, "hostname", "", "hostname to use instead of the one provided by the OS")
+		upf.BoolVar(&upArgs.enableDERP, "enable-derp", true, "enable the use of DERP servers")
 		if runtime.GOOS == "linux" || isBSD(runtime.GOOS) || version.OS() == "macOS" {
 			upf.StringVar(&upArgs.advertiseRoutes, "advertise-routes", "", "routes to advertise to other nodes (comma-separated, e.g. 10.0.0.0/8,192.168.0.0/24)")
 		}
 		if runtime.GOOS == "linux" {
-			upf.BoolVar(&upArgs.snat, "snat-subnet-routes", true, "source NAT traffic to local routes advertised with --advertise-routes")
-			upf.StringVar(&upArgs.netfilterMode, "netfilter-mode", defaultNetfilterMode(), "netfilter mode (one of on, nodivert, off)")
+			upf.BoolVar(&upArgs.snat, "snat-subnet-routes", true, "source NAT traffic to local routes advertised with -advertise-routes")
+			upf.StringVar(&upArgs.netfilterMode, "netfilter-mode", "on", "netfilter mode (one of on, nodivert, off)")
 		}
 		return upf
 	})(),
 	Exec: runUp,
 }
 
-func defaultNetfilterMode() string {
-	if distro.Get() == distro.Synology {
-		return "off"
-	}
-	return "on"
-}
-
 var upArgs struct {
 	server          string
 	acceptRoutes    bool
 	acceptDNS       bool
 	singleRoutes    bool
 	shieldsUp       bool
-	forceReauth     bool
 	advertiseRoutes string
 	advertiseTags   string
+	enableDERP      bool
 	snat            bool
 	netfilterMode   string
 	authKey         string
@@ -149,19 +148,6 @@ func runUp(ctx context.Context, args []string) error {
 		log.Fatalf("too many non-flag arguments: %q", args)
 	}
 
-	if distro.Get() == distro.Synology {
-		notSupported := "not yet supported on Synology; see https://github.com/tailscale/tailscale/issues/451"
-		if upArgs.advertiseRoutes != "" {
-			return errors.New("--advertise-routes is " + notSupported)
-		}
-		if upArgs.acceptRoutes {
-			return errors.New("--accept-routes is " + notSupported)
-		}
-		if upArgs.netfilterMode != "off" {
-			return errors.New("--netfilter-mode values besides \"off\" " + notSupported)
-		}
-	}
-
 	var routes []wgcfg.CIDR
 	if upArgs.advertiseRoutes != "" {
 		advroutes := strings.Split(upArgs.advertiseRoutes, ",")
@@ -195,6 +181,7 @@ func runUp(ctx context.Context, args []string) error {
 	}
 
 	// TODO(apenwarr): fix different semantics between prefs and uflags
+	// TODO(apenwarr): allow setting/using CorpDNS
 	prefs := ipn.NewPrefs()
 	prefs.ControlURL = upArgs.server
 	prefs.WantRunning = true
@@ -205,9 +192,8 @@ func runUp(ctx context.Context, args []string) error {
 	prefs.AdvertiseRoutes = routes
 	prefs.AdvertiseTags = tags
 	prefs.NoSNAT = !upArgs.snat
+	prefs.DisableDERP = !upArgs.enableDERP
 	prefs.Hostname = upArgs.hostname
-	prefs.ForceDaemon = (runtime.GOOS == "windows")
-
 	if runtime.GOOS == "linux" {
 		switch upArgs.netfilterMode {
 		case "on":
@@ -227,13 +213,10 @@ func runUp(ctx context.Context, args []string) error {
 	defer cancel()
 
 	var printed bool
-	var loginOnce sync.Once
-	startLoginInteractive := func() { loginOnce.Do(func() { bc.StartLoginInteractive() }) }
 
 	bc.SetPrefs(prefs)
-
 	opts := ipn.Options{
-		StateKey: ipn.GlobalDaemonStateKey,
+		StateKey: globalStateKey,
 		AuthKey:  upArgs.authKey,
 		Notify: func(n ipn.Notify) {
 			if n.ErrMessage != nil {
@@ -243,7 +226,7 @@ func runUp(ctx context.Context, args []string) error {
 				switch *s {
 				case ipn.NeedsLogin:
 					printed = true
-					startLoginInteractive()
+					bc.StartLoginInteractive()
 				case ipn.NeedsMachineAuth:
 					printed = true
 					fmt.Fprintf(os.Stderr, "\nTo authorize your machine, visit (as admin):\n\n\t%s/admin/machines\n\n", upArgs.server)
@@ -261,22 +244,6 @@ func runUp(ctx context.Context, args []string) error {
 			}
 		},
 	}
-
-	// On Windows, we still run in mostly the "legacy" way that
-	// predated the server's StateStore. That is, we send an empty
-	// StateKey and send the prefs directly. Although the Windows
-	// supports server mode, though, the transition to StateStore
-	// is only half complete. Only server mode uses it, and the
-	// Windows service (~tailscaled) is the one that computes the
-	// StateKey based on the connection idenity. So for now, just
-	// do as the Windows GUI's always done:
-	if runtime.GOOS == "windows" {
-		// The Windows service will set this as needed based
-		// on our connection's identity.
-		opts.StateKey = ""
-		opts.Prefs = prefs
-	}
-
 	// We still have to Start right now because it's the only way to
 	// set up notifications and whatnot. This causes a bunch of churn
 	// every time the CLI touches anything.
@@ -285,10 +252,6 @@ func runUp(ctx context.Context, args []string) error {
 	// ephemeral frontends that read/modify/write state, once
 	// Windows/Mac state is moved into backend.
 	bc.Start(opts)
-	if upArgs.forceReauth {
-		printed = true
-		startLoginInteractive()
-	}
 	pump(ctx, bc, c)
 
 	return nil

cmd/tailscale/cli/version.go

@@ -36,11 +36,10 @@ func runVersion(ctx context.Context, args []string) error {
 		log.Fatalf("too many non-flag arguments: %q", args)
 	}
 	if !versionArgs.daemon {
-		fmt.Println(version.String())
+		fmt.Println(version.LONG)
 		return nil
 	}
-
-	fmt.Printf("Client: %s\n", version.String())
+	fmt.Printf("Client: %s\n", version.LONG)
 
 	c, bc, ctx, cancel := connect(ctx)
 	defer cancel()

cmd/tailscale/depaware.txt

@@ -1,211 +0,0 @@
-tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/depaware)
-
-   W 💣 github.com/alexbrainman/sspi                                 from github.com/alexbrainman/sspi/negotiate
-   W 💣 github.com/alexbrainman/sspi/negotiate                       from tailscale.com/net/tshttpproxy
-        github.com/apenwarr/fixconsole                               from tailscale.com/cmd/tailscale
-   W 💣 github.com/apenwarr/w32                                      from github.com/apenwarr/fixconsole
-   L    github.com/coreos/go-iptables/iptables                       from tailscale.com/wgengine/router
-  LW    github.com/go-multierror/multierror                          from tailscale.com/wgengine/router
-   W 💣 github.com/go-ole/go-ole                                     from github.com/go-ole/go-ole/oleutil+
-   W 💣 github.com/go-ole/go-ole/oleutil                             from tailscale.com/wgengine/winnet
-   L 💣 github.com/godbus/dbus/v5                                    from tailscale.com/wgengine/router/dns
-        github.com/golang/groupcache/lru                             from tailscale.com/wgengine/filter+
-   L    github.com/jsimonetti/rtnetlink                              from tailscale.com/wgengine/monitor
-   L    github.com/jsimonetti/rtnetlink/internal/unix                from github.com/jsimonetti/rtnetlink
-   L 💣 github.com/mdlayher/netlink                                  from github.com/jsimonetti/rtnetlink+
-   L 💣 github.com/mdlayher/netlink/nlenc                            from github.com/jsimonetti/rtnetlink+
-        github.com/peterbourgon/ff/v2                                from github.com/peterbourgon/ff/v2/ffcli
-        github.com/peterbourgon/ff/v2/ffcli                          from tailscale.com/cmd/tailscale/cli
-     💣 github.com/tailscale/wireguard-go/conn                       from github.com/tailscale/wireguard-go/device+
-     💣 github.com/tailscale/wireguard-go/device                     from tailscale.com/wgengine+
-        github.com/tailscale/wireguard-go/device/tokenbucket         from github.com/tailscale/wireguard-go/device
-     💣 github.com/tailscale/wireguard-go/ipc                        from github.com/tailscale/wireguard-go/device
-   W 💣 github.com/tailscale/wireguard-go/ipc/winpipe                from github.com/tailscale/wireguard-go/ipc
-        github.com/tailscale/wireguard-go/ratelimiter                from github.com/tailscale/wireguard-go/device
-        github.com/tailscale/wireguard-go/replay                     from github.com/tailscale/wireguard-go/device
-        github.com/tailscale/wireguard-go/rwcancel                   from github.com/tailscale/wireguard-go/device+
-        github.com/tailscale/wireguard-go/tai64n                     from github.com/tailscale/wireguard-go/device
-     💣 github.com/tailscale/wireguard-go/tun                        from github.com/tailscale/wireguard-go/device+
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun                 from github.com/tailscale/wireguard-go/tun
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/iphlpapi        from github.com/tailscale/wireguard-go/tun/wintun
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/namespaceapi    from github.com/tailscale/wireguard-go/tun/wintun
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/nci             from github.com/tailscale/wireguard-go/tun/wintun
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/registry        from github.com/tailscale/wireguard-go/tun/wintun+
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/setupapi        from github.com/tailscale/wireguard-go/tun/wintun
-        github.com/tailscale/wireguard-go/wgcfg                      from github.com/tailscale/wireguard-go/conn+
-        github.com/tcnksm/go-httpstat                                from tailscale.com/net/netcheck
-        github.com/toqueteos/webbrowser                              from tailscale.com/cmd/tailscale/cli
-     💣 go4.org/mem                                                  from tailscale.com/control/controlclient+
-   W 💣 golang.zx2c4.com/wireguard/windows/tunnel/winipcfg           from tailscale.com/net/interfaces+
-        inet.af/netaddr                                              from tailscale.com/cmd/tailscale/cli+
-        rsc.io/goversion/version                                     from tailscale.com/version
-        tailscale.com/atomicfile                                     from tailscale.com/ipn+
-        tailscale.com/cmd/tailscale/cli                              from tailscale.com/cmd/tailscale
-        tailscale.com/control/controlclient                          from tailscale.com/ipn+
-        tailscale.com/derp                                           from tailscale.com/derp/derphttp+
-        tailscale.com/derp/derphttp                                  from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/derp/derpmap                                   from tailscale.com/cmd/tailscale/cli
-        tailscale.com/disco                                          from tailscale.com/derp+
-        tailscale.com/internal/deepprint                             from tailscale.com/ipn+
-        tailscale.com/ipn                                            from tailscale.com/cmd/tailscale/cli
-        tailscale.com/ipn/ipnstate                                   from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/ipn/policy                                     from tailscale.com/ipn
-        tailscale.com/log/logheap                                    from tailscale.com/control/controlclient
-        tailscale.com/logtail/backoff                                from tailscale.com/control/controlclient+
-        tailscale.com/metrics                                        from tailscale.com/derp
-        tailscale.com/net/dnscache                                   from tailscale.com/control/controlclient+
-     💣 tailscale.com/net/interfaces                                 from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/net/netcheck                                   from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/net/netns                                      from tailscale.com/control/controlclient+
-        tailscale.com/net/packet                                     from tailscale.com/wgengine+
-        tailscale.com/net/stun                                       from tailscale.com/net/netcheck+
-        tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
-        tailscale.com/net/tsaddr                                     from tailscale.com/ipn+
-     💣 tailscale.com/net/tshttpproxy                                from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/paths                                          from tailscale.com/cmd/tailscale/cli
-        tailscale.com/portlist                                       from tailscale.com/ipn
-        tailscale.com/safesocket                                     from tailscale.com/cmd/tailscale/cli
-     💣 tailscale.com/syncs                                          from tailscale.com/net/interfaces+
-        tailscale.com/tailcfg                                        from tailscale.com/cmd/tailscale/cli+
-   W    tailscale.com/tsconst                                        from tailscale.com/net/interfaces
-        tailscale.com/types/empty                                    from tailscale.com/control/controlclient+
-        tailscale.com/types/key                                      from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/types/logger                                   from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/types/nettype                                  from tailscale.com/wgengine/magicsock
-        tailscale.com/types/opt                                      from tailscale.com/control/controlclient+
-        tailscale.com/types/strbuilder                               from tailscale.com/net/packet
-        tailscale.com/types/structs                                  from tailscale.com/control/controlclient+
-   W    tailscale.com/util/endian                                    from tailscale.com/net/netns
-        tailscale.com/util/lineread                                  from tailscale.com/control/controlclient+
-        tailscale.com/version                                        from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/version/distro                                 from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/wgengine                                       from tailscale.com/ipn
-        tailscale.com/wgengine/filter                                from tailscale.com/control/controlclient+
-        tailscale.com/wgengine/magicsock                             from tailscale.com/wgengine
-     💣 tailscale.com/wgengine/monitor                               from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/wgengine/router                                from tailscale.com/cmd/tailscale/cli+
-     💣 tailscale.com/wgengine/router/dns                            from tailscale.com/ipn+
-        tailscale.com/wgengine/tsdns                                 from tailscale.com/ipn+
-        tailscale.com/wgengine/tstun                                 from tailscale.com/wgengine
-   W 💣 tailscale.com/wgengine/winnet                                from tailscale.com/wgengine/router
-        golang.org/x/crypto/blake2b                                  from golang.org/x/crypto/nacl/box
-        golang.org/x/crypto/blake2s                                  from github.com/tailscale/wireguard-go/device+
-        golang.org/x/crypto/chacha20                                 from golang.org/x/crypto/chacha20poly1305
-        golang.org/x/crypto/chacha20poly1305                         from crypto/tls+
-        golang.org/x/crypto/cryptobyte                               from crypto/ecdsa+
-        golang.org/x/crypto/cryptobyte/asn1                          from crypto/ecdsa+
-        golang.org/x/crypto/curve25519                               from crypto/tls+
-        golang.org/x/crypto/hkdf                                     from crypto/tls
-        golang.org/x/crypto/nacl/box                                 from tailscale.com/control/controlclient+
-        golang.org/x/crypto/nacl/secretbox                           from golang.org/x/crypto/nacl/box
-        golang.org/x/crypto/poly1305                                 from github.com/tailscale/wireguard-go/device+
-        golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
-        golang.org/x/net/bpf                                         from github.com/mdlayher/netlink+
-        golang.org/x/net/context/ctxhttp                             from golang.org/x/oauth2/internal
-        golang.org/x/net/dns/dnsmessage                              from net+
-        golang.org/x/net/http/httpguts                               from net/http
-        golang.org/x/net/http/httpproxy                              from net/http
-        golang.org/x/net/http2/hpack                                 from net/http
-        golang.org/x/net/idna                                        from golang.org/x/net/http/httpguts+
-        golang.org/x/net/ipv4                                        from github.com/tailscale/wireguard-go/device
-        golang.org/x/net/ipv6                                        from github.com/tailscale/wireguard-go/device+
-        golang.org/x/net/proxy                                       from tailscale.com/net/netns
-   D    golang.org/x/net/route                                       from net
-        golang.org/x/oauth2                                          from tailscale.com/control/controlclient+
-        golang.org/x/oauth2/internal                                 from golang.org/x/oauth2
-        golang.org/x/sync/errgroup                                   from tailscale.com/derp
-        golang.org/x/sync/singleflight                               from tailscale.com/net/dnscache
-        golang.org/x/sys/cpu                                         from golang.org/x/crypto/blake2b+
-  LD    golang.org/x/sys/unix                                        from github.com/jsimonetti/rtnetlink/internal/unix+
-   W    golang.org/x/sys/windows                                     from github.com/apenwarr/fixconsole+
-   W    golang.org/x/sys/windows/registry                            from github.com/tailscale/wireguard-go/tun/wintun+
-        golang.org/x/text/secure/bidirule                            from golang.org/x/net/idna
-        golang.org/x/text/transform                                  from golang.org/x/text/secure/bidirule+
-        golang.org/x/text/unicode/bidi                               from golang.org/x/net/idna+
-        golang.org/x/text/unicode/norm                               from github.com/tailscale/wireguard-go/tun/wintun+
-        golang.org/x/time/rate                                       from tailscale.com/types/logger+
-        bufio                                                        from compress/flate+
-        bytes                                                        from bufio+
-        compress/flate                                               from compress/gzip+
-        compress/gzip                                                from net/http+
-        compress/zlib                                                from debug/elf+
-        container/list                                               from crypto/tls+
-        context                                                      from crypto/tls+
-        crypto                                                       from crypto/ecdsa+
-        crypto/aes                                                   from crypto/ecdsa+
-        crypto/cipher                                                from crypto/aes+
-        crypto/des                                                   from crypto/tls+
-        crypto/dsa                                                   from crypto/x509
-        crypto/ecdsa                                                 from crypto/tls+
-        crypto/ed25519                                               from crypto/tls+
-        crypto/elliptic                                              from crypto/ecdsa+
-        crypto/hmac                                                  from crypto/tls+
-        crypto/md5                                                   from crypto/tls+
-        crypto/rand                                                  from crypto/ed25519+
-        crypto/rc4                                                   from crypto/tls
-        crypto/rsa                                                   from crypto/tls+
-        crypto/sha1                                                  from crypto/tls+
-        crypto/sha256                                                from crypto/tls+
-        crypto/sha512                                                from crypto/ecdsa+
-        crypto/subtle                                                from crypto/aes+
-        crypto/tls                                                   from github.com/tcnksm/go-httpstat+
-        crypto/x509                                                  from crypto/tls+
-        crypto/x509/pkix                                             from crypto/x509+
-        debug/dwarf                                                  from debug/elf+
-        debug/elf                                                    from rsc.io/goversion/version
-        debug/macho                                                  from rsc.io/goversion/version
-        debug/pe                                                     from rsc.io/goversion/version
-        encoding                                                     from encoding/json+
-        encoding/asn1                                                from crypto/x509+
-        encoding/base64                                              from encoding/json+
-        encoding/binary                                              from compress/gzip+
-        encoding/hex                                                 from crypto/x509+
-        encoding/json                                                from expvar+
-        encoding/pem                                                 from crypto/tls+
-        errors                                                       from bufio+
-        expvar                                                       from tailscale.com/derp+
-        flag                                                         from github.com/peterbourgon/ff/v2+
-        fmt                                                          from compress/flate+
-        hash                                                         from compress/zlib+
-        hash/adler32                                                 from compress/zlib
-        hash/crc32                                                   from compress/gzip+
-        hash/fnv                                                     from tailscale.com/wgengine/magicsock
-        hash/maphash                                                 from go4.org/mem
-        html                                                         from tailscale.com/ipn/ipnstate
-        io                                                           from bufio+
-        io/ioutil                                                    from crypto/tls+
-        log                                                          from expvar+
-        math                                                         from compress/flate+
-        math/big                                                     from crypto/dsa+
-        math/bits                                                    from compress/flate+
-        math/rand                                                    from github.com/mdlayher/netlink+
-        mime                                                         from golang.org/x/oauth2/internal+
-        mime/multipart                                               from net/http
-        mime/quotedprintable                                         from mime/multipart
-        net                                                          from crypto/tls+
-        net/http                                                     from expvar+
-        net/http/httptrace                                           from github.com/tcnksm/go-httpstat+
-        net/http/internal                                            from net/http
-        net/textproto                                                from golang.org/x/net/http/httpguts+
-        net/url                                                      from crypto/x509+
-        os                                                           from crypto/rand+
-        os/exec                                                      from github.com/coreos/go-iptables/iptables+
-        os/signal                                                    from tailscale.com/cmd/tailscale/cli
-   L    os/user                                                      from github.com/godbus/dbus/v5
-        path                                                         from debug/dwarf+
-        path/filepath                                                from crypto/x509+
-        reflect                                                      from crypto/x509+
-        regexp                                                       from github.com/coreos/go-iptables/iptables+
-        regexp/syntax                                                from regexp
-        runtime/pprof                                                from tailscale.com/log/logheap+
-        sort                                                         from compress/flate+
-        strconv                                                      from compress/flate+
-        strings                                                      from bufio+
-        sync                                                         from compress/flate+
-        sync/atomic                                                  from context+
-        syscall                                                      from crypto/rand+
-        text/tabwriter                                               from github.com/peterbourgon/ff/v2/ffcli+
-        time                                                         from compress/gzip+
-        unicode                                                      from bytes+
-        unicode/utf16                                                from encoding/asn1+
-        unicode/utf8                                                 from bufio+

cmd/tailscaled/depaware.txt

@@ -1,228 +0,0 @@
-tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/depaware)
-
-   W 💣 github.com/alexbrainman/sspi                                 from github.com/alexbrainman/sspi/negotiate
-   W 💣 github.com/alexbrainman/sspi/negotiate                       from tailscale.com/net/tshttpproxy
-        github.com/apenwarr/fixconsole                               from tailscale.com/cmd/tailscaled
-   W 💣 github.com/apenwarr/w32                                      from github.com/apenwarr/fixconsole
-   L    github.com/coreos/go-iptables/iptables                       from tailscale.com/wgengine/router
-  LW    github.com/go-multierror/multierror                          from tailscale.com/wgengine/router
-   W 💣 github.com/go-ole/go-ole                                     from github.com/go-ole/go-ole/oleutil+
-   W 💣 github.com/go-ole/go-ole/oleutil                             from tailscale.com/wgengine/winnet
-   L 💣 github.com/godbus/dbus/v5                                    from tailscale.com/wgengine/router/dns
-        github.com/golang/groupcache/lru                             from tailscale.com/wgengine/filter+
-   L    github.com/jsimonetti/rtnetlink                              from tailscale.com/wgengine/monitor
-   L    github.com/jsimonetti/rtnetlink/internal/unix                from github.com/jsimonetti/rtnetlink
-        github.com/klauspost/compress/fse                            from github.com/klauspost/compress/huff0
-        github.com/klauspost/compress/huff0                          from github.com/klauspost/compress/zstd
-        github.com/klauspost/compress/snappy                         from github.com/klauspost/compress/zstd
-        github.com/klauspost/compress/zstd                           from tailscale.com/smallzstd
-        github.com/klauspost/compress/zstd/internal/xxhash           from github.com/klauspost/compress/zstd
-   L 💣 github.com/mdlayher/netlink                                  from github.com/jsimonetti/rtnetlink+
-   L 💣 github.com/mdlayher/netlink/nlenc                            from github.com/jsimonetti/rtnetlink+
-     💣 github.com/tailscale/wireguard-go/conn                       from github.com/tailscale/wireguard-go/device+
-     💣 github.com/tailscale/wireguard-go/device                     from tailscale.com/wgengine+
-        github.com/tailscale/wireguard-go/device/tokenbucket         from github.com/tailscale/wireguard-go/device
-     💣 github.com/tailscale/wireguard-go/ipc                        from github.com/tailscale/wireguard-go/device
-   W 💣 github.com/tailscale/wireguard-go/ipc/winpipe                from github.com/tailscale/wireguard-go/ipc
-        github.com/tailscale/wireguard-go/ratelimiter                from github.com/tailscale/wireguard-go/device
-        github.com/tailscale/wireguard-go/replay                     from github.com/tailscale/wireguard-go/device
-        github.com/tailscale/wireguard-go/rwcancel                   from github.com/tailscale/wireguard-go/device+
-        github.com/tailscale/wireguard-go/tai64n                     from github.com/tailscale/wireguard-go/device
-     💣 github.com/tailscale/wireguard-go/tun                        from github.com/tailscale/wireguard-go/device+
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun                 from github.com/tailscale/wireguard-go/tun
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/iphlpapi        from github.com/tailscale/wireguard-go/tun/wintun
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/namespaceapi    from github.com/tailscale/wireguard-go/tun/wintun
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/nci             from github.com/tailscale/wireguard-go/tun/wintun
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/registry        from github.com/tailscale/wireguard-go/tun/wintun+
-   W 💣 github.com/tailscale/wireguard-go/tun/wintun/setupapi        from github.com/tailscale/wireguard-go/tun/wintun
-        github.com/tailscale/wireguard-go/wgcfg                      from github.com/tailscale/wireguard-go/conn+
-        github.com/tcnksm/go-httpstat                                from tailscale.com/net/netcheck
-     💣 go4.org/mem                                                  from tailscale.com/control/controlclient+
-   W 💣 golang.zx2c4.com/wireguard/windows/tunnel/winipcfg           from tailscale.com/net/interfaces+
-        inet.af/netaddr                                              from tailscale.com/control/controlclient+
-        rsc.io/goversion/version                                     from tailscale.com/version
-        tailscale.com/atomicfile                                     from tailscale.com/ipn+
-        tailscale.com/control/controlclient                          from tailscale.com/ipn+
-        tailscale.com/derp                                           from tailscale.com/derp/derphttp+
-        tailscale.com/derp/derphttp                                  from tailscale.com/net/netcheck+
-        tailscale.com/disco                                          from tailscale.com/derp+
-        tailscale.com/internal/deepprint                             from tailscale.com/ipn+
-        tailscale.com/ipn                                            from tailscale.com/ipn/ipnserver
-        tailscale.com/ipn/ipnserver                                  from tailscale.com/cmd/tailscaled
-        tailscale.com/ipn/ipnstate                                   from tailscale.com/ipn+
-        tailscale.com/ipn/policy                                     from tailscale.com/ipn
-        tailscale.com/log/filelogger                                 from tailscale.com/ipn/ipnserver
-        tailscale.com/log/logheap                                    from tailscale.com/control/controlclient
-        tailscale.com/logpolicy                                      from tailscale.com/cmd/tailscaled
-        tailscale.com/logtail                                        from tailscale.com/logpolicy
-        tailscale.com/logtail/backoff                                from tailscale.com/control/controlclient+
-        tailscale.com/logtail/filch                                  from tailscale.com/logpolicy
-        tailscale.com/metrics                                        from tailscale.com/derp
-        tailscale.com/net/dnscache                                   from tailscale.com/control/controlclient+
-     💣 tailscale.com/net/interfaces                                 from tailscale.com/ipn+
-        tailscale.com/net/netcheck                                   from tailscale.com/wgengine/magicsock
-        tailscale.com/net/netns                                      from tailscale.com/control/controlclient+
-     💣 tailscale.com/net/netstat                                    from tailscale.com/ipn/ipnserver
-        tailscale.com/net/packet                                     from tailscale.com/wgengine+
-        tailscale.com/net/stun                                       from tailscale.com/net/netcheck+
-        tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
-        tailscale.com/net/tsaddr                                     from tailscale.com/ipn+
-     💣 tailscale.com/net/tshttpproxy                                from tailscale.com/control/controlclient+
-        tailscale.com/paths                                          from tailscale.com/cmd/tailscaled+
-        tailscale.com/portlist                                       from tailscale.com/ipn
-        tailscale.com/safesocket                                     from tailscale.com/ipn/ipnserver
-        tailscale.com/smallzstd                                      from tailscale.com/ipn/ipnserver+
-     💣 tailscale.com/syncs                                          from tailscale.com/net/interfaces+
-        tailscale.com/tailcfg                                        from tailscale.com/control/controlclient+
-   W    tailscale.com/tsconst                                        from tailscale.com/net/interfaces
-        tailscale.com/types/empty                                    from tailscale.com/control/controlclient+
-        tailscale.com/types/flagtype                                 from tailscale.com/cmd/tailscaled
-        tailscale.com/types/key                                      from tailscale.com/derp+
-        tailscale.com/types/logger                                   from tailscale.com/cmd/tailscaled+
-        tailscale.com/types/nettype                                  from tailscale.com/wgengine/magicsock
-        tailscale.com/types/opt                                      from tailscale.com/control/controlclient+
-        tailscale.com/types/strbuilder                               from tailscale.com/net/packet
-        tailscale.com/types/structs                                  from tailscale.com/control/controlclient+
-   W    tailscale.com/util/endian                                    from tailscale.com/net/netns+
-        tailscale.com/util/lineread                                  from tailscale.com/control/controlclient+
-        tailscale.com/util/pidowner                                  from tailscale.com/ipn/ipnserver
-        tailscale.com/util/racebuild                                 from tailscale.com/logpolicy
-        tailscale.com/version                                        from tailscale.com/cmd/tailscaled+
-        tailscale.com/version/distro                                 from tailscale.com/control/controlclient+
-        tailscale.com/wgengine                                       from tailscale.com/cmd/tailscaled+
-        tailscale.com/wgengine/filter                                from tailscale.com/control/controlclient+
-        tailscale.com/wgengine/magicsock                             from tailscale.com/cmd/tailscaled+
-     💣 tailscale.com/wgengine/monitor                               from tailscale.com/wgengine
-        tailscale.com/wgengine/router                                from tailscale.com/cmd/tailscaled+
-     💣 tailscale.com/wgengine/router/dns                            from tailscale.com/ipn+
-        tailscale.com/wgengine/tsdns                                 from tailscale.com/ipn+
-        tailscale.com/wgengine/tstun                                 from tailscale.com/wgengine
-   W 💣 tailscale.com/wgengine/winnet                                from tailscale.com/wgengine/router
-        golang.org/x/crypto/blake2b                                  from golang.org/x/crypto/nacl/box
-        golang.org/x/crypto/blake2s                                  from github.com/tailscale/wireguard-go/device+
-        golang.org/x/crypto/chacha20                                 from golang.org/x/crypto/chacha20poly1305
-        golang.org/x/crypto/chacha20poly1305                         from crypto/tls+
-        golang.org/x/crypto/cryptobyte                               from crypto/ecdsa+
-        golang.org/x/crypto/cryptobyte/asn1                          from crypto/ecdsa+
-        golang.org/x/crypto/curve25519                               from crypto/tls+
-        golang.org/x/crypto/hkdf                                     from crypto/tls
-        golang.org/x/crypto/nacl/box                                 from tailscale.com/control/controlclient+
-        golang.org/x/crypto/nacl/secretbox                           from golang.org/x/crypto/nacl/box
-        golang.org/x/crypto/poly1305                                 from github.com/tailscale/wireguard-go/device+
-        golang.org/x/crypto/salsa20/salsa                            from golang.org/x/crypto/nacl/box+
-        golang.org/x/crypto/ssh/terminal                             from tailscale.com/logpolicy
-        golang.org/x/net/bpf                                         from github.com/mdlayher/netlink+
-        golang.org/x/net/context/ctxhttp                             from golang.org/x/oauth2/internal
-        golang.org/x/net/dns/dnsmessage                              from net+
-        golang.org/x/net/http/httpguts                               from net/http
-        golang.org/x/net/http/httpproxy                              from net/http
-        golang.org/x/net/http2/hpack                                 from net/http
-        golang.org/x/net/idna                                        from golang.org/x/net/http/httpguts+
-        golang.org/x/net/ipv4                                        from github.com/tailscale/wireguard-go/device
-        golang.org/x/net/ipv6                                        from github.com/tailscale/wireguard-go/device+
-        golang.org/x/net/proxy                                       from tailscale.com/net/netns
-   D    golang.org/x/net/route                                       from net
-        golang.org/x/oauth2                                          from tailscale.com/control/controlclient+
-        golang.org/x/oauth2/internal                                 from golang.org/x/oauth2
-        golang.org/x/sync/errgroup                                   from tailscale.com/derp
-        golang.org/x/sync/singleflight                               from tailscale.com/net/dnscache
-        golang.org/x/sys/cpu                                         from golang.org/x/crypto/blake2b+
-  LD    golang.org/x/sys/unix                                        from github.com/jsimonetti/rtnetlink/internal/unix+
-   W    golang.org/x/sys/windows                                     from github.com/apenwarr/fixconsole+
-   W    golang.org/x/sys/windows/registry                            from github.com/tailscale/wireguard-go/tun/wintun+
-        golang.org/x/text/secure/bidirule                            from golang.org/x/net/idna
-        golang.org/x/text/transform                                  from golang.org/x/text/secure/bidirule+
-        golang.org/x/text/unicode/bidi                               from golang.org/x/net/idna+
-        golang.org/x/text/unicode/norm                               from github.com/tailscale/wireguard-go/tun/wintun+
-        golang.org/x/time/rate                                       from tailscale.com/types/logger+
-        bufio                                                        from compress/flate+
-        bytes                                                        from bufio+
-        compress/flate                                               from compress/gzip+
-        compress/gzip                                                from internal/profile+
-        compress/zlib                                                from debug/elf+
-        container/list                                               from crypto/tls+
-        context                                                      from crypto/tls+
-        crypto                                                       from crypto/ecdsa+
-        crypto/aes                                                   from crypto/ecdsa+
-        crypto/cipher                                                from crypto/aes+
-        crypto/des                                                   from crypto/tls+
-        crypto/dsa                                                   from crypto/x509
-        crypto/ecdsa                                                 from crypto/tls+
-        crypto/ed25519                                               from crypto/tls+
-        crypto/elliptic                                              from crypto/ecdsa+
-        crypto/hmac                                                  from crypto/tls+
-        crypto/md5                                                   from crypto/tls+
-        crypto/rand                                                  from crypto/ed25519+
-        crypto/rc4                                                   from crypto/tls
-        crypto/rsa                                                   from crypto/tls+
-        crypto/sha1                                                  from crypto/tls+
-        crypto/sha256                                                from crypto/tls+
-        crypto/sha512                                                from crypto/ecdsa+
-        crypto/subtle                                                from crypto/aes+
-        crypto/tls                                                   from github.com/tcnksm/go-httpstat+
-        crypto/x509                                                  from crypto/tls+
-        crypto/x509/pkix                                             from crypto/x509+
-        debug/dwarf                                                  from debug/elf+
-        debug/elf                                                    from rsc.io/goversion/version
-        debug/macho                                                  from rsc.io/goversion/version
-        debug/pe                                                     from rsc.io/goversion/version
-        encoding                                                     from encoding/json+
-        encoding/asn1                                                from crypto/x509+
-        encoding/base64                                              from encoding/json+
-        encoding/binary                                              from compress/gzip+
-        encoding/hex                                                 from crypto/x509+
-        encoding/json                                                from expvar+
-        encoding/pem                                                 from crypto/tls+
-        errors                                                       from bufio+
-        expvar                                                       from tailscale.com/derp+
-        flag                                                         from tailscale.com/cmd/tailscaled+
-        fmt                                                          from compress/flate+
-        hash                                                         from compress/zlib+
-        hash/adler32                                                 from compress/zlib
-        hash/crc32                                                   from compress/gzip+
-        hash/fnv                                                     from tailscale.com/wgengine/magicsock
-        hash/maphash                                                 from go4.org/mem
-        html                                                         from html/template+
-        html/template                                                from net/http/pprof
-        io                                                           from bufio+
-        io/ioutil                                                    from crypto/tls+
-        log                                                          from expvar+
-        math                                                         from compress/flate+
-        math/big                                                     from crypto/dsa+
-        math/bits                                                    from compress/flate+
-        math/rand                                                    from github.com/mdlayher/netlink+
-        mime                                                         from golang.org/x/oauth2/internal+
-        mime/multipart                                               from net/http
-        mime/quotedprintable                                         from mime/multipart
-        net                                                          from crypto/tls+
-        net/http                                                     from expvar+
-        net/http/httptrace                                           from github.com/tcnksm/go-httpstat+
-        net/http/internal                                            from net/http
-        net/http/pprof                                               from tailscale.com/cmd/tailscaled
-        net/textproto                                                from golang.org/x/net/http/httpguts+
-        net/url                                                      from crypto/x509+
-        os                                                           from crypto/rand+
-        os/exec                                                      from github.com/coreos/go-iptables/iptables+
-        os/signal                                                    from tailscale.com/cmd/tailscaled+
-        os/user                                                      from github.com/godbus/dbus/v5+
-        path                                                         from debug/dwarf+
-        path/filepath                                                from crypto/x509+
-        reflect                                                      from crypto/x509+
-        regexp                                                       from github.com/coreos/go-iptables/iptables+
-        regexp/syntax                                                from regexp
-        runtime/debug                                                from github.com/klauspost/compress/zstd+
-        runtime/pprof                                                from net/http/pprof+
-        runtime/trace                                                from net/http/pprof
-        sort                                                         from compress/flate+
-        strconv                                                      from compress/flate+
-        strings                                                      from bufio+
-        sync                                                         from compress/flate+
-        sync/atomic                                                  from context+
-        syscall                                                      from crypto/rand+
-        text/tabwriter                                               from runtime/pprof
-        text/template                                                from html/template
-        text/template/parse                                          from html/template+
-        time                                                         from compress/gzip+
-        unicode                                                      from bytes+
-        unicode/utf16                                                from encoding/asn1+
-        unicode/utf8                                                 from bufio+

cmd/tailscaled/tailscaled.go

@@ -11,8 +11,6 @@ package main // import "tailscale.com/cmd/tailscaled"
 
 import (
 	"context"
-	"flag"
-	"fmt"
 	"log"
 	"net/http"
 	"net/http/pprof"
@@ -20,17 +18,15 @@ import (
 	"os/signal"
 	"runtime"
 	"runtime/debug"
-	"strconv"
 	"syscall"
 	"time"
 
 	"github.com/apenwarr/fixconsole"
+	"github.com/pborman/getopt/v2"
 	"tailscale.com/ipn/ipnserver"
 	"tailscale.com/logpolicy"
 	"tailscale.com/paths"
-	"tailscale.com/types/flagtype"
 	"tailscale.com/types/logger"
-	"tailscale.com/version"
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/magicsock"
 	"tailscale.com/wgengine/router"
@@ -75,29 +71,28 @@ func main() {
 		debug.SetGCPercent(10)
 	}
 
-	printVersion := false
-	flag.BoolVar(&args.cleanup, "cleanup", false, "clean up system state and exit")
-	flag.BoolVar(&args.fake, "fake", false, "use userspace fake tunnel+routing instead of kernel TUN interface")
-	flag.StringVar(&args.debug, "debug", "", "listen address ([ip]:port) of optional debug server")
-	flag.StringVar(&args.tunname, "tun", defaultTunName(), "tunnel interface name")
-	flag.Var(flagtype.PortValue(&args.port, magicsock.DefaultPort), "port", "UDP port to listen on for WireGuard and peer-to-peer traffic; 0 means automatically select")
-	flag.StringVar(&args.statepath, "state", paths.DefaultTailscaledStateFile(), "path of state file")
-	flag.StringVar(&args.socketpath, "socket", paths.DefaultTailscaledSocket(), "path of the service unix socket")
-	flag.BoolVar(&printVersion, "version", false, "print version information and exit")
+	// Set default values for getopt.
+	args.tunname = defaultTunName()
+	args.port = magicsock.DefaultPort
+	args.statepath = paths.DefaultTailscaledStateFile()
+	args.socketpath = paths.DefaultTailscaledSocket()
+
+	getopt.FlagLong(&args.cleanup, "cleanup", 0, "clean up system state and exit")
+	getopt.FlagLong(&args.fake, "fake", 0, "fake tunnel+routing instead of tuntap")
+	getopt.FlagLong(&args.debug, "debug", 0, "address of debug server")
+	getopt.FlagLong(&args.tunname, "tun", 0, "tunnel interface name")
+	getopt.FlagLong(&args.port, "port", 'p', "WireGuard port (0=autoselect)")
+	getopt.FlagLong(&args.statepath, "state", 0, "path of state file")
+	getopt.FlagLong(&args.socketpath, "socket", 's', "path of the service unix socket")
 
 	err := fixconsole.FixConsoleIfNeeded()
 	if err != nil {
 		log.Fatalf("fixConsoleOutput: %v", err)
 	}
 
-	flag.Parse()
-	if flag.NArg() > 0 {
-		log.Fatalf("tailscaled does not take non-flag arguments: %q", flag.Args())
-	}
-
-	if printVersion {
-		fmt.Println(version.String())
-		os.Exit(0)
+	getopt.Parse()
+	if len(getopt.Args()) > 0 {
+		log.Fatalf("too many non-flag arguments: %#v", getopt.Args()[0])
 	}
 
 	if args.statepath == "" {
@@ -125,10 +120,7 @@ func run() error {
 		pol.Shutdown(ctx)
 	}()
 
-	var logf logger.Logf = log.Printf
-	if v, _ := strconv.ParseBool(os.Getenv("TS_DEBUG_MEMORY")); v {
-		logf = logger.RusagePrefixLog(logf)
-	}
+	logf := wgengine.RusagePrefixLog(log.Printf)
 	logf = logger.RateLimitedFn(logf, 5*time.Second, 5, 100)
 
 	if args.cleanup {
@@ -144,7 +136,7 @@ func run() error {
 
 	var e wgengine.Engine
 	if args.fake {
-		e, err = wgengine.NewFakeUserspaceEngine(logf, args.port)
+		e, err = wgengine.NewFakeUserspaceEngine(logf, 0)
 	} else {
 		e, err = wgengine.NewUserspaceEngine(logf, args.tunname, args.port)
 	}

cmd/tailscaled/tailscaled.service

@@ -6,7 +6,6 @@ After=network-pre.target
 
 [Service]
 EnvironmentFile=/etc/default/tailscaled
-ExecStartPre=/usr/sbin/tailscaled --cleanup
 ExecStart=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port $PORT $FLAGS
 ExecStopPost=/usr/sbin/tailscaled --cleanup
 

control/controlclient/auto.go

@@ -288,7 +288,7 @@ func (c *Client) authRoutine() {
 			// don't send status updates for context errors,
 			// since context cancelation is always on purpose.
 			if ctx.Err() == nil {
-				c.sendStatus("authRoutine-report", err, "", nil)
+				c.sendStatus("authRoutine1", err, "", nil)
 			}
 		}
 
@@ -353,7 +353,7 @@ func (c *Client) authRoutine() {
 			c.synced = false
 			c.mu.Unlock()
 
-			c.sendStatus("authRoutine-wantout", nil, "", nil)
+			c.sendStatus("authRoutine2", nil, "", nil)
 			bo.BackOff(ctx, nil)
 		} else { // ie. goal.wantLoggedIn
 			c.mu.Lock()
@@ -394,7 +394,7 @@ func (c *Client) authRoutine() {
 				c.synced = false
 				c.mu.Unlock()
 
-				c.sendStatus("authRoutine-url", err, url, nil)
+				c.sendStatus("authRoutine3", err, url, nil)
 				bo.BackOff(ctx, err)
 				continue
 			}
@@ -406,7 +406,7 @@ func (c *Client) authRoutine() {
 			c.state = StateAuthenticated
 			c.mu.Unlock()
 
-			c.sendStatus("authRoutine-success", nil, "", nil)
+			c.sendStatus("authRoutine4", nil, "", nil)
 			c.cancelMapSafely()
 			bo.BackOff(ctx, nil)
 		}
@@ -528,7 +528,7 @@ func (c *Client) mapRoutine() {
 
 				c.logf("mapRoutine: netmap received: %s", state)
 				if stillAuthed {
-					c.sendStatus("mapRoutine-got-netmap", nil, "", nm)
+					c.sendStatus("mapRoutine2", nil, "", nm)
 				}
 			})
 

control/controlclient/direct.go

@@ -13,7 +13,6 @@ import (
 	"encoding/binary"
 	"encoding/json"
 	"errors"
-	"flag"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -21,14 +20,12 @@ import (
 	"net/http"
 	"net/url"
 	"os"
-	"os/exec"
 	"reflect"
 	"runtime"
 	"sort"
 	"strconv"
 	"strings"
 	"sync"
-	"sync/atomic"
 	"time"
 
 	"github.com/tailscale/wireguard-go/wgcfg"
@@ -36,31 +33,17 @@ import (
 	"golang.org/x/oauth2"
 	"inet.af/netaddr"
 	"tailscale.com/log/logheap"
-	"tailscale.com/net/dnscache"
 	"tailscale.com/net/netns"
 	"tailscale.com/net/tlsdial"
-	"tailscale.com/net/tshttpproxy"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
-	"tailscale.com/types/opt"
 	"tailscale.com/types/structs"
 	"tailscale.com/version"
 )
 
 type Persist struct {
-	_ structs.Incomparable
-
-	// LegacyFrontendPrivateMachineKey is here temporarily
-	// (starting 2020-09-28) during migration of Windows users'
-	// machine keys from frontend storage to the backend. On the
-	// first LocalBackend.Start call, the backend will initialize
-	// the real (backend-owned) machine key from the frontend's
-	// provided value (if non-zero), picking a new random one if
-	// needed. This field should be considered read-only from GUI
-	// frontends. The real value should not be written back in
-	// this field, lest the frontend persist it to disk.
-	LegacyFrontendPrivateMachineKey wgcfg.PrivateKey `json:"PrivateMachineKey"`
-
+	_                 structs.Incomparable
+	PrivateMachineKey wgcfg.PrivateKey
 	PrivateNodeKey    wgcfg.PrivateKey
 	OldPrivateNodeKey wgcfg.PrivateKey // needed to request key rotation
 	Provider          string
@@ -75,7 +58,7 @@ func (p *Persist) Equals(p2 *Persist) bool {
 		return false
 	}
 
-	return p.LegacyFrontendPrivateMachineKey.Equal(p2.LegacyFrontendPrivateMachineKey) &&
+	return p.PrivateMachineKey.Equal(p2.PrivateMachineKey) &&
 		p.PrivateNodeKey.Equal(p2.PrivateNodeKey) &&
 		p.OldPrivateNodeKey.Equal(p2.OldPrivateNodeKey) &&
 		p.Provider == p2.Provider &&
@@ -84,8 +67,8 @@ func (p *Persist) Equals(p2 *Persist) bool {
 
 func (p *Persist) Pretty() string {
 	var mk, ok, nk wgcfg.Key
-	if !p.LegacyFrontendPrivateMachineKey.IsZero() {
-		mk = p.LegacyFrontendPrivateMachineKey.Public()
+	if !p.PrivateMachineKey.IsZero() {
+		mk = p.PrivateMachineKey.Public()
 	}
 	if !p.OldPrivateNodeKey.IsZero() {
 		ok = p.OldPrivateNodeKey.Public()
@@ -93,14 +76,9 @@ func (p *Persist) Pretty() string {
 	if !p.PrivateNodeKey.IsZero() {
 		nk = p.PrivateNodeKey.Public()
 	}
-	ss := func(k wgcfg.Key) string {
-		if k.IsZero() {
-			return ""
-		}
-		return k.ShortString()
-	}
-	return fmt.Sprintf("Persist{lm=%v, o=%v, n=%v u=%#v}",
-		ss(mk), ss(ok), ss(nk), p.LoginName)
+	return fmt.Sprintf("Persist{m=%v, o=%v, n=%v u=%#v}",
+		mk.ShortString(), ok.ShortString(), nk.ShortString(),
+		p.LoginName)
 }
 
 // Direct is the client that connects to a tailcontrol server for a node.
@@ -113,8 +91,6 @@ type Direct struct {
 	keepAlive       bool
 	logf            logger.Logf
 	discoPubKey     tailcfg.DiscoKey
-	machinePrivKey  wgcfg.PrivateKey
-	debugFlags      []string
 
 	mu           sync.Mutex // mutex guards the following fields
 	serverKey    wgcfg.Key
@@ -123,25 +99,22 @@ type Direct struct {
 	tryingNewKey wgcfg.PrivateKey
 	expiry       *time.Time
 	// hostinfo is mutated in-place while mu is held.
-	hostinfo      *tailcfg.Hostinfo // always non-nil
-	endpoints     []string
-	everEndpoints bool   // whether we've ever had non-empty endpoints
-	localPort     uint16 // or zero to mean auto
+	hostinfo  *tailcfg.Hostinfo // always non-nil
+	endpoints []string
+	localPort uint16 // or zero to mean auto
 }
 
 type Options struct {
-	Persist           Persist           // initial persistent data
-	MachinePrivateKey wgcfg.PrivateKey  // the machine key to use
-	ServerURL         string            // URL of the tailcontrol server
-	AuthKey           string            // optional node auth key for auto registration
-	TimeNow           func() time.Time  // time.Now implementation used by Client
-	Hostinfo          *tailcfg.Hostinfo // non-nil passes ownership, nil means to use default using os.Hostname, etc
-	DiscoPublicKey    tailcfg.DiscoKey
-	NewDecompressor   func() (Decompressor, error)
-	KeepAlive         bool
-	Logf              logger.Logf
-	HTTPTestClient    *http.Client // optional HTTP client to use (for tests only)
-	DebugFlags        []string     // debug settings to send to control
+	Persist         Persist           // initial persistent data
+	ServerURL       string            // URL of the tailcontrol server
+	AuthKey         string            // optional node auth key for auto registration
+	TimeNow         func() time.Time  // time.Now implementation used by Client
+	Hostinfo        *tailcfg.Hostinfo // non-nil passes ownership, nil means to use default using os.Hostname, etc
+	DiscoPublicKey  tailcfg.DiscoKey
+	NewDecompressor func() (Decompressor, error)
+	KeepAlive       bool
+	Logf            logger.Logf
+	HTTPTestClient  *http.Client // optional HTTP client to use (for tests only)
 }
 
 type Decompressor interface {
@@ -154,9 +127,6 @@ func NewDirect(opts Options) (*Direct, error) {
 	if opts.ServerURL == "" {
 		return nil, errors.New("controlclient.New: no server URL specified")
 	}
-	if opts.MachinePrivateKey.IsZero() {
-		return nil, errors.New("controlclient.New: no MachinePrivateKey specified")
-	}
 	opts.ServerURL = strings.TrimRight(opts.ServerURL, "/")
 	serverURL, err := url.Parse(opts.ServerURL)
 	if err != nil {
@@ -173,15 +143,9 @@ func NewDirect(opts Options) (*Direct, error) {
 
 	httpc := opts.HTTPTestClient
 	if httpc == nil {
-		dnsCache := &dnscache.Resolver{
-			Forward:     dnscache.Get().Forward, // use default cache's forwarder
-			UseLastGood: true,
-		}
 		dialer := netns.NewDialer()
 		tr := http.DefaultTransport.(*http.Transport).Clone()
-		tr.Proxy = tshttpproxy.ProxyFromEnvironment
-		tshttpproxy.SetTransportGetProxyConnectHeader(tr)
-		tr.DialContext = dnscache.Dialer(dialer.DialContext, dnsCache)
+		tr.DialContext = dialer.DialContext
 		tr.ForceAttemptHTTP2 = true
 		tr.TLSClientConfig = tlsdial.Config(serverURL.Host, tr.TLSClientConfig)
 		httpc = &http.Client{Transport: tr}
@@ -189,7 +153,6 @@ func NewDirect(opts Options) (*Direct, error) {
 
 	c := &Direct{
 		httpc:           httpc,
-		machinePrivKey:  opts.MachinePrivateKey,
 		serverURL:       opts.ServerURL,
 		timeNow:         opts.TimeNow,
 		logf:            opts.Logf,
@@ -198,7 +161,6 @@ func NewDirect(opts Options) (*Direct, error) {
 		persist:         opts.Persist,
 		authKey:         opts.AuthKey,
 		discoPubKey:     opts.DiscoPublicKey,
-		debugFlags:      opts.DebugFlags,
 	}
 	if opts.Hostinfo == nil {
 		c.SetHostinfo(NewHostinfo())
@@ -217,7 +179,7 @@ func NewHostinfo() *tailcfg.Hostinfo {
 		osv = osVersion()
 	}
 	return &tailcfg.Hostinfo{
-		IPNVersion: version.Long,
+		IPNVersion: version.LONG,
 		Hostname:   hostname,
 		OS:         version.OS(),
 		OSVersion:  osv,
@@ -238,8 +200,6 @@ func (c *Direct) SetHostinfo(hi *tailcfg.Hostinfo) bool {
 		return false
 	}
 	c.hostinfo = hi.Clone()
-	j, _ := json.Marshal(c.hostinfo)
-	c.logf("HostInfo: %s", j)
 	return true
 }
 
@@ -284,14 +244,16 @@ func (c *Direct) TryLogout(ctx context.Context) error {
 
 	// TODO(crawshaw): Tell the server. This node key should be
 	// immediately invalidated.
-	//if !c.persist.PrivateNodeKey.IsZero() {
+	//if c.persist.PrivateNodeKey != (wgcfg.PrivateKey{}) {
 	//}
-	c.persist = Persist{}
+	c.persist = Persist{
+		PrivateMachineKey: c.persist.PrivateMachineKey,
+	}
 	return nil
 }
 
 func (c *Direct) TryLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags) (url string, err error) {
-	c.logf("direct.TryLogin(token=%v, flags=%v)", t != nil, flags)
+	c.logf("direct.TryLogin(%v, %v)", t != nil, flags)
 	return c.doLoginOrRegen(ctx, t, flags, false, "")
 }
 
@@ -322,8 +284,13 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 	expired := c.expiry != nil && !c.expiry.IsZero() && c.expiry.Before(c.timeNow())
 	c.mu.Unlock()
 
-	if c.machinePrivKey.IsZero() {
-		return false, "", errors.New("controlclient.Direct requires a machine private key")
+	if persist.PrivateMachineKey == (wgcfg.PrivateKey{}) {
+		c.logf("Generating a new machinekey.")
+		mkey, err := wgcfg.NewPrivateKey()
+		if err != nil {
+			log.Fatal(err)
+		}
+		persist.PrivateMachineKey = mkey
 	}
 
 	if expired {
@@ -350,7 +317,7 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 
 	var oldNodeKey wgcfg.Key
 	if url != "" {
-	} else if regen || persist.PrivateNodeKey.IsZero() {
+	} else if regen || persist.PrivateNodeKey == (wgcfg.PrivateKey{}) {
 		c.logf("Generating a new nodekey.")
 		persist.OldPrivateNodeKey = persist.PrivateNodeKey
 		key, err := wgcfg.NewPrivateKey()
@@ -363,11 +330,11 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 		// Try refreshing the current key first
 		tryingNewKey = persist.PrivateNodeKey
 	}
-	if !persist.OldPrivateNodeKey.IsZero() {
+	if persist.OldPrivateNodeKey != (wgcfg.PrivateKey{}) {
 		oldNodeKey = persist.OldPrivateNodeKey.Public()
 	}
 
-	if tryingNewKey.IsZero() {
+	if tryingNewKey == (wgcfg.PrivateKey{}) {
 		log.Fatalf("tryingNewKey is empty, give up")
 	}
 	if backendLogID == "" {
@@ -388,13 +355,13 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 	request.Auth.Provider = persist.Provider
 	request.Auth.LoginName = persist.LoginName
 	request.Auth.AuthKey = authKey
-	bodyData, err := encode(request, &serverKey, &c.machinePrivKey)
+	bodyData, err := encode(request, &serverKey, &persist.PrivateMachineKey)
 	if err != nil {
 		return regen, url, err
 	}
 	body := bytes.NewReader(bodyData)
 
-	u := fmt.Sprintf("%s/machine/%s", c.serverURL, c.machinePrivKey.Public().HexString())
+	u := fmt.Sprintf("%s/machine/%s", c.serverURL, persist.PrivateMachineKey.Public().HexString())
 	req, err := http.NewRequest("POST", u, body)
 	if err != nil {
 		return regen, url, err
@@ -405,20 +372,11 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 	if err != nil {
 		return regen, url, fmt.Errorf("register request: %v", err)
 	}
-	if res.StatusCode != 200 {
-		msg, _ := ioutil.ReadAll(res.Body)
-		res.Body.Close()
-		return regen, url, fmt.Errorf("register request: http %d: %.200s",
-			res.StatusCode, strings.TrimSpace(string(msg)))
-	}
+	c.logf("RegisterReq: returned.")
 	resp := tailcfg.RegisterResponse{}
-	if err := decode(res, &resp, &serverKey, &c.machinePrivKey); err != nil {
-		c.logf("error decoding RegisterResponse with server key %s and machine key %s: %v", serverKey, c.machinePrivKey.Public(), err)
+	if err := decode(res, &resp, &serverKey, &persist.PrivateMachineKey); err != nil {
 		return regen, url, fmt.Errorf("register request: %v", err)
 	}
-	// Log without PII:
-	c.logf("RegisterReq: got response; nodeKeyExpired=%v, machineAuthorized=%v; authURL=%v",
-		resp.NodeKeyExpired, resp.MachineAuthorized, resp.AuthURL != "")
 
 	if resp.NodeKeyExpired {
 		if regen {
@@ -494,9 +452,6 @@ func (c *Direct) newEndpoints(localPort uint16, endpoints []string) (changed boo
 	c.logf("client.newEndpoints(%v, %v)", localPort, endpoints)
 	c.localPort = localPort
 	c.endpoints = append(c.endpoints[:0], endpoints...)
-	if len(endpoints) > 0 {
-		c.everEndpoints = true
-	}
 	return true // changed
 }
 
@@ -509,13 +464,6 @@ func (c *Direct) SetEndpoints(localPort uint16, endpoints []string) (changed boo
 	return c.newEndpoints(localPort, endpoints)
 }
 
-func inTest() bool { return flag.Lookup("test.v") != nil }
-
-// PollNetMap makes a /map request to download the network map, calling cb with
-// each new netmap.
-//
-// maxPolls is how many network maps to download; common values are 1
-// or -1 (to keep a long-poll query open to the server).
 func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkMap)) error {
 	c.mu.Lock()
 	persist := c.persist
@@ -525,7 +473,6 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 	backendLogID := hostinfo.BackendLogID
 	localPort := c.localPort
 	ep := append([]string(nil), c.endpoints...)
-	everEndpoints := c.everEndpoints
 	c.mu.Unlock()
 
 	if backendLogID == "" {
@@ -533,7 +480,7 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 	}
 
 	allowStream := maxPolls != 1
-	c.logf("PollNetMap: stream=%v :%v ep=%v", allowStream, localPort, ep)
+	c.logf("PollNetMap: stream=%v :%v %v", maxPolls, localPort, ep)
 
 	vlogf := logger.Discard
 	if Debug.NetMap {
@@ -541,51 +488,36 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 	}
 
 	request := tailcfg.MapRequest{
-		Version:    5,
-		KeepAlive:  c.keepAlive,
-		NodeKey:    tailcfg.NodeKey(persist.PrivateNodeKey.Public()),
-		DiscoKey:   c.discoPubKey,
-		Endpoints:  ep,
-		Stream:     allowStream,
-		Hostinfo:   hostinfo,
-		DebugFlags: c.debugFlags,
-	}
-	if hostinfo != nil && ipForwardingBroken(hostinfo.RoutableIPs) {
-		old := request.DebugFlags
-		request.DebugFlags = append(old[:len(old):len(old)], "warn-ip-forwarding-off")
+		Version:         4,
+		IncludeIPv6:     true,
+		DeltaPeers:      true,
+		KeepAlive:       c.keepAlive,
+		NodeKey:         tailcfg.NodeKey(persist.PrivateNodeKey.Public()),
+		DiscoKey:        c.discoPubKey,
+		Endpoints:       ep,
+		Stream:          allowStream,
+		Hostinfo:        hostinfo,
+		DebugForceDisco: Debug.ForceDisco,
 	}
 	if c.newDecompressor != nil {
 		request.Compress = "zstd"
 	}
-	// On initial startup before we know our endpoints, set the ReadOnly flag
-	// to tell the control server not to distribute out our (empty) endpoints to peers.
-	// Presumably we'll learn our endpoints in a half second and do another post
-	// with useful results. The first POST just gets us the DERP map which we
-	// need to do the STUN queries to discover our endpoints.
-	// TODO(bradfitz): we skip this optimization in tests, though,
-	// because the e2e tests are currently hyperspecific about the
-	// ordering of things. The e2e tests need love.
-	if len(ep) == 0 && !everEndpoints && !inTest() {
-		request.ReadOnly = true
-	}
 
-	bodyData, err := encode(request, &serverKey, &c.machinePrivKey)
+	bodyData, err := encode(request, &serverKey, &persist.PrivateMachineKey)
 	if err != nil {
 		vlogf("netmap: encode: %v", err)
 		return err
 	}
 
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	machinePubKey := tailcfg.MachineKey(c.machinePrivKey.Public())
 	t0 := time.Now()
-	u := fmt.Sprintf("%s/machine/%s/map", serverURL, machinePubKey.HexString())
-
-	req, err := http.NewRequestWithContext(ctx, "POST", u, bytes.NewReader(bodyData))
+	u := fmt.Sprintf("%s/machine/%s/map", serverURL, persist.PrivateMachineKey.Public().HexString())
+	req, err := http.NewRequest("POST", u, bytes.NewReader(bodyData))
 	if err != nil {
 		return err
 	}
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	req = req.WithContext(ctx)
 
 	res, err := c.httpc.Do(req)
 	if err != nil {
@@ -596,7 +528,7 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 	if res.StatusCode != 200 {
 		msg, _ := ioutil.ReadAll(res.Body)
 		res.Body.Close()
-		return fmt.Errorf("initial fetch failed %d: %.200s",
+		return fmt.Errorf("initial fetch failed %d: %s",
 			res.StatusCode, strings.TrimSpace(string(msg)))
 	}
 	defer res.Body.Close()
@@ -635,7 +567,6 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 	}()
 
 	var lastDERPMap *tailcfg.DERPMap
-	var lastUserProfile = map[tailcfg.UserID]tailcfg.UserProfile{}
 
 	// If allowStream, then the server will use an HTTP long poll to
 	// return incremental results. There is always one response right
@@ -685,20 +616,13 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 
 		undeltaPeers(&resp, previousPeers)
 		previousPeers = cloneNodes(resp.Peers) // defensive/lazy clone, since this escapes to who knows where
-		for _, up := range resp.UserProfiles {
-			lastUserProfile[up.ID] = up
-		}
 
 		if resp.DERPMap != nil {
 			vlogf("netmap: new map contains DERP map")
 			lastDERPMap = resp.DERPMap
 		}
-		if resp.Debug != nil {
-			if resp.Debug.LogHeapPprof {
-				go logheap.LogHeap(resp.Debug.LogHeapURL)
-			}
-			setControlAtomic(&controlUseDERPRoute, resp.Debug.DERPRoute)
-			setControlAtomic(&controlTrimWGConfig, resp.Debug.TrimWGConfig)
+		if resp.Debug != nil && resp.Debug.LogHeapPprof {
+			go logheap.LogHeap(resp.Debug.LogHeapURL)
 		}
 		// Temporarily (2020-06-29) support removing all but
 		// discovery-supporting nodes during development, for
@@ -716,7 +640,6 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 		nm := &NetworkMap{
 			NodeKey:      tailcfg.NodeKey(persist.PrivateNodeKey.Public()),
 			PrivateKey:   persist.PrivateNodeKey,
-			MachineKey:   machinePubKey,
 			Expiry:       resp.Node.KeyExpiry,
 			Name:         resp.Node.Name,
 			Addresses:    resp.Node.Addresses,
@@ -725,24 +648,15 @@ func (c *Direct) PollNetMap(ctx context.Context, maxPolls int, cb func(*NetworkM
 			User:         resp.Node.User,
 			UserProfiles: make(map[tailcfg.UserID]tailcfg.UserProfile),
 			Domain:       resp.Domain,
+			Roles:        resp.Roles,
 			DNS:          resp.DNSConfig,
 			Hostinfo:     resp.Node.Hostinfo,
 			PacketFilter: c.parsePacketFilter(resp.PacketFilter),
 			DERPMap:      lastDERPMap,
 			Debug:        resp.Debug,
 		}
-		addUserProfile := func(userID tailcfg.UserID) {
-			if _, dup := nm.UserProfiles[userID]; dup {
-				// Already populated it from a previous peer.
-				return
-			}
-			if up, ok := lastUserProfile[userID]; ok {
-				nm.UserProfiles[userID] = up
-			}
-		}
-		addUserProfile(nm.User)
-		for _, peer := range resp.Peers {
-			addUserProfile(peer.User)
+		for _, profile := range resp.UserProfiles {
+			nm.UserProfiles[profile.ID] = profile
 		}
 		if resp.Node.MachineAuthorized {
 			nm.MachineStatus = tailcfg.MachineAuthorized
@@ -794,16 +708,13 @@ func decode(res *http.Response, v interface{}, serverKey *wgcfg.Key, mkey *wgcfg
 	return decodeMsg(msg, v, serverKey, mkey)
 }
 
-var debugMap, _ = strconv.ParseBool(os.Getenv("TS_DEBUG_MAP"))
-
-var jsonEscapedZero = []byte(`\u0000`)
-
 func (c *Direct) decodeMsg(msg []byte, v interface{}) error {
 	c.mu.Lock()
+	mkey := c.persist.PrivateMachineKey
 	serverKey := c.serverKey
 	c.mu.Unlock()
 
-	decrypted, err := decryptMsg(msg, &serverKey, &c.machinePrivKey)
+	decrypted, err := decryptMsg(msg, &serverKey, &mkey)
 	if err != nil {
 		return err
 	}
@@ -821,15 +732,6 @@ func (c *Direct) decodeMsg(msg []byte, v interface{}) error {
 			return err
 		}
 	}
-	if debugMap {
-		var buf bytes.Buffer
-		json.Indent(&buf, b, "", "    ")
-		log.Printf("MapResponse: %s", buf.Bytes())
-	}
-
-	if bytes.Contains(b, jsonEscapedZero) {
-		log.Printf("[unexpected] zero byte in controlclient.Direct.decodeMsg into %T: %q", v, b)
-	}
 	if err := json.Unmarshal(b, v); err != nil {
 		return fmt.Errorf("response: %v", err)
 	}
@@ -842,9 +744,6 @@ func decodeMsg(msg []byte, v interface{}, serverKey *wgcfg.Key, mkey *wgcfg.Priv
 	if err != nil {
 		return err
 	}
-	if bytes.Contains(decrypted, jsonEscapedZero) {
-		log.Printf("[unexpected] zero byte in controlclient decodeMsg into %T: %q", v, decrypted)
-	}
 	if err := json.Unmarshal(decrypted, v); err != nil {
 		return fmt.Errorf("response: %v", err)
 	}
@@ -862,7 +761,7 @@ func decryptMsg(msg []byte, serverKey *wgcfg.Key, mkey *wgcfg.PrivateKey) ([]byt
 	pub, pri := (*[32]byte)(serverKey), (*[32]byte)(mkey)
 	decrypted, ok := box.Open(nil, msg, &nonce, pub, pri)
 	if !ok {
-		return nil, fmt.Errorf("cannot decrypt response (len %d + nonce %d = %d)", len(msg), len(nonce), len(msg)+len(nonce))
+		return nil, fmt.Errorf("cannot decrypt response")
 	}
 	return decrypted, nil
 }
@@ -872,7 +771,8 @@ func encode(v interface{}, serverKey *wgcfg.Key, mkey *wgcfg.PrivateKey) ([]byte
 	if err != nil {
 		return nil, err
 	}
-	if debugMap {
+	const debugMapRequests = false
+	if debugMapRequests {
 		if _, ok := v.(tailcfg.MapRequest); ok {
 			log.Printf("MapRequest: %s", b)
 		}
@@ -927,20 +827,25 @@ func wgIPToNetaddr(ips []wgcfg.IP) (ret []netaddr.IP) {
 var Debug = initDebug()
 
 type debug struct {
-	NetMap    bool
-	ProxyDNS  bool
-	OnlyDisco bool
-	Disco     bool
+	NetMap     bool
+	ProxyDNS   bool
+	OnlyDisco  bool
+	Disco      bool
+	ForceDisco bool // ask control server to not filter out our disco key
 }
 
 func initDebug() debug {
-	use := os.Getenv("TS_DEBUG_USE_DISCO")
-	return debug{
-		NetMap:    envBool("TS_DEBUG_NETMAP"),
-		ProxyDNS:  envBool("TS_DEBUG_PROXY_DNS"),
-		OnlyDisco: use == "only",
-		Disco:     use == "only" || use == "" || envBool("TS_DEBUG_USE_DISCO"),
+	d := debug{
+		NetMap:     envBool("TS_DEBUG_NETMAP"),
+		ProxyDNS:   envBool("TS_DEBUG_PROXY_DNS"),
+		OnlyDisco:  os.Getenv("TS_DEBUG_USE_DISCO") == "only",
+		ForceDisco: os.Getenv("TS_DEBUG_USE_DISCO") == "only" || envBool("TS_DEBUG_USE_DISCO"),
 	}
+	if d.ForceDisco || os.Getenv("TS_DEBUG_USE_DISCO") == "" {
+		// This is now defaults to on.
+		d.Disco = true
+	}
+	return d
 }
 
 func envBool(k string) bool {
@@ -1048,61 +953,3 @@ func cloneNodes(v1 []*tailcfg.Node) []*tailcfg.Node {
 	}
 	return v2
 }
-
-// opt.Bool configs from control.
-var (
-	controlUseDERPRoute atomic.Value
-	controlTrimWGConfig atomic.Value
-)
-
-func setControlAtomic(dst *atomic.Value, v opt.Bool) {
-	old, ok := dst.Load().(opt.Bool)
-	if !ok || old != v {
-		dst.Store(v)
-	}
-}
-
-// DERPRouteFlag reports the last reported value from control for whether
-// DERP route optimization (Issue 150) should be enabled.
-func DERPRouteFlag() opt.Bool {
-	v, _ := controlUseDERPRoute.Load().(opt.Bool)
-	return v
-}
-
-// TrimWGConfig reports the last reported value from control for whether
-// we should do lazy wireguard configuration.
-func TrimWGConfig() opt.Bool {
-	v, _ := controlTrimWGConfig.Load().(opt.Bool)
-	return v
-}
-
-// ipForwardingBroken reports whether the system's IP forwarding is disabled
-// and will definitely not work for the routes provided.
-//
-// It should not return false positives.
-func ipForwardingBroken(routes []wgcfg.CIDR) bool {
-	if len(routes) == 0 {
-		// Nothing to route, so no need to warn.
-		return false
-	}
-	if runtime.GOOS != "linux" {
-		// We only do subnet routing on Linux for now.
-		// It might work on darwin/macOS when building from source, so
-		// don't return true for other OSes. We can OS-based warnings
-		// already in the admin panel.
-		return false
-	}
-	out, err := ioutil.ReadFile("/proc/sys/net/ipv4/ip_forward")
-	if err != nil {
-		// Try another way.
-		out, err = exec.Command("sysctl", "-n", "net.ipv4.ip_forward").Output()
-	}
-	if err != nil {
-		// Oh well, we tried. This is just for debugging.
-		// We don't want false positives.
-		// TODO: maybe we want a different warning for inability to check?
-		return false
-	}
-	return strings.TrimSpace(string(out)) == "0"
-	// TODO: also check IPv6 if 'routes' contains any IPv6 routes
-}

control/controlclient/filter.go

@@ -5,16 +5,80 @@
 package controlclient
 
 import (
+	"fmt"
+	"net"
 	"tailscale.com/tailcfg"
 	"tailscale.com/wgengine/filter"
 )
 
-// Parse a backward-compatible FilterRule used by control's wire
-// format, producing the most current filter format.
-func (c *Direct) parsePacketFilter(pf []tailcfg.FilterRule) []filter.Match {
-	mm, err := filter.MatchesFromFilterRules(pf)
-	if err != nil {
-		c.logf("parsePacketFilter: %s\n", err)
+func parseIP(host string, defaultBits int) (filter.Net, error) {
+	ip := net.ParseIP(host)
+	if ip != nil && ip.IsUnspecified() {
+		// For clarity, reject 0.0.0.0 as an input
+		return filter.NetNone, fmt.Errorf("ports=%#v: to allow all IP addresses, use *:port, not 0.0.0.0:port", host)
+	} else if ip == nil && host == "*" {
+		// User explicitly requested wildcard dst ip
+		return filter.NetAny, nil
+	} else {
+		if ip != nil {
+			ip = ip.To4()
+		}
+		if ip == nil || len(ip) != 4 {
+			return filter.NetNone, fmt.Errorf("ports=%#v: invalid IPv4 address", host)
+		}
+		return filter.Net{
+			IP:   filter.NewIP(ip),
+			Mask: filter.Netmask(defaultBits),
+		}, nil
+	}
+}
+
+// Parse a backward-compatible FilterRule used by control's wire format,
+// producing the most current filter.Matches format.
+func (c *Direct) parsePacketFilter(pf []tailcfg.FilterRule) filter.Matches {
+	mm := make([]filter.Match, 0, len(pf))
+	var erracc error
+
+	for _, r := range pf {
+		m := filter.Match{}
+
+		for i, s := range r.SrcIPs {
+			bits := 32
+			if len(r.SrcBits) > i {
+				bits = r.SrcBits[i]
+			}
+			net, err := parseIP(s, bits)
+			if err != nil && erracc == nil {
+				erracc = err
+				continue
+			}
+			m.Srcs = append(m.Srcs, net)
+		}
+
+		for _, d := range r.DstPorts {
+			bits := 32
+			if d.Bits != nil {
+				bits = *d.Bits
+			}
+			net, err := parseIP(d.IP, bits)
+			if err != nil && erracc == nil {
+				erracc = err
+				continue
+			}
+			m.Dsts = append(m.Dsts, filter.NetPortRange{
+				Net: net,
+				Ports: filter.PortRange{
+					First: d.Ports.First,
+					Last:  d.Ports.Last,
+				},
+			})
+		}
+
+		mm = append(mm, m)
+	}
+
+	if erracc != nil {
+		c.logf("parsePacketFilter: %s\n", erracc)
 	}
 	return mm
 }

control/controlclient/hostinfo_linux.go

@@ -16,7 +16,6 @@ import (
 
 	"go4.org/mem"
 	"tailscale.com/util/lineread"
-	"tailscale.com/version/distro"
 )
 
 func init() {
@@ -24,22 +23,13 @@ func init() {
 }
 
 func osVersionLinux() string {
-	dist := distro.Get()
-	propFile := "/etc/os-release"
-	switch dist {
-	case distro.Synology:
-		propFile = "/etc.defaults/VERSION"
-	case distro.OpenWrt:
-		propFile = "/etc/openwrt_release"
-	}
-
 	m := map[string]string{}
-	lineread.File(propFile, func(line []byte) error {
+	lineread.File("/etc/os-release", func(line []byte) error {
 		eq := bytes.IndexByte(line, '=')
 		if eq == -1 {
 			return nil
 		}
-		k, v := string(line[:eq]), strings.Trim(string(line[eq+1:]), `"'`)
+		k, v := string(line[:eq]), strings.Trim(string(line[eq+1:]), `"`)
 		m[k] = v
 		return nil
 	})
@@ -81,12 +71,6 @@ func osVersionLinux() string {
 			return fmt.Sprintf("%s%s", v, attr)
 		}
 	}
-	switch dist {
-	case distro.Synology:
-		return fmt.Sprintf("Synology %s%s", m["productversion"], attr)
-	case distro.OpenWrt:
-		return fmt.Sprintf("OpenWrt %s%s", m["DISTRIB_RELEASE"], attr)
-	}
 	return fmt.Sprintf("Other%s", attr)
 }
 

control/controlclient/hostinfo_windows.go

@@ -21,10 +21,6 @@ func osVersionWindows() string {
 	s := strings.TrimSpace(string(out))
 	s = strings.TrimPrefix(s, "Microsoft Windows [")
 	s = strings.TrimSuffix(s, "]")
-
-	// "Version 10.x.y.z", with "Version" localized. Keep only stuff after the space.
-	if sp := strings.Index(s, " "); sp != -1 {
-		s = s[sp+1:]
-	}
-	return s // "10.0.19041.388", ideally
+	s = strings.TrimPrefix(s, "Version ") // is this localized? do it last in case.
+	return s                              // "10.0.19041.388", ideally
 }

control/controlclient/netmap.go

@@ -30,11 +30,10 @@ type NetworkMap struct {
 	Addresses     []wgcfg.CIDR
 	LocalPort     uint16 // used for debugging
 	MachineStatus tailcfg.MachineStatus
-	MachineKey    tailcfg.MachineKey
 	Peers         []*tailcfg.Node // sorted by Node.ID
 	DNS           tailcfg.DNSConfig
 	Hostinfo      tailcfg.Hostinfo
-	PacketFilter  []filter.Match
+	PacketFilter  filter.Matches
 
 	// DERPMap is the last DERP server map received. It's reused
 	// between updates and should not be modified.
@@ -50,6 +49,7 @@ type NetworkMap struct {
 	// TODO(crawshaw): reduce UserProfiles to []tailcfg.UserProfile?
 	// There are lots of ways to slice this data, leave it up to users.
 	UserProfiles map[tailcfg.UserID]tailcfg.UserProfile
+	Roles        []tailcfg.Role
 	// TODO(crawshaw): Groups       []tailcfg.Group
 	// TODO(crawshaw): Capabilities []tailcfg.Capability
 }
@@ -75,15 +75,6 @@ func (nm *NetworkMap) Concise() string {
 func (nm *NetworkMap) printConciseHeader(buf *strings.Builder) {
 	fmt.Fprintf(buf, "netmap: self: %v auth=%v",
 		nm.NodeKey.ShortString(), nm.MachineStatus)
-	login := nm.UserProfiles[nm.User].LoginName
-	if login == "" {
-		if nm.User.IsZero() {
-			login = "?"
-		} else {
-			login = fmt.Sprint(nm.User)
-		}
-	}
-	fmt.Fprintf(buf, " u=%s", login)
 	if nm.LocalPort != 0 {
 		fmt.Fprintf(buf, " port=%v", nm.LocalPort)
 	}
@@ -101,7 +92,6 @@ func (a *NetworkMap) equalConciseHeader(b *NetworkMap) bool {
 	if a.NodeKey != b.NodeKey ||
 		a.MachineStatus != b.MachineStatus ||
 		a.LocalPort != b.LocalPort ||
-		a.User != b.User ||
 		len(a.Addresses) != len(b.Addresses) {
 		return false
 	}
@@ -229,6 +219,7 @@ const (
 	AllowSingleHosts WGConfigFlags = 1 << iota
 	AllowSubnetRoutes
 	AllowDefaultRoute
+	HackDefaultRoute
 )
 
 // EndpointDiscoSuffix is appended to the hex representation of a peer's discovery key
@@ -283,7 +274,11 @@ func (nm *NetworkMap) WGCfg(logf logger.Logf, flags WGConfigFlags) (*wgcfg.Confi
 					logf("wgcfg: %v skipping default route", peer.Key.ShortString())
 					continue
 				}
-			} else if cidrIsSubnet(peer, allowedIP) {
+				if (flags & HackDefaultRoute) != 0 {
+					allowedIP = wgcfg.CIDR{IP: wgcfg.IPv4(10, 0, 0, 0), Mask: 8}
+					logf("wgcfg: %v converting default route => %v", peer.Key.ShortString(), allowedIP.String())
+				}
+			} else if allowedIP.Mask < 32 {
 				if (flags & AllowSubnetRoutes) == 0 {
 					logf("wgcfg: %v skipping subnet route", peer.Key.ShortString())
 					continue
@@ -296,29 +291,6 @@ func (nm *NetworkMap) WGCfg(logf logger.Logf, flags WGConfigFlags) (*wgcfg.Confi
 	return cfg, nil
 }
 
-// cidrIsSubnet reports whether cidr is a non-default-route subnet
-// exported by node that is not one of its own self addresses.
-func cidrIsSubnet(node *tailcfg.Node, cidr wgcfg.CIDR) bool {
-	if cidr.Mask == 0 {
-		return false
-	}
-	if cidr.Mask < 32 {
-		// Fast path for IPv4, to avoid loop below.
-		//
-		// TODO: if cidr.IP is an IPv6 address, we could do "< 128"
-		// to avoid the range over node.Addresses. Or we could
-		// just remove this fast path and unconditionally do the range
-		// loop.
-		return true
-	}
-	for _, selfCIDR := range node.Addresses {
-		if cidr == selfCIDR {
-			return false
-		}
-	}
-	return true
-}
-
 func appendEndpoint(peer *wgcfg.Peer, epStr string) error {
 	if epStr == "" {
 		return nil

control/controlclient/netmap_test.go

@@ -51,7 +51,7 @@ func TestNetworkMapConcise(t *testing.T) {
 					},
 				},
 			},
-			want: "netmap: self: [AQEBA] auth=machine-unknown u=? []\n [AgICA] D2                 :    192.168.0.100:12     192.168.0.100:12354\n [AwMDA] D4                 :       10.2.0.100:12        10.1.0.100:12345\n",
+			want: "netmap: self: [AQEBA] auth=machine-unknown []\n [AgICA] D2                 :    192.168.0.100:12     192.168.0.100:12354\n [AwMDA] D4                 :       10.2.0.100:12        10.1.0.100:12345\n",
 		},
 		{
 			name: "debug_non_nil",
@@ -59,7 +59,7 @@ func TestNetworkMapConcise(t *testing.T) {
 				NodeKey: testNodeKey(1),
 				Debug:   &tailcfg.Debug{},
 			},
-			want: "netmap: self: [AQEBA] auth=machine-unknown u=? debug={} []\n",
+			want: "netmap: self: [AQEBA] auth=machine-unknown debug={} []\n",
 		},
 		{
 			name: "debug_values",
@@ -67,7 +67,7 @@ func TestNetworkMapConcise(t *testing.T) {
 				NodeKey: testNodeKey(1),
 				Debug:   &tailcfg.Debug{LogHeapPprof: true},
 			},
-			want: "netmap: self: [AQEBA] auth=machine-unknown u=? debug={\"LogHeapPprof\":true} []\n",
+			want: "netmap: self: [AQEBA] auth=machine-unknown debug={\"LogHeapPprof\":true} []\n",
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
@@ -135,7 +135,7 @@ func TestConciseDiffFrom(t *testing.T) {
 					},
 				},
 			},
-			want: "-netmap: self: [AQEBA] auth=machine-unknown u=? []\n+netmap: self: [AgICA] auth=machine-unknown u=? []\n",
+			want: "-netmap: self: [AQEBA] auth=machine-unknown []\n+netmap: self: [AgICA] auth=machine-unknown []\n",
 		},
 		{
 			name: "peer_add",

control/controlclient/persist_test.go

@@ -12,7 +12,7 @@ import (
 )
 
 func TestPersistEqual(t *testing.T) {
-	persistHandles := []string{"LegacyFrontendPrivateMachineKey", "PrivateNodeKey", "OldPrivateNodeKey", "Provider", "LoginName"}
+	persistHandles := []string{"PrivateMachineKey", "PrivateNodeKey", "OldPrivateNodeKey", "Provider", "LoginName"}
 	if have := fieldsOf(reflect.TypeOf(Persist{})); !reflect.DeepEqual(have, persistHandles) {
 		t.Errorf("Persist.Equal check might be out of sync\nfields: %q\nhandled: %q\n",
 			have, persistHandles)
@@ -36,13 +36,13 @@ func TestPersistEqual(t *testing.T) {
 		{&Persist{}, &Persist{}, true},
 
 		{
-			&Persist{LegacyFrontendPrivateMachineKey: k1},
-			&Persist{LegacyFrontendPrivateMachineKey: newPrivate()},
+			&Persist{PrivateMachineKey: k1},
+			&Persist{PrivateMachineKey: newPrivate()},
 			false,
 		},
 		{
-			&Persist{LegacyFrontendPrivateMachineKey: k1},
-			&Persist{LegacyFrontendPrivateMachineKey: k1},
+			&Persist{PrivateMachineKey: k1},
+			&Persist{PrivateMachineKey: k1},
 			true,
 		},
 

derp/derp.go

@@ -39,10 +39,14 @@ const (
 	keepAlive      = 60 * time.Second
 )
 
-// ProtocolVersion is bumped whenever there's a wire-incompatible change.
+// protocolVersion is bumped whenever there's a wire-incompatible change.
 //   * version 1 (zero on wire): consistent box headers, in use by employee dev nodes a bit
 //   * version 2: received packets have src addrs in frameRecvPacket at beginning
-const ProtocolVersion = 2
+const protocolVersion = 2
+
+const (
+	protocolSrcAddrs = 2 // protocol version at which client expects src addresses
+)
 
 // frameType is the one byte frame type at the beginning of the frame
 // header.  The second field is a big-endian uint32 describing the
@@ -104,31 +108,16 @@ var bin = binary.BigEndian
 func writeUint32(bw *bufio.Writer, v uint32) error {
 	var b [4]byte
 	bin.PutUint32(b[:], v)
-	// Writing a byte at a time is a bit silly,
-	// but it causes b not to escape,
-	// which more than pays for the silliness.
-	for _, c := range &b {
-		err := bw.WriteByte(c)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
+	_, err := bw.Write(b[:])
+	return err
 }
 
 func readUint32(br *bufio.Reader) (uint32, error) {
-	var b [4]byte
-	// Reading a byte at a time is a bit silly,
-	// but it causes b not to escape,
-	// which more than pays for the silliness.
-	for i := range &b {
-		c, err := br.ReadByte()
-		if err != nil {
-			return 0, err
-		}
-		b[i] = c
+	b := make([]byte, 4)
+	if _, err := io.ReadFull(br, b); err != nil {
+		return 0, err
 	}
-	return bin.Uint32(b[:]), nil
+	return bin.Uint32(b), nil
 }
 
 func readFrameTypeHeader(br *bufio.Reader, wantType frameType) (frameLen uint32, err error) {
@@ -205,6 +194,13 @@ func writeFrame(bw *bufio.Writer, t frameType, b []byte) error {
 	return bw.Flush()
 }
 
+func minInt(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
+
 func minUint32(a, b uint32) uint32 {
 	if a < b {
 		return a

derp/derp_client.go

@@ -21,13 +21,14 @@ import (
 
 // Client is a DERP client.
 type Client struct {
-	serverKey  key.Public // of the DERP server; not a machine or node key
-	privateKey key.Private
-	publicKey  key.Public // of privateKey
-	logf       logger.Logf
-	nc         Conn
-	br         *bufio.Reader
-	meshKey    string
+	serverKey    key.Public // of the DERP server; not a machine or node key
+	privateKey   key.Private
+	publicKey    key.Public // of privateKey
+	protoVersion int        // min of server+client
+	logf         logger.Logf
+	nc           Conn
+	br           *bufio.Reader
+	meshKey      string
 
 	wmu sync.Mutex // hold while writing to bw
 	bw  *bufio.Writer
@@ -48,8 +49,7 @@ func (f clientOptFunc) update(o *clientOpt) { f(o) }
 
 // clientOpt are the options passed to newClient.
 type clientOpt struct {
-	MeshKey   string
-	ServerPub key.Public
+	MeshKey string
 }
 
 // MeshKey returns a ClientOpt to pass to the DERP server during connect to get
@@ -58,12 +58,6 @@ type clientOpt struct {
 // An empty key means to not use a mesh key.
 func MeshKey(key string) ClientOpt { return clientOptFunc(func(o *clientOpt) { o.MeshKey = key }) }
 
-// ServerPublicKey returns a ClientOpt to declare that the server's DERP public key is known.
-// If key is the zero value, the returned ClientOpt is a no-op.
-func ServerPublicKey(key key.Public) ClientOpt {
-	return clientOptFunc(func(o *clientOpt) { o.ServerPub = key })
-}
-
 func NewClient(privateKey key.Private, nc Conn, brw *bufio.ReadWriter, logf logger.Logf, opts ...ClientOpt) (*Client, error) {
 	var opt clientOpt
 	for _, o := range opts {
@@ -85,16 +79,17 @@ func newClient(privateKey key.Private, nc Conn, brw *bufio.ReadWriter, logf logg
 		bw:         brw.Writer,
 		meshKey:    opt.MeshKey,
 	}
-	if opt.ServerPub.IsZero() {
-		if err := c.recvServerKey(); err != nil {
-			return nil, fmt.Errorf("derp.Client: failed to receive server key: %v", err)
-		}
-	} else {
-		c.serverKey = opt.ServerPub
+	if err := c.recvServerKey(); err != nil {
+		return nil, fmt.Errorf("derp.Client: failed to receive server key: %v", err)
 	}
 	if err := c.sendClientKey(); err != nil {
 		return nil, fmt.Errorf("derp.Client: failed to send client key: %v", err)
 	}
+	info, err := c.recvServerInfo()
+	if err != nil {
+		return nil, fmt.Errorf("derp.Client: failed to receive server info: %v", err)
+	}
+	c.protoVersion = minInt(protocolVersion, info.Version)
 	return c, nil
 }
 
@@ -115,9 +110,12 @@ func (c *Client) recvServerKey() error {
 	return nil
 }
 
-func (c *Client) parseServerInfo(b []byte) (*serverInfo, error) {
+func (c *Client) recvServerInfo() (*serverInfo, error) {
+	fl, err := readFrameTypeHeader(c.br, frameServerInfo)
+	if err != nil {
+		return nil, err
+	}
 	const maxLength = nonceLen + maxInfoLen
-	fl := len(b)
 	if fl < nonceLen {
 		return nil, fmt.Errorf("short serverInfo frame")
 	}
@@ -126,27 +124,33 @@ func (c *Client) parseServerInfo(b []byte) (*serverInfo, error) {
 	}
 	// TODO: add a read-nonce-and-box helper
 	var nonce [nonceLen]byte
-	copy(nonce[:], b)
-	msgbox := b[nonceLen:]
+	if _, err := io.ReadFull(c.br, nonce[:]); err != nil {
+		return nil, fmt.Errorf("nonce: %v", err)
+	}
+	msgLen := fl - nonceLen
+	msgbox := make([]byte, msgLen)
+	if _, err := io.ReadFull(c.br, msgbox); err != nil {
+		return nil, fmt.Errorf("msgbox: %v", err)
+	}
 	msg, ok := box.Open(nil, msgbox, &nonce, c.serverKey.B32(), c.privateKey.B32())
 	if !ok {
-		return nil, fmt.Errorf("failed to open naclbox from server key %x", c.serverKey[:])
+		return nil, fmt.Errorf("msgbox: cannot open len=%d with server key %x", msgLen, c.serverKey[:])
 	}
 	info := new(serverInfo)
 	if err := json.Unmarshal(msg, info); err != nil {
-		return nil, fmt.Errorf("invalid JSON: %v", err)
+		return nil, fmt.Errorf("msg: %v", err)
 	}
 	return info, nil
 }
 
 type clientInfo struct {
-	Version int `json:"version,omitempty"`
+	Version int // `json:"version,omitempty"`
 
 	// MeshKey optionally specifies a pre-shared key used by
 	// trusted clients.  It's required to subscribe to the
 	// connection list & forward packets. It's empty for regular
 	// users.
-	MeshKey string `json:"meshKey,omitempty"`
+	MeshKey string // `json:"meshKey,omitempty"`
 }
 
 func (c *Client) sendClientKey() error {
@@ -155,7 +159,7 @@ func (c *Client) sendClientKey() error {
 		return err
 	}
 	msg, err := json.Marshal(clientInfo{
-		Version: ProtocolVersion,
+		Version: protocolVersion,
 		MeshKey: c.meshKey,
 	})
 	if err != nil {
@@ -314,11 +318,6 @@ type PeerPresentMessage key.Public
 
 func (PeerPresentMessage) msg() {}
 
-// ServerInfoMessage is sent by the server upon first connect.
-type ServerInfoMessage struct{}
-
-func (ServerInfoMessage) msg() {}
-
 // Recv reads a message from the DERP server.
 //
 // The returned message may alias memory owned by the Client; it
@@ -365,7 +364,7 @@ func (c *Client) recvTimeout(timeout time.Duration) (m ReceivedMessage, err erro
 		// If the frame fits in our bufio.Reader buffer, just use it.
 		// In practice it's 4KB (from derphttp.Client's bufio.NewReader(httpConn)) and
 		// in practive, WireGuard packets (and thus DERP frames) are under 1.5KB.
-		// So this is the common path.
+		// So This is the common path.
 		if int(n) <= c.br.Size() {
 			b, err = c.br.Peek(int(n))
 			c.peeked = int(n)
@@ -383,19 +382,6 @@ func (c *Client) recvTimeout(timeout time.Duration) (m ReceivedMessage, err erro
 		switch t {
 		default:
 			continue
-		case frameServerInfo:
-			// Server sends this at start-up. Currently unused.
-			// Just has a JSON message saying "version: 2",
-			// but the protocol seems extensible enough as-is without
-			// needing to wait an RTT to discover the version at startup.
-			// We'd prefer to give the connection to the client (magicsock)
-			// to start writing as soon as possible.
-			_, err := c.parseServerInfo(b)
-			if err != nil {
-				return nil, fmt.Errorf("invalid server info frame: %v", err)
-			}
-			// TODO: add the results of parseServerInfo to ServerInfoMessage if we ever need it.
-			return ServerInfoMessage{}, nil
 		case frameKeepAlive:
 			// TODO: eventually we'll have server->client pings that
 			// require ack pongs.
@@ -420,12 +406,16 @@ func (c *Client) recvTimeout(timeout time.Duration) (m ReceivedMessage, err erro
 
 		case frameRecvPacket:
 			var rp ReceivedPacket
-			if n < keyLen {
-				c.logf("[unexpected] dropping short packet from DERP server")
-				continue
+			if c.protoVersion < protocolSrcAddrs {
+				rp.Data = b[:n]
+			} else {
+				if n < keyLen {
+					c.logf("[unexpected] dropping short packet from DERP server")
+					continue
+				}
+				copy(rp.Source[:], b[:keyLen])
+				rp.Data = b[keyLen:n]
 			}
-			copy(rp.Source[:], b[:keyLen])
-			rp.Data = b[keyLen:n]
 			return rp, nil
 		}
 	}

derp/derp_server.go

@@ -9,19 +9,14 @@ package derp
 import (
 	"bufio"
 	"context"
-	"crypto/ed25519"
 	crand "crypto/rand"
-	"crypto/x509"
-	"crypto/x509/pkix"
 	"encoding/json"
 	"errors"
 	"expvar"
 	"fmt"
 	"io"
 	"io/ioutil"
-	"log"
 	"math/big"
-	"math/rand"
 	"os"
 	"runtime"
 	"strconv"
@@ -29,10 +24,8 @@ import (
 	"sync"
 	"time"
 
-	"go4.org/mem"
 	"golang.org/x/crypto/nacl/box"
 	"golang.org/x/sync/errgroup"
-	"tailscale.com/disco"
 	"tailscale.com/metrics"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
@@ -41,29 +34,6 @@ import (
 
 var debug, _ = strconv.ParseBool(os.Getenv("DERP_DEBUG_LOGS"))
 
-// verboseDropKeys is the set of destination public keys that should
-// verbosely log whenever DERP drops a packet.
-var verboseDropKeys = map[key.Public]bool{}
-
-func init() {
-	keys := os.Getenv("TS_DEBUG_VERBOSE_DROPS")
-	if keys == "" {
-		return
-	}
-	for _, keyStr := range strings.Split(keys, ",") {
-		k, err := key.NewPublicFromHexMem(mem.S(keyStr))
-		if err != nil {
-			log.Printf("ignoring invalid debug key %q: %v", keyStr, err)
-		} else {
-			verboseDropKeys[k] = true
-		}
-	}
-}
-
-func init() {
-	rand.Seed(time.Now().UnixNano())
-}
-
 const (
 	perClientSendQueueDepth = 32 // packets buffered for sending
 	writeTimeout            = 2 * time.Second
@@ -82,22 +52,16 @@ type Server struct {
 	// before failing when writing to a client.
 	WriteTimeout time.Duration
 
-	privateKey  key.Private
-	publicKey   key.Public
-	logf        logger.Logf
-	memSys0     uint64 // runtime.MemStats.Sys at start (or early-ish)
-	meshKey     string
-	limitedLogf logger.Logf
-	metaCert    []byte // the encoded x509 cert to send after LetsEncrypt cert+intermediate
+	privateKey key.Private
+	publicKey  key.Public
+	logf       logger.Logf
+	memSys0    uint64 // runtime.MemStats.Sys at start (or early-ish)
+	meshKey    string
 
 	// Counters:
 	_                        [pad32bit]byte
 	packetsSent, bytesSent   expvar.Int
 	packetsRecv, bytesRecv   expvar.Int
-	packetsRecvByKind        metrics.LabelMap
-	packetsRecvDisco         *expvar.Int
-	packetsRecvOther         *expvar.Int
-	_                        [pad32bit]byte
 	packetsDropped           expvar.Int
 	packetsDroppedReason     metrics.LabelMap
 	packetsDroppedUnknown    *expvar.Int // unknown dst pubkey
@@ -172,8 +136,6 @@ func NewServer(privateKey key.Private, logf logger.Logf) *Server {
 		privateKey:           privateKey,
 		publicKey:            privateKey.Public(),
 		logf:                 logf,
-		limitedLogf:          logger.RateLimitedFn(logf, 30*time.Second, 5, 100),
-		packetsRecvByKind:    metrics.LabelMap{Label: "kind"},
 		packetsDroppedReason: metrics.LabelMap{Label: "reason"},
 		clients:              map[key.Public]*sclient{},
 		clientsEver:          map[key.Public]bool{},
@@ -183,9 +145,6 @@ func NewServer(privateKey key.Private, logf logger.Logf) *Server {
 		watchers:             map[*sclient]bool{},
 		sentTo:               map[key.Public]map[key.Public]int64{},
 	}
-	s.initMetacert()
-	s.packetsRecvDisco = s.packetsRecvByKind.Get("disco")
-	s.packetsRecvOther = s.packetsRecvByKind.Get("other")
 	s.packetsDroppedUnknown = s.packetsDroppedReason.Get("unknown_dest")
 	s.packetsDroppedFwdUnknown = s.packetsDroppedReason.Get("unknown_dest_on_fwd")
 	s.packetsDroppedGone = s.packetsDroppedReason.Get("gone")
@@ -277,50 +236,6 @@ func (s *Server) Accept(nc Conn, brw *bufio.ReadWriter, remoteAddr string) {
 	}
 }
 
-// initMetacert initialized s.metaCert with a self-signed x509 cert
-// encoding this server's public key and protocol version. cmd/derper
-// then sends this after the Let's Encrypt leaf + intermediate certs
-// after the ServerHello (encrypted in TLS 1.3, not that it matters
-// much).
-//
-// Then the client can save a round trip getting that and can start
-// speaking DERP right away. (We don't use ALPN because that's sent in
-// the clear and we're being paranoid to not look too weird to any
-// middleboxes, given that DERP is an ultimate fallback path). But
-// since the post-ServerHello certs are encrypted we can have the
-// client also use them as a signal to be able to start speaking DERP
-// right away, starting with its identity proof, encrypted to the
-// server's public key.
-//
-// This RTT optimization fails where there's a corp-mandated
-// TLS proxy with corp-mandated root certs on employee machines and
-// and TLS proxy cleans up unnecessary certs. In that case we just fall
-// back to the extra RTT.
-func (s *Server) initMetacert() {
-	pub, priv, err := ed25519.GenerateKey(crand.Reader)
-	if err != nil {
-		log.Fatal(err)
-	}
-	tmpl := &x509.Certificate{
-		SerialNumber: big.NewInt(ProtocolVersion),
-		Subject: pkix.Name{
-			CommonName: fmt.Sprintf("derpkey%x", s.publicKey[:]),
-		},
-		// Windows requires NotAfter and NotBefore set:
-		NotAfter:  time.Now().Add(30 * 24 * time.Hour),
-		NotBefore: time.Now().Add(-30 * 24 * time.Hour),
-	}
-	cert, err := x509.CreateCertificate(crand.Reader, tmpl, tmpl, pub, priv)
-	if err != nil {
-		log.Fatalf("CreateCertificate: %v", err)
-	}
-	s.metaCert = cert
-}
-
-// MetaCert returns the server metadata cert that can be sent by the
-// TLS server to let the client skip a round trip during start-up.
-func (s *Server) MetaCert() []byte { return s.metaCert }
-
 // registerClient notes that client c is now authenticated and ready for packets.
 // If c's public key was already connected with a different connection, the prior one is closed.
 func (s *Server) registerClient(c *sclient) {
@@ -665,8 +580,10 @@ func (c *sclient) handleFrameSendPacket(ft frameType, fl uint32) error {
 	}
 
 	p := pkt{
-		bs:  contents,
-		src: c.key,
+		bs: contents,
+	}
+	if dst.info.Version >= protocolSrcAddrs {
+		p.src = c.key
 	}
 	return c.sendPkt(dst, p)
 }
@@ -699,12 +616,6 @@ func (c *sclient) sendPkt(dst *sclient, p pkt) error {
 		case <-dst.sendQueue:
 			s.packetsDropped.Add(1)
 			s.packetsDroppedQueueHead.Add(1)
-			if verboseDropKeys[dstKey] {
-				// Generate a full string including src and dst, so
-				// the limiter kicks in once per src.
-				msg := fmt.Sprintf("tail drop %s -> %s", p.src.ShortString(), dstKey.ShortString())
-				c.s.limitedLogf(msg)
-			}
 			if debug {
 				c.logf("dropping packet from client %x queue head", dstKey)
 			}
@@ -716,12 +627,6 @@ func (c *sclient) sendPkt(dst *sclient, p pkt) error {
 	// this case to keep reader unblocked.
 	s.packetsDropped.Add(1)
 	s.packetsDroppedQueueTail.Add(1)
-	if verboseDropKeys[dstKey] {
-		// Generate a full string including src and dst, so
-		// the limiter kicks in once per src.
-		msg := fmt.Sprintf("head drop %s -> %s", p.src.ShortString(), dstKey.ShortString())
-		c.s.limitedLogf(msg)
-	}
 	if debug {
 		c.logf("dropping packet from client %x queue tail", dstKey)
 	}
@@ -763,7 +668,7 @@ func (s *Server) sendServerKey(bw *bufio.Writer) error {
 }
 
 type serverInfo struct {
-	Version int `json:"version,omitempty"`
+	Version int // `json:"version,omitempty"`
 }
 
 func (s *Server) sendServerInfo(bw *bufio.Writer, clientKey key.Public) error {
@@ -771,7 +676,7 @@ func (s *Server) sendServerInfo(bw *bufio.Writer, clientKey key.Public) error {
 	if _, err := crand.Read(nonce[:]); err != nil {
 		return err
 	}
-	msg, err := json.Marshal(serverInfo{Version: ProtocolVersion})
+	msg, err := json.Marshal(serverInfo{Version: protocolVersion})
 	if err != nil {
 		return err
 	}
@@ -833,7 +738,7 @@ func (s *Server) recvPacket(br *bufio.Reader, frameLen uint32) (dstKey key.Publi
 	if frameLen < keyLen {
 		return zpub, nil, errors.New("short send packet frame")
 	}
-	if err := readPublicKey(br, &dstKey); err != nil {
+	if _, err := io.ReadFull(br, dstKey[:]); err != nil {
 		return zpub, nil, err
 	}
 	packetLen := frameLen - keyLen
@@ -846,11 +751,6 @@ func (s *Server) recvPacket(br *bufio.Reader, frameLen uint32) (dstKey key.Publi
 	}
 	s.packetsRecv.Add(1)
 	s.bytesRecv.Add(int64(len(contents)))
-	if disco.LooksLikeDiscoWrapper(contents) {
-		s.packetsRecvDisco.Add(1)
-	} else {
-		s.packetsRecvOther.Add(1)
-	}
 	return dstKey, contents, nil
 }
 
@@ -980,7 +880,11 @@ func (c *sclient) sendLoop(ctx context.Context) error {
 		}
 	}()
 
-	jitter := time.Duration(rand.Intn(5000)) * time.Millisecond
+	jitterMs, err := crand.Int(crand.Reader, big.NewInt(5000))
+	if err != nil {
+		panic(err)
+	}
+	jitter := time.Duration(jitterMs.Int64()) * time.Millisecond
 	keepAliveTick := time.NewTicker(keepAlive + jitter)
 	defer keepAliveTick.Stop()
 
@@ -1136,8 +1040,7 @@ func (c *sclient) sendPacket(srcKey key.Public, contents []byte) (err error) {
 		return err
 	}
 	if withKey {
-		err := writePublicKey(c.bw, &srcKey)
-		if err != nil {
+		if _, err = c.bw.Write(srcKey[:]); err != nil {
 			return err
 		}
 	}
@@ -1278,7 +1181,6 @@ func (s *Server) ExpVar() expvar.Var {
 	m.Set("bytes_sent", &s.bytesSent)
 	m.Set("packets_dropped", &s.packetsDropped)
 	m.Set("counter_packets_dropped_reason", &s.packetsDroppedReason)
-	m.Set("counter_packets_received_kind", &s.packetsRecvByKind)
 	m.Set("packets_sent", &s.packetsSent)
 	m.Set("packets_received", &s.packetsRecv)
 	m.Set("unknown_frames", &s.unknownFrames)
@@ -1291,7 +1193,7 @@ func (s *Server) ExpVar() expvar.Var {
 	m.Set("multiforwarder_deleted", &s.multiForwarderDeleted)
 	m.Set("packet_forwarder_delete_other_value", &s.removePktForwardOther)
 	var expvarVersion expvar.String
-	expvarVersion.Set(version.Long)
+	expvarVersion.Set(version.LONG)
 	m.Set("version", &expvarVersion)
 	return m
 }
@@ -1334,34 +1236,3 @@ func (s *Server) ConsistencyCheck() error {
 	}
 	return errors.New(strings.Join(errs, ", "))
 }
-
-// readPublicKey reads key from br.
-// It is ~4x slower than io.ReadFull(br, key),
-// but it prevents key from escaping and thus being allocated.
-// If io.ReadFull(br, key) does not cause key to escape, use that instead.
-func readPublicKey(br *bufio.Reader, key *key.Public) error {
-	// Do io.ReadFull(br, key), but one byte at a time, to avoid allocation.
-	for i := range key {
-		b, err := br.ReadByte()
-		if err != nil {
-			return err
-		}
-		key[i] = b
-	}
-	return nil
-}
-
-// writePublicKey writes key to bw.
-// It is ~3x slower than bw.Write(key[:]),
-// but it prevents key from escaping and thus being allocated.
-// If bw.Write(key[:]) does not cause key to escape, use that instead.
-func writePublicKey(bw *bufio.Writer, key *key.Public) error {
-	// Do bw.Write(key[:]), but one byte at a time to avoid allocation.
-	for _, b := range key {
-		err := bw.WriteByte(b)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}

derp/derp_test.go

@@ -8,14 +8,10 @@ import (
 	"bufio"
 	"context"
 	crand "crypto/rand"
-	"crypto/x509"
-	"encoding/json"
 	"errors"
 	"expvar"
 	"fmt"
 	"io"
-	"io/ioutil"
-	"log"
 	"net"
 	"reflect"
 	"sync"
@@ -35,22 +31,6 @@ func newPrivateKey(tb testing.TB) (k key.Private) {
 	return
 }
 
-func TestClientInfoUnmarshal(t *testing.T) {
-	for i, in := range []string{
-		`{"Version":5,"MeshKey":"abc"}`,
-		`{"version":5,"meshKey":"abc"}`,
-	} {
-		var got clientInfo
-		if err := json.Unmarshal([]byte(in), &got); err != nil {
-			t.Fatalf("[%d]: %v", i, err)
-		}
-		want := clientInfo{Version: 5, MeshKey: "abc"}
-		if got != want {
-			t.Errorf("[%d]: got %+v; want %+v", i, got, want)
-		}
-	}
-}
-
 func TestSendRecv(t *testing.T) {
 	serverPrivateKey := newPrivateKey(t)
 	s := NewServer(serverPrivateKey, t.Logf)
@@ -99,8 +79,6 @@ func TestSendRecv(t *testing.T) {
 		if err != nil {
 			t.Fatalf("client %d: %v", i, err)
 		}
-		waitConnect(t, c)
-
 		clients = append(clients, c)
 		recvChs = append(recvChs, make(chan []byte))
 		t.Logf("Connected client %d.", i)
@@ -140,7 +118,7 @@ func TestSendRecv(t *testing.T) {
 			if got := string(b); got != want {
 				t.Errorf("client1.Recv=%q, want %q", got, want)
 			}
-		case <-time.After(5 * time.Second):
+		case <-time.After(1 * time.Second):
 			t.Errorf("client%d.Recv, got nothing, want %q", i, want)
 		}
 	}
@@ -246,7 +224,6 @@ func TestSendFreeze(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		waitConnect(t, c)
 		return c, c2
 	}
 
@@ -525,13 +502,7 @@ func newTestClient(t *testing.T, ts *testServer, name string, newClient func(net
 func newRegularClient(t *testing.T, ts *testServer, name string) *testClient {
 	return newTestClient(t, ts, name, func(nc net.Conn, priv key.Private, logf logger.Logf) (*Client, error) {
 		brw := bufio.NewReadWriter(bufio.NewReader(nc), bufio.NewWriter(nc))
-		c, err := NewClient(priv, nc, brw, logf)
-		if err != nil {
-			return nil, err
-		}
-		waitConnect(t, c)
-		return c, nil
-
+		return NewClient(priv, nc, brw, logf)
 	})
 }
 
@@ -542,7 +513,6 @@ func newTestWatcher(t *testing.T, ts *testServer, name string) *testClient {
 		if err != nil {
 			return nil, err
 		}
-		waitConnect(t, c)
 		if err := c.WatchConnectionChanges(); err != nil {
 			return nil, err
 		}
@@ -773,24 +743,6 @@ func TestForwarderRegistration(t *testing.T) {
 	})
 }
 
-func TestMetaCert(t *testing.T) {
-	priv := newPrivateKey(t)
-	pub := priv.Public()
-	s := NewServer(priv, t.Logf)
-
-	certBytes := s.MetaCert()
-	cert, err := x509.ParseCertificate(certBytes)
-	if err != nil {
-		log.Fatal(err)
-	}
-	if fmt.Sprint(cert.SerialNumber) != fmt.Sprint(ProtocolVersion) {
-		t.Errorf("serial = %v; want %v", cert.SerialNumber, ProtocolVersion)
-	}
-	if g, w := cert.Subject.CommonName, fmt.Sprintf("derpkey%x", pub[:]); g != w {
-		t.Errorf("CommonName = %q; want %q", g, w)
-	}
-}
-
 func BenchmarkSendRecv(b *testing.B) {
 	for _, size := range []int{10, 100, 1000, 10000} {
 		b.Run(fmt.Sprintf("msgsize=%d", size), func(b *testing.B) { benchmarkSendRecvSize(b, size) })
@@ -851,42 +803,3 @@ func benchmarkSendRecvSize(b *testing.B, packetSize int) {
 		}
 	}
 }
-
-func BenchmarkWriteUint32(b *testing.B) {
-	w := bufio.NewWriter(ioutil.Discard)
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		writeUint32(w, 0x0ba3a)
-	}
-}
-
-type nopRead struct{}
-
-func (r nopRead) Read(p []byte) (int, error) {
-	return len(p), nil
-}
-
-var sinkU32 uint32
-
-func BenchmarkReadUint32(b *testing.B) {
-	r := bufio.NewReader(nopRead{})
-	var err error
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		sinkU32, err = readUint32(r)
-		if err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func waitConnect(t testing.TB, c *Client) {
-	t.Helper()
-	if m, err := c.Recv(); err != nil {
-		t.Fatalf("client first Recv: %v", err)
-	} else if v, ok := m.(ServerInfoMessage); !ok {
-		t.Fatalf("client first Recv was unexpected type %T", v)
-	}
-}

derp/derphttp/derphttp_client.go

@@ -14,27 +14,21 @@ import (
 	"bufio"
 	"context"
 	"crypto/tls"
-	"crypto/x509"
 	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
-	"log"
 	"net"
 	"net/http"
 	"net/url"
-	"os"
-	"strings"
 	"sync"
 	"time"
 
-	"go4.org/mem"
 	"inet.af/netaddr"
 	"tailscale.com/derp"
 	"tailscale.com/net/dnscache"
 	"tailscale.com/net/netns"
 	"tailscale.com/net/tlsdial"
-	"tailscale.com/net/tshttpproxy"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
@@ -258,41 +252,14 @@ func (c *Client) connect(ctx context.Context, caller string) (client *derp.Clien
 		}
 	}()
 
-	var httpConn net.Conn    // a TCP conn or a TLS conn; what we speak HTTP to
-	var serverPub key.Public // or zero if unknown (if not using TLS or TLS middlebox eats it)
-	var serverProtoVersion int
+	var httpConn net.Conn // a TCP conn or a TLS conn; what we speak HTTP to
 	if c.useHTTPS() {
-		tlsConn := c.tlsClient(tcpConn, node)
-		httpConn = tlsConn
-
-		// Force a handshake now (instead of waiting for it to
-		// be done implicitly on read/write) so we can check
-		// the ConnectionState.
-		if err := tlsConn.Handshake(); err != nil {
-			return nil, 0, err
-		}
-
-		// We expect to be using TLS 1.3 to our own servers, and only
-		// starting at TLS 1.3 are the server's returned certificates
-		// encrypted, so only look for and use our "meta cert" if we're
-		// using TLS 1.3. If we're not using TLS 1.3, it might be a user
-		// running cmd/derper themselves with a different configuration,
-		// in which case we can avoid this fast-start optimization.
-		// (If a corporate proxy is MITM'ing TLS 1.3 connections with
-		// corp-mandated TLS root certs than all bets are off anyway.)
-		// Note that we're not specifically concerned about TLS downgrade
-		// attacks. TLS handles that fine:
-		// https://blog.gypsyengineer.com/en/security/how-does-tls-1-3-protect-against-downgrade-attacks.html
-		connState := tlsConn.ConnectionState()
-		if connState.Version >= tls.VersionTLS13 {
-			serverPub, serverProtoVersion = parseMetaCert(connState.PeerCertificates)
-		}
+		httpConn = c.tlsClient(tcpConn, node)
 	} else {
 		httpConn = tcpConn
 	}
 
 	brw := bufio.NewReadWriter(bufio.NewReader(httpConn), bufio.NewWriter(httpConn))
-	var derpClient *derp.Client
 
 	req, err := http.NewRequest("GET", c.urlString(node), nil)
 	if err != nil {
@@ -301,39 +268,24 @@ func (c *Client) connect(ctx context.Context, caller string) (client *derp.Clien
 	req.Header.Set("Upgrade", "DERP")
 	req.Header.Set("Connection", "Upgrade")
 
-	if !serverPub.IsZero() && serverProtoVersion != 0 {
-		// parseMetaCert found the server's public key (no TLS
-		// middlebox was in the way), so skip the HTTP upgrade
-		// exchange.  See https://github.com/tailscale/tailscale/issues/693
-		// for an overview. We still send the HTTP request
-		// just to get routed into the server's HTTP Handler so it
-		// can Hijack the request, but we signal with a special header
-		// that we don't want to deal with its HTTP response.
-		req.Header.Set(fastStartHeader, "1") // suppresses the server's HTTP response
-		if err := req.Write(brw); err != nil {
-			return nil, 0, err
-		}
-		// No need to flush the HTTP request. the derp.Client's initial
-		// client auth frame will flush it.
-	} else {
-		if err := req.Write(brw); err != nil {
-			return nil, 0, err
-		}
-		if err := brw.Flush(); err != nil {
-			return nil, 0, err
-		}
-
-		resp, err := http.ReadResponse(brw.Reader, req)
-		if err != nil {
-			return nil, 0, err
-		}
-		if resp.StatusCode != http.StatusSwitchingProtocols {
-			b, _ := ioutil.ReadAll(resp.Body)
-			resp.Body.Close()
-			return nil, 0, fmt.Errorf("GET failed: %v: %s", err, b)
-		}
+	if err := req.Write(brw); err != nil {
+		return nil, 0, err
 	}
-	derpClient, err = derp.NewClient(c.privateKey, httpConn, brw, c.logf, derp.MeshKey(c.MeshKey), derp.ServerPublicKey(serverPub))
+	if err := brw.Flush(); err != nil {
+		return nil, 0, err
+	}
+
+	resp, err := http.ReadResponse(brw.Reader, req)
+	if err != nil {
+		return nil, 0, err
+	}
+	if resp.StatusCode != http.StatusSwitchingProtocols {
+		b, _ := ioutil.ReadAll(resp.Body)
+		resp.Body.Close()
+		return nil, 0, fmt.Errorf("GET failed: %v: %s", err, b)
+	}
+
+	derpClient, err := derp.NewClient(c.privateKey, httpConn, brw, c.logf, derp.MeshKey(c.MeshKey))
 	if err != nil {
 		return nil, 0, err
 	}
@@ -412,14 +364,6 @@ func (c *Client) tlsClient(nc net.Conn, node *tailcfg.DERPNode) *tls.Conn {
 			tlsdial.SetConfigExpectedCert(tlsConf, node.CertName)
 		}
 	}
-	if n := os.Getenv("SSLKEYLOGFILE"); n != "" {
-		f, err := os.OpenFile(n, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
-		if err != nil {
-			log.Fatal(err)
-		}
-		log.Printf("WARNING: writing to SSLKEYLOGFILE %v", n)
-		tlsConf.KeyLogWriter = f
-	}
 	return tls.Client(nc, tlsConf)
 }
 
@@ -476,19 +420,6 @@ const dialNodeTimeout = 1500 * time.Millisecond
 // TODO(bradfitz): longer if no options remain perhaps? ...  Or longer
 // overall but have dialRegion start overlapping races?
 func (c *Client) dialNode(ctx context.Context, n *tailcfg.DERPNode) (net.Conn, error) {
-	// First see if we need to use an HTTP proxy.
-	proxyReq := &http.Request{
-		Method: "GET", // doesn't really matter
-		URL: &url.URL{
-			Scheme: "https",
-			Host:   c.tlsServerName(n),
-			Path:   "/", // unused
-		},
-	}
-	if proxyURL, err := tshttpproxy.ProxyFromEnvironment(proxyReq); err == nil && proxyURL != nil {
-		return c.dialNodeUsingProxy(ctx, n, proxyURL)
-	}
-
 	type res struct {
 		c   net.Conn
 		err error
@@ -549,77 +480,6 @@ func (c *Client) dialNode(ctx context.Context, n *tailcfg.DERPNode) (net.Conn, e
 	}
 }
 
-func firstStr(a, b string) string {
-	if a != "" {
-		return a
-	}
-	return b
-}
-
-// dialNodeUsingProxy connects to n using a CONNECT to the HTTP(s) proxy in proxyURL.
-func (c *Client) dialNodeUsingProxy(ctx context.Context, n *tailcfg.DERPNode, proxyURL *url.URL) (proxyConn net.Conn, err error) {
-	pu := proxyURL
-	if pu.Scheme == "https" {
-		var d tls.Dialer
-		proxyConn, err = d.DialContext(ctx, "tcp", net.JoinHostPort(pu.Hostname(), firstStr(pu.Port(), "443")))
-	} else {
-		var d net.Dialer
-		proxyConn, err = d.DialContext(ctx, "tcp", net.JoinHostPort(pu.Hostname(), firstStr(pu.Port(), "80")))
-	}
-	defer func() {
-		if err != nil && proxyConn != nil {
-			// In a goroutine in case it's a *tls.Conn (that can block on Close)
-			// TODO(bradfitz): track the underlying tcp.Conn and just close that instead.
-			go proxyConn.Close()
-		}
-	}()
-	if err != nil {
-		return nil, err
-	}
-
-	done := make(chan struct{})
-	defer close(done)
-	go func() {
-		select {
-		case <-done:
-			return
-		case <-ctx.Done():
-			proxyConn.Close()
-		}
-	}()
-
-	target := net.JoinHostPort(n.HostName, "443")
-
-	var authHeader string
-	if v, err := tshttpproxy.GetAuthHeader(pu); err != nil {
-		c.logf("derphttp: error getting proxy auth header for %v: %v", proxyURL, err)
-	} else if v != "" {
-		authHeader = fmt.Sprintf("Proxy-Authorization: %s\r\n", v)
-	}
-
-	if _, err := fmt.Fprintf(proxyConn, "CONNECT %s HTTP/1.1\r\nHost: %s\r\n%s\r\n", target, pu.Hostname(), authHeader); err != nil {
-		if ctx.Err() != nil {
-			return nil, ctx.Err()
-		}
-		return nil, err
-	}
-
-	br := bufio.NewReader(proxyConn)
-	res, err := http.ReadResponse(br, nil)
-	if err != nil {
-		if ctx.Err() != nil {
-			return nil, ctx.Err()
-		}
-		c.logf("derphttp: CONNECT dial to %s: %v", target, err)
-		return nil, err
-	}
-	c.logf("derphttp: CONNECT dial to %s: %v", target, res.Status)
-	if res.StatusCode != 200 {
-		return nil, fmt.Errorf("invalid response status from HTTP proxy %s on CONNECT to %s: %v", pu, target, res.Status)
-	}
-	return proxyConn, nil
-}
-
 func (c *Client) Send(dstKey key.Public, b []byte) error {
 	client, _, err := c.connect(context.TODO(), "derphttp.Client.Send")
 	if err != nil {
@@ -754,16 +614,3 @@ func (c *Client) closeForReconnect(brokenClient *derp.Client) {
 }
 
 var ErrClientClosed = errors.New("derphttp.Client closed")
-
-func parseMetaCert(certs []*x509.Certificate) (serverPub key.Public, serverProtoVersion int) {
-	for _, cert := range certs {
-		if cn := cert.Subject.CommonName; strings.HasPrefix(cn, "derpkey") {
-			var err error
-			serverPub, err = key.NewPublicFromHexMem(mem.S(strings.TrimPrefix(cn, "derpkey")))
-			if err == nil && cert.SerialNumber.BitLen() <= 8 { // supports up to version 255
-				return serverPub, int(cert.SerialNumber.Int64())
-			}
-		}
-	}
-	return key.Public{}, 0
-}

derp/derphttp/derphttp_server.go

@@ -5,51 +5,33 @@
 package derphttp
 
 import (
-	"fmt"
 	"log"
 	"net/http"
 
 	"tailscale.com/derp"
 )
 
-// fastStartHeader is the header (with value "1") that signals to the HTTP
-// server that the DERP HTTP client does not want the HTTP 101 response
-// headers and it will begin writing & reading the DERP protocol immediately
-// following its HTTP request.
-const fastStartHeader = "Derp-Fast-Start"
-
 func Handler(s *derp.Server) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if p := r.Header.Get("Upgrade"); p != "WebSocket" && p != "DERP" {
 			http.Error(w, "DERP requires connection upgrade", http.StatusUpgradeRequired)
 			return
 		}
-		fastStart := r.Header.Get(fastStartHeader) == "1"
+		w.Header().Set("Upgrade", "DERP")
+		w.Header().Set("Connection", "Upgrade")
+		w.WriteHeader(http.StatusSwitchingProtocols)
 
 		h, ok := w.(http.Hijacker)
 		if !ok {
 			http.Error(w, "HTTP does not support general TCP support", 500)
 			return
 		}
-
 		netConn, conn, err := h.Hijack()
 		if err != nil {
 			log.Printf("Hijack failed: %v", err)
 			http.Error(w, "HTTP does not support general TCP support", 500)
 			return
 		}
-
-		if !fastStart {
-			pubKey := s.PublicKey()
-			fmt.Fprintf(conn, "HTTP/1.1 101 Switching Protocols\r\n"+
-				"Upgrade: DERP\r\n"+
-				"Connection: Upgrade\r\n"+
-				"Derp-Version: %v\r\n"+
-				"Derp-Public-Key: %x\r\n\r\n",
-				derp.ProtocolVersion,
-				pubKey[:])
-		}
-
 		s.Accept(netConn, conn, netConn.RemoteAddr().String())
 	})
 }

derp/derphttp/derphttp_test.go

@@ -6,6 +6,7 @@ package derphttp
 
 import (
 	"context"
+	crand "crypto/rand"
 	"crypto/tls"
 	"net"
 	"net/http"
@@ -18,15 +19,22 @@ import (
 )
 
 func TestSendRecv(t *testing.T) {
-	serverPrivateKey := key.NewPrivate()
-
 	const numClients = 3
+	var serverPrivateKey key.Private
+	if _, err := crand.Read(serverPrivateKey[:]); err != nil {
+		t.Fatal(err)
+	}
 	var clientPrivateKeys []key.Private
-	var clientKeys []key.Public
 	for i := 0; i < numClients; i++ {
-		priv := key.NewPrivate()
-		clientPrivateKeys = append(clientPrivateKeys, priv)
-		clientKeys = append(clientKeys, priv.Public())
+		var key key.Private
+		if _, err := crand.Read(key[:]); err != nil {
+			t.Fatal(err)
+		}
+		clientPrivateKeys = append(clientPrivateKeys, key)
+	}
+	var clientKeys []key.Public
+	for _, privKey := range clientPrivateKeys {
+		clientKeys = append(clientKeys, privKey.Public())
 	}
 
 	s := derp.NewServer(serverPrivateKey, t.Logf)
@@ -73,7 +81,6 @@ func TestSendRecv(t *testing.T) {
 		if err := c.Connect(context.Background()); err != nil {
 			t.Fatalf("client %d Connect: %v", i, err)
 		}
-		waitConnect(t, c)
 		clients = append(clients, c)
 		recvChs = append(recvChs, make(chan []byte))
 
@@ -88,11 +95,6 @@ func TestSendRecv(t *testing.T) {
 				}
 				m, err := c.Recv()
 				if err != nil {
-					select {
-					case <-done:
-						return
-					default:
-					}
 					t.Logf("client%d: %v", i, err)
 					break
 				}
@@ -116,7 +118,7 @@ func TestSendRecv(t *testing.T) {
 			if got := string(b); got != want {
 				t.Errorf("client1.Recv=%q, want %q", got, want)
 			}
-		case <-time.After(5 * time.Second):
+		case <-time.After(1 * time.Second):
 			t.Errorf("client%d.Recv, got nothing, want %q", i, want)
 		}
 	}
@@ -144,13 +146,5 @@ func TestSendRecv(t *testing.T) {
 	recv(2, string(msg2))
 	recvNothing(0)
 	recvNothing(1)
-}
 
-func waitConnect(t testing.TB, c *Client) {
-	t.Helper()
-	if m, err := c.Recv(); err != nil {
-		t.Fatalf("client first Recv: %v", err)
-	} else if v, ok := m.(derp.ServerInfoMessage); !ok {
-		t.Fatalf("client first Recv was unexpected type %T", v)
-	}
 }

derp/derpmap/derpmap.go

@@ -3,13 +3,6 @@
 // license that can be found in the LICENSE file.
 
 // Package derpmap contains information about Tailscale.com's production DERP nodes.
-//
-// This package is only used by the "tailscale netcheck" command for debugging.
-// In normal operation the Tailscale nodes get this sent to them from the control
-// server.
-//
-// TODO: remove this package and make "tailscale netcheck" get the
-// list from the control server too.
 package derpmap
 
 import (
@@ -28,10 +21,9 @@ func derpNode(suffix, v4, v6 string) *tailcfg.DERPNode {
 	}
 }
 
-func derpRegion(id int, code, name string, nodes ...*tailcfg.DERPNode) *tailcfg.DERPRegion {
+func derpRegion(id int, code string, nodes ...*tailcfg.DERPNode) *tailcfg.DERPRegion {
 	region := &tailcfg.DERPRegion{
 		RegionID:   id,
-		RegionName: name,
 		RegionCode: code,
 		Nodes:      nodes,
 	}
@@ -53,36 +45,21 @@ func derpRegion(id int, code, name string, nodes ...*tailcfg.DERPNode) *tailcfg.
 func Prod() *tailcfg.DERPMap {
 	return &tailcfg.DERPMap{
 		Regions: map[int]*tailcfg.DERPRegion{
-			1: derpRegion(1, "nyc", "New York City",
+			1: derpRegion(1, "nyc",
 				derpNode("a", "159.89.225.99", "2604:a880:400:d1::828:b001"),
 			),
-			2: derpRegion(2, "sfo", "San Francisco",
+			2: derpRegion(2, "sfo",
 				derpNode("a", "167.172.206.31", "2604:a880:2:d1::c5:7001"),
 			),
-			3: derpRegion(3, "sin", "Singapore",
+			3: derpRegion(3, "sin",
 				derpNode("a", "68.183.179.66", "2400:6180:0:d1::67d:8001"),
 			),
-			4: derpRegion(4, "fra", "Frankfurt",
+			4: derpRegion(4, "fra",
 				derpNode("a", "167.172.182.26", "2a03:b0c0:3:e0::36e:9001"),
 			),
-			5: derpRegion(5, "syd", "Sydney",
+			5: derpRegion(5, "syd",
 				derpNode("a", "103.43.75.49", "2001:19f0:5801:10b7:5400:2ff:feaa:284c"),
 			),
-			6: derpRegion(6, "blr", "Bangalore",
-				derpNode("a", "68.183.90.120", "2400:6180:100:d0::982:d001"),
-			),
-			7: derpRegion(7, "tok", "Tokyo",
-				derpNode("a", "167.179.89.145", "2401:c080:1000:467f:5400:2ff:feee:22aa"),
-			),
-			8: derpRegion(8, "lhr", "London",
-				derpNode("a", "167.71.139.179", "2a03:b0c0:1:e0::3cc:e001"),
-			),
-			9: derpRegion(9, "dfw", "Dallas",
-				derpNode("a", "207.148.3.137", "2001:19f0:6401:1d9c:5400:2ff:feef:bb82"),
-			),
-			10: derpRegion(10, "sea", "Seattle",
-				derpNode("a", "137.220.36.168", "2001:19f0:8001:2d9:5400:2ff:feef:bbb1"),
-			),
 		},
 	}
 }

go.mod

@@ -3,13 +3,11 @@ module tailscale.com
 go 1.14
 
 require (
-	github.com/alexbrainman/sspi v0.0.0-20180613141037-e580b900e9f5
 	github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239 // indirect
 	github.com/apenwarr/fixconsole v0.0.0-20191012055117-5a9f6489cc29
 	github.com/coreos/go-iptables v0.4.5
 	github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 // indirect
 	github.com/gliderlabs/ssh v0.2.2
-	github.com/go-multierror/multierror v1.0.2
 	github.com/go-ole/go-ole v1.2.4
 	github.com/godbus/dbus/v5 v5.0.3
 	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e
@@ -22,19 +20,18 @@ require (
 	github.com/miekg/dns v1.1.30
 	github.com/pborman/getopt v0.0.0-20190409184431-ee0cd42419d3
 	github.com/peterbourgon/ff/v2 v2.0.0
-	github.com/tailscale/depaware v0.0.0-20201003033024-5d95aab075be
-	github.com/tailscale/wireguard-go v0.0.0-20201021041318-a6168fd06b3f
+	github.com/tailscale/winipcfg-go v0.0.0-20200413171540-609dcf2df55f
+	github.com/tailscale/wireguard-go v0.0.0-20200806235025-91988cfbaa3a
 	github.com/tcnksm/go-httpstat v0.2.0
 	github.com/toqueteos/webbrowser v1.2.0
-	go4.org/mem v0.0.0-20201119185036-c04c5a6ff174
-	golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9
-	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b
+	go4.org/mem v0.0.0-20200706164138-185c595c3ecc
+	golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79
+	golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5
 	golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
-	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208
-	golang.org/x/sys v0.0.0-20201112073958-5cba982894dd
+	golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
+	golang.org/x/sys v0.0.0-20200501145240-bc7a7d42d5c3
 	golang.org/x/time v0.0.0-20191024005414-555d28b269f0
-	golang.org/x/tools v0.0.0-20201002184944-ecd9fd270d5d
-	golang.zx2c4.com/wireguard/windows v0.1.2-0.20201113162609-9b85be97fdf8
+	golang.org/x/tools v0.0.0-20191216052735-49a3e744a425
 	honnef.co/go/tools v0.0.1-2020.1.4
 	inet.af/netaddr v0.0.0-20200810144936-56928fe48a98
 	rsc.io/goversion v1.2.0

go.sum

@@ -1,17 +1,14 @@
-cloud.google.com/go v0.0.0-20170206221025-ce650573d812/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/GoogleCloudPlatform/cloudsql-proxy v0.0.0-20190129172621-c8b1d7a94ddf/go.mod h1:aJ4qN3TfrelA6NZ6AXsXRfmEVaYin3EDbSPJrKS8OXo=
 github.com/Masterminds/semver/v3 v3.0.3 h1:znjIyLfpXEDQjOIEWh+ehwpTU14UzUPub3c3sm36u14=
 github.com/Masterminds/semver/v3 v3.0.3/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/aclements/go-gg v0.0.0-20170118225347-6dbb4e4fefb0/go.mod h1:55qNq4vcpkIuHowELi5C8e+1yUHtoLoOUR9QU5j7Tes=
-github.com/aclements/go-moremath v0.0.0-20161014184102-0ff62e0875ff/go.mod h1:idZL3yvz4kzx1dsBOAC+oYv6L92P1oFEhUXUB1A/lwQ=
+github.com/alecthomas/kingpin v2.2.6+incompatible h1:5svnBTFgJjZvGKyYBtMB0+m5wvrbUHiqye8wRJMlnYI=
 github.com/alecthomas/kingpin v2.2.6+incompatible/go.mod h1:59OFYbFVLKQKq+mqrL6Rw5bR0c3ACQaawgXx0QYndlE=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2cI+DC1Mbh0TJxzA3RcLoMsFw+aXw7E=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/alexbrainman/sspi v0.0.0-20180613141037-e580b900e9f5 h1:P5U+E4x5OkVEKQDklVPmzs71WM56RTTRqV4OrDC//Y4=
-github.com/alexbrainman/sspi v0.0.0-20180613141037-e580b900e9f5/go.mod h1:976q2ETgjT2snVCf2ZaBnyBbVoPERGjUz+0sofzEfro=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239 h1:kFOfPq6dUM1hTo4JG6LR5AXSUEsOjtdm0kw0FtQtMJA=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/apenwarr/fixconsole v0.0.0-20191012055117-5a9f6489cc29 h1:muXWUcay7DDy1/hEQWrYlBy+g0EuwT70sBHg65SeUc4=
@@ -31,31 +28,21 @@ github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjr
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/gliderlabs/ssh v0.2.2 h1:6zsha5zo/TWhRhwqCD3+EarCAgZ2yN28ipRnGPnwkI0=
 github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
-github.com/go-multierror/multierror v1.0.2 h1:AwsKbEXkmf49ajdFJgcFXqSG0aLo0HEyAE9zk9JguJo=
-github.com/go-multierror/multierror v1.0.2/go.mod h1:U7SZR/D9jHgt2nkSj8XcbCWdmVM2igraCHQ3HC1HiKY=
 github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI=
 github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM=
-github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/godbus/dbus/v5 v5.0.3 h1:ZqHaoEF7TBzh4jzPmqVhE/5A1z9of6orkAe5uHoAeME=
 github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/gonum/blas v0.0.0-20181208220705-f22b278b28ac/go.mod h1:P32wAyui1PQ58Oce/KYkOqQv8cVw1zAapXOl+dRFGbc=
-github.com/gonum/floats v0.0.0-20181209220543-c233463c7e82/go.mod h1:PxC8OnwL11+aosOB5+iEPoV3picfs8tUpkVd0pDo+Kg=
-github.com/gonum/internal v0.0.0-20181124074243-f884aa714029/go.mod h1:Pu4dmpkhSyOzRwuXkOgAvijx4o+4YMUJJo9OvPYMkks=
-github.com/gonum/lapack v0.0.0-20181123203213-e4cdc5a0bff9/go.mod h1:XA3DeT6rxh2EAE789SSiSJNqxPaC0aE9J8NTOI0Jo/A=
-github.com/gonum/matrix v0.0.0-20181209220409-c518dec07be9/go.mod h1:0EXg4mc1CNP0HCqCz+K4ts155PXIlUywf0wqN+GfPZw=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2 h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/rpmpack v0.0.0-20191226140753-aa36bfddb3a0 h1:BW6OvS3kpT5UEPbCZ+KyX/OB4Ks9/MNMhWjqPPkZxsE=
 github.com/google/rpmpack v0.0.0-20191226140753-aa36bfddb3a0/go.mod h1:RaTPr0KUf2K7fnZYLNDrr8rxAamWs3iNywJLtQ2AzBg=
-github.com/googleapis/gax-go v0.0.0-20161107002406-da06d194a00e/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
 github.com/goreleaser/nfpm v1.1.10 h1:0nwzKUJTcygNxTzVKq2Dh9wpVP1W2biUH6SNKmoxR3w=
 github.com/goreleaser/nfpm v1.1.10/go.mod h1:oOcoGRVwvKIODz57NUfiRwFWGfn00NXdgnn6MrYtO5k=
 github.com/imdario/mergo v0.3.8 h1:CGgOkSJeqMRmt0D9XLWExdT4m4F1vd3FV3VPt+0VxkQ=
@@ -72,11 +59,6 @@ github.com/kr/pty v1.1.1 h1:VkoXIwSboBpnk99O/KFauAEILuNHv5DVFKZMBN/gUgw=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/lxn/walk v0.0.0-20191128110447-55ccb3a9f5c1/go.mod h1:E23UucZGqpuUANJooIbHWCufXvOcT6E7Stq81gU+CSQ=
-github.com/lxn/walk v0.0.0-20201110160827-18ea5e372cdb/go.mod h1:E23UucZGqpuUANJooIbHWCufXvOcT6E7Stq81gU+CSQ=
-github.com/lxn/win v0.0.0-20191128105842-2da648fda5b4/go.mod h1:ouWl4wViUNh8tPSIwxTVMuS014WakR1hqvBc2I0bMoA=
-github.com/lxn/win v0.0.0-20201111105847-2a20daff6a55/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk=
-github.com/mattn/go-sqlite3 v0.0.0-20161215041557-2d44decb4941/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-zglob v0.0.1 h1:xsEx/XUoVlI6yXjqBK062zYhRTZltCNmYPx6v+8DNaY=
 github.com/mattn/go-zglob v0.0.1/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
 github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
@@ -92,8 +74,6 @@ github.com/pborman/getopt v0.0.0-20190409184431-ee0cd42419d3/go.mod h1:85jBQOZwp
 github.com/pelletier/go-toml v1.6.0/go.mod h1:5N711Q9dKgbdkxHL+MEfF31hpT7l0S0s/t2kKREewys=
 github.com/peterbourgon/ff/v2 v2.0.0 h1:lx0oYI5qr/FU1xnpNhQ+EZM04gKgn46jyYvGEEqBBbY=
 github.com/peterbourgon/ff/v2 v2.0.0/go.mod h1:xjwr+t+SjWm4L46fcj/D+Ap+6ME7+HqFzaP22pP5Ggk=
-github.com/pkg/diff v0.0.0-20200914180035-5b29258ca4f7 h1:+/+DxvQaYifJ+grD4klzrS5y+KJXldn/2YTl5JG+vZ8=
-github.com/pkg/diff v0.0.0-20200914180035-5b29258ca4f7/go.mod h1:zO8QMzTeZd5cpnIkz/Gn6iK0jDfGicM1nynOkkPIl28=
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -101,19 +81,13 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/sassoftware/go-rpmutils v0.0.0-20190420191620-a8f1baeba37b h1:+gCnWOZV8Z/8jehJ2CdqB47Z3S+SREmQcuXkRFLNsiI=
 github.com/sassoftware/go-rpmutils v0.0.0-20190420191620-a8f1baeba37b/go.mod h1:am+Fp8Bt506lA3Rk3QCmSqmYmLMnPDhdDUcosQCAx+I=
-github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
-github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/tailscale/depaware v0.0.0-20201003033024-5d95aab075be h1:ZKe3kVGbu/goUVxXcaCPbQ4b0STQ5NsCpG90CG6mw/c=
-github.com/tailscale/depaware v0.0.0-20201003033024-5d95aab075be/go.mod h1:jissDaJNHiyV2tFdr3QyNEfsZrax/i2yQiSO+CljThI=
-github.com/tailscale/wireguard-go v0.0.0-20200921221757-11a958a67bdd h1:yEWpro9EdxGgkt24NInVnONIJxRLURH5c37Ki5+06EE=
-github.com/tailscale/wireguard-go v0.0.0-20200921221757-11a958a67bdd/go.mod h1:WXq+IkSOJGIgfF1XW+4z4oW+LX/TXzU9DcKlT5EZLi4=
-github.com/tailscale/wireguard-go v0.0.0-20201008164108-2c83f43a9859 h1:Z7bXXCYRg/8sjSyKTk0V8Yso/gQjNvPb10DBemKuz+A=
-github.com/tailscale/wireguard-go v0.0.0-20201008164108-2c83f43a9859/go.mod h1:WXq+IkSOJGIgfF1XW+4z4oW+LX/TXzU9DcKlT5EZLi4=
-github.com/tailscale/wireguard-go v0.0.0-20201021041318-a6168fd06b3f h1:KMx58dbn2YCutzOvjNHgmvbwQH7nGE8H+J42Nenjl/M=
-github.com/tailscale/wireguard-go v0.0.0-20201021041318-a6168fd06b3f/go.mod h1:WXq+IkSOJGIgfF1XW+4z4oW+LX/TXzU9DcKlT5EZLi4=
+github.com/tailscale/winipcfg-go v0.0.0-20200413171540-609dcf2df55f h1:uFj5bslHsMzxIM8UTjAhq4VXeo6GfNW91rpoh/WMJaY=
+github.com/tailscale/winipcfg-go v0.0.0-20200413171540-609dcf2df55f/go.mod h1:x880GWw5fvrl2DVTQ04ttXQD4DuppTt1Yz6wLibbjNE=
+github.com/tailscale/wireguard-go v0.0.0-20200806235025-91988cfbaa3a h1:dQEgNpoOJf+8MswlvXJicb8ZDQqZAGe8f/WfzbDMvtE=
+github.com/tailscale/wireguard-go v0.0.0-20200806235025-91988cfbaa3a/go.mod h1:WXq+IkSOJGIgfF1XW+4z4oW+LX/TXzU9DcKlT5EZLi4=
 github.com/tcnksm/go-httpstat v0.2.0 h1:rP7T5e5U2HfmOBmZzGgGZjBQ5/GluWUylujl0tJ04I0=
 github.com/tcnksm/go-httpstat v0.2.0/go.mod h1:s3JVJFtQxtBEBC9dwcdTTXS9xFnM3SXAZwPG41aurT8=
 github.com/toqueteos/webbrowser v1.2.0 h1:tVP/gpK69Fx+qMJKsLE7TD8LuGWPnEV71wBN9rrstGQ=
@@ -122,27 +96,16 @@ github.com/ulikunitz/xz v0.5.6 h1:jGHAfXawEGZQ3blwU5wnWKQJvAraT7Ftq9EXjnXYgt8=
 github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go4.org/mem v0.0.0-20200706164138-185c595c3ecc h1:paujszgN6SpsO/UsXC7xax3gQAKz/XQKCYZLQdU34Tw=
 go4.org/mem v0.0.0-20200706164138-185c595c3ecc/go.mod h1:NEYvpHWemiG/E5UWfaN5QAIGZeT1sa0Z2UNk6oeMb/k=
-go4.org/mem v0.0.0-20201119185036-c04c5a6ff174 h1:vSug/WNOi2+4jrKdivxayTN/zd8EA1UrStjpWvvo1jk=
-go4.org/mem v0.0.0-20201119185036-c04c5a6ff174/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79 h1:IaQbIIB2X/Mp/DKctl6ROxz1KyMlKp4uyvL6+kQ7C88=
 golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899 h1:DZhuSZLsGlFL4CmhA8BcRA0mnthyA/nZ00AqCUo7vHg=
-golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9 h1:umElSU9WZirRdgu2yFHY0ayQkEnKiOC1TtM3fWXFnoU=
-golang.org/x/crypto v0.0.0-20201112155050-0c6587e931a9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.3.0 h1:RM4zey1++hCTbCVQfnWeKs9/IEsaBLA8vTkd0WVtmH4=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -150,79 +113,48 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191003171128-d98b1b443823/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2 h1:CCH4IOTTfewWjGOlSp+zGcjutRKlBEZQ6wTn8ozI/nI=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5 h1:WQ8q63x+f/zpC8Ac1s9wLElVoHhm32p6tudrU72n1QA=
 golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202 h1:VvcQYSHwXgi7W+TpUR6A9g6Up98WAHf3f/ulnJ62IyA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b h1:uwuIcX0g4Yl1NC5XAz37xsr2lTtcqevgzYNVt49waME=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/oauth2 v0.0.0-20170207211851-4464e7848382/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d h1:TzXSXBo42m9gQenoE3b9BGiEpg5IG2JkU5FkPIawgtw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/perf v0.0.0-20200918155509-d949658356f9 h1:yVBHF5pcQLKR9B+y+dOJ6y68nqJBDWaZ9DhB1Ohg0qE=
-golang.org/x/perf v0.0.0-20200918155509-d949658356f9/go.mod h1:FrqOtQDO3iMDVUtw5nNTDFpR1HUCGh00M3kj2wiSzLQ=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 h1:qwRHBd0NqMbJxfbotnDhm2ByMI1Shq4Y6oRJo21SGJA=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e h1:vcxGaoTs7kV8m5Np9uUNQin4BrLOthgV7252N8V+FwY=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190310054646-10058d7d4faa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191003212358-c178f38b412c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5 h1:LfCXLvNmTYH9kEmVgqbnsWfruoXZIrh4YBgqVHtDvw0=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200501145240-bc7a7d42d5c3 h1:5B6i6EAiSYyejWfvc5Rc9BbI3rzIsrrXfAQBWnYfn+w=
 golang.org/x/sys v0.0.0-20200501145240-bc7a7d42d5c3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200812155832-6a926be9bd1d h1:QQrM/CCYEzTs91GZylDCQjGHudbPTxF/1fvXdVh5lMo=
-golang.org/x/sys v0.0.0-20200812155832-6a926be9bd1d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201107080550-4d91cf3a1aaf/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201112073958-5cba982894dd h1:5CtCZbICpIOFdgO940moixOPjc0178IU44m4EjOO5IY=
-golang.org/x/sys v0.0.0-20201112073958-5cba982894dd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4 h1:0YWbFKbhXG/wIiuHDSKpS0Iy7FSA+u45VtBMfQcFTTc=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d h1:/iIZNFGxc/a7C3yWjGcnboV+Tkc7mxr+p6fDztwoxuM=
 golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191216052735-49a3e744a425 h1:VvQyQJN0tSuecqgcIxMWnnfG5kSmgy9KZR9sW3W5QeA=
 golang.org/x/tools v0.0.0-20191216052735-49a3e744a425/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20201001230009-b5b87423c93b/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
-golang.org/x/tools v0.0.0-20201002184944-ecd9fd270d5d h1:vWQvJ/Z0Lu+9/8oQ/pAYXNzbc7CMnBl+tULGVHOy3oE=
-golang.org/x/tools v0.0.0-20201002184944-ecd9fd270d5d/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.zx2c4.com/wireguard v0.0.20200321-0.20200715051853-507f148e1c42 h1:SrR1hmxGKKarHEEDvaHxatwnqE3uT+7jvMcin6SHOkw=
-golang.zx2c4.com/wireguard v0.0.20200321-0.20200715051853-507f148e1c42/go.mod h1:GJvYs5O24/ASlwPiRklVnjMx2xQzrOic0DuU6GvYJL4=
-golang.zx2c4.com/wireguard v0.0.20200321-0.20201111175144-60b3766b89b9 h1:qowcZ56hhpeoESmWzI4Exhx4Y78TpCyXUJur4/c0CoE=
-golang.zx2c4.com/wireguard v0.0.20200321-0.20201111175144-60b3766b89b9/go.mod h1:LMeNfjlcPZTrBC1juwgbQyA4Zy2XVcsrdO/fIJxwyuA=
-golang.zx2c4.com/wireguard/windows v0.1.2-0.20201004085714-dd60d0447f81 h1:cT2oWlz8v9g7bjFZclT362akxJJfGv9d7ccKu6GQUbA=
-golang.zx2c4.com/wireguard/windows v0.1.2-0.20201004085714-dd60d0447f81/go.mod h1:GaK5zcgr5XE98WaRzIDilumDBp5/yP8j2kG/LCDnvAM=
-golang.zx2c4.com/wireguard/windows v0.1.2-0.20201113162609-9b85be97fdf8 h1:nlXPqGA98n+qcq1pwZ28KjM5EsFQvamKS00A+VUeVjs=
-golang.zx2c4.com/wireguard/windows v0.1.2-0.20201113162609-9b85be97fdf8/go.mod h1:psva4yDnAHLuh7lUzOK7J7bLYxNFfo0iKWz+mi9gzkA=
-google.golang.org/api v0.0.0-20170206182103-3d017632ea10/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/appengine v1.4.0 h1:/wp5JvzpHIxhs/dumFmF7BXTf3Z+dd4uXta4kVyO508=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/grpc v0.0.0-20170208002647-2a6bf6142e96/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
@@ -234,6 +166,8 @@ gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 honnef.co/go/tools v0.0.1-2020.1.4 h1:UoveltGrhghAA7ePc+e+QYDHXrBps2PqFZiHkGR/xK8=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+inet.af/netaddr v0.0.0-20200718043157-99321d6ad24c h1:si3Owrfem175Ry6gKqnh59eOXxDojyBTIHxUKuvK/Eo=
+inet.af/netaddr v0.0.0-20200718043157-99321d6ad24c/go.mod h1:qqYzz/2whtrbWJvt+DNWQyvekNN4ePQZcg2xc2/Yjww=
 inet.af/netaddr v0.0.0-20200810144936-56928fe48a98 h1:bWyWDZP0l6VnQ1TDKf6yNwuiEDV6Q3q1Mv34m+lzT1I=
 inet.af/netaddr v0.0.0-20200810144936-56928fe48a98/go.mod h1:qqYzz/2whtrbWJvt+DNWQyvekNN4ePQZcg2xc2/Yjww=
 rsc.io/goversion v1.2.0 h1:SPn+NLTiAG7w30IRK/DKp1BjvpWabYgxlLp/+kx5J8w=

internal/tooldeps/tooldeps.go

@@ -1,9 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package tooldeps
-
-import (
-	_ "github.com/tailscale/depaware/depaware"
-)

ipn/backend.go

@@ -21,7 +21,6 @@ type State int
 
 const (
 	NoState = State(iota)
-	InUseOtherUser
 	NeedsLogin
 	NeedsMachineAuth
 	Stopped
@@ -34,14 +33,8 @@ const (
 const GoogleIDTokenType = "ts_android_google_login"
 
 func (s State) String() string {
-	return [...]string{
-		"NoState",
-		"InUseOtherUser",
-		"NeedsLogin",
-		"NeedsMachineAuth",
-		"Stopped",
-		"Starting",
-		"Running"}[s]
+	return [...]string{"NoState", "NeedsLogin", "NeedsMachineAuth",
+		"Stopped", "Starting", "Running"}[s]
 }
 
 // EngineStatus contains WireGuard engine stats.
@@ -60,7 +53,7 @@ type EngineStatus struct {
 type Notify struct {
 	_             structs.Incomparable
 	Version       string                    // version number of IPN backend
-	ErrMessage    *string                   // critical error message, if any; for InUseOtherUser, the details
+	ErrMessage    *string                   // critical error message, if any
 	LoginFinished *empty.Message            // event: non-nil when login process succeeded
 	State         *State                    // current IPN state has changed
 	Prefs         *Prefs                    // preferences were changed
@@ -69,7 +62,6 @@ type Notify struct {
 	Status        *ipnstate.Status          // full status
 	BrowseToURL   *string                   // UI should open a browser right now
 	BackendLogID  *string                   // public logtail id used by backend
-	PingResult    *ipnstate.PingResult
 
 	// LocalTCPPort, if non-nil, informs the UI frontend which
 	// (non-zero) localhost TCP port it's listening on.
@@ -88,14 +80,14 @@ type Notify struct {
 // shared by several consecutive users. Ideally we would just use the
 // username of the connected frontend as the StateKey.
 //
-// Various platforms currently set StateKey in different ways:
-//
-// * the macOS/iOS GUI apps set it to "ipn-go-bridge"
-// * the Android app sets it to "ipn-android"
-// * on Windows, it's the empty string (in client mode) or, via
-//   LocalBackend.userID, a string like "user-$USER_ID" (used in
-//   server mode).
-// * on Linux/etc, it's always "_daemon" (ipn.GlobalDaemonStateKey)
+// However, on Windows, there seems to be no safe way to figure out
+// the owning user of a process connected over IPC mechanisms
+// (sockets, named pipes). So instead, on Windows, we use a
+// capability-oriented system where the frontend generates a random
+// identifier for itself, and uses that as the StateKey when talking
+// to the backend. That way, while we can't identify an OS user by
+// name, we can tell two different users apart, because they'll have
+// different opaque state keys (and no access to each others's keys).
 type StateKey string
 
 type Options struct {
@@ -104,8 +96,7 @@ type Options struct {
 	// StateKey and Prefs together define the state the backend should
 	// use:
 	//  - StateKey=="" && Prefs!=nil: use Prefs for internal state,
-	//    don't persist changes in the backend, except for the machine key
-	//    for migration purposes.
+	//    don't persist changes in the backend.
 	//  - StateKey!="" && Prefs==nil: load the given backend-side
 	//    state and use/update that.
 	//  - StateKey!="" && Prefs!=nil: like the previous case, but do
@@ -152,9 +143,6 @@ type Backend interface {
 	// WantRunning. This may cause the wireguard engine to
 	// reconfigure or stop.
 	SetPrefs(*Prefs)
-	// SetWantRunning is like SetPrefs but sets only the
-	// WantRunning field.
-	SetWantRunning(wantRunning bool)
 	// RequestEngineStatus polls for an update from the wireguard
 	// engine. Only needed if you want to display byte
 	// counts. Connection events are emitted automatically without
@@ -168,8 +156,4 @@ type Backend interface {
 	// make sure they react properly with keys that are going to
 	// expire.
 	FakeExpireAfter(x time.Duration)
-	// Ping attempts to start connecting to the given IP and sends a Notify
-	// with its PingResult. If the host is down, there might never
-	// be a PingResult sent. The cmd/tailscale CLI client adds a timeout.
-	Ping(ip string)
 }

ipn/fake_test.go

@@ -79,10 +79,6 @@ func (b *FakeBackend) SetPrefs(new *Prefs) {
 	}
 }
 
-func (b *FakeBackend) SetWantRunning(v bool) {
-	b.SetPrefs(&Prefs{WantRunning: v})
-}
-
 func (b *FakeBackend) RequestEngineStatus() {
 	b.notify(Notify{Engine: &EngineStatus{}})
 }
@@ -94,7 +90,3 @@ func (b *FakeBackend) RequestStatus() {
 func (b *FakeBackend) FakeExpireAfter(x time.Duration) {
 	b.notify(Notify{NetMap: &controlclient.NetworkMap{}})
 }
-
-func (b *FakeBackend) Ping(ip string) {
-	b.notify(Notify{PingResult: &ipnstate.PingResult{}})
-}

ipn/ipnserver/server.go

@@ -7,33 +7,23 @@ package ipnserver
 import (
 	"bufio"
 	"context"
-	"errors"
 	"fmt"
-	"io"
-	"io/ioutil"
 	"log"
 	"net"
 	"net/http"
 	"os"
 	"os/exec"
 	"os/signal"
-	"os/user"
-	"runtime"
-	"strings"
 	"sync"
 	"syscall"
 	"time"
 
-	"inet.af/netaddr"
 	"tailscale.com/control/controlclient"
 	"tailscale.com/ipn"
-	"tailscale.com/log/filelogger"
 	"tailscale.com/logtail/backoff"
-	"tailscale.com/net/netstat"
 	"tailscale.com/safesocket"
 	"tailscale.com/smallzstd"
 	"tailscale.com/types/logger"
-	"tailscale.com/util/pidowner"
 	"tailscale.com/version"
 	"tailscale.com/wgengine"
 )
@@ -71,12 +61,6 @@ type Options struct {
 	// its existing state, and accepts new frontend connections. If
 	// false, the server dumps its state and becomes idle.
 	//
-	// This is effectively whether the platform is in "server
-	// mode" by default. On Linux, it's true; on Windows, it's
-	// false. But on some platforms (currently only Windows), the
-	// "server mode" can be overridden at runtime with a change in
-	// Prefs.ForceDaemon/WantRunning.
-	//
 	// To support CLI connections (notably, "tailscale status"),
 	// the actual definition of "disconnect" is when the
 	// connection count transitions from 1 to 0.
@@ -90,185 +74,21 @@ type Options struct {
 // server is an IPN backend and its set of 0 or more active connections
 // talking to an IPN backend.
 type server struct {
-	b    *ipn.LocalBackend
-	logf logger.Logf
-	// resetOnZero is whether to call bs.Reset on transition from
-	// 1->0 connections.  That is, this is whether the backend is
-	// being run in "client mode" that requires an active GUI
-	// connection (such as on Windows by default).  Even if this
-	// is true, the ForceDaemon pref can override this.
-	resetOnZero bool
+	resetOnZero bool // call bs.Reset on transition from 1->0 connections
 
 	bsMu sync.Mutex // lock order: bsMu, then mu
 	bs   *ipn.BackendServer
 
-	mu             sync.Mutex
-	serverModeUser *user.User                   // or nil if not in server mode
-	lastUserID     string                       // tracks last userid; on change, Reset state for paranoia
-	allClients     map[net.Conn]connIdentity    // HTTP or IPN
-	clients        map[net.Conn]bool            // subset of allClients; only IPN protocol
-	disconnectSub  map[chan<- struct{}]struct{} // keys are subscribers of disconnects
-}
-
-// connIdentity represents the owner of a localhost TCP connection.
-type connIdentity struct {
-	Unknown bool
-	Pid     int
-	UserID  string
-	User    *user.User
-}
-
-// getConnIdentity returns the localhost TCP connection's identity information
-// (pid, userid, user). If it's not Windows (for now), it returns a nil error
-// and a ConnIdentity with Unknown set true. It's only an error if we expected
-// to be able to map it and couldn't.
-func (s *server) getConnIdentity(c net.Conn) (ci connIdentity, err error) {
-	if runtime.GOOS != "windows" { // for now; TODO: expand to other OSes
-		return connIdentity{Unknown: true}, nil
-	}
-	la, err := netaddr.ParseIPPort(c.LocalAddr().String())
-	if err != nil {
-		return ci, fmt.Errorf("parsing local address: %w", err)
-	}
-	ra, err := netaddr.ParseIPPort(c.RemoteAddr().String())
-	if err != nil {
-		return ci, fmt.Errorf("parsing local remote: %w", err)
-	}
-	if !la.IP.IsLoopback() || !ra.IP.IsLoopback() {
-		return ci, errors.New("non-loopback connection")
-	}
-	tab, err := netstat.Get()
-	if err != nil {
-		return ci, fmt.Errorf("failed to get local connection table: %w", err)
-	}
-	pid := peerPid(tab.Entries, la, ra)
-	if pid == 0 {
-		return ci, errors.New("no local process found matching localhost connection")
-	}
-	ci.Pid = pid
-	uid, err := pidowner.OwnerOfPID(pid)
-	if err != nil {
-		var hint string
-		if runtime.GOOS == "windows" {
-			hint = " (WSL?)"
-		}
-		return ci, fmt.Errorf("failed to map connection's pid to a user%s: %w", hint, err)
-	}
-	ci.UserID = uid
-	u, err := s.lookupUserFromID(uid)
-	if err != nil {
-		return ci, fmt.Errorf("failed to look up user from userid: %w", err)
-	}
-	ci.User = u
-	return ci, nil
-}
-
-func (s *server) lookupUserFromID(uid string) (*user.User, error) {
-	u, err := user.LookupId(uid)
-	if err != nil && runtime.GOOS == "windows" && errors.Is(err, syscall.Errno(0x534)) {
-		s.logf("[warning] issue 869: os/user.LookupId failed; ignoring")
-		// Work around https://github.com/tailscale/tailscale/issues/869 for
-		// now. We don't strictly need the username. It's just a nice-to-have.
-		// So make up a *user.User if their machine is broken in this way.
-		return &user.User{
-			Uid:      uid,
-			Username: "unknown-user-" + uid,
-			Name:     "unknown user " + uid,
-		}, nil
-	}
-	return u, err
-}
-
-// blockWhileInUse blocks while until either a Read from conn fails
-// (i.e. it's closed) or until the server is able to accept ci as a
-// user.
-func (s *server) blockWhileInUse(conn io.Reader, ci connIdentity) {
-	s.logf("blocking client while server in use; connIdentity=%v", ci)
-	connDone := make(chan struct{})
-	go func() {
-		io.Copy(ioutil.Discard, conn)
-		close(connDone)
-	}()
-	ch := make(chan struct{}, 1)
-	s.registerDisconnectSub(ch, true)
-	defer s.registerDisconnectSub(ch, false)
-	for {
-		select {
-		case <-connDone:
-			s.logf("blocked client Read completed; connIdentity=%v", ci)
-			return
-		case <-ch:
-			s.mu.Lock()
-			err := s.checkConnIdentityLocked(ci)
-			s.mu.Unlock()
-			if err == nil {
-				s.logf("unblocking client, server is free; connIdentity=%v", ci)
-				// Server is now available again for a new user.
-				// TODO(bradfitz): keep this connection alive. But for
-				// now just return and have our caller close the connection
-				// (which unblocks the io.Copy goroutine we started above)
-				// and then the client (e.g. Windows) will reconnect and
-				// discover that it works.
-				return
-			}
-		}
-	}
+	mu      sync.Mutex
+	clients map[net.Conn]bool
 }
 
 func (s *server) serveConn(ctx context.Context, c net.Conn, logf logger.Logf) {
-	// First see if it's an HTTP request.
-	br := bufio.NewReader(c)
-	c.SetReadDeadline(time.Now().Add(time.Second))
-	peek, _ := br.Peek(4)
-	c.SetReadDeadline(time.Time{})
-	isHTTPReq := string(peek) == "GET "
-
-	ci, err := s.addConn(c, isHTTPReq)
-	if err != nil {
-		if isHTTPReq {
-			fmt.Fprintf(c, "HTTP/1.0 500 Nope\r\nContent-Type: text/plain\r\nX-Content-Type-Options: nosniff\r\n\r\n%s\n", err.Error())
-			c.Close()
-			return
-		}
-		defer c.Close()
-		serverToClient := func(b []byte) { ipn.WriteMsg(c, b) }
-		bs := ipn.NewBackendServer(logf, nil, serverToClient)
-		_, occupied := err.(inUseOtherUserError)
-		if occupied {
-			bs.SendInUseOtherUserErrorMessage(err.Error())
-			s.blockWhileInUse(c, ci)
-		} else {
-			bs.SendErrorMessage(err.Error())
-			time.Sleep(time.Second)
-		}
-		return
-	}
-
-	// Tell the LocalBackend about the identity we're now running as.
-	s.b.SetCurrentUserID(ci.UserID)
-
-	if isHTTPReq {
-		httpServer := http.Server{
-			// Localhost connections are cheap; so only do
-			// keep-alives for a short period of time, as these
-			// active connections lock the server into only serving
-			// that user. If the user has this page open, we don't
-			// want another switching user to be locked out for
-			// minutes. 5 seconds is enough to let browser hit
-			// favicon.ico and such.
-			IdleTimeout: 5 * time.Second,
-			ErrorLog:    logger.StdLogger(logf),
-			Handler:     s.localhostHandler(ci),
-		}
-		httpServer.Serve(&oneConnListener{&protoSwitchConn{s: s, br: br, Conn: c}})
-		return
-	}
-
-	defer s.removeAndCloseConn(c)
+	s.addConn(c)
 	logf("incoming control connection")
-
+	defer s.removeAndCloseConn(c)
 	for ctx.Err() == nil {
-		msg, err := ipn.ReadMsg(br)
+		msg, err := ipn.ReadMsg(c)
 		if err != nil {
 			if ctx.Err() == nil {
 				logf("ReadMsg: %v", err)
@@ -287,126 +107,25 @@ func (s *server) serveConn(ctx context.Context, c net.Conn, logf logger.Logf) {
 	}
 }
 
-// inUseOtherUserError is the error type for when the server is in use
-// by a different local user.
-type inUseOtherUserError struct{ error }
-
-func (e inUseOtherUserError) Unwrap() error { return e.error }
-
-// checkConnIdentityLocked checks whether the provided identity is
-// allowed to connect to the server.
-//
-// The returned error, when non-nil, will be of type inUseOtherUserError.
-//
-// s.mu must be held.
-func (s *server) checkConnIdentityLocked(ci connIdentity) error {
-	// If clients are already connected, verify they're the same user.
-	// This mostly matters on Windows at the moment.
-	if len(s.allClients) > 0 {
-		var active connIdentity
-		for _, active = range s.allClients {
-			break
-		}
-		if ci.UserID != active.UserID {
-			//lint:ignore ST1005 we want to capitalize Tailscale here
-			return inUseOtherUserError{fmt.Errorf("Tailscale already in use by %s, pid %d", active.User.Username, active.Pid)}
-		}
-	}
-	if su := s.serverModeUser; su != nil && ci.UserID != su.Uid {
-		//lint:ignore ST1005 we want to capitalize Tailscale here
-		return inUseOtherUserError{fmt.Errorf("Tailscale already in use by %s", su.Username)}
-	}
-	return nil
-}
-
-// registerDisconnectSub adds ch as a subscribe to connection disconnect
-// events. If add is false, the subscriber is removed.
-func (s *server) registerDisconnectSub(ch chan<- struct{}, add bool) {
+func (s *server) addConn(c net.Conn) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	if add {
-		if s.disconnectSub == nil {
-			s.disconnectSub = make(map[chan<- struct{}]struct{})
-		}
-		s.disconnectSub[ch] = struct{}{}
-	} else {
-		delete(s.disconnectSub, ch)
-	}
-
-}
-
-// addConn adds c to the server's list of clients.
-//
-// If the returned error is of type inUseOtherUserError then the
-// returned connIdentity is also valid.
-func (s *server) addConn(c net.Conn, isHTTP bool) (ci connIdentity, err error) {
-	ci, err = s.getConnIdentity(c)
-	if err != nil {
-		return
-	}
-
-	// If the connected user changes, reset the backend server state to make
-	// sure node keys don't leak between users.
-	var doReset bool
-	defer func() {
-		if doReset {
-			s.logf("identity changed; resetting server")
-			s.bsMu.Lock()
-			s.bs.Reset()
-			s.bsMu.Unlock()
-		}
-	}()
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
 	if s.clients == nil {
 		s.clients = map[net.Conn]bool{}
 	}
-	if s.allClients == nil {
-		s.allClients = map[net.Conn]connIdentity{}
-	}
-
-	if err := s.checkConnIdentityLocked(ci); err != nil {
-		return ci, err
-	}
-
-	if !isHTTP {
-		s.clients[c] = true
-	}
-	s.allClients[c] = ci
-
-	if s.lastUserID != ci.UserID {
-		if s.lastUserID != "" {
-			doReset = true
-		}
-		s.lastUserID = ci.UserID
-	}
-	return ci, nil
+	s.clients[c] = true
 }
 
 func (s *server) removeAndCloseConn(c net.Conn) {
 	s.mu.Lock()
 	delete(s.clients, c)
-	delete(s.allClients, c)
-	remain := len(s.allClients)
-	for sub := range s.disconnectSub {
-		select {
-		case sub <- struct{}{}:
-		default:
-		}
-	}
+	remain := len(s.clients)
 	s.mu.Unlock()
 
 	if remain == 0 && s.resetOnZero {
-		if s.b.InServerMode() {
-			s.logf("client disconnected; staying alive in server mode")
-		} else {
-			s.logf("client disconnected; stopping server")
-			s.bsMu.Lock()
-			s.bs.Reset()
-			s.bsMu.Unlock()
-		}
+		s.bsMu.Lock()
+		s.bs.Reset()
+		s.bsMu.Unlock()
 	}
 	c.Close()
 }
@@ -421,48 +140,9 @@ func (s *server) stopAll() {
 	s.clients = nil
 }
 
-// setServerModeUserLocked is called when we're in server mode but our s.serverModeUser is nil.
-//
-// s.mu must be held
-func (s *server) setServerModeUserLocked() {
-	var ci connIdentity
-	var ok bool
-	for _, ci = range s.allClients {
-		ok = true
-		break
-	}
-	if !ok {
-		s.logf("ipnserver: [unexpected] now in server mode, but no connected client")
-		return
-	}
-	if ci.Unknown {
-		return
-	}
-	if ci.User != nil {
-		s.logf("ipnserver: now in server mode; user=%v", ci.User.Username)
-		s.serverModeUser = ci.User
-	} else {
-		s.logf("ipnserver: [unexpected] now in server mode, but nil User")
-	}
-}
-
 func (s *server) writeToClients(b []byte) {
-	inServerMode := s.b.InServerMode()
-
 	s.mu.Lock()
 	defer s.mu.Unlock()
-
-	if inServerMode {
-		if s.serverModeUser == nil {
-			s.setServerModeUserLocked()
-		}
-	} else {
-		if s.serverModeUser != nil {
-			s.logf("ipnserver: no longer in server mode")
-			s.serverModeUser = nil
-		}
-	}
-
 	for c := range s.clients {
 		ipn.WriteMsg(c, b)
 	}
@@ -480,7 +160,6 @@ func Run(ctx context.Context, logf logger.Logf, logid string, getEngine func() (
 	}
 
 	server := &server{
-		logf:        logf,
 		resetOnZero: !opts.SurviveDisconnects,
 	}
 
@@ -497,11 +176,12 @@ func Run(ctx context.Context, logf logger.Logf, logid string, getEngine func() (
 	logf("Listening on %v", listen.Addr())
 
 	bo := backoff.NewBackoff("ipnserver", logf, 30*time.Second)
+
 	var unservedConn net.Conn // if non-nil, accepted, but hasn't served yet
 
 	eng, err := getEngine()
 	if err != nil {
-		logf("ipnserver: initial getEngine call: %v", err)
+		logf("Initial getEngine call: %v", err)
 		for i := 1; ctx.Err() == nil; i++ {
 			c, err := listen.Accept()
 			if err != nil {
@@ -509,14 +189,14 @@ func Run(ctx context.Context, logf logger.Logf, logid string, getEngine func() (
 				bo.BackOff(ctx, err)
 				continue
 			}
-			logf("ipnserver: try%d: trying getEngine again...", i)
+			logf("%d: trying getEngine again...", i)
 			eng, err = getEngine()
 			if err == nil {
 				logf("%d: GetEngine worked; exiting failure loop", i)
 				unservedConn = c
 				break
 			}
-			logf("ipnserver%d: getEngine failed again: %v", i, err)
+			logf("%d: getEngine failed again: %v", i, err)
 			errMsg := err.Error()
 			go func() {
 				defer c.Close()
@@ -537,24 +217,6 @@ func Run(ctx context.Context, logf logger.Logf, logid string, getEngine func() (
 		if err != nil {
 			return fmt.Errorf("ipn.NewFileStore(%q): %v", opts.StatePath, err)
 		}
-		if opts.AutostartStateKey == "" {
-			autoStartKey, err := store.ReadState(ipn.ServerModeStartKey)
-			if err != nil && err != ipn.ErrStateNotExist {
-				return fmt.Errorf("calling ReadState on %s: %w", opts.StatePath, err)
-			}
-			key := string(autoStartKey)
-			if strings.HasPrefix(key, "user-") {
-				uid := strings.TrimPrefix(key, "user-")
-				u, err := server.lookupUserFromID(uid)
-				if err != nil {
-					logf("ipnserver: found server mode auto-start key %q; failed to load user: %v", key, err)
-				} else {
-					logf("ipnserver: found server mode auto-start key %q (user %s)", key, u.Username)
-					server.serverModeUser = u
-				}
-				opts.AutostartStateKey = ipn.StateKey(key)
-			}
-		}
 	} else {
 		store = &ipn.MemoryStore{}
 	}
@@ -570,16 +232,18 @@ func Run(ctx context.Context, logf logger.Logf, logid string, getEngine func() (
 
 	if opts.DebugMux != nil {
 		opts.DebugMux.HandleFunc("/debug/ipn", func(w http.ResponseWriter, r *http.Request) {
-			serveHTMLStatus(w, b)
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			st := b.Status()
+			// TODO(bradfitz): add LogID and opts to st?
+			st.WriteHTML(w)
 		})
 	}
 
-	server.b = b
 	server.bs = ipn.NewBackendServer(logf, b, server.writeToClients)
 
 	if opts.AutostartStateKey != "" {
 		server.bs.GotCommand(&ipn.Command{
-			Version: version.Long,
+			Version: version.LONG,
 			Start: &ipn.StartArgs{
 				Opts: ipn.Options{
 					StateKey:         opts.AutostartStateKey,
@@ -610,11 +274,6 @@ func Run(ctx context.Context, logf logger.Logf, logid string, getEngine func() (
 	return ctx.Err()
 }
 
-// BabysitProc runs the current executable as a child process with the
-// provided args, capturing its output, writing it to files, and
-// restarting the process on any crashes.
-//
-// It's only currently (2020-10-29) used on Windows.
 func BabysitProc(ctx context.Context, args []string, logf logger.Logf) {
 
 	executable, err := os.Executable()
@@ -622,14 +281,6 @@ func BabysitProc(ctx context.Context, args []string, logf logger.Logf) {
 		panic("cannot determine executable: " + err.Error())
 	}
 
-	if runtime.GOOS == "windows" {
-		if len(args) != 2 && args[0] != "/subproc" {
-			panic(fmt.Sprintf("unexpected arguments %q", args))
-		}
-		logID := args[1]
-		logf = filelogger.New("tailscale-service", logID, logf)
-	}
-
 	var proc struct {
 		mu sync.Mutex
 		p  *os.Process
@@ -724,10 +375,6 @@ func BabysitProc(ctx context.Context, args []string, logf logger.Logf) {
 		// pipe. We'll make a new one when we restart the subproc.
 		wStdin.Close()
 
-		if os.Getenv("TS_DEBUG_RESTART_CRASHED") == "0" {
-			log.Fatalf("Process ended.")
-		}
-
 		if time.Since(startTime) < 60*time.Second {
 			bo.BackOff(ctx, fmt.Errorf("subproc early exit: %v", err))
 		} else {
@@ -747,69 +394,3 @@ func BabysitProc(ctx context.Context, args []string, logf logger.Logf) {
 func FixedEngine(eng wgengine.Engine) func() (wgengine.Engine, error) {
 	return func() (wgengine.Engine, error) { return eng, nil }
 }
-
-type dummyAddr string
-type oneConnListener struct {
-	conn net.Conn
-}
-
-func (l *oneConnListener) Accept() (c net.Conn, err error) {
-	c = l.conn
-	if c == nil {
-		err = io.EOF
-		return
-	}
-	err = nil
-	l.conn = nil
-	return
-}
-
-func (l *oneConnListener) Close() error { return nil }
-
-func (l *oneConnListener) Addr() net.Addr { return dummyAddr("unused-address") }
-
-func (a dummyAddr) Network() string { return string(a) }
-func (a dummyAddr) String() string  { return string(a) }
-
-// protoSwitchConn is a net.Conn that's we want to speak HTTP to but
-// it's already had a few bytes read from it to determine that it's
-// HTTP. So we Read from its bufio.Reader. On Close, we we tell the
-// server it's closed, so the server can account the who's connected.
-type protoSwitchConn struct {
-	s *server
-	net.Conn
-	br        *bufio.Reader
-	closeOnce sync.Once
-}
-
-func (psc *protoSwitchConn) Read(p []byte) (int, error) { return psc.br.Read(p) }
-func (psc *protoSwitchConn) Close() error {
-	psc.closeOnce.Do(func() { psc.s.removeAndCloseConn(psc.Conn) })
-	return nil
-}
-
-func (s *server) localhostHandler(ci connIdentity) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if ci.Unknown {
-			io.WriteString(w, "<html><title>Tailscale</title><body><h1>Tailscale</h1>This is the local Tailscale daemon.")
-			return
-		}
-		serveHTMLStatus(w, s.b)
-	})
-}
-
-func serveHTMLStatus(w http.ResponseWriter, b *ipn.LocalBackend) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	st := b.Status()
-	// TODO(bradfitz): add LogID and opts to st?
-	st.WriteHTML(w)
-}
-
-func peerPid(entries []netstat.Entry, la, ra netaddr.IPPort) int {
-	for _, e := range entries {
-		if e.Local == ra && e.Remote == la {
-			return e.Pid
-		}
-	}
-	return 0
-}

ipn/ipnserver/server_test.go

@@ -7,6 +7,8 @@ package ipnserver_test
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -23,7 +25,11 @@ func TestRunMultipleAccepts(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	td := t.TempDir()
+	td, err := ioutil.TempDir("", "TestRunMultipleAccepts")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(td)
 	socketPath := filepath.Join(td, "tailscale.sock")
 
 	logf := func(format string, args ...interface{}) {

ipn/ipnstate/ipnstate.go

@@ -27,10 +27,8 @@ import (
 type Status struct {
 	BackendState string
 	TailscaleIPs []netaddr.IP // Tailscale IP(s) assigned to this node
-	Self         *PeerStatus
-
-	Peer map[key.Public]*PeerStatus
-	User map[tailcfg.UserID]tailcfg.UserProfile
+	Peer         map[key.Public]*PeerStatus
+	User         map[tailcfg.UserID]tailcfg.UserProfile
 }
 
 func (s *Status) Peers() []key.Public {
@@ -45,7 +43,6 @@ func (s *Status) Peers() []key.Public {
 type PeerStatus struct {
 	PublicKey key.Public
 	HostName  string // HostInfo's Hostname (not a DNS name or necessarily unique)
-	DNSName   string
 	OS        string // HostInfo.OS
 	UserID    tailcfg.UserID
 
@@ -91,12 +88,6 @@ type StatusBuilder struct {
 	st     Status
 }
 
-func (sb *StatusBuilder) SetBackendState(v string) {
-	sb.mu.Lock()
-	defer sb.mu.Unlock()
-	sb.st.BackendState = v
-}
-
 func (sb *StatusBuilder) Status() *Status {
 	sb.mu.Lock()
 	defer sb.mu.Unlock()
@@ -104,13 +95,6 @@ func (sb *StatusBuilder) Status() *Status {
 	return &sb.st
 }
 
-// SetSelfStatus sets the status of the local machine.
-func (sb *StatusBuilder) SetSelfStatus(ss *PeerStatus) {
-	sb.mu.Lock()
-	defer sb.mu.Unlock()
-	sb.st.Self = ss
-}
-
 // AddUser adds a user profile to the status.
 func (sb *StatusBuilder) AddUser(id tailcfg.UserID, up tailcfg.UserProfile) {
 	sb.mu.Lock()
@@ -167,9 +151,6 @@ func (sb *StatusBuilder) AddPeer(peer key.Public, st *PeerStatus) {
 	if v := st.HostName; v != "" {
 		e.HostName = v
 	}
-	if v := st.DNSName; v != "" {
-		e.DNSName = v
-	}
 	if v := st.Relay; v != "" {
 		e.Relay = v
 	}
@@ -341,21 +322,3 @@ func osEmoji(os string) string {
 	}
 	return "👽"
 }
-
-// PingResult contains response information for the "tailscale ping" subcommand,
-// saying how Tailscale can reach a Tailscale IP or subnet-routed IP.
-type PingResult struct {
-	IP       string // ping destination
-	NodeIP   string // Tailscale IP of node handling IP (different for subnet routers)
-	NodeName string // DNS name base or (possibly not unique) hostname
-
-	Err            string
-	LatencySeconds float64
-
-	Endpoint string // ip:port if direct UDP was used
-
-	DERPRegionID   int    // non-zero if DERP was used
-	DERPRegionCode string // three-letter airport/region code if DERP was used
-
-	// TODO(bradfitz): details like whether port mapping was used on either side? (Once supported)
-}

ipn/local.go

@@ -5,12 +5,9 @@
 package ipn
 
 import (
-	"bytes"
 	"context"
 	"errors"
 	"fmt"
-	"os"
-	"runtime"
 	"strings"
 	"sync"
 	"time"
@@ -22,7 +19,6 @@ import (
 	"tailscale.com/internal/deepprint"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/ipn/policy"
-	"tailscale.com/net/interfaces"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/portlist"
 	"tailscale.com/tailcfg"
@@ -37,15 +33,6 @@ import (
 	"tailscale.com/wgengine/tsdns"
 )
 
-var controlDebugFlags = getControlDebugFlags()
-
-func getControlDebugFlags() []string {
-	if e := os.Getenv("TS_DEBUG_CONTROL_FLAGS"); e != "" {
-		return strings.Split(e, ",")
-	}
-	return nil
-}
-
 // LocalBackend is the glue between the major pieces of the Tailscale
 // network software: the cloud control plane (via controlclient), the
 // network data plane (via wgengine), and the user-facing UIs and CLIs
@@ -62,39 +49,32 @@ type LocalBackend struct {
 	ctxCancel       context.CancelFunc // cancels ctx
 	logf            logger.Logf        // general logging
 	keyLogf         logger.Logf        // for printing list of peers on change
-	statsLogf       logger.Logf        // for printing peers stats on change
 	e               wgengine.Engine
 	store           StateStore
 	backendLogID    string
 	portpoll        *portlist.Poller // may be nil
-	portpollOnce    sync.Once        // guards starting readPoller
-	gotPortPollRes  chan struct{}    // closed upon first readPoller result
-	serverURL       string           // tailcontrol URL
+	portpollOnce    sync.Once
+	serverURL       string // tailcontrol URL
 	newDecompressor func() (controlclient.Decompressor, error)
 
 	filterHash string
 
 	// The mutex protects the following elements.
-	mu             sync.Mutex
-	notify         func(Notify)
-	c              *controlclient.Client
-	stateKey       StateKey // computed in part from user-provided value
-	userID         string   // current controlling user ID (for Windows, primarily)
-	prefs          *Prefs
-	inServerMode   bool
-	machinePrivKey wgcfg.PrivateKey
-	state          State
+	mu       sync.Mutex
+	notify   func(Notify)
+	c        *controlclient.Client
+	stateKey StateKey
+	prefs    *Prefs
+	state    State
 	// hostinfo is mutated in-place while mu is held.
 	hostinfo *tailcfg.Hostinfo
 	// netMap is not mutated in-place once set.
 	netMap       *controlclient.NetworkMap
-	activeLogin  string // last logged LoginName from netMap
 	engineStatus EngineStatus
 	endpoints    []string
 	blocked      bool
 	authURL      string
-	interact     bool
-	prevIfState  *interfaces.State
+	interact     int
 
 	// statusLock must be held before calling statusChanged.Wait() or
 	// statusChanged.Broadcast().
@@ -119,51 +99,21 @@ func NewLocalBackend(logf logger.Logf, logid string, store StateStore, e wgengin
 	}
 
 	b := &LocalBackend{
-		ctx:            ctx,
-		ctxCancel:      cancel,
-		logf:           logf,
-		keyLogf:        logger.LogOnChange(logf, 5*time.Minute, time.Now),
-		statsLogf:      logger.LogOnChange(logf, 5*time.Minute, time.Now),
-		e:              e,
-		store:          store,
-		backendLogID:   logid,
-		state:          NoState,
-		portpoll:       portpoll,
-		gotPortPollRes: make(chan struct{}),
+		ctx:          ctx,
+		ctxCancel:    cancel,
+		logf:         logf,
+		keyLogf:      logger.LogOnChange(logf, 5*time.Minute, time.Now),
+		e:            e,
+		store:        store,
+		backendLogID: logid,
+		state:        NoState,
+		portpoll:     portpoll,
 	}
-	e.SetLinkChangeCallback(b.linkChange)
 	b.statusChanged = sync.NewCond(&b.statusLock)
 
 	return b, nil
 }
 
-// linkChange is called (in a new goroutine) by wgengine when its link monitor
-// detects a network change.
-func (b *LocalBackend) linkChange(major bool, ifst *interfaces.State) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	hadPAC := b.prevIfState.HasPAC()
-	b.prevIfState = ifst
-
-	networkUp := ifst.AnyInterfaceUp()
-	if b.c != nil {
-		go b.c.SetPaused(b.state == Stopped || !networkUp)
-	}
-
-	// If the PAC-ness of the network changed, reconfig wireguard+route to
-	// add/remove subnets.
-	if hadPAC != ifst.HasPAC() {
-		b.logf("linkChange: in state %v; PAC changed from %v->%v", b.state, hadPAC, ifst.HasPAC())
-		switch b.state {
-		case NoState, Stopped:
-			// Do nothing.
-		default:
-			go b.authReconfig()
-		}
-	}
-}
-
 // Shutdown halts the backend and all its sub-components. The backend
 // can no longer be used after Shutdown returns.
 func (b *LocalBackend) Shutdown() {
@@ -194,8 +144,6 @@ func (b *LocalBackend) UpdateStatus(sb *ipnstate.StatusBuilder) {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
-	sb.SetBackendState(b.state.String())
-
 	// TODO: hostinfo, and its networkinfo
 	// TODO: EngineStatus copy (and deprecate it?)
 	if b.netMap != nil {
@@ -216,7 +164,6 @@ func (b *LocalBackend) UpdateStatus(sb *ipnstate.StatusBuilder) {
 				UserID:       p.User,
 				TailAddr:     tailAddr,
 				HostName:     p.Hostinfo.Hostname,
-				DNSName:      p.Name,
 				OS:           p.Hostinfo.OS,
 				KeepAlive:    p.KeepAlive,
 				Created:      p.Created,
@@ -269,14 +216,8 @@ func (b *LocalBackend) setClientStatus(st controlclient.Status) {
 			b.prefs.Persist = st.Persist.Clone()
 		}
 	}
-	if temporarilySetMachineKeyInPersist() && b.prefs.Persist != nil &&
-		b.prefs.Persist.LegacyFrontendPrivateMachineKey.IsZero() {
-		b.prefs.Persist.LegacyFrontendPrivateMachineKey = b.machinePrivKey
-		prefsChanged = true
-	}
 	if st.NetMap != nil {
-		b.setNetMapLocked(st.NetMap)
-
+		b.netMap = st.NetMap
 	}
 	if st.URL != "" {
 		b.authURL = st.URL
@@ -315,16 +256,23 @@ func (b *LocalBackend) setClientStatus(st controlclient.Status) {
 
 		b.updateFilter(st.NetMap, prefs)
 		b.e.SetNetworkMap(st.NetMap)
+
 		if !dnsMapsEqual(st.NetMap, netMap) {
 			b.updateDNSMap(st.NetMap)
 		}
-		b.e.SetDERPMap(st.NetMap.DERPMap)
+
+		disableDERP := prefs != nil && prefs.DisableDERP
+		if disableDERP {
+			b.e.SetDERPMap(nil)
+		} else {
+			b.e.SetDERPMap(st.NetMap.DERPMap)
+		}
 
 		b.send(Notify{NetMap: st.NetMap})
 	}
 	if st.URL != "" {
 		b.logf("Received auth URL: %.20v...", st.URL)
-		if interact {
+		if interact > 0 {
 			b.popBrowserAuthNow()
 		}
 	}
@@ -346,8 +294,9 @@ func (b *LocalBackend) setWgengineStatus(s *wgengine.Status, err error) {
 		return
 	}
 
+	es := b.parseWgStatus(s)
+
 	b.mu.Lock()
-	es := b.parseWgStatusLocked(s)
 	c := b.c
 	b.engineStatus = es
 	b.endpoints = append([]string{}, s.LocalAddrs...)
@@ -415,44 +364,18 @@ func (b *LocalBackend) Start(opts Options) error {
 		return fmt.Errorf("loading requested state: %v", err)
 	}
 
-	b.inServerMode = b.prefs.ForceDaemon
 	b.serverURL = b.prefs.ControlURL
 	hostinfo.RoutableIPs = append(hostinfo.RoutableIPs, b.prefs.AdvertiseRoutes...)
 	hostinfo.RequestTags = append(hostinfo.RequestTags, b.prefs.AdvertiseTags...)
-	if b.inServerMode || runtime.GOOS == "windows" {
-		b.logf("Start: serverMode=%v", b.inServerMode)
-	}
 	applyPrefsToHostinfo(hostinfo, b.prefs)
 
 	b.notify = opts.Notify
-	b.setNetMapLocked(nil)
+	b.netMap = nil
 	persist := b.prefs.Persist
-	machinePrivKey := b.machinePrivKey
 	b.mu.Unlock()
 
 	b.updateFilter(nil, nil)
 
-	if b.portpoll != nil {
-		b.portpollOnce.Do(func() {
-			go b.portpoll.Run(b.ctx)
-			go b.readPoller()
-
-			// Give the poller a second to get results to
-			// prevent it from restarting our map poll
-			// HTTP request (via doSetHostinfoFilterServices >
-			// cli.SetHostinfo). In practice this is very quick.
-			t0 := time.Now()
-			timer := time.NewTimer(time.Second)
-			select {
-			case <-b.gotPortPollRes:
-				b.logf("got initial portlist info in %v", time.Since(t0).Round(time.Millisecond))
-				timer.Stop()
-			case <-timer.C:
-				b.logf("timeout waiting for initial portlist")
-			}
-		})
-	}
-
 	var discoPublic tailcfg.DiscoKey
 	if controlclient.Debug.Disco {
 		discoPublic = b.e.DiscoPublicKey()
@@ -464,22 +387,29 @@ func (b *LocalBackend) Start(opts Options) error {
 		persist = &controlclient.Persist{}
 	}
 	cli, err := controlclient.New(controlclient.Options{
-		MachinePrivateKey: machinePrivKey,
-		Logf:              logger.WithPrefix(b.logf, "control: "),
-		Persist:           *persist,
-		ServerURL:         b.serverURL,
-		AuthKey:           opts.AuthKey,
-		Hostinfo:          hostinfo,
-		KeepAlive:         true,
-		NewDecompressor:   b.newDecompressor,
-		HTTPTestClient:    opts.HTTPTestClient,
-		DiscoPublicKey:    discoPublic,
-		DebugFlags:        controlDebugFlags,
+		Logf:            logger.WithPrefix(b.logf, "control: "),
+		Persist:         *persist,
+		ServerURL:       b.serverURL,
+		AuthKey:         opts.AuthKey,
+		Hostinfo:        hostinfo,
+		KeepAlive:       true,
+		NewDecompressor: b.newDecompressor,
+		HTTPTestClient:  opts.HTTPTestClient,
+		DiscoPublicKey:  discoPublic,
 	})
 	if err != nil {
 		return err
 	}
 
+	// At this point, we have finished using hostinfo without synchronization,
+	// so it is safe to start readPoller which concurrently writes to it.
+	if b.portpoll != nil {
+		b.portpollOnce.Do(func() {
+			go b.portpoll.Run(b.ctx)
+			go b.readPoller()
+		})
+	}
+
 	b.mu.Lock()
 	b.c = cli
 	endpoints := b.endpoints
@@ -495,12 +425,6 @@ func (b *LocalBackend) Start(opts Options) error {
 
 	b.mu.Lock()
 	prefs := b.prefs.Clone()
-
-	if temporarilySetMachineKeyInPersist() && prefs.Persist != nil &&
-		prefs.Persist.LegacyFrontendPrivateMachineKey.IsZero() {
-		prefs.Persist.LegacyFrontendPrivateMachineKey = b.machinePrivKey
-	}
-
 	b.mu.Unlock()
 
 	blid := b.backendLogID
@@ -523,7 +447,7 @@ func (b *LocalBackend) updateFilter(netMap *controlclient.NetworkMap, prefs *Pre
 	var (
 		haveNetmap   = netMap != nil
 		addrs        []wgcfg.CIDR
-		packetFilter []filter.Match
+		packetFilter filter.Matches
 		advRoutes    []wgcfg.CIDR
 		shieldsUp    = prefs == nil || prefs.ShieldsUp // Be conservative when not ready
 	)
@@ -546,12 +470,12 @@ func (b *LocalBackend) updateFilter(netMap *controlclient.NetworkMap, prefs *Pre
 		return
 	}
 
-	localNets := wgCIDRsToNetaddr(netMap.Addresses, advRoutes)
+	localNets := wgCIDRsToFilter(netMap.Addresses, advRoutes)
 
 	if shieldsUp {
 		b.logf("netmap packet filter: (shields up)")
 		var prevFilter *filter.Filter // don't reuse old filter state
-		b.e.SetFilter(filter.New(nil, localNets, prevFilter, b.logf))
+		b.e.SetFilter(filter.New(filter.Matches{}, localNets, prevFilter, b.logf))
 	} else {
 		b.logf("netmap packet filter: %v", packetFilter)
 		b.e.SetFilter(filter.New(packetFilter, localNets, b.e.GetFilter(), b.logf))
@@ -615,7 +539,7 @@ func (b *LocalBackend) updateDNSMap(netMap *controlclient.NetworkMap) {
 
 	nameToIP := make(map[string]netaddr.IP)
 	set := func(name string, addrs []wgcfg.CIDR) {
-		if len(addrs) == 0 || name == "" {
+		if len(addrs) == 0 {
 			return
 		}
 		nameToIP[name] = netaddr.IPFrom16(addrs[0].IP.Addr)
@@ -626,7 +550,7 @@ func (b *LocalBackend) updateDNSMap(netMap *controlclient.NetworkMap) {
 	}
 	set(netMap.Name, netMap.Addresses)
 
-	dnsMap := tsdns.NewMap(nameToIP, domainsForProxying(netMap))
+	dnsMap := tsdns.NewMap(nameToIP)
 	// map diff will be logged in tsdns.Resolver.SetMap.
 	b.e.SetDNSMap(dnsMap)
 }
@@ -634,7 +558,6 @@ func (b *LocalBackend) updateDNSMap(netMap *controlclient.NetworkMap) {
 // readPoller is a goroutine that receives service lists from
 // b.portpoll and propagates them into the controlclient's HostInfo.
 func (b *LocalBackend) readPoller() {
-	n := 0
 	for {
 		ports, ok := <-b.portpoll.C
 		if !ok {
@@ -661,11 +584,6 @@ func (b *LocalBackend) readPoller() {
 		b.mu.Unlock()
 
 		b.doSetHostinfoFilterServices(hi)
-
-		n++
-		if n == 1 {
-			close(b.gotPortPollRes)
-		}
 	}
 }
 
@@ -677,7 +595,7 @@ func (b *LocalBackend) send(n Notify) {
 	b.mu.Unlock()
 
 	if notify != nil {
-		n.Version = version.Long
+		n.Version = version.LONG
 		notify(n)
 	} else {
 		b.logf("nil notify callback; dropping %+v", n)
@@ -689,7 +607,7 @@ func (b *LocalBackend) send(n Notify) {
 func (b *LocalBackend) popBrowserAuthNow() {
 	b.mu.Lock()
 	url := b.authURL
-	b.interact = false
+	b.interact = 0
 	b.authURL = ""
 	b.mu.Unlock()
 
@@ -703,171 +621,48 @@ func (b *LocalBackend) popBrowserAuthNow() {
 	}
 }
 
-// initMachineKeyLocked is called to initialize b.machinePrivKey.
-//
-// b.prefs must already be initialized.
-// b.stateKey should be set too, but just for nicer log messages.
-// b.mu must be held.
-func (b *LocalBackend) initMachineKeyLocked() (err error) {
-	if temporarilySetMachineKeyInPersist() {
-		defer func() {
-			if err != nil {
-				return
-			}
-			if b.prefs != nil && b.prefs.Persist != nil {
-				b.prefs.Persist.LegacyFrontendPrivateMachineKey = b.machinePrivKey
-			}
-		}()
-	}
-
-	if !b.machinePrivKey.IsZero() {
-		// Already set.
-		return nil
-	}
-
-	var legacyMachineKey wgcfg.PrivateKey
-	if b.prefs.Persist != nil {
-		legacyMachineKey = b.prefs.Persist.LegacyFrontendPrivateMachineKey
-	}
-
-	keyText, err := b.store.ReadState(MachineKeyStateKey)
-	if err == nil {
-		if err := b.machinePrivKey.UnmarshalText(keyText); err != nil {
-			return fmt.Errorf("invalid key in %s key of %v: %w", MachineKeyStateKey, b.store, err)
-		}
-		if b.machinePrivKey.IsZero() {
-			return fmt.Errorf("invalid zero key stored in %v key of %v", MachineKeyStateKey, b.store)
-		}
-		if !legacyMachineKey.IsZero() && !bytes.Equal(legacyMachineKey[:], b.machinePrivKey[:]) {
-			b.logf("frontend-provided legacy machine key ignored; used value from server state")
-		}
-		return nil
-	}
-	if err != ErrStateNotExist {
-		return fmt.Errorf("error reading %v key of %v: %w", MachineKeyStateKey, b.store, err)
-	}
-
-	// If we didn't find one already on disk and the prefs already
-	// have a legacy machine key, use that. Otherwise generate a
-	// new one.
-	if !legacyMachineKey.IsZero() {
-		if b.stateKey == "" {
-			b.logf("using frontend-provided legacy machine key")
-		} else {
-			b.logf("using legacy machine key from state key %q", b.stateKey)
-		}
-		b.machinePrivKey = legacyMachineKey
-	} else {
-		b.logf("generating new machine key")
-		var err error
-		b.machinePrivKey, err = wgcfg.NewPrivateKey()
-		if err != nil {
-			return fmt.Errorf("initializing new machine key: %w", err)
-		}
-	}
-
-	keyText, _ = b.machinePrivKey.MarshalText()
-	if err := b.store.WriteState(MachineKeyStateKey, keyText); err != nil {
-		b.logf("error writing machine key to store: %v", err)
-		return err
-	}
-
-	b.logf("machine key written to store")
-	return nil
-}
-
-// writeServerModeStartState stores the ServerModeStartKey value based on the current
-// user and prefs. If userID is blank or prefs is blank, no work is done.
-//
-// b.mu may either be held or not.
-func (b *LocalBackend) writeServerModeStartState(userID string, prefs *Prefs) {
-	if userID == "" || prefs == nil {
-		return
-	}
-
-	if prefs.ForceDaemon {
-		stateKey := StateKey("user-" + userID)
-		if err := b.store.WriteState(ServerModeStartKey, []byte(stateKey)); err != nil {
-			b.logf("WriteState error: %v", err)
-		}
-		// It's important we do this here too, even if it looks
-		// redundant with the one in the 'if stateKey != ""'
-		// check block above. That one won't fire in the case
-		// where the Windows client started up in client mode.
-		// This happens when we transition into server mode:
-		if err := b.store.WriteState(stateKey, prefs.ToBytes()); err != nil {
-			b.logf("WriteState error: %v", err)
-		}
-	} else {
-		if err := b.store.WriteState(ServerModeStartKey, nil); err != nil {
-			b.logf("WriteState error: %v", err)
-		}
-	}
-}
-
 // loadStateLocked sets b.prefs and b.stateKey based on a complex
 // combination of key, prefs, and legacyPath. b.mu must be held when
 // calling.
-func (b *LocalBackend) loadStateLocked(key StateKey, prefs *Prefs, legacyPath string) (err error) {
+func (b *LocalBackend) loadStateLocked(key StateKey, prefs *Prefs, legacyPath string) error {
 	if prefs == nil && key == "" {
 		panic("state key and prefs are both unset")
 	}
 
-	// Optimistically set stateKey (for initMachineKeyLocked's
-	// logging), but revert it if we return an error so a later SetPrefs
-	// call can't pick it up if it's bogus.
-	b.stateKey = key
-	defer func() {
-		if err != nil {
-			b.stateKey = ""
-		}
-	}()
-
 	if key == "" {
-		// Frontend owns the state, we just need to obey it.
-		//
-		// If the frontend (e.g. on Windows) supplied the
-		// optional/legacy machine key then it's used as the
-		// value instead of making up a new one.
-		b.logf("using frontend prefs: %s", prefs.Pretty())
+		// Frontend fully owns the state, we just need to obey it.
+		b.logf("Using frontend prefs")
 		b.prefs = prefs.Clone()
-		if err := b.initMachineKeyLocked(); err != nil {
-			return fmt.Errorf("initMachineKeyLocked: %w", err)
-		}
-		b.writeServerModeStartState(b.userID, b.prefs)
+		b.stateKey = ""
 		return nil
 	}
 
 	if prefs != nil {
 		// Backend owns the state, but frontend is trying to migrate
 		// state into the backend.
-		b.logf("importing frontend prefs into backend store; frontend prefs: %s", prefs.Pretty())
+		b.logf("Importing frontend prefs into backend store")
 		if err := b.store.WriteState(key, prefs.ToBytes()); err != nil {
 			return fmt.Errorf("store.WriteState: %v", err)
 		}
 	}
 
-	b.logf("using backend prefs")
+	b.logf("Using backend prefs")
 	bs, err := b.store.ReadState(key)
 	if err != nil {
 		if errors.Is(err, ErrStateNotExist) {
 			if legacyPath != "" {
 				b.prefs, err = LoadPrefs(legacyPath)
 				if err != nil {
-					if !errors.Is(err, os.ErrNotExist) {
-						b.logf("failed to load legacy prefs: %v", err)
-					}
+					b.logf("Failed to load legacy prefs: %v", err)
 					b.prefs = NewPrefs()
 				} else {
-					b.logf("imported prefs from relaynode for %q: %v", key, b.prefs.Pretty())
+					b.logf("Imported state from relaynode for %q", key)
 				}
 			} else {
 				b.prefs = NewPrefs()
-				b.logf("created empty state for %q: %s", key, b.prefs.Pretty())
-			}
-			if err := b.initMachineKeyLocked(); err != nil {
-				return fmt.Errorf("initMachineKeyLocked: %w", err)
+				b.logf("Created empty state for %q", key)
 			}
+			b.stateKey = key
 			return nil
 		}
 		return fmt.Errorf("store.ReadState(%q): %v", key, err)
@@ -876,10 +671,7 @@ func (b *LocalBackend) loadStateLocked(key StateKey, prefs *Prefs, legacyPath st
 	if err != nil {
 		return fmt.Errorf("PrefsFromBytes: %v", err)
 	}
-	b.logf("backend prefs for %q: %s", key, b.prefs.Pretty())
-	if err := b.initMachineKeyLocked(); err != nil {
-		return fmt.Errorf("initMachineKeyLocked: %w", err)
-	}
+	b.stateKey = key
 	return nil
 }
 
@@ -891,12 +683,6 @@ func (b *LocalBackend) State() State {
 	return b.state
 }
 
-func (b *LocalBackend) InServerMode() bool {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.inServerMode
-}
-
 // getEngineStatus returns a copy of b.engineStatus.
 //
 // TODO(bradfitz): remove this and use Status() throughout.
@@ -924,7 +710,7 @@ func (b *LocalBackend) Login(token *oauth2.Token) {
 func (b *LocalBackend) StartLoginInteractive() {
 	b.mu.Lock()
 	b.assertClientLocked()
-	b.interact = true
+	b.interact++
 	url := b.authURL
 	c := b.c
 	b.mu.Unlock()
@@ -955,48 +741,32 @@ func (b *LocalBackend) FakeExpireAfter(x time.Duration) {
 	if e.IsZero() || time.Until(e) > x {
 		mapCopy.Expiry = time.Now().Add(x)
 	}
-	b.setNetMapLocked(&mapCopy)
+	b.netMap = &mapCopy
 	b.send(Notify{NetMap: b.netMap})
 }
 
-func (b *LocalBackend) Ping(ipStr string) {
-	ip, err := netaddr.ParseIP(ipStr)
-	if err != nil {
-		b.logf("ignoring Ping request to invalid IP %q", ipStr)
-		return
-	}
-	b.e.Ping(ip, func(pr *ipnstate.PingResult) {
-		b.send(Notify{PingResult: pr})
-	})
-}
-
-// parseWgStatusLocked returns an EngineStatus based on s.
-//
-// b.mu must be held; mostly because the caller is about to anyway, and doing so
-// gives us slightly better guarantees about the two peers stats lines not
-// being intermixed if there are concurrent calls to our caller.
-func (b *LocalBackend) parseWgStatusLocked(s *wgengine.Status) (ret EngineStatus) {
-	var peerStats, peerKeys strings.Builder
+func (b *LocalBackend) parseWgStatus(s *wgengine.Status) (ret EngineStatus) {
+	var (
+		peerStats []string
+		peerKeys  []string
+	)
 
 	ret.LiveDERPs = s.DERPs
 	ret.LivePeers = map[tailcfg.NodeKey]wgengine.PeerStatus{}
 	for _, p := range s.Peers {
 		if !p.LastHandshake.IsZero() {
-			fmt.Fprintf(&peerStats, "%d/%d ", p.RxBytes, p.TxBytes)
-			fmt.Fprintf(&peerKeys, "%s ", p.NodeKey.ShortString())
-
+			peerStats = append(peerStats, fmt.Sprintf("%d/%d", p.RxBytes, p.TxBytes))
 			ret.NumLive++
 			ret.LivePeers[p.NodeKey] = p
 
+			peerKeys = append(peerKeys, p.NodeKey.ShortString())
 		}
 		ret.RBytes += p.RxBytes
 		ret.WBytes += p.TxBytes
 	}
-
-	// [GRINDER STATS LINES] - please don't remove (used for log parsing)
-	if peerStats.Len() > 0 {
-		b.keyLogf("peer keys: %s", strings.TrimSpace(peerKeys.String()))
-		b.statsLogf("v%v peers: %v", version.Long, strings.TrimSpace(peerStats.String()))
+	if len(peerStats) > 0 {
+		b.keyLogf("peer keys: %s", strings.Join(peerKeys, " "))
+		b.logf("v%v peers: %v", version.LONG, strings.Join(peerStats, " "))
 	}
 	return ret
 }
@@ -1013,28 +783,10 @@ func (b *LocalBackend) shieldsAreUp() bool {
 	return b.prefs.ShieldsUp
 }
 
-func (b *LocalBackend) SetCurrentUserID(uid string) {
-	b.mu.Lock()
-	b.userID = uid
-	b.mu.Unlock()
-}
-
-func (b *LocalBackend) SetWantRunning(wantRunning bool) {
-	b.mu.Lock()
-	new := b.prefs.Clone()
-	b.mu.Unlock()
-	if new.WantRunning == wantRunning {
-		return
-	}
-	new.WantRunning = wantRunning
-	b.logf("SetWantRunning: %v", wantRunning)
-	b.SetPrefs(new)
-}
-
 // SetPrefs saves new user preferences and propagates them throughout
 // the system. Implements Backend.
-func (b *LocalBackend) SetPrefs(newp *Prefs) {
-	if newp == nil {
+func (b *LocalBackend) SetPrefs(new *Prefs) {
+	if new == nil {
 		panic("SetPrefs got nil prefs")
 	}
 
@@ -1043,64 +795,50 @@ func (b *LocalBackend) SetPrefs(newp *Prefs) {
 	netMap := b.netMap
 	stateKey := b.stateKey
 
-	oldp := b.prefs
-	newp.Persist = oldp.Persist // caller isn't allowed to override this
-	b.prefs = newp
-	b.inServerMode = newp.ForceDaemon
+	old := b.prefs
+	new.Persist = old.Persist // caller isn't allowed to override this
+	b.prefs = new
 	// We do this to avoid holding the lock while doing everything else.
-	newp = b.prefs.Clone()
+	new = b.prefs.Clone()
 
 	oldHi := b.hostinfo
 	newHi := oldHi.Clone()
 	newHi.RoutableIPs = append([]wgcfg.CIDR(nil), b.prefs.AdvertiseRoutes...)
-	applyPrefsToHostinfo(newHi, newp)
+	applyPrefsToHostinfo(newHi, new)
 	b.hostinfo = newHi
 	hostInfoChanged := !oldHi.Equal(newHi)
-	userID := b.userID
 
 	b.mu.Unlock()
 
 	if stateKey != "" {
-		if err := b.store.WriteState(stateKey, newp.ToBytes()); err != nil {
+		if err := b.store.WriteState(stateKey, new.ToBytes()); err != nil {
 			b.logf("Failed to save new controlclient state: %v", err)
 		}
 	}
-	b.writeServerModeStartState(userID, newp)
 
-	// [GRINDER STATS LINE] - please don't remove (used for log parsing)
-	b.logf("SetPrefs: %v", newp.Pretty())
-	if netMap != nil {
-		if login := netMap.UserProfiles[netMap.User].LoginName; login != "" {
-			if newp.Persist == nil {
-				b.logf("active login: %s", login)
-			} else if newp.Persist.LoginName != login {
-				// Corp issue 461: sometimes the wrong prefs are
-				// logged; the frontend isn't always getting
-				// notified (to update its prefs/persist) on
-				// account switch.  Log this while we figure it
-				// out.
-				b.logf("active login: %s ([unexpected] corp#461, not %s)", newp.Persist.LoginName)
-			}
-		}
-	}
+	b.logf("SetPrefs: %v", new.Pretty())
 
-	if oldp.ShieldsUp != newp.ShieldsUp || hostInfoChanged {
+	if old.ShieldsUp != new.ShieldsUp || hostInfoChanged {
 		b.doSetHostinfoFilterServices(newHi)
 	}
 
-	b.updateFilter(netMap, newp)
+	b.updateFilter(netMap, new)
 
-	if netMap != nil {
+	turnDERPOff := new.DisableDERP && !old.DisableDERP
+	turnDERPOn := !new.DisableDERP && old.DisableDERP
+	if turnDERPOff {
+		b.e.SetDERPMap(nil)
+	} else if turnDERPOn && netMap != nil {
 		b.e.SetDERPMap(netMap.DERPMap)
 	}
 
-	if oldp.WantRunning != newp.WantRunning {
+	if old.WantRunning != new.WantRunning {
 		b.stateMachine()
 	} else {
 		b.authReconfig()
 	}
 
-	b.send(Notify{Prefs: newp})
+	b.send(Notify{Prefs: new})
 }
 
 // doSetHostinfoFilterServices calls SetHostinfo on the controlclient,
@@ -1153,8 +891,6 @@ func (b *LocalBackend) authReconfig() {
 	blocked := b.blocked
 	uc := b.prefs
 	nm := b.netMap
-	hasPAC := b.prevIfState.HasPAC()
-	disableSubnetsIfPAC := nm != nil && nm.Debug != nil && nm.Debug.DisableSubnetsIfPAC.EqualBool(true)
 	b.mu.Unlock()
 
 	if blocked {
@@ -1175,16 +911,16 @@ func (b *LocalBackend) authReconfig() {
 		flags |= controlclient.AllowDefaultRoute
 		// TODO(apenwarr): Make subnet routes a different pref?
 		flags |= controlclient.AllowSubnetRoutes
+		// TODO(apenwarr): Remove this once we sort out subnet routes.
+		//  Right now default routes are broken in Windows, but
+		//  controlclient doesn't properly send subnet routes. So
+		//  let's convert a default route into a subnet route in order
+		//  to allow experimentation.
+		flags |= controlclient.HackDefaultRoute
 	}
 	if uc.AllowSingleHosts {
 		flags |= controlclient.AllowSingleHosts
 	}
-	if hasPAC && disableSubnetsIfPAC {
-		if flags&controlclient.AllowSubnetRoutes != 0 {
-			b.logf("authReconfig: have PAC; disabling subnet routes")
-			flags &^= controlclient.AllowSubnetRoutes
-		}
-	}
 
 	cfg, err := nm.WGCfg(b.logf, flags)
 	if err != nil {
@@ -1261,14 +997,14 @@ func routerConfig(cfg *wgcfg.Config, prefs *Prefs) *router.Config {
 	}
 
 	rs := &router.Config{
-		LocalAddrs:       wgCIDRsToNetaddr(addrs),
-		SubnetRoutes:     wgCIDRsToNetaddr(prefs.AdvertiseRoutes),
+		LocalAddrs:       wgCIDRToNetaddr(addrs),
+		SubnetRoutes:     wgCIDRToNetaddr(prefs.AdvertiseRoutes),
 		SNATSubnetRoutes: !prefs.NoSNAT,
 		NetfilterMode:    prefs.NetfilterMode,
 	}
 
 	for _, peer := range cfg.Peers {
-		rs.Routes = append(rs.Routes, wgCIDRsToNetaddr(peer.AllowedIPs)...)
+		rs.Routes = append(rs.Routes, wgCIDRToNetaddr(peer.AllowedIPs)...)
 	}
 
 	rs.Routes = append(rs.Routes, netaddr.IPPrefix{
@@ -1279,20 +1015,35 @@ func routerConfig(cfg *wgcfg.Config, prefs *Prefs) *router.Config {
 	return rs
 }
 
-func wgCIDRsToNetaddr(cidrLists ...[]wgcfg.CIDR) (ret []netaddr.IPPrefix) {
+// wgCIDRsToFilter converts lists of wgcfg.CIDR into a single list of
+// filter.Net.
+func wgCIDRsToFilter(cidrLists ...[]wgcfg.CIDR) (ret []filter.Net) {
 	for _, cidrs := range cidrLists {
 		for _, cidr := range cidrs {
-			ncidr, ok := netaddr.FromStdIPNet(cidr.IPNet())
-			if !ok {
-				panic(fmt.Sprintf("conversion of %s from wgcfg to netaddr IPNet failed", cidr))
+			if !cidr.IP.Is4() {
+				continue
 			}
-			ncidr.IP = ncidr.IP.Unmap()
-			ret = append(ret, ncidr)
+			ret = append(ret, filter.Net{
+				IP:   filter.NewIP(cidr.IP.IP()),
+				Mask: filter.Netmask(int(cidr.Mask)),
+			})
 		}
 	}
 	return ret
 }
 
+func wgCIDRToNetaddr(cidrs []wgcfg.CIDR) (ret []netaddr.IPPrefix) {
+	for _, cidr := range cidrs {
+		ncidr, ok := netaddr.FromStdIPNet(cidr.IPNet())
+		if !ok {
+			panic(fmt.Sprintf("conversion of %s from wgcfg to netaddr IPNet failed", cidr))
+		}
+		ncidr.IP = ncidr.IP.Unmap()
+		ret = append(ret, ncidr)
+	}
+	return ret
+}
+
 func applyPrefsToHostinfo(hi *tailcfg.Hostinfo, prefs *Prefs) {
 	if h := prefs.Hostname; h != "" {
 		hi.Hostname = h
@@ -1303,7 +1054,6 @@ func applyPrefsToHostinfo(hi *tailcfg.Hostinfo, prefs *Prefs) {
 	if m := prefs.DeviceModel; m != "" {
 		hi.DeviceModel = m
 	}
-	hi.ShieldsUp = prefs.ShieldsUp
 }
 
 // enterState transitions the backend into newState, updating internal
@@ -1320,7 +1070,6 @@ func (b *LocalBackend) enterState(newState State) {
 	prefs := b.prefs
 	notify := b.notify
 	bc := b.c
-	networkUp := b.prevIfState.AnyInterfaceUp()
 	b.mu.Unlock()
 
 	if state == newState {
@@ -1333,7 +1082,7 @@ func (b *LocalBackend) enterState(newState State) {
 	}
 
 	if bc != nil {
-		bc.SetPaused(newState == Stopped || !networkUp)
+		bc.SetPaused(newState == Stopped)
 	}
 
 	switch newState {
@@ -1460,25 +1209,15 @@ func (b *LocalBackend) requestEngineStatusAndWait() {
 //  rebooting will fix it.
 func (b *LocalBackend) Logout() {
 	b.mu.Lock()
+	b.assertClientLocked()
 	c := b.c
-	b.setNetMapLocked(nil)
+	b.netMap = nil
 	b.mu.Unlock()
 
-	if c == nil {
-		// Double Logout can happen via repeated IPN
-		// connections to ipnserver making it repeatedly
-		// transition from 1->0 total connections, which on
-		// Windows by default ("client mode") causes a Logout
-		// on the transition to zero.
-		// Previously this crashed when we asserted that c was non-nil
-		// here.
-		return
-	}
-
 	c.Logout()
 
 	b.mu.Lock()
-	b.setNetMapLocked(nil)
+	b.netMap = nil
 	b.mu.Unlock()
 
 	b.stateMachine()
@@ -1507,53 +1246,19 @@ func (b *LocalBackend) setNetInfo(ni *tailcfg.NetInfo) {
 	c.SetNetInfo(ni)
 }
 
-func (b *LocalBackend) setNetMapLocked(nm *controlclient.NetworkMap) {
-	var login string
-	if nm != nil {
-		login = nm.UserProfiles[nm.User].LoginName
-		if login == "" {
-			login = "<missing-profile>"
-		}
-	}
-	b.netMap = nm
-	if login != b.activeLogin {
-		b.logf("active login: %v", login)
-		b.activeLogin = login
-	}
-}
-
 // TestOnlyPublicKeys returns the current machine and node public
 // keys. Used in tests only to facilitate automated node authorization
 // in the test harness.
 func (b *LocalBackend) TestOnlyPublicKeys() (machineKey tailcfg.MachineKey, nodeKey tailcfg.NodeKey) {
 	b.mu.Lock()
 	prefs := b.prefs
-	machinePrivKey := b.machinePrivKey
 	b.mu.Unlock()
 
-	if prefs == nil || machinePrivKey.IsZero() {
+	if prefs == nil {
 		return
 	}
 
-	mk := machinePrivKey.Public()
+	mk := prefs.Persist.PrivateMachineKey.Public()
 	nk := prefs.Persist.PrivateNodeKey.Public()
 	return tailcfg.MachineKey(mk), tailcfg.NodeKey(nk)
 }
-
-// temporarilySetMachineKeyInPersist reports whether we should set
-// the machine key in Prefs.Persist.LegacyFrontendPrivateMachineKey
-// for the frontend to write out to its preferences for use later.
-//
-// TODO: remove this in Tailscale 1.3.x (so it effectively always
-// returns false). It just exists so users can downgrade from 1.2.x to
-// 1.0.x.  But eventually we want to stop sending the machine key to
-// clients. We can't do that until 1.0.x is no longer supported.
-func temporarilySetMachineKeyInPersist() bool {
-	//lint:ignore S1008 for comments
-	switch runtime.GOOS {
-	case "darwin", "ios", "android":
-		// iOS, macOS, Android users can't downgrade anyway.
-		return false
-	}
-	return true
-}

ipn/loglines_test.go

@@ -1,91 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package ipn
-
-import (
-	"reflect"
-	"testing"
-	"time"
-
-	"tailscale.com/control/controlclient"
-	"tailscale.com/logtail"
-	"tailscale.com/tailcfg"
-	"tailscale.com/tstest"
-	"tailscale.com/types/key"
-	"tailscale.com/wgengine"
-)
-
-// TestLocalLogLines tests to make sure that the log lines required for log parsing are
-// being logged by the expected functions. Update these tests if moving log lines between
-// functions.
-func TestLocalLogLines(t *testing.T) {
-	logListen := tstest.NewLogLineTracker(t.Logf, []string{
-		"SetPrefs: %v",
-		"peer keys: %s",
-		"v%v peers: %v",
-	})
-
-	logid := func(hex byte) logtail.PublicID {
-		var ret logtail.PublicID
-		for i := 0; i < len(ret); i++ {
-			ret[i] = hex
-		}
-		return ret
-	}
-	idA := logid(0xaa)
-
-	// set up a LocalBackend, super bare bones. No functional data.
-	store := &MemoryStore{
-		cache: make(map[StateKey][]byte),
-	}
-	e, err := wgengine.NewFakeUserspaceEngine(logListen.Logf, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	lb, err := NewLocalBackend(logListen.Logf, idA.String(), store, e)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer lb.Shutdown()
-
-	// custom adjustments for required non-nil fields
-	lb.prefs = NewPrefs()
-	lb.hostinfo = &tailcfg.Hostinfo{}
-	// hacky manual override of the usual log-on-change behaviour of keylogf
-	lb.keyLogf = logListen.Logf
-
-	testWantRemain := func(wantRemain ...string) func(t *testing.T) {
-		return func(t *testing.T) {
-			if remain := logListen.Check(); !reflect.DeepEqual(remain, wantRemain) {
-				t.Errorf("remain %q, want %q", remain, wantRemain)
-			}
-		}
-	}
-
-	// log prefs line
-	persist := &controlclient.Persist{}
-	prefs := NewPrefs()
-	prefs.Persist = persist
-	lb.SetPrefs(prefs)
-
-	t.Run("after_prefs", testWantRemain("peer keys: %s", "v%v peers: %v"))
-
-	// log peers, peer keys
-	status := &wgengine.Status{
-		Peers: []wgengine.PeerStatus{wgengine.PeerStatus{
-			TxBytes:       10,
-			RxBytes:       10,
-			LastHandshake: time.Now(),
-			NodeKey:       tailcfg.NodeKey(key.NewPrivate()),
-		}},
-		LocalAddrs: []string{"idk an address"},
-	}
-	lb.mu.Lock()
-	lb.parseWgStatusLocked(status)
-	lb.mu.Unlock()
-
-	t.Run("after_peers", testWantRemain())
-}

ipn/message.go

@@ -5,7 +5,6 @@
 package ipn
 
 import (
-	"bytes"
 	"encoding/binary"
 	"encoding/json"
 	"errors"
@@ -20,8 +19,6 @@ import (
 	"tailscale.com/version"
 )
 
-var jsonEscapedZero = []byte(`\u0000`)
-
 type NoArgs struct{}
 
 type StartArgs struct {
@@ -36,10 +33,6 @@ type FakeExpireAfterArgs struct {
 	Duration time.Duration
 }
 
-type PingArgs struct {
-	IP string
-}
-
 // Command is a command message that is JSON encoded and sent by a
 // frontend to a backend.
 type Command struct {
@@ -60,11 +53,9 @@ type Command struct {
 	Login                 *oauth2.Token
 	Logout                *NoArgs
 	SetPrefs              *SetPrefsArgs
-	SetWantRunning        *bool
 	RequestEngineStatus   *NoArgs
 	RequestStatus         *NoArgs
 	FakeExpireAfter       *FakeExpireAfterArgs
-	Ping                  *PingArgs
 }
 
 type BackendServer struct {
@@ -83,14 +74,11 @@ func NewBackendServer(logf logger.Logf, b Backend, sendNotifyMsg func(b []byte))
 }
 
 func (bs *BackendServer) send(n Notify) {
-	n.Version = version.Long
+	n.Version = version.LONG
 	b, err := json.Marshal(n)
 	if err != nil {
 		log.Fatalf("Failed json.Marshal(notify): %v\n%#v", err, n)
 	}
-	if bytes.Contains(b, jsonEscapedZero) {
-		log.Printf("[unexpected] zero byte in BackendServer.send notify message: %q", b)
-	}
 	bs.sendNotifyMsg(b)
 }
 
@@ -98,17 +86,6 @@ func (bs *BackendServer) SendErrorMessage(msg string) {
 	bs.send(Notify{ErrMessage: &msg})
 }
 
-// SendInUseOtherUserErrorMessage sends a Notify message to the client that
-// both sets the state to 'InUseOtherUser' and sets the associated reason
-// to msg.
-func (bs *BackendServer) SendInUseOtherUserErrorMessage(msg string) {
-	inUse := InUseOtherUser
-	bs.send(Notify{
-		State:      &inUse,
-		ErrMessage: &msg,
-	})
-}
-
 // GotCommandMsg parses the incoming message b as a JSON Command and
 // calls GotCommand with it.
 func (bs *BackendServer) GotCommandMsg(b []byte) error {
@@ -123,14 +100,14 @@ func (bs *BackendServer) GotCommandMsg(b []byte) error {
 }
 
 func (bs *BackendServer) GotFakeCommand(cmd *Command) error {
-	cmd.Version = version.Long
+	cmd.Version = version.LONG
 	return bs.GotCommand(cmd)
 }
 
 func (bs *BackendServer) GotCommand(cmd *Command) error {
-	if cmd.Version != version.Long && !cmd.AllowVersionSkew {
+	if cmd.Version != version.LONG && !cmd.AllowVersionSkew {
 		vs := fmt.Sprintf("GotCommand: Version mismatch! frontend=%#v backend=%#v",
-			cmd.Version, version.Long)
+			cmd.Version, version.LONG)
 		bs.logf("%s", vs)
 		// ignore the command, but send a message back to the
 		// caller so it can realize the version mismatch too.
@@ -162,9 +139,6 @@ func (bs *BackendServer) GotCommand(cmd *Command) error {
 	} else if c := cmd.SetPrefs; c != nil {
 		bs.b.SetPrefs(c.New)
 		return nil
-	} else if c := cmd.SetWantRunning; c != nil {
-		bs.b.SetWantRunning(*c)
-		return nil
 	} else if c := cmd.RequestEngineStatus; c != nil {
 		bs.b.RequestEngineStatus()
 		return nil
@@ -174,9 +148,6 @@ func (bs *BackendServer) GotCommand(cmd *Command) error {
 	} else if c := cmd.FakeExpireAfter; c != nil {
 		bs.b.FakeExpireAfter(c.Duration)
 		return nil
-	} else if c := cmd.Ping; c != nil {
-		bs.b.Ping(c.IP)
-		return nil
 	} else {
 		return fmt.Errorf("BackendServer.Do: no command specified")
 	}
@@ -210,16 +181,13 @@ func (bc *BackendClient) GotNotifyMsg(b []byte) {
 		// not interesting
 		return
 	}
-	if bytes.Contains(b, jsonEscapedZero) {
-		log.Printf("[unexpected] zero byte in BackendClient.GotNotifyMsg message: %q", b)
-	}
 	n := Notify{}
 	if err := json.Unmarshal(b, &n); err != nil {
 		log.Fatalf("BackendClient.Notify: cannot decode message (length=%d)\n%#v", len(b), string(b))
 	}
-	if n.Version != version.Long && !bc.AllowVersionSkew {
+	if n.Version != version.LONG && !bc.AllowVersionSkew {
 		vs := fmt.Sprintf("GotNotify: Version mismatch! frontend=%#v backend=%#v",
-			version.Long, n.Version)
+			version.LONG, n.Version)
 		bc.logf("%s", vs)
 		// delete anything in the notification except the version,
 		// to prevent incorrect operation.
@@ -234,14 +202,11 @@ func (bc *BackendClient) GotNotifyMsg(b []byte) {
 }
 
 func (bc *BackendClient) send(cmd Command) {
-	cmd.Version = version.Long
+	cmd.Version = version.LONG
 	b, err := json.Marshal(cmd)
 	if err != nil {
 		log.Fatalf("Failed json.Marshal(cmd): %v\n%#v\n", err, cmd)
 	}
-	if bytes.Contains(b, jsonEscapedZero) {
-		log.Printf("[unexpected] zero byte in BackendClient.send command: %q", b)
-	}
 	bc.sendCommandMsg(b)
 }
 
@@ -289,14 +254,6 @@ func (bc *BackendClient) FakeExpireAfter(x time.Duration) {
 	bc.send(Command{FakeExpireAfter: &FakeExpireAfterArgs{Duration: x}})
 }
 
-func (bc *BackendClient) Ping(ip string) {
-	bc.send(Command{Ping: &PingArgs{IP: ip}})
-}
-
-func (bc *BackendClient) SetWantRunning(v bool) {
-	bc.send(Command{SetWantRunning: &v})
-}
-
 // MaxMessageSize is the maximum message size, in bytes.
 const MaxMessageSize = 10 << 20
 

ipn/prefs.go

@@ -11,8 +11,6 @@ import (
 	"log"
 	"os"
 	"path/filepath"
-	"runtime"
-	"strings"
 
 	"github.com/tailscale/wireguard-go/wgcfg"
 	"tailscale.com/atomicfile"
@@ -20,57 +18,44 @@ import (
 	"tailscale.com/wgengine/router"
 )
 
-//go:generate go run tailscale.com/cmd/cloner -type=Prefs -output=prefs_clone.go
-
 // Prefs are the user modifiable settings of the Tailscale node agent.
 type Prefs struct {
 	// ControlURL is the URL of the control server to use.
 	ControlURL string
-
 	// RouteAll specifies whether to accept subnet and default routes
 	// advertised by other nodes on the Tailscale network.
 	RouteAll bool
-
 	// AllowSingleHosts specifies whether to install routes for each
 	// node IP on the tailscale network, in addition to a route for
 	// the whole network.
-	// This corresponds to the "tailscale up --host-routes" value,
-	// which defaults to true.
 	//
 	// TODO(danderson): why do we have this? It dumps a lot of stuff
 	// into the routing table, and a single network route _should_ be
 	// all that we need. But when I turn this off in my tailscaled,
 	// packets stop flowing. What's up with that?
 	AllowSingleHosts bool
-
 	// CorpDNS specifies whether to install the Tailscale network's
 	// DNS configuration, if it exists.
 	CorpDNS bool
-
 	// WantRunning indicates whether networking should be active on
 	// this node.
 	WantRunning bool
-
 	// ShieldsUp indicates whether to block all incoming connections,
 	// regardless of the control-provided packet filter. If false, we
 	// use the packet filter as provided. If true, we block incoming
-	// connections. This overrides tailcfg.Hostinfo's ShieldsUp.
+	// connections.
 	ShieldsUp bool
-
 	// AdvertiseTags specifies groups that this node wants to join, for
 	// purposes of ACL enforcement. These can be referenced from the ACL
 	// security policy. Note that advertising a tag doesn't guarantee that
 	// the control server will allow you to take on the rights for that
 	// tag.
 	AdvertiseTags []string
-
 	// Hostname is the hostname to use for identifying the node. If
 	// not set, os.Hostname is used.
 	Hostname string
-
 	// OSVersion overrides tailcfg.Hostinfo's OSVersion.
 	OSVersion string
-
 	// DeviceModel overrides tailcfg.Hostinfo's DeviceModel.
 	DeviceModel string
 
@@ -82,17 +67,8 @@ type Prefs struct {
 	// users narrow it down a bit.
 	NotepadURLs bool
 
-	// ForceDaemon specifies whether a platform that normally
-	// operates in "client mode" (that is, requires an active user
-	// logged in with the GUI app running) should keep running after the
-	// GUI ends and/or the user logs out.
-	//
-	// The only current applicable platform is Windows. This
-	// forced Windows to go into "server mode" where Tailscale is
-	// running even with no users logged in. This might also be
-	// used for macOS in the future. This setting has no effect
-	// for Linux/etc, which always operate in daemon mode.
-	ForceDaemon bool `json:"ForceDaemon,omitempty"`
+	// DisableDERP prevents DERP from being used.
+	DisableDERP bool
 
 	// The following block of options only have an effect on Linux.
 
@@ -100,7 +76,6 @@ type Prefs struct {
 	// Tailscale network as reachable through the current
 	// node.
 	AdvertiseRoutes []wgcfg.CIDR
-
 	// NoSNAT specifies whether to source NAT traffic going to
 	// destinations in AdvertiseRoutes. The default is to apply source
 	// NAT, which makes the traffic appear to come from the router
@@ -112,7 +87,6 @@ type Prefs struct {
 	//
 	// Linux-only.
 	NoSNAT bool
-
 	// NetfilterMode specifies how much to manage netfilter rules for
 	// Tailscale, if at all.
 	NetfilterMode router.NetfilterMode
@@ -128,46 +102,16 @@ type Prefs struct {
 // IsEmpty reports whether p is nil or pointing to a Prefs zero value.
 func (p *Prefs) IsEmpty() bool { return p == nil || p.Equals(&Prefs{}) }
 
-func (p *Prefs) Pretty() string { return p.pretty(runtime.GOOS) }
-func (p *Prefs) pretty(goos string) string {
-	var sb strings.Builder
-	sb.WriteString("Prefs{")
-	fmt.Fprintf(&sb, "ra=%v ", p.RouteAll)
-	if !p.AllowSingleHosts {
-		sb.WriteString("mesh=false ")
-	}
-	fmt.Fprintf(&sb, "dns=%v want=%v ", p.CorpDNS, p.WantRunning)
-	if p.ForceDaemon {
-		sb.WriteString("server=true ")
-	}
-	if p.NotepadURLs {
-		sb.WriteString("notepad=true ")
-	}
-	if p.ShieldsUp {
-		sb.WriteString("shields=true ")
-	}
-	if len(p.AdvertiseRoutes) > 0 || goos == "linux" {
-		fmt.Fprintf(&sb, "routes=%v ", p.AdvertiseRoutes)
-	}
-	if len(p.AdvertiseRoutes) > 0 || p.NoSNAT {
-		fmt.Fprintf(&sb, "snat=%v ", !p.NoSNAT)
-	}
-	if len(p.AdvertiseTags) > 0 {
-		fmt.Fprintf(&sb, "tags=%s ", strings.Join(p.AdvertiseTags, ","))
-	}
-	if goos == "linux" {
-		fmt.Fprintf(&sb, "nf=%v ", p.NetfilterMode)
-	}
-	if p.ControlURL != "" && p.ControlURL != "https://login.tailscale.com" {
-		fmt.Fprintf(&sb, "url=%q ", p.ControlURL)
-	}
+func (p *Prefs) Pretty() string {
+	var pp string
 	if p.Persist != nil {
-		sb.WriteString(p.Persist.Pretty())
+		pp = p.Persist.Pretty()
 	} else {
-		sb.WriteString("Persist=nil")
+		pp = "Persist=nil"
 	}
-	sb.WriteString("}")
-	return sb.String()
+	return fmt.Sprintf("Prefs{ra=%v mesh=%v dns=%v want=%v notepad=%v derp=%v shields=%v routes=%v snat=%v nf=%v %v}",
+		p.RouteAll, p.AllowSingleHosts, p.CorpDNS, p.WantRunning,
+		p.NotepadURLs, !p.DisableDERP, p.ShieldsUp, p.AdvertiseRoutes, !p.NoSNAT, p.NetfilterMode, pp)
 }
 
 func (p *Prefs) ToBytes() []byte {
@@ -193,13 +137,13 @@ func (p *Prefs) Equals(p2 *Prefs) bool {
 		p.CorpDNS == p2.CorpDNS &&
 		p.WantRunning == p2.WantRunning &&
 		p.NotepadURLs == p2.NotepadURLs &&
+		p.DisableDERP == p2.DisableDERP &&
 		p.ShieldsUp == p2.ShieldsUp &&
 		p.NoSNAT == p2.NoSNAT &&
 		p.NetfilterMode == p2.NetfilterMode &&
 		p.Hostname == p2.Hostname &&
 		p.OSVersion == p2.OSVersion &&
 		p.DeviceModel == p2.DeviceModel &&
-		p.ForceDaemon == p2.ForceDaemon &&
 		compareIPNets(p.AdvertiseRoutes, p2.AdvertiseRoutes) &&
 		compareStrings(p.AdvertiseTags, p2.AdvertiseTags) &&
 		p.Persist.Equals(p2.Persist)
@@ -269,16 +213,26 @@ func PrefsFromBytes(b []byte, enforceDefaults bool) (*Prefs, error) {
 	return p, err
 }
 
+// Clone returns a deep copy of p.
+func (p *Prefs) Clone() *Prefs {
+	// TODO: write a faster/non-Fatal-y Clone implementation?
+	p2, err := PrefsFromBytes(p.ToBytes(), false)
+	if err != nil {
+		log.Fatalf("Prefs was uncopyable: %v\n", err)
+	}
+	return p2
+}
+
 // LoadPrefs loads a legacy relaynode config file into Prefs
 // with sensible migration defaults set.
 func LoadPrefs(filename string) (*Prefs, error) {
 	data, err := ioutil.ReadFile(filename)
 	if err != nil {
-		return nil, fmt.Errorf("LoadPrefs open: %w", err) // err includes path
+		return nil, fmt.Errorf("loading prefs from %q: %v", filename, err)
 	}
 	p, err := PrefsFromBytes(data, false)
 	if err != nil {
-		return nil, fmt.Errorf("LoadPrefs(%q) decode: %w", filename, err)
+		return nil, fmt.Errorf("decoding prefs in %q: %v", filename, err)
 	}
 	return p, nil
 }

ipn/prefs_clone.go

@@ -1,51 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Code generated by tailscale.com/cmd/cloner -type Prefs; DO NOT EDIT.
-
-package ipn
-
-import (
-	"github.com/tailscale/wireguard-go/wgcfg"
-	"tailscale.com/control/controlclient"
-	"tailscale.com/wgengine/router"
-)
-
-// Clone makes a deep copy of Prefs.
-// The result aliases no memory with the original.
-func (src *Prefs) Clone() *Prefs {
-	if src == nil {
-		return nil
-	}
-	dst := new(Prefs)
-	*dst = *src
-	dst.AdvertiseTags = append(src.AdvertiseTags[:0:0], src.AdvertiseTags...)
-	dst.AdvertiseRoutes = append(src.AdvertiseRoutes[:0:0], src.AdvertiseRoutes...)
-	if dst.Persist != nil {
-		dst.Persist = new(controlclient.Persist)
-		*dst.Persist = *src.Persist
-	}
-	return dst
-}
-
-// A compilation failure here means this code must be regenerated, with command:
-//   tailscale.com/cmd/cloner -type Prefs
-var _PrefsNeedsRegeneration = Prefs(struct {
-	ControlURL       string
-	RouteAll         bool
-	AllowSingleHosts bool
-	CorpDNS          bool
-	WantRunning      bool
-	ShieldsUp        bool
-	AdvertiseTags    []string
-	Hostname         string
-	OSVersion        string
-	DeviceModel      string
-	NotepadURLs      bool
-	ForceDaemon      bool
-	AdvertiseRoutes  []wgcfg.CIDR
-	NoSNAT           bool
-	NetfilterMode    router.NetfilterMode
-	Persist          *controlclient.Persist
-}{})

ipn/prefs_test.go

@@ -5,12 +5,8 @@
 package ipn
 
 import (
-	"errors"
-	"fmt"
-	"os"
 	"reflect"
 	"testing"
-	"time"
 
 	"github.com/tailscale/wireguard-go/wgcfg"
 	"tailscale.com/control/controlclient"
@@ -28,7 +24,7 @@ func fieldsOf(t reflect.Type) (fields []string) {
 func TestPrefsEqual(t *testing.T) {
 	tstest.PanicOnLog()
 
-	prefsHandles := []string{"ControlURL", "RouteAll", "AllowSingleHosts", "CorpDNS", "WantRunning", "ShieldsUp", "AdvertiseTags", "Hostname", "OSVersion", "DeviceModel", "NotepadURLs", "ForceDaemon", "AdvertiseRoutes", "NoSNAT", "NetfilterMode", "Persist"}
+	prefsHandles := []string{"ControlURL", "RouteAll", "AllowSingleHosts", "CorpDNS", "WantRunning", "ShieldsUp", "AdvertiseTags", "Hostname", "OSVersion", "DeviceModel", "NotepadURLs", "DisableDERP", "AdvertiseRoutes", "NoSNAT", "NetfilterMode", "Persist"}
 	if have := fieldsOf(reflect.TypeOf(Prefs{})); !reflect.DeepEqual(have, prefsHandles) {
 		t.Errorf("Prefs.Equal check might be out of sync\nfields: %q\nhandled: %q\n",
 			have, prefsHandles)
@@ -282,92 +278,3 @@ func TestPrefsPersist(t *testing.T) {
 	}
 	checkPrefs(t, p)
 }
-
-func TestPrefsPretty(t *testing.T) {
-	tests := []struct {
-		p    Prefs
-		os   string
-		want string
-	}{
-		{
-			Prefs{},
-			"linux",
-			"Prefs{ra=false mesh=false dns=false want=false routes=[] nf=off Persist=nil}",
-		},
-		{
-			Prefs{},
-			"windows",
-			"Prefs{ra=false mesh=false dns=false want=false Persist=nil}",
-		},
-		{
-			Prefs{ShieldsUp: true},
-			"windows",
-			"Prefs{ra=false mesh=false dns=false want=false shields=true Persist=nil}",
-		},
-		{
-			Prefs{AllowSingleHosts: true},
-			"windows",
-			"Prefs{ra=false dns=false want=false Persist=nil}",
-		},
-		{
-			Prefs{
-				NotepadURLs:      true,
-				AllowSingleHosts: true,
-			},
-			"windows",
-			"Prefs{ra=false dns=false want=false notepad=true Persist=nil}",
-		},
-		{
-			Prefs{
-				AllowSingleHosts: true,
-				WantRunning:      true,
-				ForceDaemon:      true, // server mode
-			},
-			"windows",
-			"Prefs{ra=false dns=false want=true server=true Persist=nil}",
-		},
-		{
-			Prefs{
-				AllowSingleHosts: true,
-				WantRunning:      true,
-				ControlURL:       "http://localhost:1234",
-				AdvertiseTags:    []string{"tag:foo", "tag:bar"},
-			},
-			"darwin",
-			`Prefs{ra=false dns=false want=true tags=tag:foo,tag:bar url="http://localhost:1234" Persist=nil}`,
-		},
-		{
-			Prefs{
-				Persist: &controlclient.Persist{},
-			},
-			"linux",
-			`Prefs{ra=false mesh=false dns=false want=false routes=[] nf=off Persist{lm=, o=, n= u=""}}`,
-		},
-		{
-			Prefs{
-				Persist: &controlclient.Persist{
-					PrivateNodeKey: wgcfg.PrivateKey{1: 1},
-				},
-			},
-			"linux",
-			`Prefs{ra=false mesh=false dns=false want=false routes=[] nf=off Persist{lm=, o=, n=[B1VKl] u=""}}`,
-		},
-	}
-	for i, tt := range tests {
-		got := tt.p.pretty(tt.os)
-		if got != tt.want {
-			t.Errorf("%d. wrong String:\n got: %s\nwant: %s\n", i, got, tt.want)
-		}
-	}
-}
-
-func TestLoadPrefsNotExist(t *testing.T) {
-	bogusFile := fmt.Sprintf("/tmp/not-exist-%d", time.Now().UnixNano())
-
-	p, err := LoadPrefs(bogusFile)
-	if errors.Is(err, os.ErrNotExist) {
-		// expected.
-		return
-	}
-	t.Fatalf("unexpected prefs=%#v, err=%v", p, err)
-}

ipn/store.go

@@ -5,12 +5,9 @@
 package ipn
 
 import (
-	"bytes"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io/ioutil"
-	"log"
 	"os"
 	"path/filepath"
 	"sync"
@@ -22,30 +19,6 @@ import (
 // requested state ID doesn't exist.
 var ErrStateNotExist = errors.New("no state with given ID")
 
-const (
-	// MachineKeyStateKey is the key under which we store the machine key,
-	// in its wgcfg.PrivateKey.MarshalText representation.
-	MachineKeyStateKey = StateKey("_machinekey")
-
-	// GlobalDaemonStateKey is the ipn.StateKey that tailscaled
-	// loads on startup.
-	//
-	// We have to support multiple state keys for other OSes (Windows in
-	// particular), but right now Unix daemons run with a single
-	// node-global state. To keep open the option of having per-user state
-	// later, the global state key doesn't look like a username.
-	GlobalDaemonStateKey = StateKey("_daemon")
-
-	// ServerModeStartKey's value, if non-empty, is the value of a
-	// StateKey containing the prefs to start with which to start the
-	// server.
-	//
-	// For example, the value might be "user-1234", meaning the
-	// the server should start with the Prefs JSON loaded from
-	// StateKey "user-1234".
-	ServerModeStartKey = StateKey("server-mode-start-key")
-)
-
 // StateStore persists state, and produces it back on request.
 type StateStore interface {
 	// ReadState returns the bytes associated with ID. Returns (nil,
@@ -61,8 +34,6 @@ type MemoryStore struct {
 	cache map[StateKey][]byte
 }
 
-func (s *MemoryStore) String() string { return "MemoryStore" }
-
 // ReadState implements the StateStore interface.
 func (s *MemoryStore) ReadState(id StateKey) ([]byte, error) {
 	s.mu.Lock()
@@ -96,19 +67,9 @@ type FileStore struct {
 	cache map[StateKey][]byte
 }
 
-func (s *FileStore) String() string { return fmt.Sprintf("FileStore(%q)", s.path) }
-
 // NewFileStore returns a new file store that persists to path.
 func NewFileStore(path string) (*FileStore, error) {
 	bs, err := ioutil.ReadFile(path)
-
-	// Treat an empty file as a missing file.
-	// (https://github.com/tailscale/tailscale/issues/895#issuecomment-723255589)
-	if err == nil && len(bs) == 0 {
-		log.Printf("ipn.NewFileStore(%q): file empty; treating it like a missing file [warning]", path)
-		err = os.ErrNotExist
-	}
-
 	if err != nil {
 		if os.IsNotExist(err) {
 			// Write out an initial file, to verify that we can write
@@ -151,9 +112,6 @@ func (s *FileStore) ReadState(id StateKey) ([]byte, error) {
 func (s *FileStore) WriteState(id StateKey, bs []byte) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	if bytes.Equal(s.cache[id], bs) {
-		return nil
-	}
 	s.cache[id] = append([]byte(nil), bs...)
 	bs, err := json.MarshalIndent(s.cache, "", "  ")
 	if err != nil {

log/filelogger/log.go

@@ -1,199 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package filelogger provides localdisk log writing & rotation, primarily for Windows
-// clients. (We get this for free on other platforms.)
-package filelogger
-
-import (
-	"bytes"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"sync"
-	"time"
-
-	"tailscale.com/types/logger"
-)
-
-const (
-	maxSize  = 100 << 20
-	maxFiles = 50
-)
-
-// New returns a logf wrapper that appends to local disk log
-// files on Windows, rotating old log files as needed to stay under
-// file count & byte limits.
-func New(fileBasePrefix, logID string, logf logger.Logf) logger.Logf {
-	if runtime.GOOS != "windows" {
-		panic("not yet supported on any platform except Windows")
-	}
-	if logf == nil {
-		panic("nil logf")
-	}
-	dir := filepath.Join(os.Getenv("LocalAppData"), "Tailscale", "Logs")
-
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		log.Printf("failed to create local log directory; not writing logs to disk: %v", err)
-		return logf
-	}
-	logf("local disk logdir: %v", dir)
-	lfw := &logFileWriter{
-		fileBasePrefix: fileBasePrefix,
-		logID:          logID,
-		dir:            dir,
-		wrappedLogf:    logf,
-	}
-	return lfw.Logf
-}
-
-// logFileWriter is the state for the log writer & rotator.
-type logFileWriter struct {
-	dir            string      // e.g. `C:\Users\FooBarUser\AppData\Local\Tailscale\Logs`
-	logID          string      // hex logID
-	fileBasePrefix string      // e.g. "tailscale-service" or "tailscale-gui"
-	wrappedLogf    logger.Logf // underlying logger to send to
-
-	mu   sync.Mutex   // guards following
-	buf  bytes.Buffer // scratch buffer to avoid allocs
-	fday civilDay     // day that f was opened; zero means no file yet open
-	f    *os.File     // file currently opened for append
-}
-
-// civilDay is a year, month, and day in the local timezone.
-// It's a comparable value type.
-type civilDay struct {
-	year  int
-	month time.Month
-	day   int
-}
-
-func dayOf(t time.Time) civilDay {
-	return civilDay{t.Year(), t.Month(), t.Day()}
-}
-
-func (w *logFileWriter) Logf(format string, a ...interface{}) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	w.buf.Reset()
-	fmt.Fprintf(&w.buf, format, a...)
-	if w.buf.Len() == 0 {
-		return
-	}
-	out := w.buf.Bytes()
-	w.wrappedLogf("%s", out)
-
-	// Make sure there's a final newline before we write to the log file.
-	if out[len(out)-1] != '\n' {
-		w.buf.WriteByte('\n')
-		out = w.buf.Bytes()
-	}
-
-	w.appendToFileLocked(out)
-}
-
-// out should end in a newline.
-// w.mu must be held.
-func (w *logFileWriter) appendToFileLocked(out []byte) {
-	now := time.Now()
-	day := dayOf(now)
-	if w.fday != day {
-		w.startNewFileLocked()
-	}
-	if w.f != nil {
-		// RFC3339Nano but with a fixed number (3) of nanosecond digits:
-		const formatPre = "2006-01-02T15:04:05"
-		const formatPost = "Z07:00"
-		fmt.Fprintf(w.f, "%s.%03d%s: %s",
-			now.Format(formatPre),
-			now.Nanosecond()/int(time.Millisecond/time.Nanosecond),
-			now.Format(formatPost),
-			out)
-	}
-}
-
-// startNewFileLocked opens a new log file for writing
-// and also cleans up any old files.
-//
-// w.mu must be held.
-func (w *logFileWriter) startNewFileLocked() {
-	var oldName string
-	if w.f != nil {
-		oldName = filepath.Base(w.f.Name())
-		w.f.Close()
-		w.f = nil
-		w.fday = civilDay{}
-	}
-	w.cleanLocked()
-
-	now := time.Now()
-	day := dayOf(now)
-	name := filepath.Join(w.dir, fmt.Sprintf("%s-%04d%02d%02dT%02d%02d%02d-%d.txt",
-		w.fileBasePrefix,
-		day.year,
-		day.month,
-		day.day,
-		now.Hour(),
-		now.Minute(),
-		now.Second(),
-		now.Unix()))
-	var err error
-	w.f, err = os.Create(name)
-	if err != nil {
-		w.wrappedLogf("failed to create log file: %v", err)
-		return
-	}
-	if oldName != "" {
-		fmt.Fprintf(w.f, "(logID %q; continued from log file %s)\n", w.logID, oldName)
-	} else {
-		fmt.Fprintf(w.f, "(logID %q)\n", w.logID)
-	}
-	w.fday = day
-}
-
-// cleanLocked cleans up old log files.
-//
-// w.mu must be held.
-func (w *logFileWriter) cleanLocked() {
-	fis, _ := ioutil.ReadDir(w.dir)
-	prefix := w.fileBasePrefix + "-"
-	fileSize := map[string]int64{}
-	var files []string
-	var sumSize int64
-	for _, fi := range fis {
-		baseName := filepath.Base(fi.Name())
-		if !strings.HasPrefix(baseName, prefix) {
-			continue
-		}
-		size := fi.Size()
-		fileSize[baseName] = size
-		sumSize += size
-		files = append(files, baseName)
-	}
-	if sumSize > maxSize {
-		w.wrappedLogf("cleaning log files; sum byte count %d > %d", sumSize, maxSize)
-	}
-	if len(files) > maxFiles {
-		w.wrappedLogf("cleaning log files; number of files %d > %d", len(files), maxFiles)
-	}
-	for (sumSize > maxSize || len(files) > maxFiles) && len(files) > 0 {
-		target := files[0]
-		files = files[1:]
-
-		targetSize := fileSize[target]
-		targetFull := filepath.Join(w.dir, target)
-		err := os.Remove(targetFull)
-		if err != nil {
-			w.wrappedLogf("error cleaning log file: %v", err)
-		} else {
-			sumSize -= targetSize
-			w.wrappedLogf("cleaned log file %s (size %d); new bytes=%v, files=%v", targetFull, targetSize, sumSize, len(files))
-		}
-	}
-}

log/logheap/logheap.go

@@ -15,18 +15,15 @@ import (
 	"time"
 )
 
-// LogHeap uploads a JSON logtail record with the base64 heap pprof by means
-// of an HTTP POST request to the endpoint referred to in postURL.
+// LogHeap writes a JSON logtail record with the base64 heap pprof to
+// os.Stderr.
 func LogHeap(postURL string) {
 	if postURL == "" {
 		return
 	}
 	runtime.GC()
 	buf := new(bytes.Buffer)
-	if err := pprof.WriteHeapProfile(buf); err != nil {
-		log.Printf("LogHeap: %v", err)
-		return
-	}
+	pprof.WriteHeapProfile(buf)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()

logpolicy/logpolicy.go

@@ -31,11 +31,8 @@ import (
 	"tailscale.com/logtail/filch"
 	"tailscale.com/net/netns"
 	"tailscale.com/net/tlsdial"
-	"tailscale.com/net/tshttpproxy"
-	"tailscale.com/paths"
 	"tailscale.com/smallzstd"
 	"tailscale.com/types/logger"
-	"tailscale.com/util/racebuild"
 	"tailscale.com/version"
 )
 
@@ -106,23 +103,12 @@ func (l logWriter) Write(buf []byte) (int, error) {
 // logsDir returns the directory to use for log configuration and
 // buffer storage.
 func logsDir(logf logger.Logf) string {
-	// STATE_DIRECTORY is set by systemd 240+ but we support older
-	// systems-d. For example, Ubuntu 18.04 (Bionic Beaver) is 237.
 	systemdStateDir := os.Getenv("STATE_DIRECTORY")
 	if systemdStateDir != "" {
 		logf("logpolicy: using $STATE_DIRECTORY, %q", systemdStateDir)
 		return systemdStateDir
 	}
 
-	// Default to e.g. /var/lib/tailscale or /var/db/tailscale on Unix.
-	if d := paths.DefaultTailscaledStateFile(); d != "" {
-		d = filepath.Dir(d) // directory of e.g. "/var/lib/tailscale/tailscaled.state"
-		if err := os.MkdirAll(d, 0700); err == nil {
-			logf("logpolicy: using system state directory %q", d)
-			return d
-		}
-	}
-
 	cacheDir, err := os.UserCacheDir()
 	if err == nil {
 		d := filepath.Join(cacheDir, "Tailscale")
@@ -316,9 +302,6 @@ func New(collection string) *Policy {
 	} else {
 		lflags = log.LstdFlags
 	}
-	if v, _ := strconv.ParseBool(os.Getenv("TS_DEBUG_LOG_TIME")); v {
-		lflags = log.LstdFlags | log.Lmicroseconds
-	}
 	if runningUnderSystemd() {
 		// If journalctl is going to prepend its own timestamp
 		// anyway, no need to add one.
@@ -360,7 +343,7 @@ func New(collection string) *Policy {
 		newc.PrivateID = logtail.PrivateID{}
 		newc.Collection = collection
 	}
-	if newc.PrivateID.IsZero() {
+	if newc.PrivateID == (logtail.PrivateID{}) {
 		newc.PrivateID, err = logtail.NewPrivateID()
 		if err != nil {
 			log.Fatalf("logpolicy: NewPrivateID() should never fail")
@@ -396,8 +379,8 @@ func New(collection string) *Policy {
 	log.SetOutput(lw)
 
 	log.Printf("Program starting: v%v, Go %v: %#v",
-		version.Long,
-		goVersion(),
+		version.LONG,
+		strings.TrimPrefix(runtime.Version(), "go"),
 		os.Args)
 	log.Printf("LogID: %v", newc.PublicID)
 	if filchErr != nil {
@@ -436,9 +419,6 @@ func newLogtailTransport(host string) *http.Transport {
 	// Start with a copy of http.DefaultTransport and tweak it a bit.
 	tr := http.DefaultTransport.(*http.Transport).Clone()
 
-	tr.Proxy = tshttpproxy.ProxyFromEnvironment
-	tshttpproxy.SetTransportGetProxyConnectHeader(tr)
-
 	// We do our own zstd compression on uploads, and responses never contain any payload,
 	// so don't send "Accept-Encoding: gzip" to save a few bytes on the wire, since there
 	// will never be any body to decompress:
@@ -480,11 +460,3 @@ func newLogtailTransport(host string) *http.Transport {
 
 	return tr
 }
-
-func goVersion() string {
-	v := strings.TrimPrefix(runtime.Version(), "go")
-	if racebuild.On {
-		return v + "-race"
-	}
-	return v
-}

logtail/filch/filch_test.go

@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
-	"runtime"
+	"path/filepath"
 	"strings"
 	"testing"
 	"unicode"
@@ -56,8 +56,19 @@ func (f *filchTest) close(t *testing.T) {
 	}
 }
 
+func genFilePrefix(t *testing.T) (dir, prefix string) {
+	t.Helper()
+	dir, err := ioutil.TempDir("", "filch")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return dir, filepath.Join(dir, "ringbuffer-")
+}
+
 func TestQueue(t *testing.T) {
-	filePrefix := t.TempDir()
+	td, filePrefix := genFilePrefix(t)
+	defer os.RemoveAll(td)
+
 	f := newFilchTest(t, filePrefix, Options{ReplaceStderr: false})
 
 	f.readEOF(t)
@@ -79,7 +90,8 @@ func TestQueue(t *testing.T) {
 
 func TestRecover(t *testing.T) {
 	t.Run("empty", func(t *testing.T) {
-		filePrefix := t.TempDir()
+		td, filePrefix := genFilePrefix(t)
+		defer os.RemoveAll(td)
 		f := newFilchTest(t, filePrefix, Options{ReplaceStderr: false})
 		f.write(t, "hello")
 		f.read(t, "hello")
@@ -92,7 +104,8 @@ func TestRecover(t *testing.T) {
 	})
 
 	t.Run("cur", func(t *testing.T) {
-		filePrefix := t.TempDir()
+		td, filePrefix := genFilePrefix(t)
+		defer os.RemoveAll(td)
 		f := newFilchTest(t, filePrefix, Options{ReplaceStderr: false})
 		f.write(t, "hello")
 		f.close(t)
@@ -110,7 +123,8 @@ func TestRecover(t *testing.T) {
 		filch_test.go:129: r.ReadLine()="hello", want "world"
 		*/
 
-		filePrefix := t.TempDir()
+		td, filePrefix := genFilePrefix(t)
+		defer os.RemoveAll(td)
 		f := newFilchTest(t, filePrefix, Options{ReplaceStderr: false})
 		f.write(t, "hello")
 		f.read(t, "hello")
@@ -129,14 +143,6 @@ func TestRecover(t *testing.T) {
 }
 
 func TestFilchStderr(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		// TODO(bradfitz): this is broken on Windows but not
-		// fully sure why. Investigate.  But notably, the
-		// stderrFD variable (defined in filch.go) and set
-		// below is only ever read in filch_unix.go. So just
-		// skip this for test for now.
-		t.Skip("test broken on Windows")
-	}
 	pipeR, pipeW, err := os.Pipe()
 	if err != nil {
 		t.Fatal(err)
@@ -149,7 +155,8 @@ func TestFilchStderr(t *testing.T) {
 		stderrFD = 2
 	}()
 
-	filePrefix := t.TempDir()
+	td, filePrefix := genFilePrefix(t)
+	defer os.RemoveAll(td)
 	f := newFilchTest(t, filePrefix, Options{ReplaceStderr: true})
 	f.write(t, "hello")
 	if _, err := fmt.Fprintf(pipeW, "filch\n"); err != nil {

logtail/logtail.go

@@ -69,7 +69,7 @@ type Config struct {
 	Buffer         Buffer           // temp storage, if nil a MemoryBuffer
 	NewZstdEncoder func() Encoder   // if set, used to compress logs for transmission
 
-	// DrainLogs, if non-nil, disables automatic uploading of new logs,
+	// DrainLogs, if non-nil, disables autmatic uploading of new logs,
 	// so that logs are only uploaded when a token is sent to DrainLogs.
 	DrainLogs <-chan struct{}
 }

net/dnscache/dnscache.go

@@ -9,11 +9,8 @@ package dnscache
 import (
 	"context"
 	"fmt"
-	"log"
 	"net"
-	"os"
 	"runtime"
-	"strconv"
 	"sync"
 	"time"
 
@@ -28,7 +25,7 @@ func preferGoResolver() bool {
 	// There does not appear to be a local resolver running
 	// on iOS, and NetworkExtension is good at isolating DNS.
 	// So do not use the Go resolver on macOS/iOS.
-	if runtime.GOOS == "darwin" || runtime.GOOS == "ios" {
+	if runtime.GOOS == "darwin" {
 		return false
 	}
 
@@ -45,6 +42,8 @@ func preferGoResolver() bool {
 // Get returns a caching Resolver singleton.
 func Get() *Resolver { return single }
 
+const fixedTTL = 10 * time.Minute
+
 // Resolver is a minimal DNS caching resolver.
 //
 // The TTL is always fixed for now. It's not intended for general use.
@@ -55,15 +54,6 @@ type Resolver struct {
 	// If nil, net.DefaultResolver is used.
 	Forward *net.Resolver
 
-	// TTL is how long to keep entries cached
-	//
-	// If zero, a default (currently 10 minutes) is used.
-	TTL time.Duration
-
-	// UseLastGood controls whether a cached entry older than TTL is used
-	// if a refresh fails.
-	UseLastGood bool
-
 	sf singleflight.Group
 
 	mu      sync.Mutex
@@ -82,31 +72,16 @@ func (r *Resolver) fwd() *net.Resolver {
 	return net.DefaultResolver
 }
 
-func (r *Resolver) ttl() time.Duration {
-	if r.TTL > 0 {
-		return r.TTL
-	}
-	return 10 * time.Minute
-}
-
-var debug, _ = strconv.ParseBool(os.Getenv("TS_DEBUG_DNS_CACHE"))
-
 // LookupIP returns the first IPv4 address found, otherwise the first IPv6 address.
 func (r *Resolver) LookupIP(ctx context.Context, host string) (net.IP, error) {
 	if ip := net.ParseIP(host); ip != nil {
 		if ip4 := ip.To4(); ip4 != nil {
 			return ip4, nil
 		}
-		if debug {
-			log.Printf("dnscache: %q is an IP", host)
-		}
 		return ip, nil
 	}
 
 	if ip, ok := r.lookupIPCache(host); ok {
-		if debug {
-			log.Printf("dnscache: %q = %v (cached)", host, ip)
-		}
 		return ip, nil
 	}
 
@@ -120,24 +95,10 @@ func (r *Resolver) LookupIP(ctx context.Context, host string) (net.IP, error) {
 	select {
 	case res := <-ch:
 		if res.Err != nil {
-			if r.UseLastGood {
-				if ip, ok := r.lookupIPCacheExpired(host); ok {
-					if debug {
-						log.Printf("dnscache: %q using %v after error", host, ip)
-					}
-					return ip, nil
-				}
-			}
-			if debug {
-				log.Printf("dnscache: error resolving %q: %v", host, res.Err)
-			}
 			return nil, res.Err
 		}
 		return res.Val.(net.IP), nil
 	case <-ctx.Done():
-		if debug {
-			log.Printf("dnscache: context done while resolving %q: %v", host, ctx.Err())
-		}
 		return nil, ctx.Err()
 	}
 }
@@ -151,41 +112,12 @@ func (r *Resolver) lookupIPCache(host string) (ip net.IP, ok bool) {
 	return nil, false
 }
 
-func (r *Resolver) lookupIPCacheExpired(host string) (ip net.IP, ok bool) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if ent, ok := r.ipCache[host]; ok {
-		return ent.ip, true
-	}
-	return nil, false
-}
-
-func (r *Resolver) lookupTimeoutForHost(host string) time.Duration {
-	if r.UseLastGood {
-		if _, ok := r.lookupIPCacheExpired(host); ok {
-			// If we have some previous good value for this host,
-			// don't give this DNS lookup much time. If we're in a
-			// situation where the user's DNS server is unreachable
-			// (e.g. their corp DNS server is behind a subnet router
-			// that can't come up due to Tailscale needing to
-			// connect to itself), then we want to fail fast and let
-			// our caller (who set UseLastGood) fall back to using
-			// the last-known-good IP address.
-			return 3 * time.Second
-		}
-	}
-	return 10 * time.Second
-}
-
 func (r *Resolver) lookupIP(host string) (net.IP, error) {
 	if ip, ok := r.lookupIPCache(host); ok {
-		if debug {
-			log.Printf("dnscache: %q found in cache as %v", host, ip)
-		}
 		return ip, nil
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), r.lookupTimeoutForHost(host))
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 	ips, err := r.fwd().LookupIPAddr(ctx, host)
 	if err != nil {
@@ -197,26 +129,19 @@ func (r *Resolver) lookupIP(host string) (net.IP, error) {
 
 	for _, ipa := range ips {
 		if ip4 := ipa.IP.To4(); ip4 != nil {
-			return r.addIPCache(host, ip4, r.ttl()), nil
+			return r.addIPCache(host, ip4, fixedTTL), nil
 		}
 	}
-	return r.addIPCache(host, ips[0].IP, r.ttl()), nil
+	return r.addIPCache(host, ips[0].IP, fixedTTL), nil
 }
 
 func (r *Resolver) addIPCache(host string, ip net.IP, d time.Duration) net.IP {
 	if isPrivateIP(ip) {
 		// Don't cache obviously wrong entries from captive portals.
 		// TODO: use DoH or DoT for the forwarding resolver?
-		if debug {
-			log.Printf("dnscache: %q resolved to private IP %v; using but not caching", host, ip)
-		}
 		return ip
 	}
 
-	if debug {
-		log.Printf("dnscache: %q resolved to IP %v; caching", host, ip)
-	}
-
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	if r.ipCache == nil {
@@ -243,26 +168,3 @@ var (
 	private2 = mustCIDR("172.16.0.0/12")
 	private3 = mustCIDR("192.168.0.0/16")
 )
-
-type DialContextFunc func(ctx context.Context, network, address string) (net.Conn, error)
-
-// Dialer returns a wrapped DialContext func that uses the provided dnsCache.
-func Dialer(fwd DialContextFunc, dnsCache *Resolver) DialContextFunc {
-	return func(ctx context.Context, network, address string) (net.Conn, error) {
-		host, port, err := net.SplitHostPort(address)
-		if err != nil {
-			// Bogus. But just let the real dialer return an error rather than
-			// inventing a similar one.
-			return fwd(ctx, network, address)
-		}
-		ip, err := dnsCache.LookupIP(ctx, host)
-		if err != nil {
-			return nil, fmt.Errorf("failed to resolve %q: %w", host, err)
-		}
-		dst := net.JoinHostPort(ip.String(), port)
-		if debug {
-			log.Printf("dnscache: dialing %s, %s for %s", network, dst, address)
-		}
-		return fwd(ctx, network, dst)
-	}
-}

net/interfaces/interfaces.go

@@ -8,20 +8,13 @@ package interfaces
 import (
 	"fmt"
 	"net"
-	"net/http"
 	"reflect"
-	"sort"
 	"strings"
 
 	"inet.af/netaddr"
 	"tailscale.com/net/tsaddr"
-	"tailscale.com/net/tshttpproxy"
 )
 
-// LoginEndpointForProxyDetermination is the URL used for testing
-// which HTTP proxy the system should use.
-var LoginEndpointForProxyDetermination = "https://login.tailscale.com/"
-
 // Tailscale returns the current machine's Tailscale interface, if any.
 // If none is found, all zero values are returned.
 // A non-nil error is only returned on a problem listing the system interfaces.
@@ -50,8 +43,7 @@ func Tailscale() (net.IP, *net.Interface, error) {
 // maybeTailscaleInterfaceName reports whether s is an interface
 // name that might be used by Tailscale.
 func maybeTailscaleInterfaceName(s string) bool {
-	return s == "Tailscale" ||
-		strings.HasPrefix(s, "wg") ||
+	return strings.HasPrefix(s, "wg") ||
 		strings.HasPrefix(s, "ts") ||
 		strings.HasPrefix(s, "tailscale") ||
 		strings.HasPrefix(s, "utun")
@@ -161,118 +153,35 @@ type State struct {
 	InterfaceUp  map[string]bool
 
 	// HaveV6Global is whether this machine has an IPv6 global address
-	// on some non-Tailscale interface that's up.
+	// on some interface.
 	HaveV6Global bool
 
-	// HaveV4 is whether the machine has some non-localhost,
-	// non-link-local IPv4 address on a non-Tailscale interface that's up.
+	// HaveV4 is whether the machine has some non-localhost IPv4 address.
 	HaveV4 bool
 
 	// IsExpensive is whether the current network interface is
 	// considered "expensive", which currently means LTE/etc
 	// instead of Wifi. This field is not populated by GetState.
 	IsExpensive bool
-
-	// DefaultRouteInterface is the interface name for the machine's default route.
-	// It is not yet populated on all OSes.
-	// Its exact value should not be assumed to be a map key for
-	// the Interface maps above; it's only used for debugging.
-	DefaultRouteInterface string
-
-	// HTTPProxy is the HTTP proxy to use.
-	HTTPProxy string
-
-	// PAC is the URL to the Proxy Autoconfig URL, if applicable.
-	PAC string
-}
-
-func (s *State) String() string {
-	var sb strings.Builder
-	fmt.Fprintf(&sb, "interfaces.State{defaultRoute=%v ifs={", s.DefaultRouteInterface)
-	ifs := make([]string, 0, len(s.InterfaceUp))
-	for k := range s.InterfaceUp {
-		if allLoopbackIPs(s.InterfaceIPs[k]) {
-			continue
-		}
-		ifs = append(ifs, k)
-	}
-	sort.Slice(ifs, func(i, j int) bool {
-		upi, upj := s.InterfaceUp[ifs[i]], s.InterfaceUp[ifs[j]]
-		if upi != upj {
-			// Up sorts before down.
-			return upi
-		}
-		return ifs[i] < ifs[j]
-	})
-	for i, ifName := range ifs {
-		if i > 0 {
-			sb.WriteString(" ")
-		}
-		if s.InterfaceUp[ifName] {
-			fmt.Fprintf(&sb, "%s:[", ifName)
-			needSpace := false
-			for _, ip := range s.InterfaceIPs[ifName] {
-				if ip.IsLinkLocalUnicast() {
-					continue
-				}
-				if needSpace {
-					sb.WriteString(" ")
-				}
-				fmt.Fprintf(&sb, "%s", ip)
-				needSpace = true
-			}
-			sb.WriteString("]")
-		} else {
-			fmt.Fprintf(&sb, "%s:down", ifName)
-		}
-	}
-	sb.WriteString("}")
-
-	if s.IsExpensive {
-		sb.WriteString(" expensive")
-	}
-	if s.HTTPProxy != "" {
-		fmt.Fprintf(&sb, " httpproxy=%s", s.HTTPProxy)
-	}
-	if s.PAC != "" {
-		fmt.Fprintf(&sb, " pac=%s", s.PAC)
-	}
-	fmt.Fprintf(&sb, " v4=%v v6global=%v}", s.HaveV4, s.HaveV6Global)
-	return sb.String()
 }
 
 func (s *State) Equal(s2 *State) bool {
 	return reflect.DeepEqual(s, s2)
 }
 
-func (s *State) HasPAC() bool { return s != nil && s.PAC != "" }
-
-// AnyInterfaceUp reports whether any interface seems like it has Internet access.
-func (s *State) AnyInterfaceUp() bool {
-	return s != nil && (s.HaveV4 || s.HaveV6Global)
-}
-
 // RemoveTailscaleInterfaces modifes s to remove any interfaces that
 // are owned by this process. (TODO: make this true; currently it
 // makes the Linux-only assumption that the interface is named
 // /^tailscale/)
 func (s *State) RemoveTailscaleInterfaces() {
 	for name := range s.InterfaceIPs {
-		if isTailscaleInterfaceName(name) {
+		if strings.HasPrefix(name, "tailscale") { // TODO: use --tun flag value, etc; see TODO in method doc
 			delete(s.InterfaceIPs, name)
 			delete(s.InterfaceUp, name)
 		}
 	}
 }
 
-func isTailscaleInterfaceName(name string) bool {
-	return name == "Tailscale" || // as it is on Windows
-		strings.HasPrefix(name, "tailscale") // TODO: use --tun flag value, etc; see TODO in method doc
-}
-
-// getPAC, if non-nil, returns the current PAC file URL.
-var getPAC func() string
-
 // GetState returns the state of all the current machine's network interfaces.
 //
 // It does not set the returned State.IsExpensive. The caller can populate that.
@@ -282,31 +191,13 @@ func GetState() (*State, error) {
 		InterfaceUp:  make(map[string]bool),
 	}
 	if err := ForeachInterfaceAddress(func(ni Interface, ip netaddr.IP) {
-		ifUp := ni.IsUp()
 		s.InterfaceIPs[ni.Name] = append(s.InterfaceIPs[ni.Name], ip)
-		s.InterfaceUp[ni.Name] = ifUp
-		if ifUp && !ip.IsLoopback() && !ip.IsLinkLocalUnicast() && !isTailscaleInterfaceName(ni.Name) {
-			s.HaveV6Global = s.HaveV6Global || isGlobalV6(ip)
-			s.HaveV4 = s.HaveV4 || ip.Is4()
-		}
+		s.InterfaceUp[ni.Name] = ni.IsUp()
+		s.HaveV6Global = s.HaveV6Global || isGlobalV6(ip)
+		s.HaveV4 = s.HaveV4 || (ip.Is4() && !ip.IsLoopback())
 	}); err != nil {
 		return nil, err
 	}
-	s.DefaultRouteInterface, _ = DefaultRouteInterface()
-
-	if s.AnyInterfaceUp() {
-		req, err := http.NewRequest("GET", LoginEndpointForProxyDetermination, nil)
-		if err != nil {
-			return nil, err
-		}
-		if u, err := tshttpproxy.ProxyFromEnvironment(req); err == nil && u != nil {
-			s.HTTPProxy = u.String()
-		}
-		if getPAC != nil {
-			s.PAC = getPAC()
-		}
-	}
-
 	return s, nil
 }
 
@@ -396,15 +287,3 @@ var (
 	linkLocalIPv4 = mustCIDR("169.254.0.0/16")
 	v6Global1     = mustCIDR("2000::/3")
 )
-
-func allLoopbackIPs(ips []netaddr.IP) bool {
-	if len(ips) == 0 {
-		return false
-	}
-	for _, ip := range ips {
-		if !ip.IsLoopback() {
-			return false
-		}
-	}
-	return true
-}

net/interfaces/interfaces_darwin.go

@@ -5,7 +5,6 @@
 package interfaces
 
 import (
-	"errors"
 	"os/exec"
 
 	"go4.org/mem"
@@ -63,12 +62,8 @@ func likelyHomeRouterIPDarwinExec() (ret netaddr.IP, ok bool) {
 		ip, err := netaddr.ParseIP(string(mem.Append(nil, ipm)))
 		if err == nil && isPrivateIP(ip) {
 			ret = ip
-			// We've found what we're looking for.
-			return stopReadingNetstatTable
 		}
 		return nil
 	})
 	return ret, !ret.IsZero()
 }
-
-var stopReadingNetstatTable = errors.New("found private gateway")

net/interfaces/interfaces_darwin_cgo.go

@@ -105,6 +105,8 @@ import "C"
 
 import (
 	"encoding/binary"
+	"fmt"
+	"os"
 
 	"inet.af/netaddr"
 )
@@ -115,6 +117,7 @@ func init() {
 
 func likelyHomeRouterIPDarwinSyscall() (ret netaddr.IP, ok bool) {
 	ip := C.privateGatewayIP()
+	fmt.Fprintln(os.Stderr, "likelyHomeRouterIPDarwinSyscall", ip)
 	if ip < 255 {
 		return netaddr.IP{}, false
 	}

net/interfaces/interfaces_defaultrouteif_todo.go

@@ -1,15 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !linux,!windows
-
-package interfaces
-
-import "errors"
-
-var errTODO = errors.New("TODO")
-
-func DefaultRouteInterface() (string, error) {
-	return "TODO", errTODO
-}

net/interfaces/interfaces_test.go

@@ -35,7 +35,6 @@ func TestGetState(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Logf("Got: %#v", st)
-	t.Logf("As string: %s", st)
 
 	st2, err := GetState()
 	if err != nil {
@@ -47,9 +46,6 @@ func TestGetState(t *testing.T) {
 		// the two GetState calls.
 		t.Fatal("two States back-to-back were not equal")
 	}
-
-	st.RemoveTailscaleInterfaces()
-	t.Logf("As string without Tailscale:\n\t%s", st)
 }
 
 func TestLikelyHomeRouterIP(t *testing.T) {

net/interfaces/interfaces_windows.go

@@ -5,24 +5,16 @@
 package interfaces
 
 import (
-	"fmt"
-	"log"
-	"net/url"
 	"os/exec"
 	"syscall"
-	"unsafe"
 
 	"go4.org/mem"
-	"golang.org/x/sys/windows"
-	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 	"inet.af/netaddr"
-	"tailscale.com/tsconst"
 	"tailscale.com/util/lineread"
 )
 
 func init() {
 	likelyHomeRouterIP = likelyHomeRouterIPWindows
-	getPAC = getPACWindows
 }
 
 /*
@@ -79,118 +71,3 @@ func likelyHomeRouterIPWindows() (ret netaddr.IP, ok bool) {
 	})
 	return ret, !ret.IsZero()
 }
-
-// NonTailscaleMTUs returns a map of interface LUID to interface MTU,
-// for all interfaces except Tailscale tunnels.
-func NonTailscaleMTUs() (map[winipcfg.LUID]uint32, error) {
-	mtus := map[winipcfg.LUID]uint32{}
-	ifs, err := NonTailscaleInterfaces()
-	for luid, iface := range ifs {
-		mtus[luid] = iface.MTU
-	}
-	return mtus, err
-}
-
-// NonTailscaleInterfaces returns a map of interface LUID to interface
-// for all interfaces except Tailscale tunnels.
-func NonTailscaleInterfaces() (map[winipcfg.LUID]*winipcfg.IPAdapterAddresses, error) {
-	ifs, err := winipcfg.GetAdaptersAddresses(windows.AF_UNSPEC, winipcfg.GAAFlagIncludeAllInterfaces)
-	if err != nil {
-		return nil, err
-	}
-
-	ret := map[winipcfg.LUID]*winipcfg.IPAdapterAddresses{}
-	for _, iface := range ifs {
-		if iface.Description() == tsconst.WintunInterfaceDesc {
-			continue
-		}
-		ret[iface.LUID] = iface
-	}
-
-	return ret, nil
-}
-
-// GetWindowsDefault returns the interface that has the non-Tailscale
-// default route for the given address family.
-//
-// It returns (nil, nil) if no interface is found.
-func GetWindowsDefault(family winipcfg.AddressFamily) (*winipcfg.IPAdapterAddresses, error) {
-	ifs, err := NonTailscaleInterfaces()
-	if err != nil {
-		return nil, err
-	}
-
-	routes, err := winipcfg.GetIPForwardTable2(family)
-	if err != nil {
-		return nil, err
-	}
-
-	bestMetric := ^uint32(0)
-	var bestIface *winipcfg.IPAdapterAddresses
-	for _, route := range routes {
-		iface := ifs[route.InterfaceLUID]
-		if route.DestinationPrefix.PrefixLength != 0 || iface == nil {
-			continue
-		}
-		if iface.OperStatus == winipcfg.IfOperStatusUp && route.Metric < bestMetric {
-			bestMetric = route.Metric
-			bestIface = iface
-		}
-	}
-
-	return bestIface, nil
-}
-
-func DefaultRouteInterface() (string, error) {
-	iface, err := GetWindowsDefault(windows.AF_INET)
-	if err != nil {
-		return "", err
-	}
-	if iface == nil {
-		return "(none)", nil
-	}
-	return fmt.Sprintf("%s (%s)", iface.FriendlyName(), iface.Description()), nil
-}
-
-var (
-	winHTTP                  = windows.NewLazySystemDLL("winhttp.dll")
-	detectAutoProxyConfigURL = winHTTP.NewProc("WinHttpDetectAutoProxyConfigUrl")
-
-	kernel32   = windows.NewLazySystemDLL("kernel32.dll")
-	globalFree = kernel32.NewProc("GlobalFree")
-)
-
-const (
-	winHTTP_AUTO_DETECT_TYPE_DHCP  = 0x00000001
-	winHTTP_AUTO_DETECT_TYPE_DNS_A = 0x00000002
-)
-
-func getPACWindows() string {
-	var res *uint16
-	r, _, e := detectAutoProxyConfigURL.Call(
-		winHTTP_AUTO_DETECT_TYPE_DHCP|winHTTP_AUTO_DETECT_TYPE_DNS_A,
-		uintptr(unsafe.Pointer(&res)),
-	)
-	if r == 1 {
-		if res == nil {
-			log.Printf("getPACWindows: unexpected success with nil result")
-			return ""
-		}
-		defer globalFree.Call(uintptr(unsafe.Pointer(res)))
-		s := windows.UTF16PtrToString(res)
-		if _, err := url.Parse(s); err != nil {
-			log.Printf("getPACWindows: invalid URL %q from winhttp; ignoring", s)
-			return ""
-		}
-		return s
-	}
-	const (
-		ERROR_WINHTTP_AUTODETECTION_FAILED = 12180
-	)
-	if e == syscall.Errno(ERROR_WINHTTP_AUTODETECTION_FAILED) {
-		// Common case on networks without advertised PAC.
-		return ""
-	}
-	log.Printf("getPACWindows: %T=%v", e, e) // syscall.Errno=0x....
-	return ""
-}

net/interfaces/interfaces_windows_test.go

@@ -1,17 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package interfaces
-
-import "testing"
-
-func BenchmarkGetPACWindows(b *testing.B) {
-	b.ReportAllocs()
-	for i := 0; i < b.N; i++ {
-		v := getPACWindows()
-		if i == 0 {
-			b.Logf("Got: %q", v)
-		}
-	}
-}

net/netcheck/netcheck.go

@@ -28,6 +28,7 @@ import (
 	"go4.org/mem"
 	"inet.af/netaddr"
 	"tailscale.com/derp/derphttp"
+	"tailscale.com/net/dnscache"
 	"tailscale.com/net/interfaces"
 	"tailscale.com/net/netns"
 	"tailscale.com/net/stun"
@@ -133,6 +134,10 @@ func cloneDurationMap(m map[int]time.Duration) map[int]time.Duration {
 
 // Client generates a netcheck Report.
 type Client struct {
+	// DNSCache optionally specifies a DNSCache to use.
+	// If nil, a DNS cache is not used.
+	DNSCache *dnscache.Resolver
+
 	// Verbose enables verbose logging.
 	Verbose bool
 
@@ -151,15 +156,6 @@ type Client struct {
 	// GetSTUNConn6 is like GetSTUNConn4, but for IPv6.
 	GetSTUNConn6 func() STUNConn
 
-	// SkipExternalNetwork controls whether the client should not try
-	// to reach things other than localhost. This is set to true
-	// in tests to avoid probing the local LAN's router, etc.
-	SkipExternalNetwork bool
-
-	// UDPBindAddr, if non-empty, is the address to listen on for UDP.
-	// It defaults to ":0".
-	UDPBindAddr string
-
 	mu       sync.Mutex            // guards following
 	nextFull bool                  // do a full region scan, even if last != nil
 	prev     map[time.Time]*Report // some previous reports
@@ -175,15 +171,6 @@ type STUNConn interface {
 	ReadFrom([]byte) (int, net.Addr, error)
 }
 
-func (c *Client) enoughRegions() int {
-	if c.Verbose {
-		// Abuse verbose a bit here so netcheck can show all region latencies
-		// in verbose mode.
-		return 100
-	}
-	return 3
-}
-
 func (c *Client) logf(format string, a ...interface{}) {
 	if c.Logf != nil {
 		c.Logf(format, a...)
@@ -240,6 +227,7 @@ func (c *Client) ReceiveSTUNPacket(pkt []byte, src netaddr.IPPort) {
 
 	tx, addr, port, err := stun.ParseResponse(pkt)
 	if err != nil {
+		c.mu.Unlock()
 		if _, err := stun.ParseBindingRequest(pkt); err == nil {
 			// This was probably our own netcheck hairpin
 			// check probe coming in late. Ignore.
@@ -627,13 +615,12 @@ func (rs *reportState) addNodeLatency(node *tailcfg.DERPNode, ipp netaddr.IPPort
 	ret.UDP = true
 	updateLatency(ret.RegionLatency, node.RegionID, d)
 
-	// Once we've heard from enough regions (3), start a timer to
-	// give up on the other ones. The timer's duration is a
-	// function of whether this is our initial full probe or an
-	// incremental one. For incremental ones, wait for the
-	// duration of the slowest region. For initial ones, double
-	// that.
-	if len(ret.RegionLatency) == rs.c.enoughRegions() {
+	// Once we've heard from 3 regions, start a timer to give up
+	// on the other ones.  The timer's duration is a function of
+	// whether this is our initial full probe or an incremental
+	// one. For incremental ones, wait for the duration of the
+	// slowest region. For initial ones, double that.
+	if len(ret.RegionLatency) == 3 {
 		timeout := maxDurationValue(ret.RegionLatency)
 		if !rs.incremental {
 			timeout *= 2
@@ -776,13 +763,6 @@ func newReport() *Report {
 	}
 }
 
-func (c *Client) udpBindAddr() string {
-	if v := c.UDPBindAddr; v != "" {
-		return v
-	}
-	return ":0"
-}
-
 // GetReport gets a report.
 //
 // It may not be called concurrently with itself.
@@ -842,10 +822,8 @@ func (c *Client) GetReport(ctx context.Context, dm *tailcfg.DERPMap) (*Report, e
 	}
 	defer rs.pc4Hair.Close()
 
-	if !c.SkipExternalNetwork {
-		rs.waitPortMap.Add(1)
-		go rs.probePortMapServices()
-	}
+	rs.waitPortMap.Add(1)
+	go rs.probePortMapServices()
 
 	// At least the Apple Airport Extreme doesn't allow hairpin
 	// sends from a private socket until it's seen traffic from
@@ -863,7 +841,7 @@ func (c *Client) GetReport(ctx context.Context, dm *tailcfg.DERPMap) (*Report, e
 	if f := c.GetSTUNConn4; f != nil {
 		rs.pc4 = f()
 	} else {
-		u4, err := netns.Listener().ListenPacket(ctx, "udp4", c.udpBindAddr())
+		u4, err := netns.Listener().ListenPacket(ctx, "udp4", ":0")
 		if err != nil {
 			c.logf("udp4: %v", err)
 			return nil, err
@@ -876,7 +854,7 @@ func (c *Client) GetReport(ctx context.Context, dm *tailcfg.DERPMap) (*Report, e
 		if f := c.GetSTUNConn6; f != nil {
 			rs.pc6 = f()
 		} else {
-			u6, err := netns.Listener().ListenPacket(ctx, "udp6", c.udpBindAddr())
+			u6, err := netns.Listener().ListenPacket(ctx, "udp6", ":0")
 			if err != nil {
 				c.logf("udp6: %v", err)
 			} else {
@@ -915,10 +893,8 @@ func (c *Client) GetReport(ctx context.Context, dm *tailcfg.DERPMap) (*Report, e
 
 	rs.waitHairCheck(ctx)
 	c.vlogf("hairCheck done")
-	if !c.SkipExternalNetwork {
-		rs.waitPortMap.Wait()
-		c.vlogf("portMap done")
-	}
+	rs.waitPortMap.Wait()
+	c.vlogf("portMap done")
 	rs.stopTimers()
 
 	// Try HTTPS latency check if all STUN probes failed due to UDP presumably being blocked.

net/netcheck/netcheck_test.go

@@ -50,8 +50,7 @@ func TestBasic(t *testing.T) {
 	defer cleanup()
 
 	c := &Client{
-		Logf:        t.Logf,
-		UDPBindAddr: "127.0.0.1:0",
+		Logf: t.Logf,
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)

net/netns/netns_default.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !linux,!windows
+// +build !linux
 
 package netns
 

net/netns/netns_windows.go

@@ -1,121 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package netns
-
-import (
-	"math/bits"
-	"strings"
-	"syscall"
-
-	"golang.org/x/sys/windows"
-	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
-	"tailscale.com/net/interfaces"
-	"tailscale.com/util/endian"
-)
-
-func interfaceIndex(iface *winipcfg.IPAdapterAddresses) uint32 {
-	if iface == nil {
-		// The zero ifidx means "unspecified". If we end up passing zero
-		// to bindSocket*(), it unsets the binding and lets the socket
-		// behave as normal again, which is what we want if there's no
-		// default route we can use.
-		return 0
-	}
-	return iface.IfIndex
-}
-
-// control binds c to the Windows interface that holds a default
-// route, and is not the Tailscale WinTun interface.
-func control(network, address string, c syscall.RawConn) error {
-	if strings.HasPrefix(address, "127.") {
-		// Don't bind to an interface for localhost connections,
-		// otherwise we get:
-		//   connectex: The requested address is not valid in its context
-		// (The derphttp tests were failing)
-		return nil
-	}
-	canV4, canV6 := false, false
-	switch network {
-	case "tcp", "udp":
-		canV4, canV6 = true, true
-	case "tcp4", "udp4":
-		canV4 = true
-	case "tcp6", "udp6":
-		canV6 = true
-	}
-
-	if canV4 {
-		iface, err := interfaces.GetWindowsDefault(windows.AF_INET)
-		if err != nil {
-			return err
-		}
-		if err := bindSocket4(c, interfaceIndex(iface)); err != nil {
-			return err
-		}
-	}
-
-	if canV6 {
-		iface, err := interfaces.GetWindowsDefault(windows.AF_INET6)
-		if err != nil {
-			return err
-		}
-		if err := bindSocket6(c, interfaceIndex(iface)); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// sockoptBoundInterface is the value of IP_UNICAST_IF and IPV6_UNICAST_IF.
-//
-// See https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
-// and https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ipv6-socket-options
-const sockoptBoundInterface = 31
-
-// bindSocket4 binds the given RawConn to the network interface with
-// index ifidx, for IPv4 traffic only.
-func bindSocket4(c syscall.RawConn, ifidx uint32) error {
-	// For IPv4 (but NOT IPv6) the interface index must be passed
-	// as a big-endian integer (regardless of platform endianness)
-	// because the underlying sockopt takes either an IPv4 address
-	// or an index shoved into IPv4 address representation (an IP
-	// in 0.0.0.0/8 means it's actually an index).
-	//
-	// See https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
-	// and IP_UNICAST_IF.
-	indexAsAddr := nativeToBigEndian(ifidx)
-	var controlErr error
-	err := c.Control(func(fd uintptr) {
-		controlErr = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, sockoptBoundInterface, int(indexAsAddr))
-	})
-	if err != nil {
-		return err
-	}
-	return controlErr
-}
-
-// bindSocket6 binds the given RawConn to the network interface with
-// index ifidx, for IPv6 traffic only.
-func bindSocket6(c syscall.RawConn, ifidx uint32) error {
-	var controlErr error
-	err := c.Control(func(fd uintptr) {
-		controlErr = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, sockoptBoundInterface, int(ifidx))
-	})
-	if err != nil {
-		return err
-	}
-	return controlErr
-}
-
-// nativeToBigEndian returns i converted into big-endian
-// representation, suitable for passing to Windows APIs that require a
-// mangled uint32.
-func nativeToBigEndian(i uint32) uint32 {
-	if endian.Big {
-		return i
-	}
-	return bits.ReverseBytes32(i)
-}

net/netstat/netstat.go

@@ -1,36 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package netstat returns the local machine's network connection table.
-package netstat
-
-import (
-	"errors"
-	"runtime"
-
-	"inet.af/netaddr"
-)
-
-var ErrNotImplemented = errors.New("not implemented for GOOS=" + runtime.GOOS)
-
-type Entry struct {
-	Local, Remote netaddr.IPPort
-	Pid           int
-	State         string // TODO: type?
-}
-
-// Table contains local machine's TCP connection entries.
-//
-// Currently only TCP (IPv4 and IPv6) are included.
-type Table struct {
-	Entries []Entry
-}
-
-// Get returns the connection table.
-//
-// It returns ErrNotImplemented if the table is not available for the
-// current operating system.
-func Get() (*Table, error) {
-	return get()
-}

net/netstat/netstat_noimpl.go

@@ -1,11 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !windows
-
-package netstat
-
-func get() (*Table, error) {
-	return nil, ErrNotImplemented
-}

net/netstat/netstat_test.go

@@ -1,22 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package netstat
-
-import (
-	"testing"
-)
-
-func TestGet(t *testing.T) {
-	nt, err := Get()
-	if err == ErrNotImplemented {
-		t.Skip("TODO: not implemented")
-	}
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, e := range nt.Entries {
-		t.Logf("Entry: %+v", e)
-	}
-}

net/netstat/netstat_windows.go

@@ -1,183 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package netstat returns the local machine's network connection table.
-package netstat
-
-import (
-	"errors"
-	"fmt"
-	"math/bits"
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-	"inet.af/netaddr"
-	"tailscale.com/util/endian"
-)
-
-// See https://docs.microsoft.com/en-us/windows/win32/api/iphlpapi/nf-iphlpapi-getextendedtcptable
-
-// TCP_TABLE_OWNER_PID_ALL means to include the PID info. The table type
-// we get back from Windows depends on AF_INET vs AF_INET6:
-// MIB_TCPTABLE_OWNER_PID for v4 or MIB_TCP6TABLE_OWNER_PID for v6.
-const tcpTableOwnerPidAll = 5
-
-var (
-	iphlpapi    = syscall.NewLazyDLL("iphlpapi.dll")
-	getTCPTable = iphlpapi.NewProc("GetExtendedTcpTable")
-	// TODO: GetExtendedUdpTable also? if/when needed.
-)
-
-type _MIB_TCPROW_OWNER_PID struct {
-	state      uint32
-	localAddr  uint32
-	localPort  uint32
-	remoteAddr uint32
-	remotePort uint32
-	pid        uint32
-}
-
-type _MIB_TCP6ROW_OWNER_PID struct {
-	localAddr   [16]byte
-	localScope  uint32
-	localPort   uint32
-	remoteAddr  [16]byte
-	remoteScope uint32
-	remotePort  uint32
-	state       uint32
-	pid         uint32
-}
-
-func get() (*Table, error) {
-	t := new(Table)
-	if err := t.addEntries(windows.AF_INET); err != nil {
-		return nil, fmt.Errorf("failed to get IPv4 entries: %w", err)
-	}
-	if err := t.addEntries(windows.AF_INET6); err != nil {
-		return nil, fmt.Errorf("failed to get IPv6 entries: %w", err)
-	}
-	return t, nil
-}
-
-func (t *Table) addEntries(fam int) error {
-	var size uint32
-	var addr unsafe.Pointer
-	var buf []byte
-	for {
-		err, _, _ := getTCPTable.Call(
-			uintptr(addr),
-			uintptr(unsafe.Pointer(&size)),
-			1, // sorted
-			uintptr(fam),
-			tcpTableOwnerPidAll,
-			0, // reserved; "must be zero"
-		)
-		if err == 0 {
-			break
-		}
-		if err == uintptr(syscall.ERROR_INSUFFICIENT_BUFFER) {
-			const maxSize = 10 << 20
-			if size > maxSize || size < 4 {
-				return fmt.Errorf("unreasonable kernel-reported size %d", size)
-			}
-			buf = make([]byte, size)
-			addr = unsafe.Pointer(&buf[0])
-			continue
-		}
-		return syscall.Errno(err)
-	}
-	if len(buf) < int(size) {
-		return errors.New("unexpected size growth from system call")
-	}
-	buf = buf[:size]
-
-	numEntries := endian.Native.Uint32(buf[:4])
-	buf = buf[4:]
-
-	var recSize int
-	switch fam {
-	case windows.AF_INET:
-		recSize = 6 * 4
-	case windows.AF_INET6:
-		recSize = 6*4 + 16*2
-	}
-	dataLen := numEntries * uint32(recSize)
-	if uint32(len(buf)) > dataLen {
-		buf = buf[:dataLen]
-	}
-	for len(buf) >= recSize {
-		switch fam {
-		case windows.AF_INET:
-			row := (*_MIB_TCPROW_OWNER_PID)(unsafe.Pointer(&buf[0]))
-			t.Entries = append(t.Entries, Entry{
-				Local:  ipport4(row.localAddr, port(&row.localPort)),
-				Remote: ipport4(row.remoteAddr, port(&row.remotePort)),
-				Pid:    int(row.pid),
-				State:  state(row.state),
-			})
-		case windows.AF_INET6:
-			row := (*_MIB_TCP6ROW_OWNER_PID)(unsafe.Pointer(&buf[0]))
-			t.Entries = append(t.Entries, Entry{
-				Local:  ipport6(row.localAddr, row.localScope, port(&row.localPort)),
-				Remote: ipport6(row.remoteAddr, row.remoteScope, port(&row.remotePort)),
-				Pid:    int(row.pid),
-				State:  state(row.state),
-			})
-		}
-		buf = buf[recSize:]
-	}
-	return nil
-}
-
-var states = []string{
-	"",
-	"CLOSED",
-	"LISTEN",
-	"SYN-SENT",
-	"SYN-RECEIVED",
-	"ESTABLISHED",
-	"FIN-WAIT-1",
-	"FIN-WAIT-2",
-	"CLOSE-WAIT",
-	"CLOSING",
-	"LAST-ACK",
-	"DELETE-TCB",
-}
-
-func state(v uint32) string {
-	if v < uint32(len(states)) {
-		return states[v]
-	}
-	return fmt.Sprintf("unknown-state-%d", v)
-}
-
-func ipport4(addr uint32, port uint16) netaddr.IPPort {
-	if !endian.Big {
-		addr = bits.ReverseBytes32(addr)
-	}
-	return netaddr.IPPort{
-		IP:   netaddr.IPv4(byte(addr>>24), byte(addr>>16), byte(addr>>8), byte(addr)),
-		Port: port,
-	}
-}
-
-func ipport6(addr [16]byte, scope uint32, port uint16) netaddr.IPPort {
-	ip := netaddr.IPFrom16(addr)
-	if scope != 0 {
-		// TODO: something better here?
-		ip = ip.WithZone(fmt.Sprint(scope))
-	}
-	return netaddr.IPPort{
-		IP:   ip,
-		Port: port,
-	}
-}
-
-func port(v *uint32) uint16 {
-	if !endian.Big {
-		return uint16(bits.ReverseBytes32(*v) >> 16)
-	}
-	return uint16(*v >> 16)
-}

net/packet/doc.go

@@ -1,16 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package packet contains packet parsing and marshaling utilities.
-//
-// Parsed provides allocation-free minimal packet header decoding, for
-// use in packet filtering. The other types in the package are for
-// constructing and marshaling packets into []bytes.
-//
-// To support allocation-free parsing, this package defines IPv4 and
-// IPv6 address types. You should prefer to use netaddr's types,
-// except where you absolutely need allocation-free IP handling
-// (i.e. in the tunnel datapath) and are willing to implement all
-// codepaths and data structures twice, once per IP family.
-package packet

net/packet/icmp4.go

@@ -1,90 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import "encoding/binary"
-
-// icmp4HeaderLength is the size of the ICMPv4 packet header, not
-// including the outer IP layer or the variable "response data"
-// trailer.
-const icmp4HeaderLength = 4
-
-// ICMP4Type is an ICMPv4 type, as specified in
-// https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
-type ICMP4Type uint8
-
-const (
-	ICMP4EchoReply    ICMP4Type = 0x00
-	ICMP4EchoRequest  ICMP4Type = 0x08
-	ICMP4Unreachable  ICMP4Type = 0x03
-	ICMP4TimeExceeded ICMP4Type = 0x0b
-)
-
-func (t ICMP4Type) String() string {
-	switch t {
-	case ICMP4EchoReply:
-		return "EchoReply"
-	case ICMP4EchoRequest:
-		return "EchoRequest"
-	case ICMP4Unreachable:
-		return "Unreachable"
-	case ICMP4TimeExceeded:
-		return "TimeExceeded"
-	default:
-		return "Unknown"
-	}
-}
-
-// ICMP4Code is an ICMPv4 code, as specified in
-// https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
-type ICMP4Code uint8
-
-const (
-	ICMP4NoCode ICMP4Code = 0
-)
-
-// ICMP4Header is an IPv4+ICMPv4 header.
-type ICMP4Header struct {
-	IP4Header
-	Type ICMP4Type
-	Code ICMP4Code
-}
-
-// Len implements Header.
-func (h ICMP4Header) Len() int {
-	return h.IP4Header.Len() + icmp4HeaderLength
-}
-
-// Marshal implements Header.
-func (h ICMP4Header) Marshal(buf []byte) error {
-	if len(buf) < h.Len() {
-		return errSmallBuffer
-	}
-	if len(buf) > maxPacketLength {
-		return errLargePacket
-	}
-	// The caller does not need to set this.
-	h.IPProto = ICMPv4
-
-	buf[20] = uint8(h.Type)
-	buf[21] = uint8(h.Code)
-
-	h.IP4Header.Marshal(buf)
-
-	binary.BigEndian.PutUint16(buf[22:24], ip4Checksum(buf))
-
-	return nil
-}
-
-// ToResponse implements Header. TODO: it doesn't implement it
-// correctly, instead it statically generates an ICMP Echo Reply
-// packet.
-func (h *ICMP4Header) ToResponse() {
-	// TODO: this doesn't implement ToResponse correctly, as it
-	// assumes the ICMP request type.
-	h.Type = ICMP4EchoReply
-	h.Code = ICMP4NoCode
-	h.IP4Header.ToResponse()
-}

net/packet/icmp6.go

@@ -1,44 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-// icmp6HeaderLength is the size of the ICMPv6 packet header, not
-// including the outer IP layer or the variable "response data"
-// trailer.
-const icmp6HeaderLength = 4
-
-// ICMP6Type is an ICMPv6 type, as specified in
-// https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
-type ICMP6Type uint8
-
-const (
-	ICMP6Unreachable  ICMP6Type = 1
-	ICMP6TimeExceeded ICMP6Type = 3
-	ICMP6EchoRequest  ICMP6Type = 128
-	ICMP6EchoReply    ICMP6Type = 129
-)
-
-func (t ICMP6Type) String() string {
-	switch t {
-	case ICMP6Unreachable:
-		return "Unreachable"
-	case ICMP6TimeExceeded:
-		return "TimeExceeded"
-	case ICMP6EchoRequest:
-		return "EchoRequest"
-	case ICMP6EchoReply:
-		return "EchoReply"
-	default:
-		return "Unknown"
-	}
-}
-
-// ICMP6Code is an ICMPv6 code, as specified in
-// https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
-type ICMP6Code uint8
-
-const (
-	ICMP6NoCode ICMP6Code = 0
-)

net/packet/ip.go

@@ -1,53 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-// IPProto is an IP subprotocol as defined by the IANA protocol
-// numbers list
-// (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml),
-// or the special values Unknown or Fragment.
-type IPProto uint8
-
-const (
-	// Unknown represents an unknown or unsupported protocol; it's
-	// deliberately the zero value. Strictly speaking the zero
-	// value is IPv6 hop-by-hop extensions, but we don't support
-	// those, so this is still technically correct.
-	Unknown IPProto = 0x00
-
-	// Values from the IANA registry.
-	ICMPv4 IPProto = 0x01
-	IGMP   IPProto = 0x02
-	ICMPv6 IPProto = 0x3a
-	TCP    IPProto = 0x06
-	UDP    IPProto = 0x11
-
-	// Fragment represents any non-first IP fragment, for which we
-	// don't have the sub-protocol header (and therefore can't
-	// figure out what the sub-protocol is).
-	//
-	// 0xFF is reserved in the IANA registry, so we steal it for
-	// internal use.
-	Fragment IPProto = 0xFF
-)
-
-func (p IPProto) String() string {
-	switch p {
-	case Fragment:
-		return "Frag"
-	case ICMPv4:
-		return "ICMPv4"
-	case IGMP:
-		return "IGMP"
-	case ICMPv6:
-		return "ICMPv6"
-	case UDP:
-		return "UDP"
-	case TCP:
-		return "TCP"
-	default:
-		return "Unknown"
-	}
-}

net/packet/ip4.go

@@ -1,144 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"encoding/binary"
-	"fmt"
-
-	"inet.af/netaddr"
-)
-
-// IP4 is an IPv4 address.
-type IP4 uint32
-
-// IPFromNetaddr converts a netaddr.IP to an IP4. Panics if !ip.Is4.
-func IP4FromNetaddr(ip netaddr.IP) IP4 {
-	ipbytes := ip.As4()
-	return IP4(binary.BigEndian.Uint32(ipbytes[:]))
-}
-
-// Netaddr converts ip to a netaddr.IP.
-func (ip IP4) Netaddr() netaddr.IP {
-	return netaddr.IPv4(byte(ip>>24), byte(ip>>16), byte(ip>>8), byte(ip))
-}
-
-func (ip IP4) String() string {
-	return fmt.Sprintf("%d.%d.%d.%d", byte(ip>>24), byte(ip>>16), byte(ip>>8), byte(ip))
-}
-
-// IsMulticast returns whether ip is a multicast address.
-func (ip IP4) IsMulticast() bool {
-	return byte(ip>>24)&0xf0 == 0xe0
-}
-
-// IsLinkLocalUnicast returns whether ip is a link-local unicast
-// address.
-func (ip IP4) IsLinkLocalUnicast() bool {
-	return byte(ip>>24) == 169 && byte(ip>>16) == 254
-}
-
-// IsMostLinkLocalUnicast returns whether ip is a link-local unicast
-// address other than the magical "169.254.169.254" address used by
-// GCP DNS.
-func (ip IP4) IsMostLinkLocalUnicast() bool {
-	return ip.IsLinkLocalUnicast() && ip != 0xA9FEA9FE
-}
-
-// ip4HeaderLength is the length of an IPv4 header with no IP options.
-const ip4HeaderLength = 20
-
-// IP4Header represents an IPv4 packet header.
-type IP4Header struct {
-	IPProto IPProto
-	IPID    uint16
-	SrcIP   IP4
-	DstIP   IP4
-}
-
-// Len implements Header.
-func (h IP4Header) Len() int {
-	return ip4HeaderLength
-}
-
-// Marshal implements Header.
-func (h IP4Header) Marshal(buf []byte) error {
-	if len(buf) < h.Len() {
-		return errSmallBuffer
-	}
-	if len(buf) > maxPacketLength {
-		return errLargePacket
-	}
-
-	buf[0] = 0x40 | (byte(h.Len() >> 2))                   // IPv4 + IHL
-	buf[1] = 0x00                                          // DSCP + ECN
-	binary.BigEndian.PutUint16(buf[2:4], uint16(len(buf))) // Total length
-	binary.BigEndian.PutUint16(buf[4:6], h.IPID)           // ID
-	binary.BigEndian.PutUint16(buf[6:8], 0)                // Flags + fragment offset
-	buf[8] = 64                                            // TTL
-	buf[9] = uint8(h.IPProto)                              // Inner protocol
-	// Blank checksum. This is necessary even though we overwrite
-	// it later, because the checksum computation runs over these
-	// bytes and expects them to be zero.
-	binary.BigEndian.PutUint16(buf[10:12], 0)
-	binary.BigEndian.PutUint32(buf[12:16], uint32(h.SrcIP)) // Src
-	binary.BigEndian.PutUint32(buf[16:20], uint32(h.DstIP)) // Dst
-
-	binary.BigEndian.PutUint16(buf[10:12], ip4Checksum(buf[0:20])) // Checksum
-
-	return nil
-}
-
-// ToResponse implements Header.
-func (h *IP4Header) ToResponse() {
-	h.SrcIP, h.DstIP = h.DstIP, h.SrcIP
-	// Flip the bits in the IPID. If incoming IPIDs are distinct, so are these.
-	h.IPID = ^h.IPID
-}
-
-// ip4Checksum computes an IPv4 checksum, as specified in
-// https://tools.ietf.org/html/rfc1071
-func ip4Checksum(b []byte) uint16 {
-	var ac uint32
-	i := 0
-	n := len(b)
-	for n >= 2 {
-		ac += uint32(binary.BigEndian.Uint16(b[i : i+2]))
-		n -= 2
-		i += 2
-	}
-	if n == 1 {
-		ac += uint32(b[i]) << 8
-	}
-	for (ac >> 16) > 0 {
-		ac = (ac >> 16) + (ac & 0xffff)
-	}
-	return uint16(^ac)
-}
-
-// ip4PseudoHeaderOffset is the number of bytes by which the IPv4 UDP
-// pseudo-header is smaller than the real IPv4 header.
-const ip4PseudoHeaderOffset = 8
-
-// marshalPseudo serializes h into buf in the "pseudo-header" form
-// required when calculating UDP checksums. The pseudo-header starts
-// at buf[ip4PseudoHeaderOffset] so as to abut the following UDP
-// header, while leaving enough space in buf for a full IPv4 header.
-func (h IP4Header) marshalPseudo(buf []byte) error {
-	if len(buf) < h.Len() {
-		return errSmallBuffer
-	}
-	if len(buf) > maxPacketLength {
-		return errLargePacket
-	}
-
-	length := len(buf) - h.Len()
-	binary.BigEndian.PutUint32(buf[8:12], uint32(h.SrcIP))
-	binary.BigEndian.PutUint32(buf[12:16], uint32(h.DstIP))
-	buf[16] = 0x0
-	buf[17] = uint8(h.IPProto)
-	binary.BigEndian.PutUint16(buf[18:20], uint16(length))
-	return nil
-}

net/packet/ip6.go

@@ -1,113 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"encoding/binary"
-	"fmt"
-
-	"inet.af/netaddr"
-)
-
-// IP6 is an IPv6 address.
-type IP6 struct {
-	Hi, Lo uint64
-}
-
-// IP6FromNetaddr converts a netaddr.IP to an IP6. Panics if !ip.Is6.
-func IP6FromNetaddr(ip netaddr.IP) IP6 {
-	if !ip.Is6() {
-		panic(fmt.Sprintf("IP6FromNetaddr called with non-v6 addr %q", ip))
-	}
-	b := ip.As16()
-	return IP6{binary.BigEndian.Uint64(b[:8]), binary.BigEndian.Uint64(b[8:])}
-}
-
-// Netaddr converts ip to a netaddr.IP.
-func (ip IP6) Netaddr() netaddr.IP {
-	var b [16]byte
-	binary.BigEndian.PutUint64(b[:8], ip.Hi)
-	binary.BigEndian.PutUint64(b[8:], ip.Lo)
-	return netaddr.IPFrom16(b)
-}
-
-func (ip IP6) String() string {
-	return ip.Netaddr().String()
-}
-
-func (ip IP6) IsMulticast() bool {
-	return (ip.Hi >> 56) == 0xFF
-}
-
-func (ip IP6) IsLinkLocalUnicast() bool {
-	return (ip.Hi >> 48) == 0xFE80
-}
-
-// ip6HeaderLength is the length of an IPv6 header with no IP options.
-const ip6HeaderLength = 40
-
-// IP6Header represents an IPv6 packet header.
-type IP6Header struct {
-	IPProto IPProto
-	IPID    uint32 // only lower 20 bits used
-	SrcIP   IP6
-	DstIP   IP6
-}
-
-// Len implements Header.
-func (h IP6Header) Len() int {
-	return ip6HeaderLength
-}
-
-// Marshal implements Header.
-func (h IP6Header) Marshal(buf []byte) error {
-	if len(buf) < h.Len() {
-		return errSmallBuffer
-	}
-	if len(buf) > maxPacketLength {
-		return errLargePacket
-	}
-
-	binary.BigEndian.PutUint32(buf[:4], h.IPID&0x000FFFFF)
-	buf[0] = 0x60
-	binary.BigEndian.PutUint16(buf[4:6], uint16(len(buf)-ip6HeaderLength)) // Total length
-	buf[6] = uint8(h.IPProto)                                              // Inner protocol
-	buf[7] = 64                                                            // TTL
-	binary.BigEndian.PutUint64(buf[8:16], h.SrcIP.Hi)
-	binary.BigEndian.PutUint64(buf[16:24], h.SrcIP.Lo)
-	binary.BigEndian.PutUint64(buf[24:32], h.DstIP.Hi)
-	binary.BigEndian.PutUint64(buf[32:40], h.DstIP.Lo)
-
-	return nil
-}
-
-// ToResponse implements Header.
-func (h *IP6Header) ToResponse() {
-	h.SrcIP, h.DstIP = h.DstIP, h.SrcIP
-	// Flip the bits in the IPID. If incoming IPIDs are distinct, so are these.
-	h.IPID = (^h.IPID) & 0x000FFFFF
-}
-
-// marshalPseudo serializes h into buf in the "pseudo-header" form
-// required when calculating UDP checksums.
-func (h IP6Header) marshalPseudo(buf []byte) error {
-	if len(buf) < h.Len() {
-		return errSmallBuffer
-	}
-	if len(buf) > maxPacketLength {
-		return errLargePacket
-	}
-
-	binary.BigEndian.PutUint64(buf[:8], h.SrcIP.Hi)
-	binary.BigEndian.PutUint64(buf[8:16], h.SrcIP.Lo)
-	binary.BigEndian.PutUint64(buf[16:24], h.DstIP.Hi)
-	binary.BigEndian.PutUint64(buf[24:32], h.DstIP.Lo)
-	binary.BigEndian.PutUint32(buf[32:36], uint32(len(buf)-h.Len()))
-	buf[36] = 0
-	buf[37] = 0
-	buf[38] = 0
-	buf[39] = 17 // NextProto
-	return nil
-}

net/packet/packet.go

@@ -1,434 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"encoding/binary"
-	"fmt"
-	"strings"
-
-	"tailscale.com/types/strbuilder"
-)
-
-// RFC1858: prevent overlapping fragment attacks.
-const minFrag = 60 + 20 // max IPv4 header + basic TCP header
-
-const (
-	TCPSyn    = 0x02
-	TCPAck    = 0x10
-	TCPSynAck = TCPSyn | TCPAck
-)
-
-// Parsed is a minimal decoding of a packet suitable for use in filters.
-type Parsed struct {
-	// b is the byte buffer that this decodes.
-	b []byte
-	// subofs is the offset of IP subprotocol.
-	subofs int
-	// dataofs is the offset of IP subprotocol payload.
-	dataofs int
-	// length is the total length of the packet.
-	// This is not the same as len(b) because b can have trailing zeros.
-	length int
-
-	// IPVersion is the IP protocol version of the packet (4 or
-	// 6), or 0 if the packet doesn't look like IPv4 or IPv6.
-	IPVersion uint8
-	// IPProto is the IP subprotocol (UDP, TCP, etc.). Valid iff IPVersion != 0.
-	IPProto IPProto
-	// SrcIP4 is the IPv4 source address. Valid iff IPVersion == 4.
-	SrcIP4 IP4
-	// DstIP4 is the IPv4 destination address. Valid iff IPVersion == 4.
-	DstIP4 IP4
-	// SrcIP6 is the IPv6 source address. Valid iff IPVersion == 6.
-	SrcIP6 IP6
-	// DstIP6 is the IPv6 destination address. Valid iff IPVersion == 6.
-	DstIP6 IP6
-	// SrcPort is the TCP/UDP source port. Valid iff IPProto == TCP || IPProto == UDP.
-	SrcPort uint16
-	// DstPort is the TCP/UDP source port. Valid iff IPProto == TCP || IPProto == UDP.
-	DstPort uint16
-	// TCPFlags is the packet's TCP flag bigs. Valid iff IPProto == TCP.
-	TCPFlags uint8
-}
-
-func (p *Parsed) String() string {
-	switch p.IPVersion {
-	case 4:
-		sb := strbuilder.Get()
-		sb.WriteString(p.IPProto.String())
-		sb.WriteByte('{')
-		writeIP4Port(sb, p.SrcIP4, p.SrcPort)
-		sb.WriteString(" > ")
-		writeIP4Port(sb, p.DstIP4, p.DstPort)
-		sb.WriteByte('}')
-		return sb.String()
-	case 6:
-		sb := strbuilder.Get()
-		sb.WriteString(p.IPProto.String())
-		sb.WriteByte('{')
-		writeIP6Port(sb, p.SrcIP6, p.SrcPort)
-		sb.WriteString(" > ")
-		writeIP6Port(sb, p.DstIP6, p.DstPort)
-		sb.WriteByte('}')
-		return sb.String()
-	default:
-		return "Unknown{???}"
-	}
-}
-
-func writeIP4Port(sb *strbuilder.Builder, ip IP4, port uint16) {
-	sb.WriteUint(uint64(byte(ip >> 24)))
-	sb.WriteByte('.')
-	sb.WriteUint(uint64(byte(ip >> 16)))
-	sb.WriteByte('.')
-	sb.WriteUint(uint64(byte(ip >> 8)))
-	sb.WriteByte('.')
-	sb.WriteUint(uint64(byte(ip)))
-	sb.WriteByte(':')
-	sb.WriteUint(uint64(port))
-}
-
-func writeIP6Port(sb *strbuilder.Builder, ip IP6, port uint16) {
-	sb.WriteByte('[')
-	sb.WriteString(ip.Netaddr().String()) // TODO: faster?
-	sb.WriteString("]:")
-	sb.WriteUint(uint64(port))
-}
-
-// Decode extracts data from the packet in b into q.
-// It performs extremely simple packet decoding for basic IPv4 packet types.
-// It extracts only the subprotocol id, IP addresses, and (if any) ports,
-// and shouldn't need any memory allocation.
-func (q *Parsed) Decode(b []byte) {
-	q.b = b
-
-	if len(b) < 1 {
-		q.IPVersion = 0
-		q.IPProto = Unknown
-		return
-	}
-
-	q.IPVersion = b[0] >> 4
-	switch q.IPVersion {
-	case 4:
-		q.decode4(b)
-	case 6:
-		q.decode6(b)
-	default:
-		q.IPVersion = 0
-		q.IPProto = Unknown
-	}
-}
-
-func (q *Parsed) decode4(b []byte) {
-	if len(b) < ip4HeaderLength {
-		q.IPVersion = 0
-		q.IPProto = Unknown
-		return
-	}
-
-	// Check that it's IPv4.
-	q.IPProto = IPProto(b[9])
-	q.length = int(binary.BigEndian.Uint16(b[2:4]))
-	if len(b) < q.length {
-		// Packet was cut off before full IPv4 length.
-		q.IPProto = Unknown
-		return
-	}
-
-	// If it's valid IPv4, then the IP addresses are valid
-	q.SrcIP4 = IP4(binary.BigEndian.Uint32(b[12:16]))
-	q.DstIP4 = IP4(binary.BigEndian.Uint32(b[16:20]))
-
-	q.subofs = int((b[0] & 0x0F) << 2)
-	if q.subofs > q.length {
-		// next-proto starts beyond end of packet.
-		q.IPProto = Unknown
-		return
-	}
-	sub := b[q.subofs:]
-	sub = sub[:len(sub):len(sub)] // help the compiler do bounds check elimination
-
-	// We don't care much about IP fragmentation, except insofar as it's
-	// used for firewall bypass attacks. The trick is make the first
-	// fragment of a TCP or UDP packet so short that it doesn't fit
-	// the TCP or UDP header, so we can't read the port, in hope that
-	// it'll sneak past. Then subsequent fragments fill it in, but we're
-	// missing the first part of the header, so we can't read that either.
-	//
-	// A "perfectly correct" implementation would have to reassemble
-	// fragments before deciding what to do. But the truth is there's
-	// zero reason to send such a short first fragment, so we can treat
-	// it as Unknown. We can also treat any subsequent fragment that starts
-	// at such a low offset as Unknown.
-	fragFlags := binary.BigEndian.Uint16(b[6:8])
-	moreFrags := (fragFlags & 0x20) != 0
-	fragOfs := fragFlags & 0x1FFF
-	if fragOfs == 0 {
-		// This is the first fragment
-		if moreFrags && len(sub) < minFrag {
-			// Suspiciously short first fragment, dump it.
-			q.IPProto = Unknown
-			return
-		}
-		// otherwise, this is either non-fragmented (the usual case)
-		// or a big enough initial fragment that we can read the
-		// whole subprotocol header.
-		switch q.IPProto {
-		case ICMPv4:
-			if len(sub) < icmp4HeaderLength {
-				q.IPProto = Unknown
-				return
-			}
-			q.SrcPort = 0
-			q.DstPort = 0
-			q.dataofs = q.subofs + icmp4HeaderLength
-			return
-		case IGMP:
-			// Keep IPProto, but don't parse anything else
-			// out.
-			return
-		case TCP:
-			if len(sub) < tcpHeaderLength {
-				q.IPProto = Unknown
-				return
-			}
-			q.SrcPort = binary.BigEndian.Uint16(sub[0:2])
-			q.DstPort = binary.BigEndian.Uint16(sub[2:4])
-			q.TCPFlags = sub[13] & 0x3F
-			headerLength := (sub[12] & 0xF0) >> 2
-			q.dataofs = q.subofs + int(headerLength)
-			return
-		case UDP:
-			if len(sub) < udpHeaderLength {
-				q.IPProto = Unknown
-				return
-			}
-			q.SrcPort = binary.BigEndian.Uint16(sub[0:2])
-			q.DstPort = binary.BigEndian.Uint16(sub[2:4])
-			q.dataofs = q.subofs + udpHeaderLength
-			return
-		default:
-			q.IPProto = Unknown
-			return
-		}
-	} else {
-		// This is a fragment other than the first one.
-		if fragOfs < minFrag {
-			// First frag was suspiciously short, so we can't
-			// trust the followup either.
-			q.IPProto = Unknown
-			return
-		}
-		// otherwise, we have to permit the fragment to slide through.
-		// Second and later fragments don't have sub-headers.
-		// Ideally, we would drop fragments that we can't identify,
-		// but that would require statefulness. Anyway, receivers'
-		// kernels know to drop fragments where the initial fragment
-		// doesn't arrive.
-		q.IPProto = Fragment
-		return
-	}
-}
-
-func (q *Parsed) decode6(b []byte) {
-	if len(b) < ip6HeaderLength {
-		q.IPVersion = 0
-		q.IPProto = Unknown
-		return
-	}
-
-	q.IPProto = IPProto(b[6])
-	q.length = int(binary.BigEndian.Uint16(b[4:6])) + ip6HeaderLength
-	if len(b) < q.length {
-		// Packet was cut off before the full IPv6 length.
-		q.IPProto = Unknown
-		return
-	}
-
-	q.SrcIP6.Hi = binary.BigEndian.Uint64(b[8:16])
-	q.SrcIP6.Lo = binary.BigEndian.Uint64(b[16:24])
-	q.DstIP6.Hi = binary.BigEndian.Uint64(b[24:32])
-	q.DstIP6.Lo = binary.BigEndian.Uint64(b[32:40])
-
-	// We don't support any IPv6 extension headers. Don't try to
-	// be clever. Therefore, the IP subprotocol always starts at
-	// byte 40.
-	//
-	// Note that this means we don't support fragmentation in
-	// IPv6. This is fine, because IPv6 strongly mandates that you
-	// should not fragment, which makes fragmentation on the open
-	// internet extremely uncommon.
-	//
-	// This also means we don't support IPSec headers (AH/ESP), or
-	// IPv6 jumbo frames. Those will get marked Unknown and
-	// dropped.
-	q.subofs = 40
-	sub := b[q.subofs:]
-	sub = sub[:len(sub):len(sub)] // help the compiler do bounds check elimination
-
-	switch q.IPProto {
-	case ICMPv6:
-		if len(sub) < icmp6HeaderLength {
-			q.IPProto = Unknown
-			return
-		}
-		q.SrcPort = 0
-		q.DstPort = 0
-		q.dataofs = q.subofs + icmp6HeaderLength
-	case TCP:
-		if len(sub) < tcpHeaderLength {
-			q.IPProto = Unknown
-			return
-		}
-		q.SrcPort = binary.BigEndian.Uint16(sub[0:2])
-		q.DstPort = binary.BigEndian.Uint16(sub[2:4])
-		q.TCPFlags = sub[13] & 0x3F
-		headerLength := (sub[12] & 0xF0) >> 2
-		q.dataofs = q.subofs + int(headerLength)
-		return
-	case UDP:
-		if len(sub) < udpHeaderLength {
-			q.IPProto = Unknown
-			return
-		}
-		q.SrcPort = binary.BigEndian.Uint16(sub[0:2])
-		q.DstPort = binary.BigEndian.Uint16(sub[2:4])
-		q.dataofs = q.subofs + udpHeaderLength
-	default:
-		q.IPProto = Unknown
-		return
-	}
-}
-
-func (q *Parsed) IP4Header() IP4Header {
-	if q.IPVersion != 4 {
-		panic("IP4Header called on non-IPv4 Parsed")
-	}
-	ipid := binary.BigEndian.Uint16(q.b[4:6])
-	return IP4Header{
-		IPID:    ipid,
-		IPProto: q.IPProto,
-		SrcIP:   q.SrcIP4,
-		DstIP:   q.DstIP4,
-	}
-}
-
-func (q *Parsed) ICMP4Header() ICMP4Header {
-	if q.IPVersion != 4 {
-		panic("IP4Header called on non-IPv4 Parsed")
-	}
-	return ICMP4Header{
-		IP4Header: q.IP4Header(),
-		Type:      ICMP4Type(q.b[q.subofs+0]),
-		Code:      ICMP4Code(q.b[q.subofs+1]),
-	}
-}
-
-func (q *Parsed) UDP4Header() UDP4Header {
-	if q.IPVersion != 4 {
-		panic("IP4Header called on non-IPv4 Parsed")
-	}
-	return UDP4Header{
-		IP4Header: q.IP4Header(),
-		SrcPort:   q.SrcPort,
-		DstPort:   q.DstPort,
-	}
-}
-
-// Buffer returns the entire packet buffer.
-// This is a read-only view; that is, q retains the ownership of the buffer.
-func (q *Parsed) Buffer() []byte {
-	return q.b
-}
-
-// Payload returns the payload of the IP subprotocol section.
-// This is a read-only view; that is, q retains the ownership of the buffer.
-func (q *Parsed) Payload() []byte {
-	return q.b[q.dataofs:q.length]
-}
-
-// IsTCPSyn reports whether q is a TCP SYN packet
-// (i.e. the first packet in a new connection).
-func (q *Parsed) IsTCPSyn() bool {
-	return (q.TCPFlags & TCPSynAck) == TCPSyn
-}
-
-// IsError reports whether q is an ICMP "Error" packet.
-func (q *Parsed) IsError() bool {
-	switch q.IPProto {
-	case ICMPv4:
-		if len(q.b) < q.subofs+8 {
-			return false
-		}
-		t := ICMP4Type(q.b[q.subofs])
-		return t == ICMP4Unreachable || t == ICMP4TimeExceeded
-	case ICMPv6:
-		if len(q.b) < q.subofs+8 {
-			return false
-		}
-		t := ICMP6Type(q.b[q.subofs])
-		return t == ICMP6Unreachable || t == ICMP6TimeExceeded
-	default:
-		return false
-	}
-}
-
-// IsEchoRequest reports whether q is an ICMP Echo Request.
-func (q *Parsed) IsEchoRequest() bool {
-	switch q.IPProto {
-	case ICMPv4:
-		return len(q.b) >= q.subofs+8 && ICMP4Type(q.b[q.subofs]) == ICMP4EchoRequest && ICMP4Code(q.b[q.subofs+1]) == ICMP4NoCode
-	case ICMPv6:
-		return len(q.b) >= q.subofs+8 && ICMP6Type(q.b[q.subofs]) == ICMP6EchoRequest && ICMP6Code(q.b[q.subofs+1]) == ICMP6NoCode
-	default:
-		return false
-	}
-}
-
-// IsEchoRequest reports whether q is an IPv4 ICMP Echo Response.
-func (q *Parsed) IsEchoResponse() bool {
-	switch q.IPProto {
-	case ICMPv4:
-		return len(q.b) >= q.subofs+8 && ICMP4Type(q.b[q.subofs]) == ICMP4EchoReply && ICMP4Code(q.b[q.subofs+1]) == ICMP4NoCode
-	case ICMPv6:
-		return len(q.b) >= q.subofs+8 && ICMP6Type(q.b[q.subofs]) == ICMP6EchoReply && ICMP6Code(q.b[q.subofs+1]) == ICMP6NoCode
-	default:
-		return false
-	}
-}
-
-func Hexdump(b []byte) string {
-	out := new(strings.Builder)
-	for i := 0; i < len(b); i += 16 {
-		if i > 0 {
-			fmt.Fprintf(out, "\n")
-		}
-		fmt.Fprintf(out, "  %04x  ", i)
-		j := 0
-		for ; j < 16 && i+j < len(b); j++ {
-			if j == 8 {
-				fmt.Fprintf(out, " ")
-			}
-			fmt.Fprintf(out, "%02x ", b[i+j])
-		}
-		for ; j < 16; j++ {
-			if j == 8 {
-				fmt.Fprintf(out, " ")
-			}
-			fmt.Fprintf(out, "   ")
-		}
-		fmt.Fprintf(out, " ")
-		for j = 0; j < 16 && i+j < len(b); j++ {
-			if b[i+j] >= 32 && b[i+j] < 128 {
-				fmt.Fprintf(out, "%c", b[i+j])
-			} else {
-				fmt.Fprintf(out, ".")
-			}
-		}
-	}
-	return out.String()
-}

net/packet/packet_test.go

@@ -1,502 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"bytes"
-	"reflect"
-	"testing"
-
-	"inet.af/netaddr"
-)
-
-func mustIP4(s string) IP4 {
-	ip, err := netaddr.ParseIP(s)
-	if err != nil {
-		panic(err)
-	}
-	return IP4FromNetaddr(ip)
-}
-
-func mustIP6(s string) IP6 {
-	ip, err := netaddr.ParseIP(s)
-	if err != nil {
-		panic(err)
-	}
-	return IP6FromNetaddr(ip)
-}
-
-func TestIP4String(t *testing.T) {
-	const str = "1.2.3.4"
-	ip := mustIP4(str)
-
-	var got string
-	allocs := testing.AllocsPerRun(1000, func() {
-		got = ip.String()
-	})
-
-	if got != str {
-		t.Errorf("got %q; want %q", got, str)
-	}
-	if allocs != 1 {
-		t.Errorf("allocs = %v; want 1", allocs)
-	}
-}
-
-func TestIP6String(t *testing.T) {
-	const str = "2607:f8b0:400a:809::200e"
-	ip := mustIP6(str)
-
-	var got string
-	allocs := testing.AllocsPerRun(1000, func() {
-		got = ip.String()
-	})
-
-	if got != str {
-		t.Errorf("got %q; want %q", got, str)
-	}
-	if allocs != 2 {
-		t.Errorf("allocs = %v; want 1", allocs)
-	}
-}
-
-var icmp4RequestBuffer = []byte{
-	// IP header up to checksum
-	0x45, 0x00, 0x00, 0x27, 0xde, 0xad, 0x00, 0x00, 0x40, 0x01, 0x8c, 0x15,
-	// source ip
-	0x01, 0x02, 0x03, 0x04,
-	// destination ip
-	0x05, 0x06, 0x07, 0x08,
-	// ICMP header
-	0x08, 0x00, 0x7d, 0x22,
-	// "request_payload"
-	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-}
-
-var icmp4RequestDecode = Parsed{
-	b:       icmp4RequestBuffer,
-	subofs:  20,
-	dataofs: 24,
-	length:  len(icmp4RequestBuffer),
-
-	IPVersion: 4,
-	IPProto:   ICMPv4,
-	SrcIP4:    mustIP4("1.2.3.4"),
-	DstIP4:    mustIP4("5.6.7.8"),
-	SrcPort:   0,
-	DstPort:   0,
-}
-
-var icmp4ReplyBuffer = []byte{
-	0x45, 0x00, 0x00, 0x25, 0x21, 0x52, 0x00, 0x00, 0x40, 0x01, 0x49, 0x73,
-	// source ip
-	0x05, 0x06, 0x07, 0x08,
-	// destination ip
-	0x01, 0x02, 0x03, 0x04,
-	// ICMP header
-	0x00, 0x00, 0xe6, 0x9e,
-	// "reply_payload"
-	0x72, 0x65, 0x70, 0x6c, 0x79, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-}
-
-var icmp4ReplyDecode = Parsed{
-	b:       icmp4ReplyBuffer,
-	subofs:  20,
-	dataofs: 24,
-	length:  len(icmp4ReplyBuffer),
-
-	IPVersion: 4,
-	IPProto:   ICMPv4,
-	SrcIP4:    mustIP4("1.2.3.4"),
-	DstIP4:    mustIP4("5.6.7.8"),
-	SrcPort:   0,
-	DstPort:   0,
-}
-
-// ICMPv6 Router Solicitation
-var icmp6PacketBuffer = []byte{
-	0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff,
-	0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0xfb, 0x57, 0x1d, 0xea, 0x9c, 0x39, 0x8f, 0xb7,
-	0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
-	0x85, 0x00, 0x38, 0x04, 0x00, 0x00, 0x00, 0x00,
-}
-
-var icmp6PacketDecode = Parsed{
-	b:         icmp6PacketBuffer,
-	subofs:    40,
-	dataofs:   44,
-	length:    len(icmp6PacketBuffer),
-	IPVersion: 6,
-	IPProto:   ICMPv6,
-	SrcIP6:    mustIP6("fe80::fb57:1dea:9c39:8fb7"),
-	DstIP6:    mustIP6("ff02::2"),
-}
-
-// This is a malformed IPv4 packet.
-// Namely, the string "tcp_payload" follows the first byte of the IPv4 header.
-var unknownPacketBuffer = []byte{
-	0x45, 0x74, 0x63, 0x70, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-}
-
-var unknownPacketDecode = Parsed{
-	b:         unknownPacketBuffer,
-	IPVersion: 0,
-	IPProto:   Unknown,
-}
-
-var tcp4PacketBuffer = []byte{
-	// IP header up to checksum
-	0x45, 0x00, 0x00, 0x37, 0xde, 0xad, 0x00, 0x00, 0x40, 0x06, 0x49, 0x5f,
-	// source ip
-	0x01, 0x02, 0x03, 0x04,
-	// destination ip
-	0x05, 0x06, 0x07, 0x08,
-	// TCP header with SYN, ACK set
-	0x00, 0x7b, 0x02, 0x37, 0x00, 0x00, 0x12, 0x34, 0x00, 0x00, 0x00, 0x00,
-	0x50, 0x12, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
-	// "request_payload"
-	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-}
-
-var tcp4PacketDecode = Parsed{
-	b:       tcp4PacketBuffer,
-	subofs:  20,
-	dataofs: 40,
-	length:  len(tcp4PacketBuffer),
-
-	IPVersion: 4,
-	IPProto:   TCP,
-	SrcIP4:    mustIP4("1.2.3.4"),
-	DstIP4:    mustIP4("5.6.7.8"),
-	SrcPort:   123,
-	DstPort:   567,
-	TCPFlags:  TCPSynAck,
-}
-
-var tcp6RequestBuffer = []byte{
-	// IPv6 header up to hop limit
-	0x60, 0x06, 0xef, 0xcc, 0x00, 0x28, 0x06, 0x40,
-	// Src addr
-	0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b,
-	// Dst addr
-	0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e,
-	// TCP SYN segment, no payload
-	0xa4, 0x60, 0x00, 0x50, 0xf3, 0x82, 0xa1, 0x25, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0xfd, 0x20,
-	0xb1, 0xc6, 0x00, 0x00, 0x02, 0x04, 0x05, 0xa0, 0x04, 0x02, 0x08, 0x0a, 0xca, 0x76, 0xa6, 0x8e,
-	0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x07,
-}
-
-var tcp6RequestDecode = Parsed{
-	b:       tcp6RequestBuffer,
-	subofs:  40,
-	dataofs: len(tcp6RequestBuffer),
-	length:  len(tcp6RequestBuffer),
-
-	IPVersion: 6,
-	IPProto:   TCP,
-	SrcIP6:    mustIP6("2001:559:bc13:5400:1749:4628:3934:e1b"),
-	DstIP6:    mustIP6("2607:f8b0:400a:809::200e"),
-	SrcPort:   42080,
-	DstPort:   80,
-	TCPFlags:  TCPSyn,
-}
-
-var udp4RequestBuffer = []byte{
-	// IP header up to checksum
-	0x45, 0x00, 0x00, 0x2b, 0xde, 0xad, 0x00, 0x00, 0x40, 0x11, 0x8c, 0x01,
-	// source ip
-	0x01, 0x02, 0x03, 0x04,
-	// destination ip
-	0x05, 0x06, 0x07, 0x08,
-	// UDP header
-	0x00, 0x7b, 0x02, 0x37, 0x00, 0x17, 0x72, 0x1d,
-	// "request_payload"
-	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-}
-
-var udp4RequestDecode = Parsed{
-	b:       udp4RequestBuffer,
-	subofs:  20,
-	dataofs: 28,
-	length:  len(udp4RequestBuffer),
-
-	IPVersion: 4,
-	IPProto:   UDP,
-	SrcIP4:    mustIP4("1.2.3.4"),
-	DstIP4:    mustIP4("5.6.7.8"),
-	SrcPort:   123,
-	DstPort:   567,
-}
-
-var invalid4RequestBuffer = []byte{
-	// IP header up to checksum. IHL field points beyond end of packet.
-	0x4a, 0x00, 0x00, 0x14, 0xde, 0xad, 0x00, 0x00, 0x40, 0x11, 0x8c, 0x01,
-	// source ip
-	0x01, 0x02, 0x03, 0x04,
-	// destination ip
-	0x05, 0x06, 0x07, 0x08,
-}
-
-// Regression check for the IHL field pointing beyond the end of the
-// packet.
-var invalid4RequestDecode = Parsed{
-	b:      invalid4RequestBuffer,
-	subofs: 40,
-	length: len(invalid4RequestBuffer),
-
-	IPVersion: 4,
-	IPProto:   Unknown,
-	SrcIP4:    mustIP4("1.2.3.4"),
-	DstIP4:    mustIP4("5.6.7.8"),
-}
-
-var udp6RequestBuffer = []byte{
-	// IPv6 header up to hop limit
-	0x60, 0x0e, 0xc9, 0x67, 0x00, 0x29, 0x11, 0x40,
-	// Src addr
-	0x20, 0x01, 0x05, 0x59, 0xbc, 0x13, 0x54, 0x00, 0x17, 0x49, 0x46, 0x28, 0x39, 0x34, 0x0e, 0x1b,
-	// Dst addr
-	0x26, 0x07, 0xf8, 0xb0, 0x40, 0x0a, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x0e,
-	// UDP header
-	0xd4, 0x04, 0x01, 0xbb, 0x00, 0x29, 0x96, 0x84,
-	// Payload
-	0x5c, 0x06, 0xae, 0x85, 0x02, 0xf5, 0xdb, 0x90, 0xe0, 0xe0, 0x93, 0xed, 0x9a, 0xd9, 0x92, 0x69, 0xbe, 0x36, 0x8a, 0x7d, 0xd7, 0xce, 0xd0, 0x8a, 0xf2, 0x51, 0x95, 0xff, 0xb6, 0x92, 0x70, 0x10, 0xd7,
-}
-
-var udp6RequestDecode = Parsed{
-	b:       udp6RequestBuffer,
-	subofs:  40,
-	dataofs: 48,
-	length:  len(udp6RequestBuffer),
-
-	IPVersion: 6,
-	IPProto:   UDP,
-	SrcIP6:    mustIP6("2001:559:bc13:5400:1749:4628:3934:e1b"),
-	DstIP6:    mustIP6("2607:f8b0:400a:809::200e"),
-	SrcPort:   54276,
-	DstPort:   443,
-}
-
-var udp4ReplyBuffer = []byte{
-	// IP header up to checksum
-	0x45, 0x00, 0x00, 0x29, 0x21, 0x52, 0x00, 0x00, 0x40, 0x11, 0x49, 0x5f,
-	// source ip
-	0x05, 0x06, 0x07, 0x08,
-	// destination ip
-	0x01, 0x02, 0x03, 0x04,
-	// UDP header
-	0x02, 0x37, 0x00, 0x7b, 0x00, 0x15, 0xd3, 0x9d,
-	// "reply_payload"
-	0x72, 0x65, 0x70, 0x6c, 0x79, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-}
-
-var udp4ReplyDecode = Parsed{
-	b:       udp4ReplyBuffer,
-	subofs:  20,
-	dataofs: 28,
-	length:  len(udp4ReplyBuffer),
-
-	IPProto: UDP,
-	SrcIP4:  mustIP4("1.2.3.4"),
-	DstIP4:  mustIP4("5.6.7.8"),
-	SrcPort: 567,
-	DstPort: 123,
-}
-
-var igmpPacketBuffer = []byte{
-	// IP header up to checksum
-	0x46, 0xc0, 0x00, 0x20, 0x00, 0x00, 0x40, 0x00, 0x01, 0x02, 0x41, 0x22,
-	// source IP
-	0xc0, 0xa8, 0x01, 0x52,
-	// destination IP
-	0xe0, 0x00, 0x00, 0xfb,
-	// IGMP Membership Report
-	0x94, 0x04, 0x00, 0x00, 0x16, 0x00, 0x09, 0x04, 0xe0, 0x00, 0x00, 0xfb,
-	//0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-}
-
-var igmpPacketDecode = Parsed{
-	b:      igmpPacketBuffer,
-	subofs: 24,
-	length: len(igmpPacketBuffer),
-
-	IPVersion: 4,
-	IPProto:   IGMP,
-	SrcIP4:    mustIP4("192.168.1.82"),
-	DstIP4:    mustIP4("224.0.0.251"),
-}
-
-func TestParsed(t *testing.T) {
-	tests := []struct {
-		name    string
-		qdecode Parsed
-		want    string
-	}{
-		{"tcp4", tcp4PacketDecode, "TCP{1.2.3.4:123 > 5.6.7.8:567}"},
-		{"tcp6", tcp6RequestDecode, "TCP{[2001:559:bc13:5400:1749:4628:3934:e1b]:42080 > [2607:f8b0:400a:809::200e]:80}"},
-		{"udp4", udp4RequestDecode, "UDP{1.2.3.4:123 > 5.6.7.8:567}"},
-		{"udp6", udp6RequestDecode, "UDP{[2001:559:bc13:5400:1749:4628:3934:e1b]:54276 > [2607:f8b0:400a:809::200e]:443}"},
-		{"icmp4", icmp4RequestDecode, "ICMPv4{1.2.3.4:0 > 5.6.7.8:0}"},
-		{"icmp6", icmp6PacketDecode, "ICMPv6{[fe80::fb57:1dea:9c39:8fb7]:0 > [ff02::2]:0}"},
-		{"igmp", igmpPacketDecode, "IGMP{192.168.1.82:0 > 224.0.0.251:0}"},
-		{"unknown", unknownPacketDecode, "Unknown{???}"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := tt.qdecode.String()
-			if got != tt.want {
-				t.Errorf("got %q; want %q", got, tt.want)
-			}
-		})
-	}
-
-	var sink string
-	allocs := testing.AllocsPerRun(1000, func() {
-		sink = tests[0].qdecode.String()
-	})
-	_ = sink
-	if allocs != 1 {
-		t.Errorf("allocs = %v; want 1", allocs)
-	}
-}
-
-func TestDecode(t *testing.T) {
-	tests := []struct {
-		name string
-		buf  []byte
-		want Parsed
-	}{
-		{"icmp4", icmp4RequestBuffer, icmp4RequestDecode},
-		{"icmp6", icmp6PacketBuffer, icmp6PacketDecode},
-		{"tcp4", tcp4PacketBuffer, tcp4PacketDecode},
-		{"tcp6", tcp6RequestBuffer, tcp6RequestDecode},
-		{"udp4", udp4RequestBuffer, udp4RequestDecode},
-		{"udp6", udp6RequestBuffer, udp6RequestDecode},
-		{"igmp", igmpPacketBuffer, igmpPacketDecode},
-		{"unknown", unknownPacketBuffer, unknownPacketDecode},
-		{"invalid4", invalid4RequestBuffer, invalid4RequestDecode},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var got Parsed
-			got.Decode(tt.buf)
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("mismatch\n got: %#v\nwant: %#v", got, tt.want)
-			}
-		})
-	}
-
-	allocs := testing.AllocsPerRun(1000, func() {
-		var got Parsed
-		got.Decode(tests[0].buf)
-	})
-	if allocs != 0 {
-		t.Errorf("allocs = %v; want 0", allocs)
-	}
-}
-
-func BenchmarkDecode(b *testing.B) {
-	benches := []struct {
-		name string
-		buf  []byte
-	}{
-		{"tcp4", tcp4PacketBuffer},
-		{"tcp6", tcp6RequestBuffer},
-		{"udp4", udp4RequestBuffer},
-		{"udp6", udp6RequestBuffer},
-		{"icmp4", icmp4RequestBuffer},
-		{"icmp6", icmp6PacketBuffer},
-		{"igmp", igmpPacketBuffer},
-		{"unknown", unknownPacketBuffer},
-	}
-
-	for _, bench := range benches {
-		b.Run(bench.name, func(b *testing.B) {
-			b.ReportAllocs()
-			for i := 0; i < b.N; i++ {
-				var p Parsed
-				p.Decode(bench.buf)
-			}
-		})
-	}
-}
-
-func TestMarshalRequest(t *testing.T) {
-	// Too small to hold our packets, but only barely.
-	var small [20]byte
-	var large [64]byte
-
-	icmpHeader := icmp4RequestDecode.ICMP4Header()
-	udpHeader := udp4RequestDecode.UDP4Header()
-	tests := []struct {
-		name   string
-		header Header
-		want   []byte
-	}{
-		{"icmp", &icmpHeader, icmp4RequestBuffer},
-		{"udp", &udpHeader, udp4RequestBuffer},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := tt.header.Marshal(small[:])
-			if err != errSmallBuffer {
-				t.Errorf("got err: nil; want: %s", errSmallBuffer)
-			}
-
-			dataOffset := tt.header.Len()
-			dataLength := copy(large[dataOffset:], []byte("request_payload"))
-			end := dataOffset + dataLength
-			err = tt.header.Marshal(large[:end])
-
-			if err != nil {
-				t.Errorf("got err: %s; want nil", err)
-			}
-
-			if !bytes.Equal(large[:end], tt.want) {
-				t.Errorf("got %x; want %x", large[:end], tt.want)
-			}
-		})
-	}
-}
-
-func TestMarshalResponse(t *testing.T) {
-	var buf [64]byte
-
-	icmpHeader := icmp4RequestDecode.ICMP4Header()
-	udpHeader := udp4RequestDecode.UDP4Header()
-
-	tests := []struct {
-		name   string
-		header Header
-		want   []byte
-	}{
-		{"icmp", &icmpHeader, icmp4ReplyBuffer},
-		{"udp", &udpHeader, udp4ReplyBuffer},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			tt.header.ToResponse()
-
-			dataOffset := tt.header.Len()
-			dataLength := copy(buf[dataOffset:], []byte("reply_payload"))
-			end := dataOffset + dataLength
-			err := tt.header.Marshal(buf[:end])
-
-			if err != nil {
-				t.Errorf("got err: %s; want nil", err)
-			}
-
-			if !bytes.Equal(buf[:end], tt.want) {
-				t.Errorf("got %x; want %x", buf[:end], tt.want)
-			}
-		})
-	}
-}

net/packet/udp4.go

@@ -1,55 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import "encoding/binary"
-
-// udpHeaderLength is the size of the UDP packet header, not including
-// the outer IP header.
-const udpHeaderLength = 8
-
-// UDP4Header is an IPv4+UDP header.
-type UDP4Header struct {
-	IP4Header
-	SrcPort uint16
-	DstPort uint16
-}
-
-// Len implements Header.
-func (h UDP4Header) Len() int {
-	return h.IP4Header.Len() + udpHeaderLength
-}
-
-// Marshal implements Header.
-func (h UDP4Header) Marshal(buf []byte) error {
-	if len(buf) < h.Len() {
-		return errSmallBuffer
-	}
-	if len(buf) > maxPacketLength {
-		return errLargePacket
-	}
-	// The caller does not need to set this.
-	h.IPProto = UDP
-
-	length := len(buf) - h.IP4Header.Len()
-	binary.BigEndian.PutUint16(buf[20:22], h.SrcPort)
-	binary.BigEndian.PutUint16(buf[22:24], h.DstPort)
-	binary.BigEndian.PutUint16(buf[24:26], uint16(length))
-	binary.BigEndian.PutUint16(buf[26:28], 0) // blank checksum
-
-	// UDP checksum with IP pseudo header.
-	h.IP4Header.marshalPseudo(buf)
-	binary.BigEndian.PutUint16(buf[26:28], ip4Checksum(buf[ip4PseudoHeaderOffset:]))
-
-	h.IP4Header.Marshal(buf)
-
-	return nil
-}
-
-// ToResponse implements Header.
-func (h *UDP4Header) ToResponse() {
-	h.SrcPort, h.DstPort = h.DstPort, h.SrcPort
-	h.IP4Header.ToResponse()
-}

net/packet/udp6.go

@@ -1,51 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import "encoding/binary"
-
-// UDP6Header is an IPv6+UDP header.
-type UDP6Header struct {
-	IP6Header
-	SrcPort uint16
-	DstPort uint16
-}
-
-// Len implements Header.
-func (h UDP6Header) Len() int {
-	return h.IP6Header.Len() + udpHeaderLength
-}
-
-// Marshal implements Header.
-func (h UDP6Header) Marshal(buf []byte) error {
-	if len(buf) < h.Len() {
-		return errSmallBuffer
-	}
-	if len(buf) > maxPacketLength {
-		return errLargePacket
-	}
-	// The caller does not need to set this.
-	h.IPProto = UDP
-
-	length := len(buf) - h.IP6Header.Len()
-	binary.BigEndian.PutUint16(buf[40:42], h.SrcPort)
-	binary.BigEndian.PutUint16(buf[42:44], h.DstPort)
-	binary.BigEndian.PutUint16(buf[44:46], uint16(length))
-	binary.BigEndian.PutUint16(buf[46:48], 0) // blank checksum
-
-	// UDP checksum with IP pseudo header.
-	h.IP6Header.marshalPseudo(buf)
-	binary.BigEndian.PutUint16(buf[46:48], ip4Checksum(buf[:]))
-
-	h.IP6Header.Marshal(buf)
-
-	return nil
-}
-
-// ToResponse implements Header.
-func (h *UDP6Header) ToResponse() {
-	h.SrcPort, h.DstPort = h.DstPort, h.SrcPort
-	h.IP6Header.ToResponse()
-}

net/stun/stun.go

@@ -137,15 +137,15 @@ func foreachAttr(b []byte, fn func(attrType uint16, a []byte) error) error {
 		}
 		attrType := binary.BigEndian.Uint16(b[:2])
 		attrLen := int(binary.BigEndian.Uint16(b[2:4]))
-		attrLenWithPad := (attrLen + 3) &^ 3
+		attrLenPad := attrLen % 4
 		b = b[4:]
-		if attrLenWithPad > len(b) {
+		if attrLen+attrLenPad > len(b) {
 			return ErrMalformedAttrs
 		}
 		if err := fn(attrType, b[:attrLen]); err != nil {
 			return err
 		}
-		b = b[attrLenWithPad:]
+		b = b[attrLen+attrLenPad:]
 	}
 	return nil
 }

net/stun/stun_test.go

@@ -140,41 +140,6 @@ var responseTests = []struct {
 		wantAddr: net.ParseIP("2602:d1:b4cf:c100:38b2:31ff:feef:96f6"),
 		wantPort: 37070,
 	},
-
-	// Testing STUN attribute padding rules using STUN software attribute
-	// with values of 1 & 3 length respectively before the XorMappedAddress attribute
-	{
-		name: "software-a",
-		data: []byte{
-			0x01, 0x01, 0x00, 0x14, 0x21, 0x12, 0xa4, 0x42,
-			0xeb, 0xc2, 0xd3, 0x6e, 0xf4, 0x71, 0x21, 0x7c,
-			0x4f, 0x3e, 0x30, 0x8e, 0x80, 0x22, 0x00, 0x01,
-			0x61, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x08,
-			0x00, 0x01, 0xce, 0x66, 0x5e, 0x12, 0xa4, 0x43,
-		},
-		wantTID: []byte{
-			0xeb, 0xc2, 0xd3, 0x6e, 0xf4, 0x71, 0x21, 0x7c,
-			0x4f, 0x3e, 0x30, 0x8e,
-		},
-		wantAddr: []byte{127, 0, 0, 1},
-		wantPort: 61300,
-	},
-	{
-		name: "software-abc",
-		data: []byte{
-			0x01, 0x01, 0x00, 0x14, 0x21, 0x12, 0xa4, 0x42,
-			0xeb, 0xc2, 0xd3, 0x6e, 0xf4, 0x71, 0x21, 0x7c,
-			0x4f, 0x3e, 0x30, 0x8e, 0x80, 0x22, 0x00, 0x03,
-			0x61, 0x62, 0x63, 0x00, 0x00, 0x20, 0x00, 0x08,
-			0x00, 0x01, 0xce, 0x66, 0x5e, 0x12, 0xa4, 0x43,
-		},
-		wantTID: []byte{
-			0xeb, 0xc2, 0xd3, 0x6e, 0xf4, 0x71, 0x21, 0x7c,
-			0x4f, 0x3e, 0x30, 0x8e,
-		},
-		wantAddr: []byte{127, 0, 0, 1},
-		wantPort: 61300,
-	},
 }
 
 func TestParseResponse(t *testing.T) {

net/tsaddr/tsaddr.go

@@ -30,11 +30,7 @@ func CGNATRange() netaddr.IPPrefix {
 	return cgnatRange.v
 }
 
-var (
-	cgnatRange   oncePrefix
-	ulaRange     oncePrefix
-	ula4To6Range oncePrefix
-)
+var cgnatRange oncePrefix
 
 // TailscaleServiceIP returns the listen address of services
 // provided by Tailscale itself such as the Magic DNS proxy.
@@ -48,40 +44,7 @@ var serviceIP onceIP
 // IsTailscaleIP reports whether ip is an IP address in a range that
 // Tailscale assigns from.
 func IsTailscaleIP(ip netaddr.IP) bool {
-	if ip.Is4() {
-		return CGNATRange().Contains(ip) && !ChromeOSVMRange().Contains(ip)
-	}
-	return TailscaleULARange().Contains(ip)
-}
-
-// TailscaleULARange returns the IPv6 Unique Local Address range that
-// is the superset range that Tailscale assigns out of.
-func TailscaleULARange() netaddr.IPPrefix {
-	ulaRange.Do(func() { mustPrefix(&ulaRange.v, "fd7a:115c:a1e0::/48") })
-	return ulaRange.v
-}
-
-// Tailscale4To6Range returns the subset of TailscaleULARange used for
-// auto-translated Tailscale ipv4 addresses.
-func Tailscale4To6Range() netaddr.IPPrefix {
-	// This IP range has no significance, beyond being a subset of
-	// TailscaleULARange. The bits from /48 to /104 were picked at
-	// random.
-	ula4To6Range.Do(func() { mustPrefix(&ula4To6Range.v, "fd7a:115c:a1e0:ab12:4843:cd96:6200::/104") })
-	return ula4To6Range.v
-}
-
-// Tailscale4To6 returns a Tailscale IPv6 address that maps 1:1 to the
-// given Tailscale IPv4 address. Returns a zero IP if ipv4 isn't a
-// Tailscale IPv4 address.
-func Tailscale4To6(ipv4 netaddr.IP) netaddr.IP {
-	if !ipv4.Is4() || !IsTailscaleIP(ipv4) {
-		return netaddr.IP{}
-	}
-	ret := Tailscale4To6Range().IP.As16()
-	v4 := ipv4.As4()
-	copy(ret[13:], v4[1:])
-	return netaddr.IPFrom16(ret)
+	return CGNATRange().Contains(ip) && !ChromeOSVMRange().Contains(ip)
 }
 
 func mustPrefix(v *netaddr.IPPrefix, prefix string) {

net/tshttpproxy/tshttpproxy.go

@@ -1,91 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package tshttpproxy contains Tailscale additions to httpproxy not available
-// in golang.org/x/net/http/httpproxy. Notably, it aims to support Windows better.
-package tshttpproxy
-
-import (
-	"net/http"
-	"net/url"
-	"os"
-	"sync"
-	"time"
-)
-
-// InvalidateCache invalidates the package-level cache for ProxyFromEnvironment.
-//
-// It's intended to be called on network link/routing table changes.
-func InvalidateCache() {
-	mu.Lock()
-	defer mu.Unlock()
-	noProxyUntil = time.Time{}
-}
-
-var (
-	mu           sync.Mutex
-	noProxyUntil time.Time // if non-zero, time at which ProxyFromEnvironment should check again
-)
-
-func setNoProxyUntil(d time.Duration) {
-	mu.Lock()
-	defer mu.Unlock()
-	noProxyUntil = time.Now().Add(d)
-}
-
-var _ = setNoProxyUntil // quiet staticcheck; Windows uses the above, more might later
-
-// sysProxyFromEnv, if non-nil, specifies a platform-specific ProxyFromEnvironment
-// func to use if http.ProxyFromEnvironment doesn't return a proxy.
-// For example, WPAD PAC files on Windows.
-var sysProxyFromEnv func(*http.Request) (*url.URL, error)
-
-func ProxyFromEnvironment(req *http.Request) (*url.URL, error) {
-	mu.Lock()
-	noProxyTime := noProxyUntil
-	mu.Unlock()
-	if time.Now().Before(noProxyTime) {
-		return nil, nil
-	}
-
-	u, err := http.ProxyFromEnvironment(req)
-	if u != nil && err == nil {
-		return u, nil
-	}
-
-	if sysProxyFromEnv != nil {
-		u, err := sysProxyFromEnv(req)
-		if u != nil && err == nil {
-			return u, nil
-		}
-	}
-
-	return nil, err
-}
-
-var sysAuthHeader func(*url.URL) (string, error)
-
-// GetAuthHeader returns the Authorization header value to send to proxy u.
-func GetAuthHeader(u *url.URL) (string, error) {
-	if fake := os.Getenv("TS_DEBUG_FAKE_PROXY_AUTH"); fake != "" {
-		return fake, nil
-	}
-	if sysAuthHeader != nil {
-		return sysAuthHeader(u)
-	}
-	return "", nil
-}
-
-var condSetTransportGetProxyConnectHeader func(*http.Transport)
-
-// SetTarnsportGetProxyConnectHeader sets the provided Transport's
-// GetProxyConnectHeader field, if the current build of Go supports
-// it.
-//
-// See https://github.com/golang/go/issues/41048.
-func SetTransportGetProxyConnectHeader(tr *http.Transport) {
-	if f := condSetTransportGetProxyConnectHeader; f != nil {
-		f(tr)
-	}
-}

net/tshttpproxy/tshttpproxy_future.go

@@ -1,45 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build tailscale_go
-
-// We want to use https://github.com/golang/go/issues/41048 but it's only in the
-// Tailscale Go tree for now. Hence the build tag above.
-
-package tshttpproxy
-
-import (
-	"context"
-	"fmt"
-	"log"
-	"net/http"
-	"net/url"
-)
-
-const proxyAuthHeader = "Proxy-Authorization"
-
-func init() {
-	condSetTransportGetProxyConnectHeader = func(tr *http.Transport) {
-		tr.GetProxyConnectHeader = func(ctx context.Context, proxyURL *url.URL, target string) (http.Header, error) {
-			v, err := GetAuthHeader(proxyURL)
-			if err != nil {
-				log.Printf("failed to get proxy Auth header for %v; ignoring: %v", proxyURL, err)
-				return nil, nil
-			}
-			if v == "" {
-				return nil, nil
-			}
-			return http.Header{proxyAuthHeader: []string{v}}, nil
-		}
-		tr.OnProxyConnectResponse = func(ctx context.Context, proxyURL *url.URL, connectReq *http.Request, res *http.Response) error {
-			auth := connectReq.Header.Get(proxyAuthHeader)
-			const truncLen = 20
-			if len(auth) > truncLen {
-				auth = fmt.Sprintf("%s...(%d total bytes)", auth[:truncLen], len(auth))
-			}
-			log.Printf("tshttpproxy: CONNECT response from %v for target %q (auth %q): %v", proxyURL, connectReq.Host, auth, res.Status)
-			return nil
-		}
-	}
-}

net/tshttpproxy/tshttpproxy_windows.go

@@ -1,236 +0,0 @@
-// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package tshttpproxy
-
-import (
-	"context"
-	"encoding/base64"
-	"fmt"
-	"log"
-	"net/http"
-	"net/url"
-	"strings"
-	"sync"
-	"syscall"
-	"time"
-	"unsafe"
-
-	"github.com/alexbrainman/sspi/negotiate"
-	"golang.org/x/sys/windows"
-	"tailscale.com/types/logger"
-)
-
-var (
-	winHTTP            = windows.NewLazySystemDLL("winhttp.dll")
-	httpOpenProc       = winHTTP.NewProc("WinHttpOpen")
-	closeHandleProc    = winHTTP.NewProc("WinHttpCloseHandle")
-	getProxyForUrlProc = winHTTP.NewProc("WinHttpGetProxyForUrl")
-)
-
-func init() {
-	sysProxyFromEnv = proxyFromWinHTTPOrCache
-	sysAuthHeader = sysAuthHeaderWindows
-}
-
-var cachedProxy struct {
-	sync.Mutex
-	val *url.URL
-}
-
-// proxyErrorf is a rate-limited logger specifically for errors asking
-// WinHTTP for the proxy information. We don't want to log about
-// errors often, otherwise the log message itself will generate a new
-// HTTP request which ultimately will call back into us to log again,
-// forever. So for errors, we only log a bit.
-var proxyErrorf = logger.RateLimitedFn(log.Printf, 10*time.Minute, 2 /* burst*/, 10 /* maxCache */)
-
-func proxyFromWinHTTPOrCache(req *http.Request) (*url.URL, error) {
-	if req.URL == nil {
-		return nil, nil
-	}
-	urlStr := req.URL.String()
-
-	ctx, cancel := context.WithTimeout(req.Context(), 5*time.Second)
-	defer cancel()
-
-	type result struct {
-		proxy *url.URL
-		err   error
-	}
-	resc := make(chan result, 1)
-	go func() {
-		proxy, err := proxyFromWinHTTP(ctx, urlStr)
-		resc <- result{proxy, err}
-	}()
-
-	select {
-	case res := <-resc:
-		err := res.err
-		if err == nil {
-			cachedProxy.Lock()
-			defer cachedProxy.Unlock()
-			if was, now := fmt.Sprint(cachedProxy.val), fmt.Sprint(res.proxy); was != now {
-				log.Printf("tshttpproxy: winhttp: updating cached proxy setting from %v to %v", was, now)
-			}
-			cachedProxy.val = res.proxy
-			return res.proxy, nil
-		}
-
-		// See https://docs.microsoft.com/en-us/windows/win32/winhttp/error-messages
-		const (
-			ERROR_WINHTTP_AUTODETECTION_FAILED      = 12180
-			ERROR_WINHTTP_UNABLE_TO_DOWNLOAD_SCRIPT = 12167
-		)
-		if err == syscall.Errno(ERROR_WINHTTP_AUTODETECTION_FAILED) {
-			setNoProxyUntil(10 * time.Second)
-			return nil, nil
-		}
-		if err == windows.ERROR_INVALID_PARAMETER {
-			// Seen on Windows 8.1. (https://github.com/tailscale/tailscale/issues/879)
-			// TODO(bradfitz): figure this out.
-			setNoProxyUntil(time.Hour)
-			proxyErrorf("tshttpproxy: winhttp: GetProxyForURL(%q): ERROR_INVALID_PARAMETER [unexpected]", urlStr)
-			return nil, nil
-		}
-		proxyErrorf("tshttpproxy: winhttp: GetProxyForURL(%q): %v/%#v", urlStr, err, err)
-		if err == syscall.Errno(ERROR_WINHTTP_UNABLE_TO_DOWNLOAD_SCRIPT) {
-			setNoProxyUntil(10 * time.Second)
-			return nil, nil
-		}
-		return nil, err
-	case <-ctx.Done():
-		cachedProxy.Lock()
-		defer cachedProxy.Unlock()
-		proxyErrorf("tshttpproxy: winhttp: GetProxyForURL(%q): timeout; using cached proxy %v", urlStr, cachedProxy.val)
-		return cachedProxy.val, nil
-	}
-}
-
-func proxyFromWinHTTP(ctx context.Context, urlStr string) (proxy *url.URL, err error) {
-	whi, err := winHTTPOpen()
-	if err != nil {
-		proxyErrorf("winhttp: Open: %v", err)
-		return nil, err
-	}
-	defer whi.Close()
-
-	t0 := time.Now()
-	v, err := whi.GetProxyForURL(urlStr)
-	td := time.Since(t0).Round(time.Millisecond)
-	if err := ctx.Err(); err != nil {
-		log.Printf("tshttpproxy: winhttp: context canceled, ignoring GetProxyForURL(%q) after %v", urlStr, td)
-		return nil, err
-	}
-	if err != nil {
-		return nil, err
-	}
-	if v == "" {
-		return nil, nil
-	}
-	// Discard all but first proxy value for now.
-	if i := strings.Index(v, ";"); i != -1 {
-		v = v[:i]
-	}
-	if !strings.HasPrefix(v, "https://") {
-		v = "http://" + v
-	}
-	return url.Parse(v)
-}
-
-var userAgent = windows.StringToUTF16Ptr("Tailscale")
-
-const (
-	winHTTP_ACCESS_TYPE_AUTOMATIC_PROXY = 4
-	winHTTP_AUTOPROXY_ALLOW_AUTOCONFIG  = 0x00000100
-	winHTTP_AUTOPROXY_AUTO_DETECT       = 1
-	winHTTP_AUTO_DETECT_TYPE_DHCP       = 0x00000001
-	winHTTP_AUTO_DETECT_TYPE_DNS_A      = 0x00000002
-)
-
-func winHTTPOpen() (winHTTPInternet, error) {
-	if err := httpOpenProc.Find(); err != nil {
-		return 0, err
-	}
-	r, _, err := httpOpenProc.Call(
-		uintptr(unsafe.Pointer(userAgent)),
-		winHTTP_ACCESS_TYPE_AUTOMATIC_PROXY,
-		0, /* WINHTTP_NO_PROXY_NAME */
-		0, /* WINHTTP_NO_PROXY_BYPASS */
-		0)
-	if r == 0 {
-		return 0, err
-	}
-	return winHTTPInternet(r), nil
-}
-
-type winHTTPInternet windows.Handle
-
-func (hi winHTTPInternet) Close() error {
-	if err := closeHandleProc.Find(); err != nil {
-		return err
-	}
-	r, _, err := closeHandleProc.Call(uintptr(hi))
-	if r == 1 {
-		return nil
-	}
-	return err
-}
-
-// WINHTTP_AUTOPROXY_OPTIONS
-// https://docs.microsoft.com/en-us/windows/win32/api/winhttp/ns-winhttp-winhttp_autoproxy_options
-type autoProxyOptions struct {
-	DwFlags                uint32
-	DwAutoDetectFlags      uint32
-	AutoConfigUrl          *uint16
-	_                      uintptr
-	_                      uint32
-	FAutoLogonIfChallenged bool
-}
-
-// WINHTTP_PROXY_INFO
-// https://docs.microsoft.com/en-us/windows/win32/api/winhttp/ns-winhttp-winhttp_proxy_info
-type winHTTPProxyInfo struct {
-	AccessType  uint16
-	Proxy       *uint16
-	ProxyBypass *uint16
-}
-
-var proxyForURLOpts = &autoProxyOptions{
-	DwFlags:           winHTTP_AUTOPROXY_ALLOW_AUTOCONFIG | winHTTP_AUTOPROXY_AUTO_DETECT,
-	DwAutoDetectFlags: winHTTP_AUTO_DETECT_TYPE_DHCP, // | winHTTP_AUTO_DETECT_TYPE_DNS_A,
-}
-
-func (hi winHTTPInternet) GetProxyForURL(urlStr string) (string, error) {
-	if err := getProxyForUrlProc.Find(); err != nil {
-		return "", err
-	}
-	var out winHTTPProxyInfo
-	r, _, err := getProxyForUrlProc.Call(
-		uintptr(hi),
-		uintptr(unsafe.Pointer(windows.StringToUTF16Ptr(urlStr))),
-		uintptr(unsafe.Pointer(proxyForURLOpts)),
-		uintptr(unsafe.Pointer(&out)))
-	if r == 1 {
-		return windows.UTF16PtrToString(out.Proxy), nil
-	}
-	return "", err
-}
-
-func sysAuthHeaderWindows(u *url.URL) (string, error) {
-	spn := "HTTP/" + u.Hostname()
-	creds, err := negotiate.AcquireCurrentUserCredentials()
-	if err != nil {
-		return "", fmt.Errorf("negotiate.AcquireCurrentUserCredentials: %w", err)
-	}
-	defer creds.Release()
-
-	secCtx, token, err := negotiate.NewClientContext(creds, spn)
-	if err != nil {
-		return "", fmt.Errorf("negotiate.NewClientContext: %w", err)
-	}
-	defer secCtx.Release()
-
-	return "Negotiate " + base64.StdEncoding.EncodeToString(token), nil
-}

portlist/netstat.go

@@ -41,10 +41,6 @@ func parsePort(s string) int {
 	return int(port)
 }
 
-func isLoopbackAddr(s string) bool {
-	return strings.HasPrefix(s, "127.0.0.1:") || strings.HasPrefix(s, "127.0.0.1.")
-}
-
 type nothing struct{}
 
 // Lowest common denominator parser for "netstat -na" format.
@@ -78,7 +74,7 @@ func parsePortsNetstat(output string) List {
 				// not interested in non-listener sockets
 				continue
 			}
-			if isLoopbackAddr(laddr) {
+			if strings.HasPrefix(laddr, "127.0.0.1:") || strings.HasPrefix(laddr, "127.0.0.1.") {
 				// not interested in loopback-bound listeners
 				continue
 			}
@@ -89,7 +85,7 @@ func parsePortsNetstat(output string) List {
 			proto = "udp"
 			laddr = cols[len(cols)-2]
 			raddr = cols[len(cols)-1]
-			if isLoopbackAddr(laddr) {
+			if strings.HasPrefix(laddr, "127.0.0.1:") || strings.HasPrefix(laddr, "127.0.0.1.") {
 				// not interested in loopback-bound listeners
 				continue
 			}