Update dependencies

vendor/tailscale.com/net/captivedetection/captivedetection.go

@@ -0,0 +1,227 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package captivedetection provides a way to detect if the system is connected to a network that has
+// a captive portal. It does this by making HTTP requests to known captive portal detection endpoints
+// and checking if the HTTP responses indicate that a captive portal might be present.
+package captivedetection
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"runtime"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"tailscale.com/net/netmon"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+)
+
+// Detector checks whether the system is behind a captive portal.
+type Detector struct {
+
+	// httpClient is the HTTP client that is used for captive portal detection. It is configured
+	// to not follow redirects, have a short timeout and no keep-alive.
+	httpClient *http.Client
+	// currIfIndex is the index of the interface that is currently being used by the httpClient.
+	currIfIndex int
+	// mu guards currIfIndex.
+	mu sync.Mutex
+	// logf is the logger used for logging messages. If it is nil, log.Printf is used.
+	logf logger.Logf
+}
+
+// NewDetector creates a new Detector instance for captive portal detection.
+func NewDetector(logf logger.Logf) *Detector {
+	d := &Detector{logf: logf}
+	d.httpClient = &http.Client{
+		// No redirects allowed
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+		Transport: &http.Transport{
+			DialContext:       d.dialContext,
+			DisableKeepAlives: true,
+		},
+		Timeout: Timeout,
+	}
+	return d
+}
+
+// Timeout is the timeout for captive portal detection requests. Because the captive portal intercepting our requests
+// is usually located on the LAN, this is a relatively short timeout.
+const Timeout = 3 * time.Second
+
+// Detect is the entry point to the API. It attempts to detect if the system is behind a captive portal
+// by making HTTP requests to known captive portal detection Endpoints. If any of the requests return a response code
+// or body that looks like a captive portal, Detect returns true. It returns false in all other cases, including when any
+// error occurs during a detection attempt.
+//
+// This function might take a while to return, as it will attempt to detect a captive portal on all available interfaces
+// by performing multiple HTTP requests. It should be called in a separate goroutine if you want to avoid blocking.
+func (d *Detector) Detect(ctx context.Context, netMon *netmon.Monitor, derpMap *tailcfg.DERPMap, preferredDERPRegionID int) (found bool) {
+	return d.detectCaptivePortalWithGOOS(ctx, netMon, derpMap, preferredDERPRegionID, runtime.GOOS)
+}
+
+func (d *Detector) detectCaptivePortalWithGOOS(ctx context.Context, netMon *netmon.Monitor, derpMap *tailcfg.DERPMap, preferredDERPRegionID int, goos string) (found bool) {
+	ifState := netMon.InterfaceState()
+	if !ifState.AnyInterfaceUp() {
+		d.logf("[v2] DetectCaptivePortal: no interfaces up, returning false")
+		return false
+	}
+
+	endpoints := availableEndpoints(derpMap, preferredDERPRegionID, d.logf, goos)
+
+	// Here we try detecting a captive portal using *all* available interfaces on the system
+	// that have a IPv4 address. We consider to have found a captive portal when any interface
+	// reports one may exists. This is necessary because most systems have multiple interfaces,
+	// and most importantly on macOS no default route interface is set until the user has accepted
+	// the captive portal alert thrown by the system. If no default route interface is known,
+	// we need to try with anything that might remotely resemble a Wi-Fi interface.
+	for ifName, i := range ifState.Interface {
+		if !i.IsUp() || i.IsLoopback() || interfaceNameDoesNotNeedCaptiveDetection(ifName, goos) {
+			continue
+		}
+		addrs, err := i.Addrs()
+		if err != nil {
+			d.logf("[v1] DetectCaptivePortal: failed to get addresses for interface %s: %v", ifName, err)
+			continue
+		}
+		if len(addrs) == 0 {
+			continue
+		}
+		d.logf("[v2] attempting to do captive portal detection on interface %s", ifName)
+		res := d.detectOnInterface(ctx, i.Index, endpoints)
+		if res {
+			d.logf("DetectCaptivePortal(found=true,ifName=%s)", ifName)
+			return true
+		}
+	}
+
+	d.logf("DetectCaptivePortal(found=false)")
+	return false
+}
+
+// interfaceNameDoesNotNeedCaptiveDetection returns true if an interface does not require captive portal detection
+// based on its name. This is useful to avoid making unnecessary HTTP requests on interfaces that are known to not
+// require it. We also avoid making requests on the interface prefixes "pdp" and "rmnet", which are cellular data
+// interfaces on iOS and Android, respectively, and would be needlessly battery-draining.
+func interfaceNameDoesNotNeedCaptiveDetection(ifName string, goos string) bool {
+	ifName = strings.ToLower(ifName)
+	excludedPrefixes := []string{"tailscale", "tun", "tap", "docker", "kube", "wg", "ipsec"}
+	if goos == "windows" {
+		excludedPrefixes = append(excludedPrefixes, "loopback", "tunnel", "ppp", "isatap", "teredo", "6to4")
+	} else if goos == "darwin" || goos == "ios" {
+		excludedPrefixes = append(excludedPrefixes, "pdp", "awdl", "bridge", "ap", "utun", "tap", "llw", "anpi", "lo", "stf", "gif", "xhc", "pktap")
+	} else if goos == "android" {
+		excludedPrefixes = append(excludedPrefixes, "rmnet", "p2p", "dummy", "sit")
+	}
+	for _, prefix := range excludedPrefixes {
+		if strings.HasPrefix(ifName, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+// detectOnInterface reports whether or not we think the system is behind a
+// captive portal, detected by making a request to a URL that we know should
+// return a "204 No Content" response and checking if that's what we get.
+//
+// The boolean return is whether we think we have a captive portal.
+func (d *Detector) detectOnInterface(ctx context.Context, ifIndex int, endpoints []Endpoint) bool {
+	defer d.httpClient.CloseIdleConnections()
+
+	d.logf("[v2] %d available captive portal detection endpoints: %v", len(endpoints), endpoints)
+
+	// We try to detect the captive portal more quickly by making requests to multiple endpoints concurrently.
+	var wg sync.WaitGroup
+	resultCh := make(chan bool, len(endpoints))
+
+	for i, e := range endpoints {
+		if i >= 5 {
+			// Try a maximum of 5 endpoints, break out (returning false) if we run of attempts.
+			break
+		}
+		wg.Add(1)
+		go func(endpoint Endpoint) {
+			defer wg.Done()
+			found, err := d.verifyCaptivePortalEndpoint(ctx, endpoint, ifIndex)
+			if err != nil {
+				d.logf("[v1] checkCaptivePortalEndpoint failed with endpoint %v: %v", endpoint, err)
+				return
+			}
+			if found {
+				resultCh <- true
+			}
+		}(e)
+	}
+
+	go func() {
+		wg.Wait()
+		close(resultCh)
+	}()
+
+	for result := range resultCh {
+		if result {
+			// If any of the endpoints seems to be a captive portal, we consider the system to be behind one.
+			return true
+		}
+	}
+
+	return false
+}
+
+// verifyCaptivePortalEndpoint checks if the given Endpoint is a captive portal by making an HTTP request to the
+// given Endpoint URL using the interface with index ifIndex, and checking if the response looks like a captive portal.
+func (d *Detector) verifyCaptivePortalEndpoint(ctx context.Context, e Endpoint, ifIndex int) (found bool, err error) {
+	ctx, cancel := context.WithTimeout(ctx, Timeout)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, "GET", e.URL.String(), nil)
+	if err != nil {
+		return false, err
+	}
+
+	// Attach the Tailscale challenge header if the endpoint supports it. Not all captive portal detection endpoints
+	// support this, so we only attach it if the endpoint does.
+	if e.SupportsTailscaleChallenge {
+		// Note: the set of valid characters in a challenge and the total
+		// length is limited; see isChallengeChar in cmd/derper for more
+		// details.
+		chal := "ts_" + e.URL.Host
+		req.Header.Set("X-Tailscale-Challenge", chal)
+	}
+
+	d.mu.Lock()
+	d.currIfIndex = ifIndex
+	d.mu.Unlock()
+
+	// Make the actual request, and check if the response looks like a captive portal or not.
+	r, err := d.httpClient.Do(req)
+	if err != nil {
+		return false, err
+	}
+
+	return e.responseLooksLikeCaptive(r, d.logf), nil
+}
+
+func (d *Detector) dialContext(ctx context.Context, network, addr string) (net.Conn, error) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	ifIndex := d.currIfIndex
+
+	dl := &net.Dialer{
+		Timeout: Timeout,
+		Control: func(network, address string, c syscall.RawConn) error {
+			return setSocketInterfaceIndex(c, ifIndex, d.logf)
+		},
+	}
+
+	return dl.DialContext(ctx, network, addr)
+}

vendor/tailscale.com/net/captivedetection/endpoints.go

@@ -0,0 +1,178 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package captivedetection
+
+import (
+	"cmp"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"slices"
+
+	"go4.org/mem"
+	"tailscale.com/net/dnsfallback"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+)
+
+// EndpointProvider is an enum that represents the source of an Endpoint.
+type EndpointProvider int
+
+const (
+	// DERPMapPreferred is used for an endpoint that is a DERP node contained in the current preferred DERP region,
+	// as provided by the DERPMap.
+	DERPMapPreferred EndpointProvider = iota
+	// DERPMapOther is used for an endpoint that is a DERP node, but not contained in the current preferred DERP region.
+	DERPMapOther
+	// Tailscale is used for endpoints that are the Tailscale coordination server or admin console.
+	Tailscale
+)
+
+func (p EndpointProvider) String() string {
+	switch p {
+	case DERPMapPreferred:
+		return "DERPMapPreferred"
+	case Tailscale:
+		return "Tailscale"
+	case DERPMapOther:
+		return "DERPMapOther"
+	default:
+		return fmt.Sprintf("EndpointProvider(%d)", p)
+	}
+}
+
+// Endpoint represents a URL that can be used to detect a captive portal, along with the expected
+// result of the HTTP request.
+type Endpoint struct {
+	// URL is the URL that we make an HTTP request to as part of the captive portal detection process.
+	URL *url.URL
+	// StatusCode is the expected HTTP status code that we expect to see in the response.
+	StatusCode int
+	// ExpectedContent is a string that we expect to see contained in the response body. If this is non-empty,
+	// we will check that the response body contains this string. If it is empty, we will not check the response body
+	// and only check the status code.
+	ExpectedContent string
+	// SupportsTailscaleChallenge is true if the endpoint will return the sent value of the X-Tailscale-Challenge
+	// HTTP header in its HTTP response.
+	SupportsTailscaleChallenge bool
+	// Provider is the source of the endpoint. This is used to prioritize certain endpoints over others
+	// (for example, a DERP node in the preferred region should always be used first).
+	Provider EndpointProvider
+}
+
+func (e Endpoint) String() string {
+	return fmt.Sprintf("Endpoint{URL=%q, StatusCode=%d, ExpectedContent=%q, SupportsTailscaleChallenge=%v, Provider=%s}", e.URL, e.StatusCode, e.ExpectedContent, e.SupportsTailscaleChallenge, e.Provider.String())
+}
+
+func (e Endpoint) Equal(other Endpoint) bool {
+	return e.URL.String() == other.URL.String() &&
+		e.StatusCode == other.StatusCode &&
+		e.ExpectedContent == other.ExpectedContent &&
+		e.SupportsTailscaleChallenge == other.SupportsTailscaleChallenge &&
+		e.Provider == other.Provider
+}
+
+// availableEndpoints returns a set of Endpoints which can be used for captive portal detection by performing
+// one or more HTTP requests and looking at the response. The returned Endpoints are ordered by preference,
+// with the most preferred Endpoint being the first in the slice.
+func availableEndpoints(derpMap *tailcfg.DERPMap, preferredDERPRegionID int, logf logger.Logf, goos string) []Endpoint {
+	endpoints := []Endpoint{}
+
+	if derpMap == nil || len(derpMap.Regions) == 0 {
+		// When the client first starts, we don't have a DERPMap in LocalBackend yet. In this case,
+		// we use the static DERPMap from dnsfallback.
+		logf("captivedetection: current DERPMap is empty, using map from dnsfallback")
+		derpMap = dnsfallback.GetDERPMap()
+	}
+	// Use the DERP IPs as captive portal detection endpoints. Using IPs is better than hostnames
+	// because they do not depend on DNS resolution.
+	for _, region := range derpMap.Regions {
+		if region.Avoid {
+			continue
+		}
+		for _, node := range region.Nodes {
+			if node.IPv4 == "" || !node.CanPort80 {
+				continue
+			}
+			str := "http://" + node.IPv4 + "/generate_204"
+			u, err := url.Parse(str)
+			if err != nil {
+				logf("captivedetection: failed to parse DERP node URL %q: %v", str, err)
+				continue
+			}
+			p := DERPMapOther
+			if region.RegionID == preferredDERPRegionID {
+				p = DERPMapPreferred
+			}
+			e := Endpoint{u, http.StatusNoContent, "", true, p}
+			endpoints = append(endpoints, e)
+		}
+	}
+
+	// Let's also try the default Tailscale coordination server and admin console.
+	// These are likely to be blocked on some networks.
+	appendTailscaleEndpoint := func(urlString string) {
+		u, err := url.Parse(urlString)
+		if err != nil {
+			logf("captivedetection: failed to parse Tailscale URL %q: %v", urlString, err)
+			return
+		}
+		endpoints = append(endpoints, Endpoint{u, http.StatusNoContent, "", false, Tailscale})
+	}
+	appendTailscaleEndpoint("http://controlplane.tailscale.com/generate_204")
+	appendTailscaleEndpoint("http://login.tailscale.com/generate_204")
+
+	// Sort the endpoints by provider so that we can prioritize DERP nodes in the preferred region, followed by
+	// any other DERP server elsewhere, then followed by Tailscale endpoints.
+	slices.SortFunc(endpoints, func(x, y Endpoint) int {
+		return cmp.Compare(x.Provider, y.Provider)
+	})
+
+	return endpoints
+}
+
+// responseLooksLikeCaptive checks if the given HTTP response matches the expected response for the Endpoint.
+func (e Endpoint) responseLooksLikeCaptive(r *http.Response, logf logger.Logf) bool {
+	defer r.Body.Close()
+
+	// Check the status code first.
+	if r.StatusCode != e.StatusCode {
+		logf("[v1] unexpected status code in captive portal response: want=%d, got=%d", e.StatusCode, r.StatusCode)
+		return true
+	}
+
+	// If the endpoint supports the Tailscale challenge header, check that the response contains the expected header.
+	if e.SupportsTailscaleChallenge {
+		expectedResponse := "response ts_" + e.URL.Host
+		hasResponse := r.Header.Get("X-Tailscale-Response") == expectedResponse
+		if !hasResponse {
+			// The response did not contain the expected X-Tailscale-Response header, which means we are most likely
+			// behind a captive portal (somebody is tampering with the response headers).
+			logf("captive portal check response did not contain expected X-Tailscale-Response header: want=%q, got=%q", expectedResponse, r.Header.Get("X-Tailscale-Response"))
+			return true
+		}
+	}
+
+	// If we don't have an expected content string, we don't need to check the response body.
+	if e.ExpectedContent == "" {
+		return false
+	}
+
+	// Read the response body and check if it contains the expected content.
+	b, err := io.ReadAll(io.LimitReader(r.Body, 4096))
+	if err != nil {
+		logf("reading captive portal check response body failed: %v", err)
+		return false
+	}
+	hasExpectedContent := mem.Contains(mem.B(b), mem.S(e.ExpectedContent))
+	if !hasExpectedContent {
+		// The response body did not contain the expected content, that means we are most likely behind a captive portal.
+		logf("[v1] captive portal check response body did not contain expected content: want=%q", e.ExpectedContent)
+		return true
+	}
+
+	// If we got here, the response looks good.
+	return false
+}

vendor/tailscale.com/net/captivedetection/rawconn.go

@@ -0,0 +1,19 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !(ios || darwin)
+
+package captivedetection
+
+import (
+	"syscall"
+
+	"tailscale.com/types/logger"
+)
+
+// setSocketInterfaceIndex sets the IP_BOUND_IF socket option on the given RawConn.
+// This forces the socket to use the given interface.
+func setSocketInterfaceIndex(c syscall.RawConn, ifIndex int, logf logger.Logf) error {
+	// No-op on non-Darwin platforms.
+	return nil
+}

vendor/tailscale.com/net/captivedetection/rawconn_apple.go

@@ -0,0 +1,24 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build ios || darwin
+
+package captivedetection
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+	"tailscale.com/types/logger"
+)
+
+// setSocketInterfaceIndex sets the IP_BOUND_IF socket option on the given RawConn.
+// This forces the socket to use the given interface.
+func setSocketInterfaceIndex(c syscall.RawConn, ifIndex int, logf logger.Logf) error {
+	return c.Control((func(fd uintptr) {
+		err := unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_BOUND_IF, ifIndex)
+		if err != nil {
+			logf("captivedetection: failed to set IP_BOUND_IF (ifIndex=%d): %v", ifIndex, err)
+		}
+	}))
+}

vendor/tailscale.com/net/connstats/stats.go

@@ -0,0 +1,222 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package connstats maintains statistics about connections
+// flowing through a TUN device (which operate at the IP layer).
+package connstats
+
+import (
+	"context"
+	"net/netip"
+	"sync"
+	"time"
+
+	"golang.org/x/sync/errgroup"
+	"tailscale.com/net/packet"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/netlogtype"
+)
+
+// Statistics maintains counters for every connection.
+// All methods are safe for concurrent use.
+// The zero value is ready for use.
+type Statistics struct {
+	maxConns int // immutable once set
+
+	mu sync.Mutex
+	connCnts
+
+	connCntsCh  chan connCnts
+	shutdownCtx context.Context
+	shutdown    context.CancelFunc
+	group       errgroup.Group
+}
+
+type connCnts struct {
+	start    time.Time
+	end      time.Time
+	virtual  map[netlogtype.Connection]netlogtype.Counts
+	physical map[netlogtype.Connection]netlogtype.Counts
+}
+
+// NewStatistics creates a data structure for tracking connection statistics
+// that periodically dumps the virtual and physical connection counts
+// depending on whether the maxPeriod or maxConns is exceeded.
+// The dump function is called from a single goroutine.
+// Shutdown must be called to cleanup resources.
+func NewStatistics(maxPeriod time.Duration, maxConns int, dump func(start, end time.Time, virtual, physical map[netlogtype.Connection]netlogtype.Counts)) *Statistics {
+	s := &Statistics{maxConns: maxConns}
+	s.connCntsCh = make(chan connCnts, 256)
+	s.shutdownCtx, s.shutdown = context.WithCancel(context.Background())
+	s.group.Go(func() error {
+		// TODO(joetsai): Using a ticker is problematic on mobile platforms
+		// where waking up a process every maxPeriod when there is no activity
+		// is a drain on battery life. Switch this instead to instead use
+		// a time.Timer that is triggered upon network activity.
+		ticker := new(time.Ticker)
+		if maxPeriod > 0 {
+			ticker = time.NewTicker(maxPeriod)
+			defer ticker.Stop()
+		}
+
+		for {
+			var cc connCnts
+			select {
+			case cc = <-s.connCntsCh:
+			case <-ticker.C:
+				cc = s.extract()
+			case <-s.shutdownCtx.Done():
+				cc = s.extract()
+			}
+			if len(cc.virtual)+len(cc.physical) > 0 && dump != nil {
+				dump(cc.start, cc.end, cc.virtual, cc.physical)
+			}
+			if s.shutdownCtx.Err() != nil {
+				return nil
+			}
+		}
+	})
+	return s
+}
+
+// UpdateTxVirtual updates the counters for a transmitted IP packet
+// The source and destination of the packet directly correspond with
+// the source and destination in netlogtype.Connection.
+func (s *Statistics) UpdateTxVirtual(b []byte) {
+	s.updateVirtual(b, false)
+}
+
+// UpdateRxVirtual updates the counters for a received IP packet.
+// The source and destination of the packet are inverted with respect to
+// the source and destination in netlogtype.Connection.
+func (s *Statistics) UpdateRxVirtual(b []byte) {
+	s.updateVirtual(b, true)
+}
+
+var (
+	tailscaleServiceIPv4 = tsaddr.TailscaleServiceIP()
+	tailscaleServiceIPv6 = tsaddr.TailscaleServiceIPv6()
+)
+
+func (s *Statistics) updateVirtual(b []byte, receive bool) {
+	var p packet.Parsed
+	p.Decode(b)
+	conn := netlogtype.Connection{Proto: p.IPProto, Src: p.Src, Dst: p.Dst}
+	if receive {
+		conn.Src, conn.Dst = conn.Dst, conn.Src
+	}
+
+	// Network logging is defined as traffic between two Tailscale nodes.
+	// Traffic with the internal Tailscale service is not with another node
+	// and should not be logged. It also happens to be a high volume
+	// amount of discrete traffic flows (e.g., DNS lookups).
+	switch conn.Dst.Addr() {
+	case tailscaleServiceIPv4, tailscaleServiceIPv6:
+		return
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	cnts, found := s.virtual[conn]
+	if !found && !s.preInsertConn() {
+		return
+	}
+	if receive {
+		cnts.RxPackets++
+		cnts.RxBytes += uint64(len(b))
+	} else {
+		cnts.TxPackets++
+		cnts.TxBytes += uint64(len(b))
+	}
+	s.virtual[conn] = cnts
+}
+
+// UpdateTxPhysical updates the counters for a transmitted wireguard packet
+// The src is always a Tailscale IP address, representing some remote peer.
+// The dst is a remote IP address and port that corresponds
+// with some physical peer backing the Tailscale IP address.
+func (s *Statistics) UpdateTxPhysical(src netip.Addr, dst netip.AddrPort, n int) {
+	s.updatePhysical(src, dst, n, false)
+}
+
+// UpdateRxPhysical updates the counters for a received wireguard packet.
+// The src is always a Tailscale IP address, representing some remote peer.
+// The dst is a remote IP address and port that corresponds
+// with some physical peer backing the Tailscale IP address.
+func (s *Statistics) UpdateRxPhysical(src netip.Addr, dst netip.AddrPort, n int) {
+	s.updatePhysical(src, dst, n, true)
+}
+
+func (s *Statistics) updatePhysical(src netip.Addr, dst netip.AddrPort, n int, receive bool) {
+	conn := netlogtype.Connection{Src: netip.AddrPortFrom(src, 0), Dst: dst}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	cnts, found := s.physical[conn]
+	if !found && !s.preInsertConn() {
+		return
+	}
+	if receive {
+		cnts.RxPackets++
+		cnts.RxBytes += uint64(n)
+	} else {
+		cnts.TxPackets++
+		cnts.TxBytes += uint64(n)
+	}
+	s.physical[conn] = cnts
+}
+
+// preInsertConn updates the maps to handle insertion of a new connection.
+// It reports false if insertion is not allowed (i.e., after shutdown).
+func (s *Statistics) preInsertConn() bool {
+	// Check whether insertion of a new connection will exceed maxConns.
+	if len(s.virtual)+len(s.physical) == s.maxConns && s.maxConns > 0 {
+		// Extract the current statistics and send it to the serializer.
+		// Avoid blocking the network packet handling path.
+		select {
+		case s.connCntsCh <- s.extractLocked():
+		default:
+			// TODO(joetsai): Log that we are dropping an entire connCounts.
+		}
+	}
+
+	// Initialize the maps if nil.
+	if s.virtual == nil && s.physical == nil {
+		s.start = time.Now().UTC()
+		s.virtual = make(map[netlogtype.Connection]netlogtype.Counts)
+		s.physical = make(map[netlogtype.Connection]netlogtype.Counts)
+	}
+
+	return s.shutdownCtx.Err() == nil
+}
+
+func (s *Statistics) extract() connCnts {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.extractLocked()
+}
+
+func (s *Statistics) extractLocked() connCnts {
+	if len(s.virtual)+len(s.physical) == 0 {
+		return connCnts{}
+	}
+	s.end = time.Now().UTC()
+	cc := s.connCnts
+	s.connCnts = connCnts{}
+	return cc
+}
+
+// TestExtract synchronously extracts the current network statistics map
+// and resets the counters. This should only be used for testing purposes.
+func (s *Statistics) TestExtract() (virtual, physical map[netlogtype.Connection]netlogtype.Counts) {
+	cc := s.extract()
+	return cc.virtual, cc.physical
+}
+
+// Shutdown performs a final flush of statistics.
+// Statistics for any subsequent calls to Update will be dropped.
+// It is safe to call Shutdown concurrently and repeatedly.
+func (s *Statistics) Shutdown(context.Context) error {
+	s.shutdown()
+	return s.group.Wait()
+}

vendor/tailscale.com/net/dns/config.go

@@ -0,0 +1,182 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package dns contains code to configure and manage DNS settings.
+package dns
+
+import (
+	"bufio"
+	"fmt"
+	"net/netip"
+	"sort"
+
+	"tailscale.com/net/dns/publicdns"
+	"tailscale.com/net/dns/resolver"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/dnstype"
+	"tailscale.com/util/dnsname"
+)
+
+// Config is a DNS configuration.
+type Config struct {
+	// DefaultResolvers are the DNS resolvers to use for DNS names
+	// which aren't covered by more specific per-domain routes below.
+	// If empty, the OS's default resolvers (the ones that predate
+	// Tailscale altering the configuration) are used.
+	DefaultResolvers []*dnstype.Resolver
+	// Routes maps a DNS suffix to the resolvers that should be used
+	// for queries that fall within that suffix.
+	// If a query doesn't match any entry in Routes, the
+	// DefaultResolvers are used.
+	// A Routes entry with no resolvers means the route should be
+	// authoritatively answered using the contents of Hosts.
+	Routes map[dnsname.FQDN][]*dnstype.Resolver
+	// SearchDomains are DNS suffixes to try when expanding
+	// single-label queries.
+	SearchDomains []dnsname.FQDN
+	// Hosts maps DNS FQDNs to their IPs, which can be a mix of IPv4
+	// and IPv6.
+	// Queries matching entries in Hosts are resolved locally by
+	// 100.100.100.100 without leaving the machine.
+	// Adding an entry to Hosts merely creates the record. If you want
+	// it to resolve, you also need to add appropriate routes to
+	// Routes.
+	Hosts map[dnsname.FQDN][]netip.Addr
+	// OnlyIPv6, if true, uses the IPv6 service IP (for MagicDNS)
+	// instead of the IPv4 version (100.100.100.100).
+	OnlyIPv6 bool
+}
+
+func (c *Config) serviceIP() netip.Addr {
+	if c.OnlyIPv6 {
+		return tsaddr.TailscaleServiceIPv6()
+	}
+	return tsaddr.TailscaleServiceIP()
+}
+
+// WriteToBufioWriter write a debug version of c for logs to w, omitting
+// spammy stuff like *.arpa entries and replacing it with a total count.
+func (c *Config) WriteToBufioWriter(w *bufio.Writer) {
+	w.WriteString("{DefaultResolvers:")
+	resolver.WriteDNSResolvers(w, c.DefaultResolvers)
+
+	w.WriteString(" Routes:")
+	resolver.WriteRoutes(w, c.Routes)
+
+	fmt.Fprintf(w, " SearchDomains:%v", c.SearchDomains)
+	fmt.Fprintf(w, " Hosts:%v", len(c.Hosts))
+	w.WriteString("}")
+}
+
+// needsAnyResolvers reports whether c requires a resolver to be set
+// at the OS level.
+func (c Config) needsOSResolver() bool {
+	return c.hasDefaultResolvers() || c.hasRoutes()
+}
+
+func (c Config) hasRoutes() bool {
+	return len(c.Routes) > 0
+}
+
+// hasDefaultIPResolversOnly reports whether the only resolvers in c are
+// DefaultResolvers, and that those resolvers are simple IP addresses
+// that speak regular port 53 DNS.
+func (c Config) hasDefaultIPResolversOnly() bool {
+	if !c.hasDefaultResolvers() || c.hasRoutes() {
+		return false
+	}
+	for _, r := range c.DefaultResolvers {
+		if ipp, ok := r.IPPort(); !ok || ipp.Port() != 53 || publicdns.IPIsDoHOnlyServer(ipp.Addr()) {
+			return false
+		}
+	}
+	return true
+}
+
+// hasHostsWithoutSplitDNSRoutes reports whether c contains any Host entries
+// that aren't covered by a SplitDNS route suffix.
+func (c Config) hasHostsWithoutSplitDNSRoutes() bool {
+	// TODO(bradfitz): this could be more efficient, but we imagine
+	// the number of SplitDNS routes and/or hosts will be small.
+	for host := range c.Hosts {
+		if !c.hasSplitDNSRouteForHost(host) {
+			return true
+		}
+	}
+	return false
+}
+
+// hasSplitDNSRouteForHost reports whether c contains a SplitDNS route
+// that contains hosts.
+func (c Config) hasSplitDNSRouteForHost(host dnsname.FQDN) bool {
+	for route := range c.Routes {
+		if route.Contains(host) {
+			return true
+		}
+	}
+	return false
+}
+
+func (c Config) hasDefaultResolvers() bool {
+	return len(c.DefaultResolvers) > 0
+}
+
+// singleResolverSet returns the resolvers used by c.Routes if all
+// routes use the same resolvers, or nil if multiple sets of resolvers
+// are specified.
+func (c Config) singleResolverSet() []*dnstype.Resolver {
+	var (
+		prev            []*dnstype.Resolver
+		prevInitialized bool
+	)
+	for _, resolvers := range c.Routes {
+		if !prevInitialized {
+			prev = resolvers
+			prevInitialized = true
+			continue
+		}
+		if !sameResolverNames(prev, resolvers) {
+			return nil
+		}
+	}
+	return prev
+}
+
+// matchDomains returns the list of match suffixes needed by Routes.
+func (c Config) matchDomains() []dnsname.FQDN {
+	ret := make([]dnsname.FQDN, 0, len(c.Routes))
+	for suffix := range c.Routes {
+		ret = append(ret, suffix)
+	}
+	sort.Slice(ret, func(i, j int) bool {
+		return ret[i].WithTrailingDot() < ret[j].WithTrailingDot()
+	})
+	return ret
+}
+
+func sameResolverNames(a, b []*dnstype.Resolver) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i].Addr != b[i].Addr {
+			return false
+		}
+		if !sameIPs(a[i].BootstrapResolution, b[i].BootstrapResolution) {
+			return false
+		}
+	}
+	return true
+}
+
+func sameIPs(a, b []netip.Addr) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}

vendor/tailscale.com/net/dns/debian_resolvconf.go

@@ -0,0 +1,184 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux || freebsd || openbsd
+
+package dns
+
+import (
+	"bufio"
+	"bytes"
+	_ "embed"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"tailscale.com/atomicfile"
+	"tailscale.com/types/logger"
+)
+
+//go:embed resolvconf-workaround.sh
+var workaroundScript []byte
+
+// resolvconfConfigName is the name of the config submitted to
+// resolvconf.
+// The name starts with 'tun' in order to match the hardcoded
+// interface order in debian resolvconf, which will place this
+// configuration ahead of regular network links. In theory, this
+// doesn't matter because we then fix things up to ensure our config
+// is the only one in use, but in case that fails, this will make our
+// configuration slightly preferred.
+// The 'inet' suffix has no specific meaning, but conventionally
+// resolvconf implementations encourage adding a suffix roughly
+// indicating where the config came from, and "inet" is the "none of
+// the above" value (rather than, say, "ppp" or "dhcp").
+const resolvconfConfigName = "tun-tailscale.inet"
+
+// resolvconfLibcHookPath is the directory containing libc update
+// scripts, which are run by Debian resolvconf when /etc/resolv.conf
+// has been updated.
+const resolvconfLibcHookPath = "/etc/resolvconf/update-libc.d"
+
+// resolvconfHookPath is the name of the libc hook script we install
+// to force Tailscale's DNS config to take effect.
+var resolvconfHookPath = filepath.Join(resolvconfLibcHookPath, "tailscale")
+
+// resolvconfManager manages DNS configuration using the Debian
+// implementation of the `resolvconf` program, written by Thomas Hood.
+type resolvconfManager struct {
+	logf            logger.Logf
+	listRecordsPath string
+	interfacesDir   string
+	scriptInstalled bool // libc update script has been installed
+}
+
+func newDebianResolvconfManager(logf logger.Logf) (*resolvconfManager, error) {
+	ret := &resolvconfManager{
+		logf:            logf,
+		listRecordsPath: "/lib/resolvconf/list-records",
+		interfacesDir:   "/etc/resolvconf/run/interface", // panic fallback if nothing seems to work
+	}
+
+	if _, err := os.Stat(ret.listRecordsPath); os.IsNotExist(err) {
+		// This might be a Debian system from before the big /usr
+		// merge, try /usr instead.
+		ret.listRecordsPath = "/usr" + ret.listRecordsPath
+	}
+	// The runtime directory is currently (2020-04) canonically
+	// /etc/resolvconf/run, but the manpage is making noise about
+	// switching to /run/resolvconf and dropping the /etc path. So,
+	// let's probe the possible directories and use the first one
+	// that works.
+	for _, path := range []string{
+		"/etc/resolvconf/run/interface",
+		"/run/resolvconf/interface",
+		"/var/run/resolvconf/interface",
+	} {
+		if _, err := os.Stat(path); err == nil {
+			ret.interfacesDir = path
+			break
+		}
+	}
+	if ret.interfacesDir == "" {
+		// None of the paths seem to work, use the canonical location
+		// that the current manpage says to use.
+		ret.interfacesDir = "/etc/resolvconf/run/interfaces"
+	}
+
+	return ret, nil
+}
+
+func (m *resolvconfManager) deleteTailscaleConfig() error {
+	cmd := exec.Command("resolvconf", "-d", resolvconfConfigName)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("running %s: %s", cmd, out)
+	}
+	return nil
+}
+
+func (m *resolvconfManager) SetDNS(config OSConfig) error {
+	if !m.scriptInstalled {
+		m.logf("injecting resolvconf workaround script")
+		if err := os.MkdirAll(resolvconfLibcHookPath, 0755); err != nil {
+			return err
+		}
+		if err := atomicfile.WriteFile(resolvconfHookPath, workaroundScript, 0755); err != nil {
+			return err
+		}
+		m.scriptInstalled = true
+	}
+
+	if config.IsZero() {
+		if err := m.deleteTailscaleConfig(); err != nil {
+			return err
+		}
+	} else {
+		stdin := new(bytes.Buffer)
+		writeResolvConf(stdin, config.Nameservers, config.SearchDomains) // dns_direct.go
+
+		// This resolvconf implementation doesn't support exclusive
+		// mode or interface priorities, so it will end up blending
+		// our configuration with other sources. However, this will
+		// get fixed up by the script we injected above.
+		cmd := exec.Command("resolvconf", "-a", resolvconfConfigName)
+		cmd.Stdin = stdin
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("running %s: %s", cmd, out)
+		}
+	}
+
+	return nil
+}
+
+func (m *resolvconfManager) SupportsSplitDNS() bool {
+	return false
+}
+
+func (m *resolvconfManager) GetBaseConfig() (OSConfig, error) {
+	var bs bytes.Buffer
+
+	cmd := exec.Command(m.listRecordsPath)
+	// list-records assumes it's being run with CWD set to the
+	// interfaces runtime dir, and returns nonsense otherwise.
+	cmd.Dir = m.interfacesDir
+	cmd.Stdout = &bs
+	if err := cmd.Run(); err != nil {
+		return OSConfig{}, err
+	}
+
+	var conf bytes.Buffer
+	sc := bufio.NewScanner(&bs)
+	for sc.Scan() {
+		if sc.Text() == resolvconfConfigName {
+			continue
+		}
+		bs, err := os.ReadFile(filepath.Join(m.interfacesDir, sc.Text()))
+		if err != nil {
+			if os.IsNotExist(err) {
+				// Probably raced with a deletion, that's okay.
+				continue
+			}
+			return OSConfig{}, err
+		}
+		conf.Write(bs)
+		conf.WriteByte('\n')
+	}
+
+	return readResolv(&conf)
+}
+
+func (m *resolvconfManager) Close() error {
+	if err := m.deleteTailscaleConfig(); err != nil {
+		return err
+	}
+
+	if m.scriptInstalled {
+		m.logf("removing resolvconf workaround script")
+		os.Remove(resolvconfHookPath) // Best-effort
+	}
+
+	return nil
+}

vendor/tailscale.com/net/dns/direct.go

@@ -0,0 +1,551 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/netip"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"tailscale.com/health"
+	"tailscale.com/net/dns/resolvconffile"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/dnsname"
+	"tailscale.com/version/distro"
+)
+
+// writeResolvConf writes DNS configuration in resolv.conf format to the given writer.
+func writeResolvConf(w io.Writer, servers []netip.Addr, domains []dnsname.FQDN) error {
+	c := &resolvconffile.Config{
+		Nameservers:   servers,
+		SearchDomains: domains,
+	}
+	return c.Write(w)
+}
+
+func readResolv(r io.Reader) (OSConfig, error) {
+	c, err := resolvconffile.Parse(r)
+	if err != nil {
+		return OSConfig{}, err
+	}
+	return OSConfig{
+		Nameservers:   c.Nameservers,
+		SearchDomains: c.SearchDomains,
+	}, nil
+}
+
+// resolvOwner returns the apparent owner of the resolv.conf
+// configuration in bs - one of "resolvconf", "systemd-resolved" or
+// "NetworkManager", or "" if no known owner was found.
+//
+//lint:ignore U1000 used in linux and freebsd code
+func resolvOwner(bs []byte) string {
+	likely := ""
+	b := bytes.NewBuffer(bs)
+	for {
+		line, err := b.ReadString('\n')
+		if err != nil {
+			return likely
+		}
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		if line[0] != '#' {
+			// First non-empty, non-comment line. Assume the owner
+			// isn't hiding further down.
+			return likely
+		}
+
+		if strings.Contains(line, "systemd-resolved") {
+			likely = "systemd-resolved"
+		} else if strings.Contains(line, "NetworkManager") {
+			likely = "NetworkManager"
+		} else if strings.Contains(line, "resolvconf") {
+			likely = "resolvconf"
+		}
+	}
+}
+
+// isResolvedRunning reports whether systemd-resolved is running on the system,
+// even if it is not managing the system DNS settings.
+func isResolvedRunning() bool {
+	if runtime.GOOS != "linux" {
+		return false
+	}
+
+	// systemd-resolved is never installed without systemd.
+	_, err := exec.LookPath("systemctl")
+	if err != nil {
+		return false
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	err = exec.CommandContext(ctx, "systemctl", "is-active", "systemd-resolved.service").Run()
+
+	// is-active exits with code 3 if the service is not active.
+	return err == nil
+}
+
+func restartResolved() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return exec.CommandContext(ctx, "systemctl", "restart", "systemd-resolved.service").Run()
+}
+
+// directManager is an OSConfigurator which replaces /etc/resolv.conf with a file
+// generated from the given configuration, creating a backup of its old state.
+//
+// This way of configuring DNS is precarious, since it does not react
+// to the disappearance of the Tailscale interface.
+// The caller must call Down before program shutdown
+// or as cleanup if the program terminates unexpectedly.
+type directManager struct {
+	logf   logger.Logf
+	health *health.Tracker
+	fs     wholeFileFS
+	// renameBroken is set if fs.Rename to or from /etc/resolv.conf
+	// fails. This can happen in some container runtimes, where
+	// /etc/resolv.conf is bind-mounted from outside the container,
+	// and therefore /etc and /etc/resolv.conf are different
+	// filesystems as far as rename(2) is concerned.
+	//
+	// In those situations, we fall back to emulating rename with file
+	// copies and truncations, which is not as good (opens up a race
+	// where a reader can see an empty or partial /etc/resolv.conf),
+	// but is better than having non-functioning DNS.
+	renameBroken bool
+
+	ctx      context.Context    // valid until Close
+	ctxClose context.CancelFunc // closes ctx
+
+	mu             sync.Mutex
+	wantResolvConf []byte // if non-nil, what we expect /etc/resolv.conf to contain
+	//lint:ignore U1000 used in direct_linux.go
+	lastWarnContents []byte // last resolv.conf contents that we warned about
+}
+
+//lint:ignore U1000 used in manager_{freebsd,openbsd}.go
+func newDirectManager(logf logger.Logf, health *health.Tracker) *directManager {
+	return newDirectManagerOnFS(logf, health, directFS{})
+}
+
+func newDirectManagerOnFS(logf logger.Logf, health *health.Tracker, fs wholeFileFS) *directManager {
+	ctx, cancel := context.WithCancel(context.Background())
+	m := &directManager{
+		logf:     logf,
+		health:   health,
+		fs:       fs,
+		ctx:      ctx,
+		ctxClose: cancel,
+	}
+	go m.runFileWatcher()
+	return m
+}
+
+func (m *directManager) readResolvFile(path string) (OSConfig, error) {
+	b, err := m.fs.ReadFile(path)
+	if err != nil {
+		return OSConfig{}, err
+	}
+	return readResolv(bytes.NewReader(b))
+}
+
+// ownedByTailscale reports whether /etc/resolv.conf seems to be a
+// tailscale-managed file.
+func (m *directManager) ownedByTailscale() (bool, error) {
+	isRegular, err := m.fs.Stat(resolvConf)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	if !isRegular {
+		return false, nil
+	}
+	bs, err := m.fs.ReadFile(resolvConf)
+	if err != nil {
+		return false, err
+	}
+	if bytes.Contains(bs, []byte("generated by tailscale")) {
+		return true, nil
+	}
+	return false, nil
+}
+
+// backupConfig creates or updates a backup of /etc/resolv.conf, if
+// resolv.conf does not currently contain a Tailscale-managed config.
+func (m *directManager) backupConfig() error {
+	if _, err := m.fs.Stat(resolvConf); err != nil {
+		if os.IsNotExist(err) {
+			// No resolv.conf, nothing to back up. Also get rid of any
+			// existing backup file, to avoid restoring something old.
+			m.fs.Remove(backupConf)
+			return nil
+		}
+		return err
+	}
+
+	owned, err := m.ownedByTailscale()
+	if err != nil {
+		return err
+	}
+	if owned {
+		return nil
+	}
+
+	return m.rename(resolvConf, backupConf)
+}
+
+func (m *directManager) restoreBackup() (restored bool, err error) {
+	if _, err := m.fs.Stat(backupConf); err != nil {
+		if os.IsNotExist(err) {
+			// No backup, nothing we can do.
+			return false, nil
+		}
+		return false, err
+	}
+	owned, err := m.ownedByTailscale()
+	if err != nil {
+		return false, err
+	}
+	_, err = m.fs.Stat(resolvConf)
+	if err != nil && !os.IsNotExist(err) {
+		return false, err
+	}
+	resolvConfExists := !os.IsNotExist(err)
+
+	if resolvConfExists && !owned {
+		// There's already a non-tailscale config in place, get rid of
+		// our backup.
+		m.fs.Remove(backupConf)
+		return false, nil
+	}
+
+	// We own resolv.conf, and a backup exists.
+	if err := m.rename(backupConf, resolvConf); err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
+
+// rename tries to rename old to new using m.fs.Rename, and falls back
+// to hand-copying bytes and truncating old if that fails.
+//
+// This is a workaround to /etc/resolv.conf being a bind-mounted file
+// some container environments, which cannot be moved elsewhere in
+// /etc (because that would be a cross-filesystem move) or deleted
+// (because that would break the bind in surprising ways).
+func (m *directManager) rename(old, new string) error {
+	if !m.renameBroken {
+		err := m.fs.Rename(old, new)
+		if err == nil {
+			return nil
+		}
+		if runtime.GOOS == "linux" && distro.Get() == distro.Synology {
+			// Fail fast. The fallback case below won't work anyway.
+			return err
+		}
+		m.logf("rename of %q to %q failed (%v), falling back to copy+delete", old, new, err)
+		m.renameBroken = true
+	}
+
+	bs, err := m.fs.ReadFile(old)
+	if err != nil {
+		return fmt.Errorf("reading %q to rename: %w", old, err)
+	}
+	if err := m.fs.WriteFile(new, bs, 0644); err != nil {
+		return fmt.Errorf("writing to %q in rename of %q: %w", new, old, err)
+	}
+
+	// Explicitly set the permissions on the new file. This ensures that
+	// if we have a umask set which prevents creating world-readable files,
+	// the file will still have the correct permissions once it's renamed
+	// into place. See #12609.
+	if err := m.fs.Chmod(new, 0644); err != nil {
+		return fmt.Errorf("chmod %q in rename of %q: %w", new, old, err)
+	}
+
+	if err := m.fs.Remove(old); err != nil {
+		err2 := m.fs.Truncate(old)
+		if err2 != nil {
+			return fmt.Errorf("remove of %q failed (%w) and so did truncate: %v", old, err, err2)
+		}
+	}
+	return nil
+}
+
+// setWant sets the expected contents of /etc/resolv.conf, if any.
+//
+// A value of nil means no particular value is expected.
+//
+// m takes ownership of want.
+func (m *directManager) setWant(want []byte) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.wantResolvConf = want
+}
+
+func (m *directManager) SetDNS(config OSConfig) (err error) {
+	defer func() {
+		if err != nil && errors.Is(err, fs.ErrPermission) && runtime.GOOS == "linux" &&
+			distro.Get() == distro.Synology && os.Geteuid() != 0 {
+			// On Synology (notably DSM7 where we don't run as root), ignore all
+			// DNS configuration errors for now. We don't have permission.
+			// See https://github.com/tailscale/tailscale/issues/4017
+			m.logf("ignoring SetDNS permission error on Synology (Issue 4017); was: %v", err)
+			err = nil
+		}
+	}()
+	m.setWant(nil) // reset our expectations before any work
+	var changed bool
+	if config.IsZero() {
+		changed, err = m.restoreBackup()
+		if err != nil {
+			return err
+		}
+	} else {
+		changed = true
+		if err := m.backupConfig(); err != nil {
+			return err
+		}
+
+		buf := new(bytes.Buffer)
+		writeResolvConf(buf, config.Nameservers, config.SearchDomains)
+		if err := m.atomicWriteFile(m.fs, resolvConf, buf.Bytes(), 0644); err != nil {
+			return err
+		}
+
+		// Now that we've successfully written to the file, lock it in.
+		// If we see /etc/resolv.conf with different contents, we know somebody
+		// else trampled on it.
+		m.setWant(buf.Bytes())
+	}
+
+	// We might have taken over a configuration managed by resolved,
+	// in which case it will notice this on restart and gracefully
+	// start using our configuration. This shouldn't happen because we
+	// try to manage DNS through resolved when it's around, but as a
+	// best-effort fallback if we messed up the detection, try to
+	// restart resolved to make the system configuration consistent.
+	//
+	// We take care to only kick systemd-resolved if we've made some
+	// change to the system's DNS configuration, because this codepath
+	// can end up running in cases where the user has manually
+	// configured /etc/resolv.conf to point to systemd-resolved (but
+	// it's not managed explicitly by systemd-resolved), *and* has
+	// --accept-dns=false, meaning we pass an empty configuration to
+	// the running DNS manager. In that very edge-case scenario, we
+	// cause a disruptive DNS outage each time we reset an empty
+	// OS configuration.
+	if changed && isResolvedRunning() && !runningAsGUIDesktopUser() {
+		t0 := time.Now()
+		err := restartResolved()
+		d := time.Since(t0).Round(time.Millisecond)
+		if err != nil {
+			m.logf("error restarting resolved after %v: %v", d, err)
+		} else {
+			m.logf("restarted resolved after %v", d)
+		}
+	}
+
+	return nil
+}
+
+func (m *directManager) SupportsSplitDNS() bool {
+	return false
+}
+
+func (m *directManager) GetBaseConfig() (OSConfig, error) {
+	owned, err := m.ownedByTailscale()
+	if err != nil {
+		return OSConfig{}, err
+	}
+	fileToRead := resolvConf
+	if owned {
+		fileToRead = backupConf
+	}
+
+	oscfg, err := m.readResolvFile(fileToRead)
+	if err != nil {
+		return OSConfig{}, err
+	}
+
+	// On some systems, the backup configuration file is actually a
+	// symbolic link to something owned by another DNS service (commonly,
+	// resolved). Thus, it can be updated out from underneath us to contain
+	// the Tailscale service IP, which results in an infinite loop of us
+	// trying to send traffic to resolved, which sends back to us, and so
+	// on. To solve this, drop the Tailscale service IP from the base
+	// configuration; we do this in all situations since there's
+	// essentially no world where we want to forward to ourselves.
+	//
+	// See: https://github.com/tailscale/tailscale/issues/7816
+	var removed bool
+	oscfg.Nameservers = slices.DeleteFunc(oscfg.Nameservers, func(ip netip.Addr) bool {
+		if ip == tsaddr.TailscaleServiceIP() || ip == tsaddr.TailscaleServiceIPv6() {
+			removed = true
+			return true
+		}
+		return false
+	})
+	if removed {
+		m.logf("[v1] dropped Tailscale IP from base config that was a symlink")
+	}
+	return oscfg, nil
+}
+
+func (m *directManager) Close() error {
+	m.ctxClose()
+
+	// We used to keep a file for the tailscale config and symlinked
+	// to it, but then we stopped because /etc/resolv.conf being a
+	// symlink to surprising places breaks snaps and other sandboxing
+	// things. Clean it up if it's still there.
+	m.fs.Remove("/etc/resolv.tailscale.conf")
+
+	if _, err := m.fs.Stat(backupConf); err != nil {
+		if os.IsNotExist(err) {
+			// No backup, nothing we can do.
+			return nil
+		}
+		return err
+	}
+	owned, err := m.ownedByTailscale()
+	if err != nil {
+		return err
+	}
+	_, err = m.fs.Stat(resolvConf)
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	resolvConfExists := !os.IsNotExist(err)
+
+	if resolvConfExists && !owned {
+		// There's already a non-tailscale config in place, get rid of
+		// our backup.
+		m.fs.Remove(backupConf)
+		return nil
+	}
+
+	// We own resolv.conf, and a backup exists.
+	if err := m.rename(backupConf, resolvConf); err != nil {
+		return err
+	}
+
+	if isResolvedRunning() && !runningAsGUIDesktopUser() {
+		m.logf("restarting systemd-resolved...")
+		if err := restartResolved(); err != nil {
+			m.logf("restart of systemd-resolved failed: %v", err)
+		} else {
+			m.logf("restarted systemd-resolved")
+		}
+	}
+
+	return nil
+}
+
+func (m *directManager) atomicWriteFile(fs wholeFileFS, filename string, data []byte, perm os.FileMode) error {
+	var randBytes [12]byte
+	if _, err := rand.Read(randBytes[:]); err != nil {
+		return fmt.Errorf("atomicWriteFile: %w", err)
+	}
+
+	tmpName := fmt.Sprintf("%s.%x.tmp", filename, randBytes[:])
+	defer fs.Remove(tmpName)
+
+	if err := fs.WriteFile(tmpName, data, perm); err != nil {
+		return fmt.Errorf("atomicWriteFile: %w", err)
+	}
+	// Explicitly set the permissions on the temporary file before renaming
+	// it. This ensures that if we have a umask set which prevents creating
+	// world-readable files, the file will still have the correct
+	// permissions once it's renamed into place. See #12609.
+	if err := fs.Chmod(tmpName, perm); err != nil {
+		return fmt.Errorf("atomicWriteFile: Chmod: %w", err)
+	}
+
+	return m.rename(tmpName, filename)
+}
+
+// wholeFileFS is a high-level file system abstraction designed just for use
+// by directManager, with the goal that it is easy to implement over wsl.exe.
+//
+// All name parameters are absolute paths.
+type wholeFileFS interface {
+	Chmod(name string, mode os.FileMode) error
+	ReadFile(name string) ([]byte, error)
+	Remove(name string) error
+	Rename(oldName, newName string) error
+	Stat(name string) (isRegular bool, err error)
+	Truncate(name string) error
+	WriteFile(name string, contents []byte, perm os.FileMode) error
+}
+
+// directFS is a wholeFileFS implemented directly on the OS.
+type directFS struct {
+	// prefix is file path prefix.
+	//
+	// All name parameters are absolute paths so this is typically a
+	// testing temporary directory like "/tmp".
+	prefix string
+}
+
+func (fs directFS) path(name string) string { return filepath.Join(fs.prefix, name) }
+
+func (fs directFS) Stat(name string) (isRegular bool, err error) {
+	fi, err := os.Stat(fs.path(name))
+	if err != nil {
+		return false, err
+	}
+	return fi.Mode().IsRegular(), nil
+}
+
+func (fs directFS) Chmod(name string, mode os.FileMode) error {
+	return os.Chmod(fs.path(name), mode)
+}
+
+func (fs directFS) Rename(oldName, newName string) error {
+	return os.Rename(fs.path(oldName), fs.path(newName))
+}
+
+func (fs directFS) Remove(name string) error { return os.Remove(fs.path(name)) }
+
+func (fs directFS) ReadFile(name string) ([]byte, error) {
+	return os.ReadFile(fs.path(name))
+}
+
+func (fs directFS) Truncate(name string) error {
+	return os.Truncate(fs.path(name), 0)
+}
+
+func (fs directFS) WriteFile(name string, contents []byte, perm os.FileMode) error {
+	return os.WriteFile(fs.path(name), contents, perm)
+}
+
+// runningAsGUIDesktopUser reports whether it seems that this code is
+// being run as a regular user on a Linux desktop. This is a quick
+// hack to fix Issue 2672 where PolicyKit pops up a GUI dialog asking
+// to proceed we do a best effort attempt to restart
+// systemd-resolved.service. There's surely a better way.
+func runningAsGUIDesktopUser() bool {
+	return os.Getuid() != 0 && os.Getenv("DISPLAY") != ""
+}

vendor/tailscale.com/net/dns/direct_linux.go

@@ -0,0 +1,108 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bytes"
+	"context"
+
+	"github.com/illarion/gonotify/v2"
+	"tailscale.com/health"
+)
+
+func (m *directManager) runFileWatcher() {
+	ctx, cancel := context.WithCancel(m.ctx)
+	defer cancel()
+	in, err := gonotify.NewInotify(ctx)
+	if err != nil {
+		// Oh well, we tried. This is all best effort for now, to
+		// surface warnings to users.
+		m.logf("dns: inotify new: %v", err)
+		return
+	}
+
+	const events = gonotify.IN_ATTRIB |
+		gonotify.IN_CLOSE_WRITE |
+		gonotify.IN_CREATE |
+		gonotify.IN_DELETE |
+		gonotify.IN_MODIFY |
+		gonotify.IN_MOVE
+
+	if err := in.AddWatch("/etc/", events); err != nil {
+		m.logf("dns: inotify addwatch: %v", err)
+		return
+	}
+	for {
+		events, err := in.Read()
+		if ctx.Err() != nil {
+			return
+		}
+		if err != nil {
+			m.logf("dns: inotify read: %v", err)
+			return
+		}
+		var match bool
+		for _, ev := range events {
+			if ev.Name == resolvConf {
+				match = true
+				break
+			}
+		}
+		if !match {
+			continue
+		}
+		m.checkForFileTrample()
+	}
+}
+
+var resolvTrampleWarnable = health.Register(&health.Warnable{
+	Code:     "resolv-conf-overwritten",
+	Severity: health.SeverityMedium,
+	Title:    "Linux DNS configuration issue",
+	Text:     health.StaticMessage("Linux DNS config not ideal. /etc/resolv.conf overwritten. See https://tailscale.com/s/dns-fight"),
+})
+
+// checkForFileTrample checks whether /etc/resolv.conf has been trampled
+// by another program on the system. (e.g. a DHCP client)
+func (m *directManager) checkForFileTrample() {
+	m.mu.Lock()
+	want := m.wantResolvConf
+	lastWarn := m.lastWarnContents
+	m.mu.Unlock()
+
+	if want == nil {
+		return
+	}
+
+	cur, err := m.fs.ReadFile(resolvConf)
+	if err != nil {
+		m.logf("trample: read error: %v", err)
+		return
+	}
+	if bytes.Equal(cur, want) {
+		m.health.SetHealthy(resolvTrampleWarnable)
+		if lastWarn != nil {
+			m.mu.Lock()
+			m.lastWarnContents = nil
+			m.mu.Unlock()
+			m.logf("trample: resolv.conf again matches expected content")
+		}
+		return
+	}
+	if bytes.Equal(cur, lastWarn) {
+		// We already logged about this, so not worth doing it again.
+		return
+	}
+
+	m.mu.Lock()
+	m.lastWarnContents = cur
+	m.mu.Unlock()
+
+	show := cur
+	if len(show) > 1024 {
+		show = show[:1024]
+	}
+	m.logf("trample: resolv.conf changed from what we expected. did some other program interfere? current contents: %q", show)
+	m.health.SetUnhealthy(resolvTrampleWarnable, nil)
+}

vendor/tailscale.com/net/dns/direct_notlinux.go

@@ -0,0 +1,10 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !linux
+
+package dns
+
+func (m *directManager) runFileWatcher() {
+	// Not implemented on other platforms. Maybe it could resort to polling.
+}

vendor/tailscale.com/net/dns/flush_default.go

@@ -0,0 +1,10 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !windows
+
+package dns
+
+func flushCaches() error {
+	return nil
+}

vendor/tailscale.com/net/dns/flush_windows.go

@@ -0,0 +1,34 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"fmt"
+	"os/exec"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+)
+
+func flushCaches() error {
+	cmd := exec.Command("ipconfig", "/flushdns")
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		CreationFlags: windows.DETACHED_PROCESS,
+	}
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("%v (output: %s)", err, out)
+	}
+	return nil
+}
+
+// Flush clears the local resolver cache.
+//
+// Only Windows has a public dns.Flush, needed in router_windows.go. Other
+// platforms like Linux need a different flush implementation depending on
+// the DNS manager. There is a FlushCaches method on the manager which
+// can be used on all platforms.
+func Flush() error {
+	return flushCaches()
+}

vendor/tailscale.com/net/dns/ini.go

@@ -0,0 +1,30 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build windows
+
+package dns
+
+import (
+	"regexp"
+	"strings"
+)
+
+// parseIni parses a basic .ini file, used for wsl.conf.
+func parseIni(data string) map[string]map[string]string {
+	sectionRE := regexp.MustCompile(`^\[([^]]+)\]`)
+	kvRE := regexp.MustCompile(`^\s*(\w+)\s*=\s*([^#]*)`)
+
+	ini := map[string]map[string]string{}
+	var section string
+	for _, line := range strings.Split(data, "\n") {
+		if res := sectionRE.FindStringSubmatch(line); len(res) > 1 {
+			section = res[1]
+			ini[section] = map[string]string{}
+		} else if res := kvRE.FindStringSubmatch(line); len(res) > 2 {
+			k, v := strings.TrimSpace(res[1]), strings.TrimSpace(res[2])
+			ini[section][k] = v
+		}
+	}
+	return ini
+}

vendor/tailscale.com/net/dns/manager.go

@@ -0,0 +1,564 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bufio"
+	"context"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"net/netip"
+	"runtime"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	xmaps "golang.org/x/exp/maps"
+	"tailscale.com/control/controlknobs"
+	"tailscale.com/health"
+	"tailscale.com/net/dns/resolver"
+	"tailscale.com/net/netmon"
+	"tailscale.com/net/tsdial"
+	"tailscale.com/syncs"
+	"tailscale.com/tstime/rate"
+	"tailscale.com/types/dnstype"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/dnsname"
+)
+
+var (
+	errFullQueue = errors.New("request queue full")
+)
+
+// maxActiveQueries returns the maximal number of DNS requests that can
+// be running.
+const maxActiveQueries = 256
+
+// We use file-ignore below instead of ignore because on some platforms,
+// the lint exception is necessary and on others it is not,
+// and plain ignore complains if the exception is unnecessary.
+
+// Manager manages system DNS settings.
+type Manager struct {
+	logf   logger.Logf
+	health *health.Tracker
+
+	activeQueriesAtomic int32
+
+	ctx       context.Context    // good until Down
+	ctxCancel context.CancelFunc // closes ctx
+
+	resolver *resolver.Resolver
+	os       OSConfigurator
+	knobs    *controlknobs.Knobs // or nil
+	goos     string              // if empty, gets set to runtime.GOOS
+
+	mu sync.Mutex // guards following
+	// config is the last configuration we successfully compiled or nil if there
+	// was any failure applying the last configuration.
+	config *Config
+}
+
+// NewManagers created a new manager from the given config.
+//
+// knobs may be nil.
+func NewManager(logf logger.Logf, oscfg OSConfigurator, health *health.Tracker, dialer *tsdial.Dialer, linkSel resolver.ForwardLinkSelector, knobs *controlknobs.Knobs, goos string) *Manager {
+	if dialer == nil {
+		panic("nil Dialer")
+	}
+	if dialer.NetMon() == nil {
+		panic("Dialer has nil NetMon")
+	}
+	logf = logger.WithPrefix(logf, "dns: ")
+	if goos == "" {
+		goos = runtime.GOOS
+	}
+
+	m := &Manager{
+		logf:     logf,
+		resolver: resolver.New(logf, linkSel, dialer, health, knobs),
+		os:       oscfg,
+		health:   health,
+		knobs:    knobs,
+		goos:     goos,
+	}
+
+	// Rate limit our attempts to correct our DNS configuration.
+	limiter := rate.NewLimiter(1.0/5.0, 1)
+
+	// This will recompile the DNS config, which in turn will requery the system
+	// DNS settings. The recovery func should triggered only when we are missing
+	// upstream nameservers and require them to forward a query.
+	m.resolver.SetMissingUpstreamRecovery(func() {
+		m.mu.Lock()
+		defer m.mu.Unlock()
+		if m.config == nil {
+			return
+		}
+
+		if limiter.Allow() {
+			m.logf("DNS resolution failed due to missing upstream nameservers.  Recompiling DNS configuration.")
+			m.setLocked(*m.config)
+		}
+	})
+
+	m.ctx, m.ctxCancel = context.WithCancel(context.Background())
+	m.logf("using %T", m.os)
+	return m
+}
+
+// Resolver returns the Manager's DNS Resolver.
+func (m *Manager) Resolver() *resolver.Resolver { return m.resolver }
+
+func (m *Manager) Set(cfg Config) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.setLocked(cfg)
+}
+
+// GetBaseConfig returns the current base OS DNS configuration as provided by the OSConfigurator.
+func (m *Manager) GetBaseConfig() (OSConfig, error) {
+	return m.os.GetBaseConfig()
+}
+
+// setLocked sets the DNS configuration.
+//
+// m.mu must be held.
+func (m *Manager) setLocked(cfg Config) error {
+	syncs.AssertLocked(&m.mu)
+
+	// On errors, the 'set' config is cleared.
+	m.config = nil
+
+	m.logf("Set: %v", logger.ArgWriter(func(w *bufio.Writer) {
+		cfg.WriteToBufioWriter(w)
+	}))
+
+	rcfg, ocfg, err := m.compileConfig(cfg)
+	if err != nil {
+		return err
+	}
+
+	m.logf("Resolvercfg: %v", logger.ArgWriter(func(w *bufio.Writer) {
+		rcfg.WriteToBufioWriter(w)
+	}))
+	m.logf("OScfg: %v", logger.ArgWriter(func(w *bufio.Writer) {
+		ocfg.WriteToBufioWriter(w)
+	}))
+
+	if err := m.resolver.SetConfig(rcfg); err != nil {
+		return err
+	}
+	if err := m.os.SetDNS(ocfg); err != nil {
+		m.health.SetDNSOSHealth(err)
+		return err
+	}
+
+	m.health.SetDNSOSHealth(nil)
+	m.config = &cfg
+
+	return nil
+}
+
+// compileHostEntries creates a list of single-label resolutions possible
+// from the configured hosts and search domains.
+// The entries are compiled in the order of the search domains, then the hosts.
+// The returned list is sorted by the first hostname in each entry.
+func compileHostEntries(cfg Config) (hosts []*HostEntry) {
+	didLabel := make(map[string]bool, len(cfg.Hosts))
+	hostsMap := make(map[netip.Addr]*HostEntry, len(cfg.Hosts))
+	for _, sd := range cfg.SearchDomains {
+		for h, ips := range cfg.Hosts {
+			if !sd.Contains(h) || h.NumLabels() != (sd.NumLabels()+1) {
+				continue
+			}
+			ipHosts := []string{string(h.WithTrailingDot())}
+			if label := dnsname.FirstLabel(string(h)); !didLabel[label] {
+				didLabel[label] = true
+				ipHosts = append(ipHosts, label)
+			}
+			for _, ip := range ips {
+				if cfg.OnlyIPv6 && ip.Is4() {
+					continue
+				}
+				if e := hostsMap[ip]; e != nil {
+					e.Hosts = append(e.Hosts, ipHosts...)
+				} else {
+					hostsMap[ip] = &HostEntry{
+						Addr:  ip,
+						Hosts: ipHosts,
+					}
+				}
+				// Only add IPv4 or IPv6 per host, like we do in the resolver.
+				break
+			}
+		}
+	}
+	if len(hostsMap) == 0 {
+		return nil
+	}
+	hosts = xmaps.Values(hostsMap)
+	slices.SortFunc(hosts, func(a, b *HostEntry) int {
+		if len(a.Hosts) == 0 && len(b.Hosts) == 0 {
+			return 0
+		} else if len(a.Hosts) == 0 {
+			return -1
+		} else if len(b.Hosts) == 0 {
+			return 1
+		}
+		return strings.Compare(a.Hosts[0], b.Hosts[0])
+	})
+	return hosts
+}
+
+// compileConfig converts cfg into a quad-100 resolver configuration
+// and an OS-level configuration.
+func (m *Manager) compileConfig(cfg Config) (rcfg resolver.Config, ocfg OSConfig, err error) {
+	// The internal resolver always gets MagicDNS hosts and
+	// authoritative suffixes, even if we don't propagate MagicDNS to
+	// the OS.
+	rcfg.Hosts = cfg.Hosts
+	routes := map[dnsname.FQDN][]*dnstype.Resolver{} // assigned conditionally to rcfg.Routes below.
+	for suffix, resolvers := range cfg.Routes {
+		if len(resolvers) == 0 {
+			rcfg.LocalDomains = append(rcfg.LocalDomains, suffix)
+		} else {
+			routes[suffix] = resolvers
+		}
+	}
+
+	// Similarly, the OS always gets search paths.
+	ocfg.SearchDomains = cfg.SearchDomains
+	if m.goos == "windows" {
+		ocfg.Hosts = compileHostEntries(cfg)
+	}
+
+	// Deal with trivial configs first.
+	switch {
+	case !cfg.needsOSResolver():
+		// Set search domains, but nothing else. This also covers the
+		// case where cfg is entirely zero, in which case these
+		// configs clear all Tailscale DNS settings.
+		return rcfg, ocfg, nil
+	case cfg.hasDefaultIPResolversOnly() && !cfg.hasHostsWithoutSplitDNSRoutes():
+		// Trivial CorpDNS configuration, just override the OS resolver.
+		//
+		// If there are hosts (ExtraRecords) that are not covered by an existing
+		// SplitDNS route, then we don't go into this path so that we fall into
+		// the next case and send the extra record hosts queries through
+		// 100.100.100.100 instead where we can answer them.
+		//
+		// TODO: for OSes that support it, pass IP:port and DoH
+		// addresses directly to OS.
+		// https://github.com/tailscale/tailscale/issues/1666
+		ocfg.Nameservers = toIPsOnly(cfg.DefaultResolvers)
+		return rcfg, ocfg, nil
+	case cfg.hasDefaultResolvers():
+		// Default resolvers plus other stuff always ends up proxying
+		// through quad-100.
+		rcfg.Routes = routes
+		rcfg.Routes["."] = cfg.DefaultResolvers
+		ocfg.Nameservers = []netip.Addr{cfg.serviceIP()}
+		return rcfg, ocfg, nil
+	}
+
+	// From this point on, we're figuring out split DNS
+	// configurations. The possible cases don't return directly any
+	// more, because as a final step we have to handle the case where
+	// the OS can't do split DNS.
+
+	// Workaround for
+	// https://github.com/tailscale/corp/issues/1662. Even though
+	// Windows natively supports split DNS, it only configures linux
+	// containers using whatever the primary is, and doesn't apply
+	// NRPT rules to DNS traffic coming from WSL.
+	//
+	// In order to make WSL work okay when the host Windows is using
+	// Tailscale, we need to set up quad-100 as a "full proxy"
+	// resolver, regardless of whether Windows itself can do split
+	// DNS. We still make Windows do split DNS itself when it can, but
+	// quad-100 will still have the full split configuration as well,
+	// and so can service WSL requests correctly.
+	//
+	// This bool is used in a couple of places below to implement this
+	// workaround.
+	isWindows := m.goos == "windows"
+	isApple := (m.goos == "darwin" || m.goos == "ios")
+	if len(cfg.singleResolverSet()) > 0 && m.os.SupportsSplitDNS() && !isWindows && !isApple {
+		// Split DNS configuration requested, where all split domains
+		// go to the same resolvers. We can let the OS do it.
+		ocfg.Nameservers = toIPsOnly(cfg.singleResolverSet())
+		ocfg.MatchDomains = cfg.matchDomains()
+		return rcfg, ocfg, nil
+	}
+
+	// Split DNS configuration with either multiple upstream routes,
+	// or routes + MagicDNS, or just MagicDNS, or on an OS that cannot
+	// split-DNS. Install a split config pointing at quad-100.
+	rcfg.Routes = routes
+	ocfg.Nameservers = []netip.Addr{cfg.serviceIP()}
+
+	var baseCfg *OSConfig // base config; non-nil if/when known
+
+	// Even though Apple devices can do split DNS, they don't provide a way to
+	// selectively answer ExtraRecords, and ignore other DNS traffic. As a
+	// workaround, we read the existing default resolver configuration and use
+	// that as the forwarder for all DNS traffic that quad-100 doesn't handle.
+	if isApple || !m.os.SupportsSplitDNS() {
+		// If the OS can't do native split-dns, read out the underlying
+		// resolver config and blend it into our config.
+		cfg, err := m.os.GetBaseConfig()
+		if err == nil {
+			baseCfg = &cfg
+		} else if isApple && err == ErrGetBaseConfigNotSupported {
+			// This is currently (2022-10-13) expected on certain iOS and macOS
+			// builds.
+		} else {
+			m.health.SetDNSOSHealth(err)
+			return resolver.Config{}, OSConfig{}, err
+		}
+	}
+
+	if baseCfg == nil {
+		// If there was no base config, then we need to fallback to SplitDNS mode.
+		ocfg.MatchDomains = cfg.matchDomains()
+	} else {
+		// On iOS only (for now), check if all route names point to resources inside the tailnet.
+		// If so, we can set those names as MatchDomains to enable a split DNS configuration
+		// which will help preserve battery life.
+		// Because on iOS MatchDomains must equal SearchDomains, we cannot do this when
+		// we have any Routes outside the tailnet. Otherwise when app connectors are enabled,
+		// a query for 'work-laptop' might lead to search domain expansion, resolving
+		// as 'work-laptop.aws.com' for example.
+		if m.goos == "ios" && rcfg.RoutesRequireNoCustomResolvers() {
+			if !m.disableSplitDNSOptimization() {
+				for r := range rcfg.Routes {
+					ocfg.MatchDomains = append(ocfg.MatchDomains, r)
+				}
+			} else {
+				m.logf("iOS split DNS is disabled by nodeattr")
+			}
+		}
+		var defaultRoutes []*dnstype.Resolver
+		for _, ip := range baseCfg.Nameservers {
+			defaultRoutes = append(defaultRoutes, &dnstype.Resolver{Addr: ip.String()})
+		}
+		rcfg.Routes["."] = defaultRoutes
+		ocfg.SearchDomains = append(ocfg.SearchDomains, baseCfg.SearchDomains...)
+	}
+
+	return rcfg, ocfg, nil
+}
+
+func (m *Manager) disableSplitDNSOptimization() bool {
+	return m.knobs != nil && m.knobs.DisableSplitDNSWhenNoCustomResolvers.Load()
+}
+
+// toIPsOnly returns only the IP portion of dnstype.Resolver.
+// Only safe to use if the resolvers slice has been cleared of
+// DoH or custom-port entries with something like hasDefaultIPResolversOnly.
+func toIPsOnly(resolvers []*dnstype.Resolver) (ret []netip.Addr) {
+	for _, r := range resolvers {
+		if ipp, ok := r.IPPort(); ok && ipp.Port() == 53 {
+			ret = append(ret, ipp.Addr())
+		}
+	}
+	return ret
+}
+
+// Query executes a DNS query received from the given address. The query is
+// provided in bs as a wire-encoded DNS query without any transport header.
+// This method is called for requests arriving over UDP and TCP.
+//
+// The "family" parameter should indicate what type of DNS query this is:
+// either "tcp" or "udp".
+func (m *Manager) Query(ctx context.Context, bs []byte, family string, from netip.AddrPort) ([]byte, error) {
+	select {
+	case <-m.ctx.Done():
+		return nil, net.ErrClosed
+	default:
+		// continue
+	}
+
+	if n := atomic.AddInt32(&m.activeQueriesAtomic, 1); n > maxActiveQueries {
+		atomic.AddInt32(&m.activeQueriesAtomic, -1)
+		metricDNSQueryErrorQueue.Add(1)
+		return nil, errFullQueue
+	}
+	defer atomic.AddInt32(&m.activeQueriesAtomic, -1)
+	return m.resolver.Query(ctx, bs, family, from)
+}
+
+const (
+	// RFC 7766 6.2 recommends connection reuse & request pipelining
+	// be undertaken, and the connection be closed by the server
+	// using an idle timeout on the order of seconds.
+	idleTimeoutTCP = 45 * time.Second
+	// The RFCs don't specify the max size of a TCP-based DNS query,
+	// but we want to keep this reasonable. Given payloads are typically
+	// much larger and all known client send a single query, I've arbitrarily
+	// chosen 4k.
+	maxReqSizeTCP = 4096
+)
+
+// dnsTCPSession services DNS requests sent over TCP.
+type dnsTCPSession struct {
+	m *Manager
+
+	conn    net.Conn
+	srcAddr netip.AddrPort
+
+	readClosing chan struct{}
+	responses   chan []byte // DNS replies pending writing
+
+	ctx      context.Context
+	closeCtx context.CancelFunc
+}
+
+func (s *dnsTCPSession) handleWrites() {
+	defer s.conn.Close()
+	defer s.closeCtx()
+
+	// NOTE(andrew): we explicitly do not close the 'responses' channel
+	// when this function exits. If we hit an error and return, we could
+	// still have outstanding 'handleQuery' goroutines running, and if we
+	// closed this channel they'd end up trying to send on a closed channel
+	// when they finish.
+	//
+	// Because we call closeCtx, those goroutines will not hang since they
+	// select on <-s.ctx.Done() as well as s.responses.
+
+	for {
+		select {
+		case <-s.readClosing:
+			return // connection closed or timeout, teardown time
+
+		case resp := <-s.responses:
+			s.conn.SetWriteDeadline(time.Now().Add(idleTimeoutTCP))
+			if err := binary.Write(s.conn, binary.BigEndian, uint16(len(resp))); err != nil {
+				s.m.logf("tcp write (len): %v", err)
+				return
+			}
+			if _, err := s.conn.Write(resp); err != nil {
+				s.m.logf("tcp write (response): %v", err)
+				return
+			}
+		}
+	}
+}
+
+func (s *dnsTCPSession) handleQuery(q []byte) {
+	resp, err := s.m.Query(s.ctx, q, "tcp", s.srcAddr)
+	if err != nil {
+		s.m.logf("tcp query: %v", err)
+		return
+	}
+
+	// See note in handleWrites (above) regarding this select{}
+	select {
+	case <-s.ctx.Done():
+	case s.responses <- resp:
+	}
+}
+
+func (s *dnsTCPSession) handleReads() {
+	defer s.conn.Close()
+	defer close(s.readClosing)
+
+	for {
+		select {
+		case <-s.ctx.Done():
+			return
+
+		default:
+			s.conn.SetReadDeadline(time.Now().Add(idleTimeoutTCP))
+			var reqLen uint16
+			if err := binary.Read(s.conn, binary.BigEndian, &reqLen); err != nil {
+				if err == io.EOF || err == io.ErrClosedPipe {
+					return // connection closed nominally, we gucci
+				}
+				s.m.logf("tcp read (len): %v", err)
+				return
+			}
+			if int(reqLen) > maxReqSizeTCP {
+				s.m.logf("tcp request too large (%d > %d)", reqLen, maxReqSizeTCP)
+				return
+			}
+
+			buf := make([]byte, int(reqLen))
+			if _, err := io.ReadFull(s.conn, buf); err != nil {
+				s.m.logf("tcp read (payload): %v", err)
+				return
+			}
+
+			select {
+			case <-s.ctx.Done():
+				return
+			default:
+				// NOTE: by kicking off the query handling in a
+				// new goroutine, it is possible that we'll
+				// deliver responses out-of-order. This is
+				// explicitly allowed by RFC7766, Section
+				// 6.2.1.1 ("Query Pipelining").
+				go s.handleQuery(buf)
+			}
+		}
+	}
+}
+
+// HandleTCPConn implements magicDNS over TCP, taking a connection and
+// servicing DNS requests sent down it.
+func (m *Manager) HandleTCPConn(conn net.Conn, srcAddr netip.AddrPort) {
+	s := dnsTCPSession{
+		m:           m,
+		conn:        conn,
+		srcAddr:     srcAddr,
+		responses:   make(chan []byte),
+		readClosing: make(chan struct{}),
+	}
+	s.ctx, s.closeCtx = context.WithCancel(m.ctx)
+	go s.handleReads()
+	s.handleWrites()
+}
+
+func (m *Manager) Down() error {
+	m.ctxCancel()
+	if err := m.os.Close(); err != nil {
+		return err
+	}
+	m.resolver.Close()
+	return nil
+}
+
+func (m *Manager) FlushCaches() error {
+	return flushCaches()
+}
+
+// CleanUp restores the system DNS configuration to its original state
+// in case the Tailscale daemon terminated without closing the router.
+// No other state needs to be instantiated before this runs.
+//
+// health must not be nil
+func CleanUp(logf logger.Logf, netMon *netmon.Monitor, health *health.Tracker, interfaceName string) {
+	oscfg, err := NewOSConfigurator(logf, nil, nil, interfaceName)
+	if err != nil {
+		logf("creating dns cleanup: %v", err)
+		return
+	}
+	d := &tsdial.Dialer{Logf: logf}
+	d.SetNetMon(netMon)
+	dns := NewManager(logf, oscfg, health, d, nil, nil, runtime.GOOS)
+	if err := dns.Down(); err != nil {
+		logf("dns down: %v", err)
+	}
+}
+
+var (
+	metricDNSQueryErrorQueue = clientmetric.NewCounter("dns_query_local_error_queue")
+)

vendor/tailscale.com/net/dns/manager_darwin.go

@@ -0,0 +1,156 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bytes"
+	"os"
+
+	"go4.org/mem"
+	"tailscale.com/control/controlknobs"
+	"tailscale.com/health"
+	"tailscale.com/net/dns/resolvconffile"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/mak"
+)
+
+// NewOSConfigurator creates a new OS configurator.
+//
+// The health tracker and the knobs may be nil and are ignored on this platform.
+func NewOSConfigurator(logf logger.Logf, _ *health.Tracker, _ *controlknobs.Knobs, ifName string) (OSConfigurator, error) {
+	return &darwinConfigurator{logf: logf, ifName: ifName}, nil
+}
+
+// darwinConfigurator is the tailscaled-on-macOS DNS OS configurator that
+// maintains the Split DNS nameserver entries pointing MagicDNS DNS suffixes
+// to 100.100.100.100 using the macOS /etc/resolver/$SUFFIX files.
+type darwinConfigurator struct {
+	logf   logger.Logf
+	ifName string
+}
+
+func (c *darwinConfigurator) Close() error {
+	c.removeResolverFiles(func(domain string) bool { return true })
+	return nil
+}
+
+func (c *darwinConfigurator) SupportsSplitDNS() bool {
+	return true
+}
+
+func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
+	var buf bytes.Buffer
+	buf.WriteString(macResolverFileHeader)
+	for _, ip := range cfg.Nameservers {
+		buf.WriteString("nameserver ")
+		buf.WriteString(ip.String())
+		buf.WriteString("\n")
+	}
+
+	if err := os.MkdirAll("/etc/resolver", 0755); err != nil {
+		return err
+	}
+
+	var keep map[string]bool
+
+	// Add a dummy file to /etc/resolver with a "search ..." directive if we have
+	// search suffixes to add.
+	if len(cfg.SearchDomains) > 0 {
+		const searchFile = "search.tailscale" // fake DNS suffix+TLD to put our search
+		mak.Set(&keep, searchFile, true)
+		var sbuf bytes.Buffer
+		sbuf.WriteString(macResolverFileHeader)
+		sbuf.WriteString("search")
+		for _, d := range cfg.SearchDomains {
+			sbuf.WriteString(" ")
+			sbuf.WriteString(string(d.WithoutTrailingDot()))
+		}
+		sbuf.WriteString("\n")
+		if err := os.WriteFile("/etc/resolver/"+searchFile, sbuf.Bytes(), 0644); err != nil {
+			return err
+		}
+	}
+
+	for _, d := range cfg.MatchDomains {
+		fileBase := string(d.WithoutTrailingDot())
+		mak.Set(&keep, fileBase, true)
+		fullPath := "/etc/resolver/" + fileBase
+
+		if err := os.WriteFile(fullPath, buf.Bytes(), 0644); err != nil {
+			return err
+		}
+	}
+	return c.removeResolverFiles(func(domain string) bool { return !keep[domain] })
+}
+
+// GetBaseConfig returns the current OS DNS configuration, extracting it from /etc/resolv.conf.
+// We should really be using the SystemConfiguration framework to get this information, as this
+// is not a stable public API, and is provided mostly as a compatibility effort with Unix
+// tools. Apple might break this in the future. But honestly, parsing the output of `scutil --dns`
+// is *even more* likely to break in the future.
+func (c *darwinConfigurator) GetBaseConfig() (OSConfig, error) {
+	cfg := OSConfig{}
+
+	resolvConf, err := resolvconffile.ParseFile("/etc/resolv.conf")
+	if err != nil {
+		c.logf("failed to parse /etc/resolv.conf: %v", err)
+		return cfg, ErrGetBaseConfigNotSupported
+	}
+
+	for _, ns := range resolvConf.Nameservers {
+		if ns == tsaddr.TailscaleServiceIP() || ns == tsaddr.TailscaleServiceIPv6() {
+			// If we find Quad100 in /etc/resolv.conf, we should ignore it
+			c.logf("ignoring 100.100.100.100 resolver IP found in /etc/resolv.conf")
+			continue
+		}
+		cfg.Nameservers = append(cfg.Nameservers, ns)
+	}
+	cfg.SearchDomains = resolvConf.SearchDomains
+
+	if len(cfg.Nameservers) == 0 {
+		// Log a warning in case we couldn't find any nameservers in /etc/resolv.conf.
+		c.logf("no nameservers found in /etc/resolv.conf, DNS resolution might fail")
+	}
+
+	return cfg, nil
+}
+
+const macResolverFileHeader = "# Added by tailscaled\n"
+
+// removeResolverFiles deletes all files in /etc/resolver for which the shouldDelete
+// func returns true.
+func (c *darwinConfigurator) removeResolverFiles(shouldDelete func(domain string) bool) error {
+	dents, err := os.ReadDir("/etc/resolver")
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	for _, de := range dents {
+		if !de.Type().IsRegular() {
+			continue
+		}
+		name := de.Name()
+		if !shouldDelete(name) {
+			continue
+		}
+		fullPath := "/etc/resolver/" + name
+		contents, err := os.ReadFile(fullPath)
+		if err != nil {
+			if os.IsNotExist(err) { // race?
+				continue
+			}
+			return err
+		}
+		if !mem.HasPrefix(mem.B(contents), mem.S(macResolverFileHeader)) {
+			continue
+		}
+		if err := os.Remove(fullPath); err != nil {
+			return err
+		}
+	}
+	return nil
+}

vendor/tailscale.com/net/dns/manager_default.go

@@ -0,0 +1,19 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !linux && !freebsd && !openbsd && !windows && !darwin
+
+package dns
+
+import (
+	"tailscale.com/control/controlknobs"
+	"tailscale.com/health"
+	"tailscale.com/types/logger"
+)
+
+// NewOSConfigurator creates a new OS configurator.
+//
+// The health tracker and the knobs may be nil and are ignored on this platform.
+func NewOSConfigurator(logger.Logf, *health.Tracker, *controlknobs.Knobs, string) (OSConfigurator, error) {
+	return NewNoopManager()
+}

vendor/tailscale.com/net/dns/manager_freebsd.go

@@ -0,0 +1,43 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"fmt"
+	"os"
+
+	"tailscale.com/control/controlknobs"
+	"tailscale.com/health"
+	"tailscale.com/types/logger"
+)
+
+// NewOSConfigurator creates a new OS configurator.
+//
+// The health tracker may be nil; the knobs may be nil and are ignored on this platform.
+func NewOSConfigurator(logf logger.Logf, health *health.Tracker, _ *controlknobs.Knobs, _ string) (OSConfigurator, error) {
+	bs, err := os.ReadFile("/etc/resolv.conf")
+	if os.IsNotExist(err) {
+		return newDirectManager(logf, health), nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("reading /etc/resolv.conf: %w", err)
+	}
+
+	switch resolvOwner(bs) {
+	case "resolvconf":
+		switch resolvconfStyle() {
+		case "":
+			return newDirectManager(logf, health), nil
+		case "debian":
+			return newDebianResolvconfManager(logf)
+		case "openresolv":
+			return newOpenresolvManager(logf)
+		default:
+			logf("[unexpected] got unknown flavor of resolvconf %q, falling back to direct manager", resolvconfStyle())
+			return newDirectManager(logf, health), nil
+		}
+	default:
+		return newDirectManager(logf, health), nil
+	}
+}

vendor/tailscale.com/net/dns/manager_linux.go

@@ -0,0 +1,431 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/godbus/dbus/v5"
+	"tailscale.com/control/controlknobs"
+	"tailscale.com/health"
+	"tailscale.com/net/netaddr"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/cmpver"
+)
+
+type kv struct {
+	k, v string
+}
+
+func (kv kv) String() string {
+	return fmt.Sprintf("%s=%s", kv.k, kv.v)
+}
+
+var publishOnce sync.Once
+
+// NewOSConfigurator created a new OS configurator.
+//
+// The health tracker may be nil; the knobs may be nil and are ignored on this platform.
+func NewOSConfigurator(logf logger.Logf, health *health.Tracker, _ *controlknobs.Knobs, interfaceName string) (ret OSConfigurator, err error) {
+	env := newOSConfigEnv{
+		fs:                directFS{},
+		dbusPing:          dbusPing,
+		dbusReadString:    dbusReadString,
+		nmIsUsingResolved: nmIsUsingResolved,
+		nmVersionBetween:  nmVersionBetween,
+		resolvconfStyle:   resolvconfStyle,
+	}
+	mode, err := dnsMode(logf, health, env)
+	if err != nil {
+		return nil, err
+	}
+	publishOnce.Do(func() {
+		sanitizedMode := strings.ReplaceAll(mode, "-", "_")
+		m := clientmetric.NewGauge(fmt.Sprintf("dns_manager_linux_mode_%s", sanitizedMode))
+		m.Set(1)
+	})
+	logf("dns: using %q mode", mode)
+	switch mode {
+	case "direct":
+		return newDirectManagerOnFS(logf, health, env.fs), nil
+	case "systemd-resolved":
+		return newResolvedManager(logf, health, interfaceName)
+	case "network-manager":
+		return newNMManager(interfaceName)
+	case "debian-resolvconf":
+		return newDebianResolvconfManager(logf)
+	case "openresolv":
+		return newOpenresolvManager(logf)
+	default:
+		logf("[unexpected] detected unknown DNS mode %q, using direct manager as last resort", mode)
+		return newDirectManagerOnFS(logf, health, env.fs), nil
+	}
+}
+
+// newOSConfigEnv are the funcs newOSConfigurator needs, pulled out for testing.
+type newOSConfigEnv struct {
+	fs                wholeFileFS
+	dbusPing          func(string, string) error
+	dbusReadString    func(string, string, string, string) (string, error)
+	nmIsUsingResolved func() error
+	nmVersionBetween  func(v1, v2 string) (safe bool, err error)
+	resolvconfStyle   func() string
+}
+
+func dnsMode(logf logger.Logf, health *health.Tracker, env newOSConfigEnv) (ret string, err error) {
+	var debug []kv
+	dbg := func(k, v string) {
+		debug = append(debug, kv{k, v})
+	}
+	defer func() {
+		if ret != "" {
+			dbg("ret", ret)
+		}
+		logf("dns: %v", debug)
+	}()
+
+	// In all cases that we detect systemd-resolved, try asking it what it
+	// thinks the current resolv.conf mode is so we can add it to our logs.
+	defer func() {
+		if ret != "systemd-resolved" {
+			return
+		}
+
+		// Try to ask systemd-resolved what it thinks the current
+		// status of resolv.conf is. This is documented at:
+		//    https://www.freedesktop.org/software/systemd/man/org.freedesktop.resolve1.html
+		mode, err := env.dbusReadString("org.freedesktop.resolve1", "/org/freedesktop/resolve1", "org.freedesktop.resolve1.Manager", "ResolvConfMode")
+		if err != nil {
+			logf("dns: ResolvConfMode error: %v", err)
+			dbg("resolv-conf-mode", "error")
+		} else {
+			dbg("resolv-conf-mode", mode)
+		}
+	}()
+
+	// Before we read /etc/resolv.conf (which might be in a broken
+	// or symlink-dangling state), try to ping the D-Bus service
+	// for systemd-resolved. If it's active on the machine, this
+	// will make it start up and write the /etc/resolv.conf file
+	// before it replies to the ping. (see how systemd's
+	// src/resolve/resolved.c calls manager_write_resolv_conf
+	// before the sd_event_loop starts)
+	resolvedUp := env.dbusPing("org.freedesktop.resolve1", "/org/freedesktop/resolve1") == nil
+	if resolvedUp {
+		dbg("resolved-ping", "yes")
+	}
+
+	bs, err := env.fs.ReadFile(resolvConf)
+	if os.IsNotExist(err) {
+		dbg("rc", "missing")
+		return "direct", nil
+	}
+	if err != nil {
+		return "", fmt.Errorf("reading /etc/resolv.conf: %w", err)
+	}
+
+	switch resolvOwner(bs) {
+	case "systemd-resolved":
+		dbg("rc", "resolved")
+
+		// Some systems, for reasons known only to them, have a
+		// resolv.conf that has the word "systemd-resolved" in its
+		// header, but doesn't actually point to resolved. We mustn't
+		// try to program resolved in that case.
+		// https://github.com/tailscale/tailscale/issues/2136
+		if err := resolvedIsActuallyResolver(logf, env, dbg, bs); err != nil {
+			logf("dns: resolvedIsActuallyResolver error: %v", err)
+			dbg("resolved", "not-in-use")
+			return "direct", nil
+		}
+		if err := env.dbusPing("org.freedesktop.NetworkManager", "/org/freedesktop/NetworkManager/DnsManager"); err != nil {
+			dbg("nm", "no")
+			return "systemd-resolved", nil
+		}
+		dbg("nm", "yes")
+		if err := env.nmIsUsingResolved(); err != nil {
+			dbg("nm-resolved", "no")
+			return "systemd-resolved", nil
+		}
+		dbg("nm-resolved", "yes")
+
+		// Version of NetworkManager before 1.26.6 programmed resolved
+		// incorrectly, such that NM's settings would always take
+		// precedence over other settings set by other resolved
+		// clients.
+		//
+		// If we're dealing with such a version, we have to set our
+		// DNS settings through NM to have them take.
+		//
+		// However, versions 1.26.6 later both fixed the resolved
+		// programming issue _and_ started ignoring DNS settings for
+		// "unmanaged" interfaces - meaning NM 1.26.6 and later
+		// actively ignore DNS configuration we give it. So, for those
+		// NM versions, we can and must use resolved directly.
+		//
+		// Even more fun, even-older versions of NM won't let us set
+		// DNS settings if the interface isn't managed by NM, with a
+		// hard failure on DBus requests. Empirically, NM 1.22 does
+		// this. Based on the versions popular distros shipped, we
+		// conservatively decree that only 1.26.0 through 1.26.5 are
+		// "safe" to use for our purposes. This roughly matches
+		// distros released in the latter half of 2020.
+		//
+		// In a perfect world, we'd avoid this by replacing
+		// configuration out from under NM entirely (e.g. using
+		// directManager to overwrite resolv.conf), but in a world
+		// where resolved runs, we need to get correct configuration
+		// into resolved regardless of what's in resolv.conf (because
+		// resolved can also be queried over dbus, or via an NSS
+		// module that bypasses /etc/resolv.conf). Given that we must
+		// get correct configuration into resolved, we have no choice
+		// but to use NM, and accept the loss of IPv6 configuration
+		// that comes with it (see
+		// https://github.com/tailscale/tailscale/issues/1699,
+		// https://github.com/tailscale/tailscale/pull/1945)
+		safe, err := env.nmVersionBetween("1.26.0", "1.26.5")
+		if err != nil {
+			// Failed to figure out NM's version, can't make a correct
+			// decision.
+			return "", fmt.Errorf("checking NetworkManager version: %v", err)
+		}
+		if safe {
+			dbg("nm-safe", "yes")
+			return "network-manager", nil
+		}
+		dbg("nm-safe", "no")
+		return "systemd-resolved", nil
+	case "resolvconf":
+		dbg("rc", "resolvconf")
+		style := env.resolvconfStyle()
+		switch style {
+		case "":
+			dbg("resolvconf", "no")
+			return "direct", nil
+		case "debian":
+			dbg("resolvconf", "debian")
+			return "debian-resolvconf", nil
+		case "openresolv":
+			dbg("resolvconf", "openresolv")
+			return "openresolv", nil
+		default:
+			// Shouldn't happen, that means we updated flavors of
+			// resolvconf without updating here.
+			dbg("resolvconf", style)
+			logf("[unexpected] got unknown flavor of resolvconf %q, falling back to direct manager", env.resolvconfStyle())
+			return "direct", nil
+		}
+	case "NetworkManager":
+		dbg("rc", "nm")
+		// Sometimes, NetworkManager owns the configuration but points
+		// it at systemd-resolved.
+		if err := resolvedIsActuallyResolver(logf, env, dbg, bs); err != nil {
+			logf("dns: resolvedIsActuallyResolver error: %v", err)
+			dbg("resolved", "not-in-use")
+			// You'd think we would use newNMManager here. However, as
+			// explained in
+			// https://github.com/tailscale/tailscale/issues/1699 ,
+			// using NetworkManager for DNS configuration carries with
+			// it the cost of losing IPv6 configuration on the
+			// Tailscale network interface. So, when we can avoid it,
+			// we bypass NetworkManager by replacing resolv.conf
+			// directly.
+			//
+			// If you ever try to put NMManager back here, keep in mind
+			// that versions >=1.26.6 will ignore DNS configuration
+			// anyway, so you still need a fallback path that uses
+			// directManager.
+			return "direct", nil
+		}
+		dbg("nm-resolved", "yes")
+
+		// See large comment above for reasons we'd use NM rather than
+		// resolved. systemd-resolved is actually in charge of DNS
+		// configuration, but in some cases we might need to configure
+		// it via NetworkManager. All the logic below is probing for
+		// that case: is NetworkManager running? If so, is it one of
+		// the versions that requires direct interaction with it?
+		if err := env.dbusPing("org.freedesktop.NetworkManager", "/org/freedesktop/NetworkManager/DnsManager"); err != nil {
+			dbg("nm", "no")
+			return "systemd-resolved", nil
+		}
+		safe, err := env.nmVersionBetween("1.26.0", "1.26.5")
+		if err != nil {
+			// Failed to figure out NM's version, can't make a correct
+			// decision.
+			return "", fmt.Errorf("checking NetworkManager version: %v", err)
+		}
+		if safe {
+			dbg("nm-safe", "yes")
+			return "network-manager", nil
+		}
+		if err := env.nmIsUsingResolved(); err != nil {
+			// If systemd-resolved is not running at all, then we don't have any
+			// other choice: we take direct control of DNS.
+			dbg("nm-resolved", "no")
+			return "direct", nil
+		}
+
+		health.SetDNSManagerHealth(errors.New("systemd-resolved and NetworkManager are wired together incorrectly; MagicDNS will probably not work. For more info, see https://tailscale.com/s/resolved-nm"))
+		dbg("nm-safe", "no")
+		return "systemd-resolved", nil
+	default:
+		dbg("rc", "unknown")
+		return "direct", nil
+	}
+}
+
+func nmVersionBetween(first, last string) (bool, error) {
+	conn, err := dbus.SystemBus()
+	if err != nil {
+		// DBus probably not running.
+		return false, err
+	}
+
+	nm := conn.Object("org.freedesktop.NetworkManager", dbus.ObjectPath("/org/freedesktop/NetworkManager"))
+	v, err := nm.GetProperty("org.freedesktop.NetworkManager.Version")
+	if err != nil {
+		return false, err
+	}
+
+	version, ok := v.Value().(string)
+	if !ok {
+		return false, fmt.Errorf("unexpected type %T for NM version", v.Value())
+	}
+
+	outside := cmpver.Compare(version, first) < 0 || cmpver.Compare(version, last) > 0
+	return !outside, nil
+}
+
+func nmIsUsingResolved() error {
+	conn, err := dbus.SystemBus()
+	if err != nil {
+		// DBus probably not running.
+		return err
+	}
+
+	nm := conn.Object("org.freedesktop.NetworkManager", dbus.ObjectPath("/org/freedesktop/NetworkManager/DnsManager"))
+	v, err := nm.GetProperty("org.freedesktop.NetworkManager.DnsManager.Mode")
+	if err != nil {
+		return fmt.Errorf("getting NM mode: %w", err)
+	}
+	mode, ok := v.Value().(string)
+	if !ok {
+		return fmt.Errorf("unexpected type %T for NM DNS mode", v.Value())
+	}
+	if mode != "systemd-resolved" {
+		return errors.New("NetworkManager is not using systemd-resolved for DNS")
+	}
+	return nil
+}
+
+// resolvedIsActuallyResolver reports whether the system is using
+// systemd-resolved as the resolver. There are two different ways to
+// use systemd-resolved:
+//   - libnss_resolve, which requires adding `resolve` to the "hosts:"
+//     line in /etc/nsswitch.conf
+//   - setting the only nameserver configured in `resolv.conf` to
+//     systemd-resolved IP (127.0.0.53)
+//
+// Returns an error if the configuration is something other than
+// exclusively systemd-resolved, or nil if the config is only
+// systemd-resolved.
+func resolvedIsActuallyResolver(logf logger.Logf, env newOSConfigEnv, dbg func(k, v string), bs []byte) error {
+	if err := isLibnssResolveUsed(env); err == nil {
+		dbg("resolved", "nss")
+		return nil
+	}
+
+	cfg, err := readResolv(bytes.NewBuffer(bs))
+	if err != nil {
+		return err
+	}
+	// We've encountered at least one system where the line
+	// "nameserver 127.0.0.53" appears twice, so we look exhaustively
+	// through all of them and allow any number of repeated mentions
+	// of the systemd-resolved stub IP.
+	if len(cfg.Nameservers) == 0 {
+		return errors.New("resolv.conf has no nameservers")
+	}
+	for _, ns := range cfg.Nameservers {
+		if ns != netaddr.IPv4(127, 0, 0, 53) {
+			return fmt.Errorf("resolv.conf doesn't point to systemd-resolved; points to %v", cfg.Nameservers)
+		}
+	}
+	dbg("resolved", "file")
+	return nil
+}
+
+// isLibnssResolveUsed reports whether libnss_resolve is used
+// for resolving names. Returns nil if it is, and an error otherwise.
+func isLibnssResolveUsed(env newOSConfigEnv) error {
+	bs, err := env.fs.ReadFile("/etc/nsswitch.conf")
+	if err != nil {
+		return fmt.Errorf("reading /etc/resolv.conf: %w", err)
+	}
+	for _, line := range strings.Split(string(bs), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) < 2 || fields[0] != "hosts:" {
+			continue
+		}
+		for _, module := range fields[1:] {
+			if module == "dns" {
+				return fmt.Errorf("dns with a higher priority than libnss_resolve")
+			}
+			if module == "resolve" {
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("libnss_resolve not used")
+}
+
+func dbusPing(name, objectPath string) error {
+	conn, err := dbus.SystemBus()
+	if err != nil {
+		// DBus probably not running.
+		return err
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	obj := conn.Object(name, dbus.ObjectPath(objectPath))
+	call := obj.CallWithContext(ctx, "org.freedesktop.DBus.Peer.Ping", 0)
+	return call.Err
+}
+
+// dbusReadString reads a string property from the provided name and object
+// path. property must be in "interface.member" notation.
+func dbusReadString(name, objectPath, iface, member string) (string, error) {
+	conn, err := dbus.SystemBus()
+	if err != nil {
+		// DBus probably not running.
+		return "", err
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	obj := conn.Object(name, dbus.ObjectPath(objectPath))
+
+	var result dbus.Variant
+	err = obj.CallWithContext(ctx, "org.freedesktop.DBus.Properties.Get", 0, iface, member).Store(&result)
+	if err != nil {
+		return "", err
+	}
+
+	if s, ok := result.Value().(string); ok {
+		return s, nil
+	}
+	return result.String(), nil
+}

vendor/tailscale.com/net/dns/manager_openbsd.go

@@ -0,0 +1,78 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+
+	"tailscale.com/control/controlknobs"
+	"tailscale.com/health"
+	"tailscale.com/types/logger"
+)
+
+type kv struct {
+	k, v string
+}
+
+func (kv kv) String() string {
+	return fmt.Sprintf("%s=%s", kv.k, kv.v)
+}
+
+// NewOSConfigurator created a new OS configurator.
+//
+// The health tracker may be nil; the knobs may be nil and are ignored on this platform.
+func NewOSConfigurator(logf logger.Logf, health *health.Tracker, _ *controlknobs.Knobs, interfaceName string) (OSConfigurator, error) {
+	return newOSConfigurator(logf, health, interfaceName,
+		newOSConfigEnv{
+			rcIsResolvd: rcIsResolvd,
+			fs:          directFS{},
+		})
+}
+
+// newOSConfigEnv are the funcs newOSConfigurator needs, pulled out for testing.
+type newOSConfigEnv struct {
+	fs          directFS
+	rcIsResolvd func(resolvConfContents []byte) bool
+}
+
+func newOSConfigurator(logf logger.Logf, health *health.Tracker, interfaceName string, env newOSConfigEnv) (ret OSConfigurator, err error) {
+	var debug []kv
+	dbg := func(k, v string) {
+		debug = append(debug, kv{k, v})
+	}
+	defer func() {
+		if ret != nil {
+			dbg("ret", fmt.Sprintf("%T", ret))
+		}
+		logf("dns: %v", debug)
+	}()
+
+	bs, err := env.fs.ReadFile(resolvConf)
+	if os.IsNotExist(err) {
+		dbg("rc", "missing")
+		return newDirectManager(logf, health), nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("reading /etc/resolv.conf: %w", err)
+	}
+
+	if env.rcIsResolvd(bs) {
+		dbg("resolvd", "yes")
+		return newResolvdManager(logf, interfaceName)
+	}
+
+	dbg("resolvd", "missing")
+	return newDirectManager(logf, health), nil
+}
+
+func rcIsResolvd(resolvConfContents []byte) bool {
+	// If we have the string "# resolvd:" in resolv.conf resolvd(8) is
+	// managing things.
+	if bytes.Contains(resolvConfContents, []byte("# resolvd:")) {
+		return true
+	}
+	return false
+}

vendor/tailscale.com/net/dns/manager_windows.go

@@ -0,0 +1,617 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"net/netip"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"golang.org/x/sys/windows"
+	"golang.org/x/sys/windows/registry"
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
+	"tailscale.com/atomicfile"
+	"tailscale.com/control/controlknobs"
+	"tailscale.com/envknob"
+	"tailscale.com/health"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/dnsname"
+	"tailscale.com/util/winutil"
+)
+
+const (
+	versionKey = `SOFTWARE\Microsoft\Windows NT\CurrentVersion`
+)
+
+var configureWSL = envknob.RegisterBool("TS_DEBUG_CONFIGURE_WSL")
+
+type windowsManager struct {
+	logf       logger.Logf
+	guid       string
+	knobs      *controlknobs.Knobs // or nil
+	nrptDB     *nrptRuleDatabase
+	wslManager *wslManager
+
+	mu      sync.Mutex
+	closing bool
+}
+
+// NewOSConfigurator created a new OS configurator.
+//
+// The health tracker and the knobs may be nil.
+func NewOSConfigurator(logf logger.Logf, health *health.Tracker, knobs *controlknobs.Knobs, interfaceName string) (OSConfigurator, error) {
+	ret := &windowsManager{
+		logf:       logf,
+		guid:       interfaceName,
+		knobs:      knobs,
+		wslManager: newWSLManager(logf, health),
+	}
+
+	if isWindows10OrBetter() {
+		ret.nrptDB = newNRPTRuleDatabase(logf)
+	}
+
+	go func() {
+		// Log WSL status once at startup.
+		if distros, err := wslDistros(); err != nil {
+			logf("WSL: could not list distributions: %v", err)
+		} else {
+			logf("WSL: found %d distributions", len(distros))
+		}
+	}()
+
+	return ret, nil
+}
+
+func (m *windowsManager) openInterfaceKey(pfx winutil.RegistryPathPrefix) (registry.Key, error) {
+	var key registry.Key
+	var err error
+	path := pfx.WithSuffix(m.guid)
+
+	m.mu.Lock()
+	closing := m.closing
+	m.mu.Unlock()
+	if closing {
+		// Do not wait for the interface key to appear if the manager is being closed.
+		// If it's being closed due to the removal of the wintun adapter,
+		// the key would already be gone by now and will not reappear until tailscaled is restarted.
+		key, err = registry.OpenKey(registry.LOCAL_MACHINE, string(path), registry.SET_VALUE)
+	} else {
+		key, err = winutil.OpenKeyWait(registry.LOCAL_MACHINE, path, registry.SET_VALUE)
+	}
+	if err != nil {
+		return 0, fmt.Errorf("opening %s: %w", path, err)
+	}
+	return key, nil
+}
+
+func (m *windowsManager) muteKeyNotFoundIfClosing(err error) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if !m.closing || (!errors.Is(err, windows.ERROR_FILE_NOT_FOUND) && !errors.Is(err, windows.ERROR_PATH_NOT_FOUND)) {
+		return err
+	}
+
+	return nil
+}
+
+func delValue(key registry.Key, name string) error {
+	if err := key.DeleteValue(name); err != nil && err != registry.ErrNotExist {
+		return err
+	}
+	return nil
+}
+
+// setSplitDNS configures one or more NRPT (Name Resolution Policy Table) rules
+// to resolve queries for domains using resolvers, rather than the
+// system's "primary" resolver.
+//
+// If no resolvers are provided, the Tailscale NRPT rules are deleted.
+func (m *windowsManager) setSplitDNS(resolvers []netip.Addr, domains []dnsname.FQDN) error {
+	if m.nrptDB == nil {
+		if resolvers == nil {
+			// Just a no-op in this case.
+			return nil
+		}
+		return fmt.Errorf("Split DNS unsupported on this Windows version")
+	}
+
+	defer m.nrptDB.Refresh()
+	if len(resolvers) == 0 {
+		return m.nrptDB.DelAllRuleKeys()
+	}
+
+	servers := make([]string, 0, len(resolvers))
+	for _, resolver := range resolvers {
+		servers = append(servers, resolver.String())
+	}
+
+	return m.nrptDB.WriteSplitDNSConfig(servers, domains)
+}
+
+func setTailscaleHosts(prevHostsFile []byte, hosts []*HostEntry) ([]byte, error) {
+	b := bytes.ReplaceAll(prevHostsFile, []byte("\r\n"), []byte("\n"))
+	sc := bufio.NewScanner(bytes.NewReader(b))
+	const (
+		header = "# TailscaleHostsSectionStart"
+		footer = "# TailscaleHostsSectionEnd"
+	)
+	var comments = []string{
+		"# This section contains MagicDNS entries for Tailscale.",
+		"# Do not edit this section manually.",
+	}
+	var out bytes.Buffer
+	var inSection bool
+	for sc.Scan() {
+		line := strings.TrimSpace(sc.Text())
+		if line == header {
+			inSection = true
+			continue
+		}
+		if line == footer {
+			inSection = false
+			continue
+		}
+		if inSection {
+			continue
+		}
+		fmt.Fprintln(&out, line)
+	}
+	if err := sc.Err(); err != nil {
+		return nil, err
+	}
+	if len(hosts) > 0 {
+		fmt.Fprintln(&out, header)
+		for _, c := range comments {
+			fmt.Fprintln(&out, c)
+		}
+		fmt.Fprintln(&out)
+		for _, he := range hosts {
+			fmt.Fprintf(&out, "%s %s\n", he.Addr, strings.Join(he.Hosts, " "))
+		}
+		fmt.Fprintln(&out)
+		fmt.Fprintln(&out, footer)
+	}
+	return bytes.ReplaceAll(out.Bytes(), []byte("\n"), []byte("\r\n")), nil
+}
+
+// setHosts sets the hosts file to contain the given host entries.
+func (m *windowsManager) setHosts(hosts []*HostEntry) error {
+	systemDir, err := windows.GetSystemDirectory()
+	if err != nil {
+		return err
+	}
+	hostsFile := filepath.Join(systemDir, "drivers", "etc", "hosts")
+	b, err := os.ReadFile(hostsFile)
+	if err != nil {
+		return err
+	}
+	outB, err := setTailscaleHosts(b, hosts)
+	if err != nil {
+		return err
+	}
+	const fileMode = 0 // ignored on windows.
+
+	// This can fail spuriously with an access denied error, so retry it a
+	// few times.
+	for range 5 {
+		if err = atomicfile.WriteFile(hostsFile, outB, fileMode); err == nil {
+			return nil
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	return err
+}
+
+// setPrimaryDNS sets the given resolvers and domains as the Tailscale
+// interface's DNS configuration.
+// If resolvers is non-empty, those resolvers become the system's
+// "primary" resolvers.
+// domains can be set without resolvers, which just contributes new
+// paths to the global DNS search list.
+func (m *windowsManager) setPrimaryDNS(resolvers []netip.Addr, domains []dnsname.FQDN) error {
+	var ipsv4 []string
+	var ipsv6 []string
+
+	for _, ip := range resolvers {
+		if ip.Is4() {
+			ipsv4 = append(ipsv4, ip.String())
+		} else {
+			ipsv6 = append(ipsv6, ip.String())
+		}
+	}
+
+	domStrs := make([]string, 0, len(domains))
+	for _, dom := range domains {
+		domStrs = append(domStrs, dom.WithoutTrailingDot())
+	}
+
+	key4, err := m.openInterfaceKey(winutil.IPv4TCPIPInterfacePrefix)
+	if err != nil {
+		return m.muteKeyNotFoundIfClosing(err)
+	}
+	defer key4.Close()
+
+	if len(ipsv4) == 0 {
+		if err := delValue(key4, "NameServer"); err != nil {
+			return err
+		}
+	} else if err := key4.SetStringValue("NameServer", strings.Join(ipsv4, ",")); err != nil {
+		return err
+	}
+
+	if len(domains) == 0 {
+		if err := delValue(key4, "SearchList"); err != nil {
+			return err
+		}
+	} else if err := key4.SetStringValue("SearchList", strings.Join(domStrs, ",")); err != nil {
+		return err
+	}
+
+	key6, err := m.openInterfaceKey(winutil.IPv6TCPIPInterfacePrefix)
+	if err != nil {
+		return m.muteKeyNotFoundIfClosing(err)
+	}
+	defer key6.Close()
+
+	if len(ipsv6) == 0 {
+		if err := delValue(key6, "NameServer"); err != nil {
+			return err
+		}
+	} else if err := key6.SetStringValue("NameServer", strings.Join(ipsv6, ",")); err != nil {
+		return err
+	}
+
+	if len(domains) == 0 {
+		if err := delValue(key6, "SearchList"); err != nil {
+			return err
+		}
+	} else if err := key6.SetStringValue("SearchList", strings.Join(domStrs, ",")); err != nil {
+		return err
+	}
+
+	// Disable LLMNR on the Tailscale interface. We don't do multicast, and we
+	// certainly don't do LLMNR, so it's pointless to make Windows try it. It is
+	// being deprecated.
+	if err := key4.SetDWordValue("EnableMulticast", 0); err != nil {
+		return err
+	}
+	if err := key6.SetDWordValue("EnableMulticast", 0); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *windowsManager) disableLocalDNSOverrideViaNRPT() bool {
+	return m.knobs != nil && m.knobs.DisableLocalDNSOverrideViaNRPT.Load()
+}
+
+func (m *windowsManager) SetDNS(cfg OSConfig) error {
+	// We can configure Windows DNS in one of two ways:
+	//
+	//  - In primary DNS mode, we set the NameServer and SearchList
+	//    registry keys on our interface. Because our interface metric
+	//    is very low, this turns us into the one and only "primary"
+	//    resolver for the OS, i.e. all queries flow to the
+	//    resolver(s) we specify.
+	//  - In split DNS mode, we set the Domain registry key on our
+	//    interface (which adds that domain to the global search list,
+	//    but does not contribute other DNS configuration from the
+	//    interface), and configure an NRPT (Name Resolution Policy
+	//    Table) rule to route queries for our suffixes to the
+	//    provided resolver.
+	//
+	// When switching modes, we delete all the configuration related
+	// to the other mode, so these two are an XOR.
+	//
+	// Windows actually supports much more advanced configurations as
+	// well, with arbitrary routing of hosts and suffixes to arbitrary
+	// resolvers. However, we use it in a "simple" split domain
+	// configuration only, routing one set of things to the "split"
+	// resolver and the rest to the primary.
+
+	// Unconditionally disable dynamic DNS updates and NetBIOS on our
+	// interfaces.
+	if err := m.disableDynamicUpdates(); err != nil {
+		m.logf("disableDynamicUpdates error: %v\n", err)
+	}
+	if err := m.disableNetBIOS(); err != nil {
+		m.logf("disableNetBIOS error: %v\n", err)
+	}
+
+	if len(cfg.MatchDomains) == 0 {
+		var resolvers []netip.Addr
+		var domains []dnsname.FQDN
+		if !m.disableLocalDNSOverrideViaNRPT() {
+			// Create a default catch-all rule to make ourselves the actual primary resolver.
+			// Without this rule, Windows 8.1 and newer devices issue parallel DNS requests to DNS servers
+			// associated with all network adapters, even when "Override local DNS" is enabled and/or
+			// a Mullvad exit node is being used, resulting in DNS leaks.
+			resolvers = cfg.Nameservers
+			domains = []dnsname.FQDN{"."}
+		}
+		if err := m.setSplitDNS(resolvers, domains); err != nil {
+			return err
+		}
+		if err := m.setHosts(nil); err != nil {
+			return err
+		}
+		if err := m.setPrimaryDNS(cfg.Nameservers, cfg.SearchDomains); err != nil {
+			return err
+		}
+	} else {
+		if err := m.setSplitDNS(cfg.Nameservers, cfg.MatchDomains); err != nil {
+			return err
+		}
+		// Unset the resolver on the interface to ensure that we do not become
+		// the primary resolver. Although this is what we want, at the moment
+		// (2022-08-13) it causes single label resolutions from the OS resolver
+		// to wait for a MDNS response from the Tailscale interface.
+		// See #1659 and #5366 for more details.
+		//
+		// Still set search domains on the interface, since NRPT only handles
+		// query routing and not search domain expansion.
+		if err := m.setPrimaryDNS(nil, cfg.SearchDomains); err != nil {
+			return err
+		}
+
+		// As we are not the primary resolver in this setup, we need to
+		// explicitly set some single name hosts to ensure that we can resolve
+		// them quickly and get around the 2.3s delay that otherwise occurs due
+		// to multicast timeouts.
+		if err := m.setHosts(cfg.Hosts); err != nil {
+			return err
+		}
+	}
+
+	// Force DNS re-registration in Active Directory. What we actually
+	// care about is that this command invokes the undocumented hidden
+	// function that forces Windows to notice that adapter settings
+	// have changed, which makes the DNS settings actually take
+	// effect.
+	//
+	// This command can take a few seconds to run, so run it async, best effort.
+	//
+	// After re-registering DNS, also flush the DNS cache to clear out
+	// any cached split-horizon queries that are no longer the correct
+	// answer.
+	go func() {
+		t0 := time.Now()
+		m.logf("running ipconfig /registerdns ...")
+		cmd := exec.Command("ipconfig", "/registerdns")
+		cmd.SysProcAttr = &syscall.SysProcAttr{
+			CreationFlags: windows.DETACHED_PROCESS,
+		}
+		err := cmd.Run()
+		d := time.Since(t0).Round(time.Millisecond)
+		if err != nil {
+			m.logf("error running ipconfig /registerdns after %v: %v", d, err)
+		} else {
+			m.logf("ran ipconfig /registerdns in %v", d)
+		}
+
+		t0 = time.Now()
+		m.logf("running ipconfig /flushdns ...")
+		cmd = exec.Command("ipconfig", "/flushdns")
+		cmd.SysProcAttr = &syscall.SysProcAttr{
+			CreationFlags: windows.DETACHED_PROCESS,
+		}
+		err = cmd.Run()
+		d = time.Since(t0).Round(time.Millisecond)
+		if err != nil {
+			m.logf("error running ipconfig /flushdns after %v: %v", d, err)
+		} else {
+			m.logf("ran ipconfig /flushdns in %v", d)
+		}
+	}()
+
+	// On initial setup of WSL, the restart caused by --shutdown is slow,
+	// so we do it out-of-line.
+	if configureWSL() {
+		go func() {
+			if err := m.wslManager.SetDNS(cfg); err != nil {
+				m.logf("WSL SetDNS: %v", err) // continue
+			} else {
+				m.logf("WSL SetDNS: success")
+			}
+		}()
+	}
+
+	return nil
+}
+
+func (m *windowsManager) SupportsSplitDNS() bool {
+	return m.nrptDB != nil
+}
+
+func (m *windowsManager) Close() error {
+	m.mu.Lock()
+	if m.closing {
+		m.mu.Unlock()
+		return nil
+	}
+	m.closing = true
+	m.mu.Unlock()
+
+	err := m.SetDNS(OSConfig{})
+	if m.nrptDB != nil {
+		m.nrptDB.Close()
+		m.nrptDB = nil
+	}
+	return err
+}
+
+// disableDynamicUpdates sets the appropriate registry values to prevent the
+// Windows DHCP client from sending dynamic DNS updates for our interface to
+// AD domain controllers.
+func (m *windowsManager) disableDynamicUpdates() error {
+	prefixen := []winutil.RegistryPathPrefix{
+		winutil.IPv4TCPIPInterfacePrefix,
+		winutil.IPv6TCPIPInterfacePrefix,
+	}
+
+	for _, prefix := range prefixen {
+		k, err := m.openInterfaceKey(prefix)
+		if err != nil {
+			return m.muteKeyNotFoundIfClosing(err)
+		}
+		defer k.Close()
+
+		if err := k.SetDWordValue("RegistrationEnabled", 0); err != nil {
+			return err
+		}
+		if err := k.SetDWordValue("DisableDynamicUpdate", 1); err != nil {
+			return err
+		}
+		if err := k.SetDWordValue("MaxNumberOfAddressesToRegister", 0); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// setSingleDWORD opens the Registry Key in HKLM for the interface associated
+// with the windowsManager and sets the "keyPrefix\value" to data.
+func (m *windowsManager) setSingleDWORD(prefix winutil.RegistryPathPrefix, value string, data uint32) error {
+	k, err := m.openInterfaceKey(prefix)
+	if err != nil {
+		return m.muteKeyNotFoundIfClosing(err)
+	}
+	defer k.Close()
+	return k.SetDWordValue(value, data)
+}
+
+// disableNetBIOS sets the appropriate registry values to prevent Windows from
+// sending NetBIOS name resolution requests for our interface which we do not
+// handle nor want to. By leaving it enabled and not handling it we introduce
+// short-name resolution delays in certain conditions as Windows waits for
+// NetBIOS responses from our interface (#1659).
+//
+// Further, LLMNR and NetBIOS are being deprecated anyway in favor of MDNS.
+// https://techcommunity.microsoft.com/t5/networking-blog/aligning-on-mdns-ramping-down-netbios-name-resolution-and-llmnr/ba-p/3290816
+func (m *windowsManager) disableNetBIOS() error {
+	return m.setSingleDWORD(winutil.NetBTInterfacePrefix, "NetbiosOptions", 2)
+}
+
+func (m *windowsManager) GetBaseConfig() (OSConfig, error) {
+	resolvers, err := m.getBasePrimaryResolver()
+	if err != nil {
+		return OSConfig{}, err
+	}
+	return OSConfig{
+		Nameservers: resolvers,
+		// Don't return any search domains here, because even Windows
+		// 7 correctly handles blending search domains from multiple
+		// sources, and any search domains we add here will get tacked
+		// onto the Tailscale config unnecessarily.
+	}, nil
+}
+
+// getBasePrimaryResolver returns a guess of the non-Tailscale primary
+// resolver on the system.
+// It's used on Windows 7 to emulate split DNS by trying to figure out
+// what the "previous" primary resolver was. It might be wrong, or
+// incomplete.
+func (m *windowsManager) getBasePrimaryResolver() (resolvers []netip.Addr, err error) {
+	tsGUID, err := windows.GUIDFromString(m.guid)
+	if err != nil {
+		return nil, err
+	}
+	tsLUID, err := winipcfg.LUIDFromGUID(&tsGUID)
+	if err != nil {
+		return nil, err
+	}
+	ifrows, err := winipcfg.GetIPInterfaceTable(windows.AF_INET)
+	if err == windows.ERROR_NOT_FOUND {
+		// IPv4 seems disabled, try to get interface metrics from IPv6 instead.
+		ifrows, err = winipcfg.GetIPInterfaceTable(windows.AF_INET6)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	type candidate struct {
+		id     winipcfg.LUID
+		metric uint32
+	}
+	var candidates []candidate
+	for _, row := range ifrows {
+		if !row.Connected {
+			continue
+		}
+		if row.InterfaceLUID == tsLUID {
+			continue
+		}
+		candidates = append(candidates, candidate{row.InterfaceLUID, row.Metric})
+	}
+	if len(candidates) == 0 {
+		// No resolvers set outside of Tailscale.
+		return nil, nil
+	}
+
+	sort.Slice(candidates, func(i, j int) bool { return candidates[i].metric < candidates[j].metric })
+
+	for _, candidate := range candidates {
+		ips, err := candidate.id.DNS()
+		if err != nil {
+			return nil, err
+		}
+
+	ipLoop:
+		for _, ip := range ips {
+			ip = ip.Unmap()
+			// Skip IPv6 site-local resolvers. These are an ancient
+			// and obsolete IPv6 RFC, which Windows still faithfully
+			// implements. The net result is that some low-metric
+			// interfaces can "have" DNS resolvers, but they're just
+			// site-local resolver IPs that don't go anywhere. So, we
+			// skip the site-local resolvers in order to find the
+			// first interface that has real DNS servers configured.
+			for _, sl := range siteLocalResolvers {
+				if ip.WithZone("") == sl {
+					continue ipLoop
+				}
+			}
+			resolvers = append(resolvers, ip)
+		}
+
+		if len(resolvers) > 0 {
+			// Found some resolvers, we're done.
+			break
+		}
+	}
+
+	return resolvers, nil
+}
+
+var siteLocalResolvers = []netip.Addr{
+	netip.MustParseAddr("fec0:0:0:ffff::1"),
+	netip.MustParseAddr("fec0:0:0:ffff::2"),
+	netip.MustParseAddr("fec0:0:0:ffff::3"),
+}
+
+func isWindows10OrBetter() bool {
+	key, err := registry.OpenKey(registry.LOCAL_MACHINE, versionKey, registry.READ)
+	if err != nil {
+		// Fail safe, assume old Windows.
+		return false
+	}
+	// This key above only exists in Windows 10 and above. Its mere
+	// presence is good enough.
+	if _, _, err := key.GetIntegerValue("CurrentMajorVersionNumber"); err != nil {
+		return false
+	}
+	return true
+}

vendor/tailscale.com/net/dns/nm.go

@@ -0,0 +1,391 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux
+
+package dns
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/netip"
+	"sort"
+	"time"
+
+	"github.com/godbus/dbus/v5"
+	"github.com/josharian/native"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/util/dnsname"
+)
+
+const (
+	highestPriority = int32(-1 << 31)
+	mediumPriority  = int32(1)   // Highest priority that doesn't hard-override
+	lowerPriority   = int32(200) // lower than all builtin auto priorities
+)
+
+// reconfigTimeout is the time interval within which Manager.{Up,Down} should complete.
+//
+// This is particularly useful because certain conditions can cause indefinite hangs
+// (such as improper dbus auth followed by contextless dbus.Object.Call).
+// Such operations should be wrapped in a timeout context.
+const reconfigTimeout = time.Second
+
+// nmManager uses the NetworkManager DBus API.
+type nmManager struct {
+	interfaceName string
+	manager       dbus.BusObject
+	dnsManager    dbus.BusObject
+}
+
+func newNMManager(interfaceName string) (*nmManager, error) {
+	conn, err := dbus.SystemBus()
+	if err != nil {
+		return nil, err
+	}
+
+	return &nmManager{
+		interfaceName: interfaceName,
+		manager:       conn.Object("org.freedesktop.NetworkManager", dbus.ObjectPath("/org/freedesktop/NetworkManager")),
+		dnsManager:    conn.Object("org.freedesktop.NetworkManager", dbus.ObjectPath("/org/freedesktop/NetworkManager/DnsManager")),
+	}, nil
+}
+
+type nmConnectionSettings map[string]map[string]dbus.Variant
+
+func (m *nmManager) SetDNS(config OSConfig) error {
+	ctx, cancel := context.WithTimeout(context.Background(), reconfigTimeout)
+	defer cancel()
+
+	// NetworkManager only lets you set DNS settings on "active"
+	// connections, which requires an assigned IP address. This got
+	// configured before the DNS manager was invoked, but it might
+	// take a little time for the netlink notifications to propagate
+	// up. So, keep retrying for the duration of the reconfigTimeout.
+	var err error
+	for ctx.Err() == nil {
+		err = m.trySet(ctx, config)
+		if err == nil {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	return err
+}
+
+func (m *nmManager) trySet(ctx context.Context, config OSConfig) error {
+	conn, err := dbus.SystemBus()
+	if err != nil {
+		return fmt.Errorf("connecting to system bus: %w", err)
+	}
+
+	// This is how we get at the DNS settings:
+	//
+	//               org.freedesktop.NetworkManager
+	//                              |
+	//                    [GetDeviceByIpIface]
+	//                              |
+	//                              v
+	//           org.freedesktop.NetworkManager.Device <--------\
+	//              (describes a network interface)             |
+	//                              |                           |
+	//                   [GetAppliedConnection]             [Reapply]
+	//                              |                           |
+	//                              v                           |
+	//          org.freedesktop.NetworkManager.Connection       |
+	//                   (connection settings)            ------/
+	//          contains {dns, dns-priority, dns-search}
+	//
+	// Ref: https://developer.gnome.org/NetworkManager/stable/settings-ipv4.html.
+
+	nm := conn.Object(
+		"org.freedesktop.NetworkManager",
+		dbus.ObjectPath("/org/freedesktop/NetworkManager"),
+	)
+
+	var devicePath dbus.ObjectPath
+	err = nm.CallWithContext(
+		ctx, "org.freedesktop.NetworkManager.GetDeviceByIpIface", 0,
+		m.interfaceName,
+	).Store(&devicePath)
+	if err != nil {
+		return fmt.Errorf("getDeviceByIpIface: %w", err)
+	}
+	device := conn.Object("org.freedesktop.NetworkManager", devicePath)
+
+	var (
+		settings nmConnectionSettings
+		version  uint64
+	)
+	err = device.CallWithContext(
+		ctx, "org.freedesktop.NetworkManager.Device.GetAppliedConnection", 0,
+		uint32(0),
+	).Store(&settings, &version)
+	if err != nil {
+		return fmt.Errorf("getAppliedConnection: %w", err)
+	}
+
+	// Frustratingly, NetworkManager represents IPv4 addresses as uint32s,
+	// although IPv6 addresses are represented as byte arrays.
+	// Perform the conversion here.
+	var (
+		dnsv4 []uint32
+		dnsv6 [][]byte
+	)
+	for _, ip := range config.Nameservers {
+		b := ip.As16()
+		if ip.Is4() {
+			dnsv4 = append(dnsv4, native.Endian.Uint32(b[12:]))
+		} else {
+			dnsv6 = append(dnsv6, b[:])
+		}
+	}
+
+	// NetworkManager wipes out IPv6 address configuration unless we
+	// tell it explicitly to keep it. Read out the current interface
+	// settings and mirror them out to NetworkManager.
+	var addrs6 []map[string]any
+	if tsIf, err := net.InterfaceByName(m.interfaceName); err == nil {
+		addrs, _ := tsIf.Addrs()
+		for _, a := range addrs {
+			if ipnet, ok := a.(*net.IPNet); ok {
+				nip, ok := netip.AddrFromSlice(ipnet.IP)
+				nip = nip.Unmap()
+				if ok && tsaddr.IsTailscaleIP(nip) && nip.Is6() {
+					addrs6 = append(addrs6, map[string]any{
+						"address": nip.String(),
+						"prefix":  uint32(128),
+					})
+				}
+			}
+		}
+	}
+
+	seen := map[dnsname.FQDN]bool{}
+	var search []string
+	for _, dom := range config.SearchDomains {
+		if seen[dom] {
+			continue
+		}
+		seen[dom] = true
+		search = append(search, dom.WithTrailingDot())
+	}
+	for _, dom := range config.MatchDomains {
+		if seen[dom] {
+			continue
+		}
+		seen[dom] = true
+		search = append(search, "~"+dom.WithTrailingDot())
+	}
+	if len(config.MatchDomains) == 0 {
+		// Non-split routing requested, add an all-domains match.
+		search = append(search, "~.")
+	}
+
+	// Ideally we would like to disable LLMNR and mdns on the
+	// interface here, but older NetworkManagers don't understand
+	// those settings and choke on them, so we don't. Both LLMNR and
+	// mdns will fail since tailscale0 doesn't do multicast, so it's
+	// effectively fine. We used to try and enforce LLMNR and mdns
+	// settings here, but that led to #1870.
+
+	ipv4Map := settings["ipv4"]
+	ipv4Map["dns"] = dbus.MakeVariant(dnsv4)
+	ipv4Map["dns-search"] = dbus.MakeVariant(search)
+	// We should only request priority if we have nameservers to set.
+	if len(dnsv4) == 0 {
+		ipv4Map["dns-priority"] = dbus.MakeVariant(lowerPriority)
+	} else if len(config.MatchDomains) > 0 {
+		// Set a fairly high priority, but don't override all other
+		// configs when in split-DNS mode.
+		ipv4Map["dns-priority"] = dbus.MakeVariant(mediumPriority)
+	} else {
+		// Negative priority means only the settings from the most
+		// negative connection get used. The way this mixes with
+		// per-domain routing is unclear, but it _seems_ that the
+		// priority applies after routing has found possible
+		// candidates for a resolution.
+		ipv4Map["dns-priority"] = dbus.MakeVariant(highestPriority)
+	}
+
+	ipv6Map := settings["ipv6"]
+	// In IPv6 settings, you're only allowed to provide additional
+	// static DNS settings in "auto" (SLAAC) or "manual" mode. In
+	// "manual" mode you also have to specify IP addresses, so we use
+	// "auto".
+	//
+	// NM actually documents that to set just DNS servers, you should
+	// use "auto" mode and then set ignore auto routes and DNS, which
+	// basically means "autoconfigure but ignore any autoconfiguration
+	// results you might get". As a safety, we also say that
+	// NetworkManager should never try to make us the default route
+	// (none of its business anyway, we handle our own default
+	// routing).
+	ipv6Map["method"] = dbus.MakeVariant("auto")
+	if len(addrs6) > 0 {
+		ipv6Map["address-data"] = dbus.MakeVariant(addrs6)
+	}
+	ipv6Map["ignore-auto-routes"] = dbus.MakeVariant(true)
+	ipv6Map["ignore-auto-dns"] = dbus.MakeVariant(true)
+	ipv6Map["never-default"] = dbus.MakeVariant(true)
+
+	ipv6Map["dns"] = dbus.MakeVariant(dnsv6)
+	ipv6Map["dns-search"] = dbus.MakeVariant(search)
+	if len(dnsv6) == 0 {
+		ipv6Map["dns-priority"] = dbus.MakeVariant(lowerPriority)
+	} else if len(config.MatchDomains) > 0 {
+		// Set a fairly high priority, but don't override all other
+		// configs when in split-DNS mode.
+		ipv6Map["dns-priority"] = dbus.MakeVariant(mediumPriority)
+	} else {
+		ipv6Map["dns-priority"] = dbus.MakeVariant(highestPriority)
+	}
+
+	// deprecatedProperties are the properties in interface settings
+	// that are deprecated by NetworkManager.
+	//
+	// In practice, this means that they are returned for reading,
+	// but submitting a settings object with them present fails
+	// with hard-to-diagnose errors. They must be removed.
+	deprecatedProperties := []string{
+		"addresses", "routes",
+	}
+
+	for _, property := range deprecatedProperties {
+		delete(ipv4Map, property)
+		delete(ipv6Map, property)
+	}
+
+	if call := device.CallWithContext(ctx, "org.freedesktop.NetworkManager.Device.Reapply", 0, settings, version, uint32(0)); call.Err != nil {
+		return fmt.Errorf("reapply: %w", call.Err)
+	}
+
+	return nil
+}
+
+func (m *nmManager) SupportsSplitDNS() bool {
+	var mode string
+	v, err := m.dnsManager.GetProperty("org.freedesktop.NetworkManager.DnsManager.Mode")
+	if err != nil {
+		return false
+	}
+	mode, ok := v.Value().(string)
+	if !ok {
+		return false
+	}
+
+	// Per NM's documentation, it only does split-DNS when it's
+	// programming dnsmasq or systemd-resolved. All other modes are
+	// primary-only.
+	return mode == "dnsmasq" || mode == "systemd-resolved"
+}
+
+func (m *nmManager) GetBaseConfig() (OSConfig, error) {
+	conn, err := dbus.SystemBus()
+	if err != nil {
+		return OSConfig{}, err
+	}
+
+	nm := conn.Object("org.freedesktop.NetworkManager", dbus.ObjectPath("/org/freedesktop/NetworkManager/DnsManager"))
+	v, err := nm.GetProperty("org.freedesktop.NetworkManager.DnsManager.Configuration")
+	if err != nil {
+		return OSConfig{}, err
+	}
+	cfgs, ok := v.Value().([]map[string]dbus.Variant)
+	if !ok {
+		return OSConfig{}, fmt.Errorf("unexpected NM config type %T", v.Value())
+	}
+
+	if len(cfgs) == 0 {
+		return OSConfig{}, nil
+	}
+
+	type dnsPrio struct {
+		resolvers []netip.Addr
+		domains   []string
+		priority  int32
+	}
+	order := make([]dnsPrio, 0, len(cfgs)-1)
+
+	for _, cfg := range cfgs {
+		if name, ok := cfg["interface"]; ok {
+			if s, ok := name.Value().(string); ok && s == m.interfaceName {
+				// Config for the tailscale interface, skip.
+				continue
+			}
+		}
+
+		var p dnsPrio
+
+		if v, ok := cfg["nameservers"]; ok {
+			if ips, ok := v.Value().([]string); ok {
+				for _, s := range ips {
+					ip, err := netip.ParseAddr(s)
+					if err != nil {
+						// hmm, what do? Shouldn't really happen.
+						continue
+					}
+					p.resolvers = append(p.resolvers, ip)
+				}
+			}
+		}
+		if v, ok := cfg["domains"]; ok {
+			if domains, ok := v.Value().([]string); ok {
+				p.domains = domains
+			}
+		}
+		if v, ok := cfg["priority"]; ok {
+			if prio, ok := v.Value().(int32); ok {
+				p.priority = prio
+			}
+		}
+
+		order = append(order, p)
+	}
+
+	sort.Slice(order, func(i, j int) bool {
+		return order[i].priority < order[j].priority
+	})
+
+	var (
+		ret           OSConfig
+		seenResolvers = map[netip.Addr]bool{}
+		seenSearch    = map[string]bool{}
+	)
+
+	for _, cfg := range order {
+		for _, resolver := range cfg.resolvers {
+			if seenResolvers[resolver] {
+				continue
+			}
+			ret.Nameservers = append(ret.Nameservers, resolver)
+			seenResolvers[resolver] = true
+		}
+		for _, dom := range cfg.domains {
+			if seenSearch[dom] {
+				continue
+			}
+			fqdn, err := dnsname.ToFQDN(dom)
+			if err != nil {
+				continue
+			}
+			ret.SearchDomains = append(ret.SearchDomains, fqdn)
+			seenSearch[dom] = true
+		}
+		if cfg.priority < 0 {
+			// exclusive configurations preempt all other
+			// configurations, so we're done.
+			break
+		}
+	}
+
+	return ret, nil
+}
+
+func (m *nmManager) Close() error {
+	// No need to do anything on close, NetworkManager will delete our
+	// settings when the tailscale interface goes away.
+	return nil
+}

vendor/tailscale.com/net/dns/noop.go

@@ -0,0 +1,17 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+type noopManager struct{}
+
+func (m noopManager) SetDNS(OSConfig) error  { return nil }
+func (m noopManager) SupportsSplitDNS() bool { return false }
+func (m noopManager) Close() error           { return nil }
+func (m noopManager) GetBaseConfig() (OSConfig, error) {
+	return OSConfig{}, ErrGetBaseConfigNotSupported
+}
+
+func NewNoopManager() (noopManager, error) {
+	return noopManager{}, nil
+}

vendor/tailscale.com/net/dns/nrpt_windows.go

@@ -0,0 +1,459 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+	"sync/atomic"
+
+	"golang.org/x/sys/windows"
+	"golang.org/x/sys/windows/registry"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/dnsname"
+	"tailscale.com/util/set"
+	"tailscale.com/util/winutil"
+	"tailscale.com/util/winutil/gp"
+)
+
+const (
+	dnsBaseGP     = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient`
+	nrptBaseLocal = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig`
+	nrptBaseGP    = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
+
+	nrptOverrideDNS = 0x8 // bitmask value for "use the provided override DNS resolvers"
+
+	// Apparently NRPT rules cannot handle > 50 domains.
+	nrptMaxDomainsPerRule = 50
+
+	// This is the legacy rule ID that previous versions used when we supported
+	// only a single rule. Now that we support multiple rules are required, we
+	// generate their GUIDs and store them under the Tailscale registry key.
+	nrptSingleRuleID = `{5abe529b-675b-4486-8459-25a634dacc23}`
+
+	// This is the name of the registry value we use to save Rule IDs under
+	// the Tailscale registry key.
+	nrptRuleIDValueName = `NRPTRuleIDs`
+
+	// This is the name of the registry value the NRPT uses for storing a rule's version number.
+	nrptRuleVersionName = `Version`
+
+	// This is the name of the registry value the NRPT uses for storing a rule's list of domains.
+	nrptRuleDomsName = `Name`
+
+	// This is the name of the registry value the NRPT uses for storing a rule's list of DNS servers.
+	nrptRuleServersName = `GenericDNSServers`
+
+	// This is the name of the registry value the NRPT uses for storing a rule's flags.
+	nrptRuleFlagsName = `ConfigOptions`
+)
+
+// nrptRuleDatabase encapsulates access to the Windows Name Resolution Policy
+// Table (NRPT).
+type nrptRuleDatabase struct {
+	logf               logger.Logf
+	watcher            *gp.ChangeWatcher
+	isGPRefreshPending atomic.Bool
+	mu                 sync.Mutex // protects the fields below
+	ruleIDs            []string
+	isGPDirty          bool
+	writeAsGP          bool
+}
+
+func newNRPTRuleDatabase(logf logger.Logf) *nrptRuleDatabase {
+	ret := &nrptRuleDatabase{logf: logf}
+	ret.loadRuleSubkeyNames()
+	ret.detectWriteAsGP()
+	ret.watchForGPChanges()
+	// Best-effort: if our NRPT rule exists, try to delete it. Unlike
+	// per-interface configuration, NRPT rules survive the unclean
+	// termination of the Tailscale process, and depending on the
+	// rule, it may prevent us from reaching login.tailscale.com to
+	// boot up. The bootstrap resolver logic will save us, but it
+	// slows down start-up a bunch.
+	ret.DelAllRuleKeys()
+	return ret
+}
+
+func (db *nrptRuleDatabase) loadRuleSubkeyNames() {
+	// Use the legacy rule ID if none are specified in our registry key
+	db.ruleIDs = winutil.GetRegStrings(nrptRuleIDValueName, []string{nrptSingleRuleID})
+}
+
+// detectWriteAsGP determines which registry path should be used for writing
+// NRPT rules. If there are rules in the GP path that don't belong to us, then
+// we should use the GP path. When detectWriteAsGP determines that the desired
+// path has changed, it moves the NRPT policies as appropriate.
+func (db *nrptRuleDatabase) detectWriteAsGP() {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+
+	writeAsGP := false
+	var err error
+
+	defer func() {
+		if err != nil {
+			return
+		}
+		prev := db.writeAsGP
+		db.writeAsGP = writeAsGP
+		db.logf("nrptRuleDatabase using group policy: %v, was %v\n", writeAsGP, prev)
+		// When db.watcher == nil, prev != writeAsGP because we're initializing, not
+		// because anything has changed. We do not invoke
+		// db.updateGroupPoliciesLocked in that case.
+		if db.watcher != nil && prev != writeAsGP {
+			db.updateGroupPoliciesLocked(writeAsGP)
+		}
+	}()
+
+	// Get a list of all the NRPT rules under the GP subkey.
+	nrptKey, err := registry.OpenKey(registry.LOCAL_MACHINE, nrptBaseGP, registry.READ)
+	if err != nil {
+		if err != registry.ErrNotExist {
+			db.logf("Failed to open key %q with error: %v\n", nrptBaseGP, err)
+		}
+		// If this subkey does not exist then we definitely don't need to use the GP key.
+		return
+	}
+	defer nrptKey.Close()
+
+	gpSubkeyNames, err := nrptKey.ReadSubKeyNames(0)
+	if err != nil {
+		db.logf("Failed to list subkeys under %q with error: %v\n", nrptBaseGP, err)
+		return
+	}
+
+	// Add *all* rules from the GP subkey into a set.
+	gpSubkeyMap := make(set.Set[string], len(gpSubkeyNames))
+	for _, gpSubkey := range gpSubkeyNames {
+		gpSubkeyMap.Add(strings.ToUpper(gpSubkey))
+	}
+
+	// Remove *our* rules from the set.
+	for _, ourRuleID := range db.ruleIDs {
+		gpSubkeyMap.Delete(strings.ToUpper(ourRuleID))
+	}
+
+	// Any leftover rules do not belong to us. When group policy is being used
+	// by something else, we must also use the GP path.
+	writeAsGP = len(gpSubkeyMap) > 0
+}
+
+// DelAllRuleKeys removes any and all NRPT rules that are owned by Tailscale.
+func (db *nrptRuleDatabase) DelAllRuleKeys() error {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+
+	if err := db.delRuleKeys(db.ruleIDs); err != nil {
+		return err
+	}
+	if err := winutil.DeleteRegValue(nrptRuleIDValueName); err != nil {
+		db.logf("Error deleting registry value %q: %v", nrptRuleIDValueName, err)
+		return err
+	}
+	db.ruleIDs = nil
+	return nil
+}
+
+// delRuleKeys removes the NRPT rules specified by nrptRuleIDs from the
+// Windows registry. It attempts to remove the rules from both possible registry
+// keys: the local key and the group policy key.
+func (db *nrptRuleDatabase) delRuleKeys(nrptRuleIDs []string) error {
+	for _, rid := range nrptRuleIDs {
+		keyNameLocal := nrptBaseLocal + `\` + rid
+		if err := registry.DeleteKey(registry.LOCAL_MACHINE, keyNameLocal); err != nil && err != registry.ErrNotExist {
+			db.logf("Error deleting NRPT rule key %q: %v", keyNameLocal, err)
+			return err
+		}
+
+		keyNameGP := nrptBaseGP + `\` + rid
+		err := registry.DeleteKey(registry.LOCAL_MACHINE, keyNameGP)
+		if err == nil {
+			// If this deleted subkey existed under the GP key, we will need to refresh.
+			db.isGPDirty = true
+		} else if err != registry.ErrNotExist {
+			db.logf("Error deleting NRPT rule key %q: %v", keyNameGP, err)
+			return err
+		}
+	}
+
+	if !db.isGPDirty {
+		return nil
+	}
+
+	// If we've removed keys from the Group Policy subkey, and the DNSPolicyConfig
+	// subkey is now empty, we need to remove that subkey.
+	isEmpty, err := isPolicyConfigSubkeyEmpty()
+	if err != nil || !isEmpty {
+		return err
+	}
+
+	return registry.DeleteKey(registry.LOCAL_MACHINE, nrptBaseGP)
+}
+
+// isPolicyConfigSubkeyEmpty returns true if and only if the nrptBaseGP exists
+// and does not contain any values or subkeys.
+func isPolicyConfigSubkeyEmpty() (bool, error) {
+	subKey, err := registry.OpenKey(registry.LOCAL_MACHINE, nrptBaseGP, registry.READ)
+	if err != nil {
+		if err == registry.ErrNotExist {
+			return false, nil
+		}
+		return false, err
+	}
+	defer subKey.Close()
+
+	ki, err := subKey.Stat()
+	if err != nil {
+		return false, err
+	}
+
+	return (ki.ValueCount == 0 && ki.SubKeyCount == 0), nil
+}
+
+func (db *nrptRuleDatabase) WriteSplitDNSConfig(servers []string, domains []dnsname.FQDN) error {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+
+	// NRPT has an undocumented restriction that each rule may only be associated
+	// with a maximum of 50 domains. If we are setting rules for more domains
+	// than that, we need to split domains into chunks and write out a rule per chunk.
+	domainRulesLen := (len(domains) + nrptMaxDomainsPerRule - 1) / nrptMaxDomainsPerRule
+	db.loadRuleSubkeyNames()
+
+	for len(db.ruleIDs) < domainRulesLen {
+		guid, err := windows.GenerateGUID()
+		if err != nil {
+			return err
+		}
+		db.ruleIDs = append(db.ruleIDs, guid.String())
+	}
+
+	// Remove any surplus rules that are no longer needed.
+	ruleIDsToRemove := db.ruleIDs[domainRulesLen:]
+	db.delRuleKeys(ruleIDsToRemove)
+
+	// We need to save the list of rule IDs to our Tailscale registry key so that
+	// we know which rules are ours during subsequent modifications to NRPT rules.
+	ruleIDsToWrite := db.ruleIDs[:domainRulesLen]
+	if len(ruleIDsToWrite) == 0 {
+		if err := winutil.DeleteRegValue(nrptRuleIDValueName); err != nil {
+			return err
+		}
+		db.ruleIDs = nil
+		return nil
+	}
+
+	if err := winutil.SetRegStrings(nrptRuleIDValueName, ruleIDsToWrite); err != nil {
+		return err
+	}
+	db.ruleIDs = ruleIDsToWrite
+
+	curRuleID := 0
+	doms := make([]string, 0, nrptMaxDomainsPerRule)
+
+	for _, domain := range domains {
+		if len(doms) == nrptMaxDomainsPerRule {
+			if err := db.writeNRPTRule(db.ruleIDs[curRuleID], servers, doms); err != nil {
+				return err
+			}
+			curRuleID++
+			doms = doms[:0]
+		}
+
+		// NRPT rules must have a leading dot, which is not usual for
+		// DNS search paths.
+		doms = append(doms, "."+domain.WithoutTrailingDot())
+	}
+
+	if len(doms) > 0 {
+		if err := db.writeNRPTRule(db.ruleIDs[curRuleID], servers, doms); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// Refresh notifies the Windows group policy engine when policies have changed.
+func (db *nrptRuleDatabase) Refresh() {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+
+	db.refreshLocked()
+}
+
+func (db *nrptRuleDatabase) refreshLocked() {
+	if !db.isGPDirty {
+		return
+	}
+
+	// Record that we are about to initiate a refresh.
+	// (*nrptRuleDatabase).watchForGPChanges() checks this value to avoid false
+	// positives.
+	db.isGPRefreshPending.Store(true)
+
+	if err := gp.RefreshMachinePolicy(true); err != nil {
+		db.logf("RefreshMachinePolicy failed: %v", err)
+		return
+	}
+
+	db.isGPDirty = false
+}
+
+func (db *nrptRuleDatabase) writeNRPTRule(ruleID string, servers, doms []string) error {
+	subKeys := []string{nrptBaseLocal, nrptBaseGP}
+	if !db.writeAsGP {
+		// We don't want to write to the GP key, so chop nrptBaseGP off of subKeys.
+		subKeys = subKeys[:1]
+	}
+
+	for _, subKeyBase := range subKeys {
+		subKey := strings.Join([]string{subKeyBase, ruleID}, `\`)
+		key, _, err := registry.CreateKey(registry.LOCAL_MACHINE, subKey, registry.SET_VALUE)
+		if err != nil {
+			return fmt.Errorf("opening %q: %w", subKey, err)
+		}
+		defer key.Close()
+
+		if err := writeNRPTValues(key, strings.Join(servers, "; "), doms); err != nil {
+			return err
+		}
+	}
+
+	db.isGPDirty = db.writeAsGP
+	return nil
+}
+
+func readNRPTValues(key registry.Key) (servers string, doms []string, err error) {
+	doms, _, err = key.GetStringsValue(nrptRuleDomsName)
+	if err != nil {
+		return servers, doms, err
+	}
+
+	servers, _, err = key.GetStringValue(nrptRuleServersName)
+	return servers, doms, err
+}
+
+func writeNRPTValues(key registry.Key, servers string, doms []string) error {
+	if err := key.SetDWordValue(nrptRuleVersionName, 1); err != nil {
+		return err
+	}
+
+	if err := key.SetStringsValue(nrptRuleDomsName, doms); err != nil {
+		return err
+	}
+
+	if err := key.SetStringValue(nrptRuleServersName, servers); err != nil {
+		return err
+	}
+
+	return key.SetDWordValue(nrptRuleFlagsName, nrptOverrideDNS)
+}
+
+func (db *nrptRuleDatabase) watchForGPChanges() {
+	watchHandler := func() {
+		// Do not invoke detectWriteAsGP when we ourselves were responsible for
+		// initiating the group policy refresh.
+		if db.isGPRefreshPending.CompareAndSwap(true, false) {
+			return
+		}
+		db.logf("Computer group policies refreshed, reconfiguring NRPT rule database.")
+		db.detectWriteAsGP()
+	}
+
+	watcher, err := gp.NewChangeWatcher(gp.MachinePolicy, watchHandler)
+	if err != nil {
+		return
+	}
+
+	db.watcher = watcher
+}
+
+// updateGroupPoliciesLocked updates the NRPT group policy table depending on
+// the value of writeAsGP. When writeAsGP is true, each NRPT rule is copied from
+// the local NRPT table to the group policy NRPT table. When writeAsGP is false,
+// we remove any Tailscale NRPT rules from the group policy table and, if no
+// non-Tailscale rules remain, we also delete the entire DnsPolicyConfig subkey.
+// db.mu must already be locked.
+func (db *nrptRuleDatabase) updateGroupPoliciesLocked(writeAsGP bool) {
+	// Since we're updating the group policy NRPT table, we need
+	// to refresh once this updateGroupPoliciesLocked is done.
+	defer db.refreshLocked()
+
+	for _, id := range db.ruleIDs {
+		if writeAsGP {
+			if err := copyNRPTRule(id); err != nil {
+				db.logf("updateGroupPoliciesLocked: copyNRPTRule(%q) failed with error %v", id, err)
+				return
+			}
+		} else {
+			subKeyFrom := strings.Join([]string{nrptBaseGP, id}, `\`)
+			if err := registry.DeleteKey(registry.LOCAL_MACHINE, subKeyFrom); err != nil && err != registry.ErrNotExist {
+				db.logf("updateGroupPoliciesLocked: DeleteKey for rule %q failed with error %v", id, err)
+				return
+			}
+		}
+
+		db.isGPDirty = true
+	}
+
+	if writeAsGP {
+		return
+	}
+
+	// Now that we have removed our rules from group policy subkey, it should
+	// now be empty. Let's verify that.
+	isEmpty, err := isPolicyConfigSubkeyEmpty()
+	if err != nil {
+		db.logf("updateGroupPoliciesLocked: isPolicyConfigSubkeyEmpty error %v", err)
+		return
+	}
+	if !isEmpty {
+		db.logf("updateGroupPoliciesLocked: policy config subkey should be empty, but isn't!")
+		return
+	}
+
+	// Delete the subkey itself. Group policy will continue to override local
+	// settings unless we do so.
+	if err := registry.DeleteKey(registry.LOCAL_MACHINE, nrptBaseGP); err != nil {
+		db.logf("updateGroupPoliciesLocked DeleteKey error %v", err)
+	}
+
+	db.isGPDirty = true
+}
+
+func copyNRPTRule(ruleID string) error {
+	subKeyFrom := strings.Join([]string{nrptBaseLocal, ruleID}, `\`)
+	subKeyTo := strings.Join([]string{nrptBaseGP, ruleID}, `\`)
+
+	fromKey, err := registry.OpenKey(registry.LOCAL_MACHINE, subKeyFrom, registry.QUERY_VALUE)
+	if err != nil {
+		return err
+	}
+	defer fromKey.Close()
+
+	toKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, subKeyTo, registry.WRITE)
+	if err != nil {
+		return err
+	}
+	defer toKey.Close()
+
+	servers, doms, err := readNRPTValues(fromKey)
+	if err != nil {
+		return err
+	}
+
+	return writeNRPTValues(toKey, servers, doms)
+}
+
+func (db *nrptRuleDatabase) Close() error {
+	if db.watcher == nil {
+		return nil
+	}
+	err := db.watcher.Close()
+	db.watcher = nil
+	return err
+}

vendor/tailscale.com/net/dns/openresolv.go

@@ -0,0 +1,115 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux || freebsd || openbsd
+
+package dns
+
+import (
+	"bytes"
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"tailscale.com/types/logger"
+)
+
+// openresolvManager manages DNS configuration using the openresolv
+// implementation of the `resolvconf` program.
+type openresolvManager struct {
+	logf logger.Logf
+}
+
+func newOpenresolvManager(logf logger.Logf) (openresolvManager, error) {
+	return openresolvManager{logf}, nil
+}
+
+func (m openresolvManager) logCmdErr(cmd *exec.Cmd, err error) {
+	if err == nil {
+		return
+	}
+
+	commandStr := fmt.Sprintf("path=%q args=%q", cmd.Path, cmd.Args)
+	exerr, ok := err.(*exec.ExitError)
+	if !ok {
+		m.logf("error running command %s: %v", commandStr, err)
+		return
+	}
+
+	m.logf("error running command %s stderr=%q exitCode=%d: %v", commandStr, exerr.Stderr, exerr.ExitCode(), err)
+}
+
+func (m openresolvManager) deleteTailscaleConfig() error {
+	cmd := exec.Command("resolvconf", "-f", "-d", "tailscale")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		m.logCmdErr(cmd, err)
+		return fmt.Errorf("running %s: %s", cmd, out)
+	}
+	return nil
+}
+
+func (m openresolvManager) SetDNS(config OSConfig) error {
+	if config.IsZero() {
+		return m.deleteTailscaleConfig()
+	}
+
+	var stdin bytes.Buffer
+	writeResolvConf(&stdin, config.Nameservers, config.SearchDomains)
+
+	cmd := exec.Command("resolvconf", "-m", "0", "-x", "-a", "tailscale")
+	cmd.Stdin = &stdin
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		m.logCmdErr(cmd, err)
+		return fmt.Errorf("running %s: %s", cmd, out)
+	}
+	return nil
+}
+
+func (m openresolvManager) SupportsSplitDNS() bool {
+	return false
+}
+
+func (m openresolvManager) GetBaseConfig() (OSConfig, error) {
+	// List the names of all config snippets openresolv is aware
+	// of. Snippets get listed in priority order (most to least),
+	// which we'll exploit later.
+	bs, err := exec.Command("resolvconf", "-i").CombinedOutput()
+	if err != nil {
+		return OSConfig{}, err
+	}
+
+	// Remove the "tailscale" snippet from the list.
+	args := []string{"-l"}
+	for _, f := range strings.Split(strings.TrimSpace(string(bs)), " ") {
+		if f == "tailscale" {
+			continue
+		}
+		args = append(args, f)
+	}
+
+	// List all resolvconf snippets except our own, and parse that as
+	// a resolv.conf. This effectively generates a blended config of
+	// "everyone except tailscale", which is what would be in use if
+	// tailscale hadn't set exclusive mode.
+	//
+	// Note that this is not _entirely_ true. To be perfectly correct,
+	// we should be looking for other interfaces marked exclusive that
+	// predated tailscale, and stick to only those. However, in
+	// practice, openresolv uses are generally quite limited, and boil
+	// down to 1-2 DHCP leases, for which the correct outcome is a
+	// blended config like the one we produce here.
+	var buf bytes.Buffer
+	cmd := exec.Command("resolvconf", args...)
+	cmd.Stdout = &buf
+	if err := cmd.Run(); err != nil {
+		m.logCmdErr(cmd, err)
+		return OSConfig{}, err
+	}
+	return readResolv(&buf)
+}
+
+func (m openresolvManager) Close() error {
+	return m.deleteTailscaleConfig()
+}

vendor/tailscale.com/net/dns/osconfig.go

@@ -0,0 +1,196 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"net/netip"
+	"slices"
+	"strings"
+
+	"tailscale.com/types/logger"
+	"tailscale.com/util/dnsname"
+)
+
+// An OSConfigurator applies DNS settings to the operating system.
+type OSConfigurator interface {
+	// SetDNS updates the OS's DNS configuration to match cfg.
+	// If cfg is the zero value, all Tailscale-related DNS
+	// configuration is removed.
+	// SetDNS must not be called after Close.
+	// SetDNS takes ownership of cfg.
+	SetDNS(cfg OSConfig) error
+	// SupportsSplitDNS reports whether the configurator is capable of
+	// installing a resolver only for specific DNS suffixes. If false,
+	// the configurator can only set a global resolver.
+	SupportsSplitDNS() bool
+	// GetBaseConfig returns the OS's "base" configuration, i.e. the
+	// resolver settings the OS would use without Tailscale
+	// contributing any configuration.
+	// GetBaseConfig must return the tailscale-free base config even
+	// after SetDNS has been called to set a Tailscale configuration.
+	// Only works when SupportsSplitDNS=false.
+
+	// Implementations that don't support getting the base config must
+	// return ErrGetBaseConfigNotSupported.
+	GetBaseConfig() (OSConfig, error)
+	// Close removes Tailscale-related DNS configuration from the OS.
+	Close() error
+}
+
+// HostEntry represents a single line in the OS's hosts file.
+type HostEntry struct {
+	Addr  netip.Addr
+	Hosts []string
+}
+
+// OSConfig is an OS DNS configuration.
+type OSConfig struct {
+	// Hosts is a map of DNS FQDNs to their IPs, which should be added to the
+	// OS's hosts file. Currently, (2022-08-12) it is only populated for Windows
+	// in SplitDNS mode and with Smart Name Resolution turned on.
+	Hosts []*HostEntry
+	// Nameservers are the IP addresses of the nameservers to use.
+	Nameservers []netip.Addr
+	// SearchDomains are the domain suffixes to use when expanding
+	// single-label name queries. SearchDomains is additive to
+	// whatever non-Tailscale search domains the OS has.
+	SearchDomains []dnsname.FQDN
+	// MatchDomains are the DNS suffixes for which Nameservers should
+	// be used. If empty, Nameservers is installed as the "primary" resolver.
+	// A non-empty MatchDomains requests a "split DNS" configuration
+	// from the OS, which will only work with OSConfigurators that
+	// report SupportsSplitDNS()=true.
+	MatchDomains []dnsname.FQDN
+}
+
+func (o *OSConfig) WriteToBufioWriter(w *bufio.Writer) {
+	if o == nil {
+		w.WriteString("<nil>")
+		return
+	}
+	w.WriteString("{")
+	if len(o.Hosts) > 0 {
+		fmt.Fprintf(w, "Hosts:%v ", o.Hosts)
+	}
+	if len(o.Nameservers) > 0 {
+		fmt.Fprintf(w, "Nameservers:%v ", o.Nameservers)
+	}
+	if len(o.SearchDomains) > 0 {
+		fmt.Fprintf(w, "SearchDomains:%v ", o.SearchDomains)
+	}
+	if len(o.MatchDomains) > 0 {
+		w.WriteString("MatchDomains:[")
+		sp := ""
+		var numARPA int
+		for _, s := range o.MatchDomains {
+			if strings.HasSuffix(string(s), ".arpa.") {
+				numARPA++
+				continue
+			}
+			w.WriteString(sp)
+			w.WriteString(string(s))
+			sp = " "
+		}
+		w.WriteString("]")
+		if numARPA > 0 {
+			fmt.Fprintf(w, "+%darpa", numARPA)
+		}
+	}
+	w.WriteString("}")
+}
+
+func (o OSConfig) IsZero() bool {
+	return len(o.Hosts) == 0 &&
+		len(o.Nameservers) == 0 &&
+		len(o.SearchDomains) == 0 &&
+		len(o.MatchDomains) == 0
+}
+
+func (a OSConfig) Equal(b OSConfig) bool {
+	if len(a.Hosts) != len(b.Hosts) {
+		return false
+	}
+	if len(a.Nameservers) != len(b.Nameservers) {
+		return false
+	}
+	if len(a.SearchDomains) != len(b.SearchDomains) {
+		return false
+	}
+	if len(a.MatchDomains) != len(b.MatchDomains) {
+		return false
+	}
+
+	for i := range a.Hosts {
+		ha, hb := a.Hosts[i], b.Hosts[i]
+		if ha.Addr != hb.Addr {
+			return false
+		}
+		if !slices.Equal(ha.Hosts, hb.Hosts) {
+			return false
+		}
+	}
+	for i := range a.Nameservers {
+		if a.Nameservers[i] != b.Nameservers[i] {
+			return false
+		}
+	}
+	for i := range a.SearchDomains {
+		if a.SearchDomains[i] != b.SearchDomains[i] {
+			return false
+		}
+	}
+	for i := range a.MatchDomains {
+		if a.MatchDomains[i] != b.MatchDomains[i] {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Format implements the fmt.Formatter interface to ensure that Hosts is
+// printed correctly (i.e. not as a bunch of pointers).
+//
+// Fixes https://github.com/tailscale/tailscale/issues/5669
+func (a OSConfig) Format(f fmt.State, verb rune) {
+	logger.ArgWriter(func(w *bufio.Writer) {
+		w.WriteString(`{Nameservers:[`)
+		for i, ns := range a.Nameservers {
+			if i != 0 {
+				w.WriteString(" ")
+			}
+			fmt.Fprintf(w, "%+v", ns)
+		}
+		w.WriteString(`] SearchDomains:[`)
+		for i, domain := range a.SearchDomains {
+			if i != 0 {
+				w.WriteString(" ")
+			}
+			fmt.Fprintf(w, "%+v", domain)
+		}
+		w.WriteString(`] MatchDomains:[`)
+		for i, domain := range a.MatchDomains {
+			if i != 0 {
+				w.WriteString(" ")
+			}
+			fmt.Fprintf(w, "%+v", domain)
+		}
+		w.WriteString(`] Hosts:[`)
+		for i, host := range a.Hosts {
+			if i != 0 {
+				w.WriteString(" ")
+			}
+			fmt.Fprintf(w, "%+v", host)
+		}
+		w.WriteString(`]}`)
+	}).Format(f, verb)
+}
+
+// ErrGetBaseConfigNotSupported is the error
+// OSConfigurator.GetBaseConfig returns when the OSConfigurator
+// doesn't support reading the underlying configuration out of the OS.
+var ErrGetBaseConfigNotSupported = errors.New("getting OS base config is not supported")

vendor/tailscale.com/net/dns/publicdns/publicdns.go

@@ -0,0 +1,344 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package publicdns contains mapping and helpers for working with
+// public DNS providers.
+package publicdns
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/hex"
+	"fmt"
+	"log"
+	"math/big"
+	"net/netip"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+// dohOfIP maps from public DNS IPs to their DoH base URL.
+//
+// This does not include NextDNS which is handled specially.
+var dohOfIP = map[netip.Addr]string{} // 8.8.8.8 => "https://..."
+
+var dohIPsOfBase = map[string][]netip.Addr{}
+var populateOnce sync.Once
+
+const (
+	nextDNSBase  = "https://dns.nextdns.io/"
+	controlDBase = "https://dns.controld.com/"
+)
+
+// DoHEndpointFromIP returns the DNS-over-HTTPS base URL for a given IP
+// and whether it's DoH-only (not speaking DNS on port 53).
+//
+// The ok result is whether the IP is a known DNS server.
+func DoHEndpointFromIP(ip netip.Addr) (dohBase string, dohOnly bool, ok bool) {
+	populateOnce.Do(populate)
+	if b, ok := dohOfIP[ip]; ok {
+		return b, false, true
+	}
+
+	// NextDNS DoH URLs are of the form "https://dns.nextdns.io/c3a884"
+	// where the path component is the lower 12 bytes of the IPv6 address
+	// in lowercase hex without any zero padding.
+	if nextDNSv6RangeA.Contains(ip) || nextDNSv6RangeB.Contains(ip) {
+		a := ip.As16()
+		var sb strings.Builder
+		sb.Grow(len(nextDNSBase) + 12)
+		sb.WriteString(nextDNSBase)
+		for _, b := range bytes.TrimLeft(a[4:], "\x00") {
+			fmt.Fprintf(&sb, "%02x", b)
+		}
+		return sb.String(), true, true
+	}
+
+	// Control D DoH URLs are of the form "https://dns.controld.com/8yezwenugs"
+	// where the path component is represented by 8 bytes (7-14) of the IPv6 address in base36
+	if controlDv6RangeA.Contains(ip) || controlDv6RangeB.Contains(ip) {
+		path := big.NewInt(0).SetBytes(ip.AsSlice()[6:14]).Text(36)
+		return controlDBase + path, true, true
+	}
+
+	return "", false, false
+}
+
+// KnownDoHPrefixes returns the list of DoH base URLs.
+//
+// It returns a new copy each time, sorted. It's meant for tests.
+//
+// It does not include providers that have customer-specific DoH URLs like
+// NextDNS.
+func KnownDoHPrefixes() []string {
+	populateOnce.Do(populate)
+	ret := make([]string, 0, len(dohIPsOfBase))
+	for b := range dohIPsOfBase {
+		ret = append(ret, b)
+	}
+	sort.Strings(ret)
+	return ret
+}
+
+func isSlashOrQuestionMark(r rune) bool {
+	return r == '/' || r == '?'
+}
+
+// DoHIPsOfBase returns the IP addresses to use to dial the provided DoH base
+// URL.
+//
+// It is basically the inverse of DoHEndpointFromIP with the exception that for
+// NextDNS it returns IPv4 addresses that DoHEndpointFromIP doesn't map back.
+func DoHIPsOfBase(dohBase string) []netip.Addr {
+	populateOnce.Do(populate)
+	if s := dohIPsOfBase[dohBase]; len(s) > 0 {
+		return s
+	}
+	if hexStr, ok := strings.CutPrefix(dohBase, nextDNSBase); ok {
+		// The path is of the form /<profile-hex>[/<hostname>/<model>/<device id>...]
+		// or /<profile-hex>?<query params>
+		// but only the <profile-hex> is required. Ignore the rest:
+		if i := strings.IndexFunc(hexStr, isSlashOrQuestionMark); i != -1 {
+			hexStr = hexStr[:i]
+		}
+
+		// TODO(bradfitz): using the NextDNS anycast addresses works but is not
+		// ideal. Some of their regions have better latency via a non-anycast IP
+		// which we could get by first resolving A/AAAA "dns.nextdns.io" over
+		// DoH using their anycast address. For now we only use the anycast
+		// addresses. The IPv4 IPs we use are just the first one in their ranges.
+		// For IPv6 we put the profile ID in the lower bytes, but that seems just
+		// conventional for them and not required (it'll already be in the DoH path).
+		// (Really we shouldn't use either IPv4 or IPv6 anycast for DoH once we
+		// resolve "dns.nextdns.io".)
+		if b, err := hex.DecodeString(hexStr); err == nil && len(b) <= 12 && len(b) > 0 {
+			return []netip.Addr{
+				nextDNSv4One,
+				nextDNSv4Two,
+				nextDNSv6Gen(nextDNSv6RangeA.Addr(), b),
+				nextDNSv6Gen(nextDNSv6RangeB.Addr(), b),
+			}
+		}
+	}
+	if pathStr, ok := strings.CutPrefix(dohBase, controlDBase); ok {
+		if i := strings.IndexFunc(pathStr, isSlashOrQuestionMark); i != -1 {
+			pathStr = pathStr[:i]
+		}
+		return []netip.Addr{
+			controlDv4One,
+			controlDv4Two,
+			controlDv6Gen(controlDv6RangeA.Addr(), pathStr),
+			controlDv6Gen(controlDv6RangeB.Addr(), pathStr),
+		}
+	}
+	return nil
+}
+
+// DoHV6 returns the first IPv6 DNS address from a given public DNS provider
+// if found, along with a boolean indicating success.
+func DoHV6(base string) (ip netip.Addr, ok bool) {
+	populateOnce.Do(populate)
+	for _, ip := range dohIPsOfBase[base] {
+		if ip.Is6() {
+			return ip, true
+		}
+	}
+	return ip, false
+}
+
+// addDoH parses a given well-formed ip string into a netip.Addr type and
+// adds it to both knownDoH and dohIPsOFBase maps.
+func addDoH(ipStr, base string) {
+	ip := netip.MustParseAddr(ipStr)
+	dohOfIP[ip] = base
+	dohIPsOfBase[base] = append(dohIPsOfBase[base], ip)
+}
+
+const (
+	wikimediaDNSv4 = "185.71.138.138"
+	wikimediaDNSv6 = "2001:67c:930::1"
+)
+
+// populate is called once to initialize the knownDoH and dohIPsOfBase maps.
+func populate() {
+	// Cloudflare
+	// https://developers.cloudflare.com/1.1.1.1/ip-addresses/
+	addDoH("1.1.1.1", "https://cloudflare-dns.com/dns-query")
+	addDoH("1.0.0.1", "https://cloudflare-dns.com/dns-query")
+	addDoH("2606:4700:4700::1111", "https://cloudflare-dns.com/dns-query")
+	addDoH("2606:4700:4700::1001", "https://cloudflare-dns.com/dns-query")
+
+	// Cloudflare -Malware
+	addDoH("1.1.1.2", "https://security.cloudflare-dns.com/dns-query")
+	addDoH("1.0.0.2", "https://security.cloudflare-dns.com/dns-query")
+	addDoH("2606:4700:4700::1112", "https://security.cloudflare-dns.com/dns-query")
+	addDoH("2606:4700:4700::1002", "https://security.cloudflare-dns.com/dns-query")
+
+	// Cloudflare -Malware -Adult
+	addDoH("1.1.1.3", "https://family.cloudflare-dns.com/dns-query")
+	addDoH("1.0.0.3", "https://family.cloudflare-dns.com/dns-query")
+	addDoH("2606:4700:4700::1113", "https://family.cloudflare-dns.com/dns-query")
+	addDoH("2606:4700:4700::1003", "https://family.cloudflare-dns.com/dns-query")
+
+	// Google
+	addDoH("8.8.8.8", "https://dns.google/dns-query")
+	addDoH("8.8.4.4", "https://dns.google/dns-query")
+	addDoH("2001:4860:4860::8888", "https://dns.google/dns-query")
+	addDoH("2001:4860:4860::8844", "https://dns.google/dns-query")
+
+	// OpenDNS
+	// TODO(bradfitz): OpenDNS is unique amongst this current set in that
+	// its DoH DNS names resolve to different IPs than its normal DNS
+	// IPs. Support that later. For now we assume that they're the same.
+	// addDoH("208.67.222.222", "https://doh.opendns.com/dns-query")
+	// addDoH("208.67.220.220", "https://doh.opendns.com/dns-query")
+	// addDoH("208.67.222.123", "https://doh.familyshield.opendns.com/dns-query")
+	// addDoH("208.67.220.123", "https://doh.familyshield.opendns.com/dns-query")
+
+	// Quad9
+	// https://www.quad9.net/service/service-addresses-and-features
+	addDoH("9.9.9.9", "https://dns.quad9.net/dns-query")
+	addDoH("149.112.112.112", "https://dns.quad9.net/dns-query")
+	addDoH("2620:fe::fe", "https://dns.quad9.net/dns-query")
+	addDoH("2620:fe::9", "https://dns.quad9.net/dns-query")
+
+	// Quad9 +ECS +DNSSEC
+	addDoH("9.9.9.11", "https://dns11.quad9.net/dns-query")
+	addDoH("149.112.112.11", "https://dns11.quad9.net/dns-query")
+	addDoH("2620:fe::11", "https://dns11.quad9.net/dns-query")
+	addDoH("2620:fe::fe:11", "https://dns11.quad9.net/dns-query")
+
+	// Quad9 -DNSSEC
+	addDoH("9.9.9.10", "https://dns10.quad9.net/dns-query")
+	addDoH("149.112.112.10", "https://dns10.quad9.net/dns-query")
+	addDoH("2620:fe::10", "https://dns10.quad9.net/dns-query")
+	addDoH("2620:fe::fe:10", "https://dns10.quad9.net/dns-query")
+
+	// Mullvad
+	// See https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
+	// Mullvad (default)
+	addDoH("194.242.2.2", "https://dns.mullvad.net/dns-query")
+	addDoH("2a07:e340::2", "https://dns.mullvad.net/dns-query")
+	// Mullvad (adblock)
+	addDoH("194.242.2.3", "https://adblock.dns.mullvad.net/dns-query")
+	addDoH("2a07:e340::3", "https://adblock.dns.mullvad.net/dns-query")
+	// Mullvad (base)
+	addDoH("194.242.2.4", "https://base.dns.mullvad.net/dns-query")
+	addDoH("2a07:e340::4", "https://base.dns.mullvad.net/dns-query")
+	// Mullvad (extended)
+	addDoH("194.242.2.5", "https://extended.dns.mullvad.net/dns-query")
+	addDoH("2a07:e340::5", "https://extended.dns.mullvad.net/dns-query")
+	// Mullvad (family)
+	addDoH("194.242.2.6", "https://family.dns.mullvad.net/dns-query")
+	addDoH("2a07:e340::6", "https://family.dns.mullvad.net/dns-query")
+	// Mullvad (all)
+	addDoH("194.242.2.9", "https://all.dns.mullvad.net/dns-query")
+	addDoH("2a07:e340::9", "https://all.dns.mullvad.net/dns-query")
+
+	// Wikimedia
+	addDoH(wikimediaDNSv4, "https://wikimedia-dns.org/dns-query")
+	addDoH(wikimediaDNSv6, "https://wikimedia-dns.org/dns-query")
+
+	// Control D
+	addDoH("76.76.2.0", "https://freedns.controld.com/p0")
+	addDoH("76.76.10.0", "https://freedns.controld.com/p0")
+	addDoH("2606:1a40::", "https://freedns.controld.com/p0")
+	addDoH("2606:1a40:1::", "https://freedns.controld.com/p0")
+
+	// Control D -Malware
+	addDoH("76.76.2.1", "https://freedns.controld.com/p1")
+	addDoH("76.76.10.1", "https://freedns.controld.com/p1")
+	addDoH("2606:1a40::1", "https://freedns.controld.com/p1")
+	addDoH("2606:1a40:1::1", "https://freedns.controld.com/p1")
+
+	// Control D -Malware + Ads
+	addDoH("76.76.2.2", "https://freedns.controld.com/p2")
+	addDoH("76.76.10.2", "https://freedns.controld.com/p2")
+	addDoH("2606:1a40::2", "https://freedns.controld.com/p2")
+	addDoH("2606:1a40:1::2", "https://freedns.controld.com/p2")
+
+	// Control D -Malware + Ads + Social
+	addDoH("76.76.2.3", "https://freedns.controld.com/p3")
+	addDoH("76.76.10.3", "https://freedns.controld.com/p3")
+	addDoH("2606:1a40::3", "https://freedns.controld.com/p3")
+	addDoH("2606:1a40:1::3", "https://freedns.controld.com/p3")
+
+	// Control D -Malware + Ads + Adult
+	addDoH("76.76.2.4", "https://freedns.controld.com/family")
+	addDoH("76.76.10.4", "https://freedns.controld.com/family")
+	addDoH("2606:1a40::4", "https://freedns.controld.com/family")
+	addDoH("2606:1a40:1::4", "https://freedns.controld.com/family")
+}
+
+var (
+	// The NextDNS IPv6 ranges (primary and secondary). The customer ID is
+	// encoded in the lower bytes and is used (in hex form) as the DoH query
+	// path.
+	nextDNSv6RangeA = netip.MustParsePrefix("2a07:a8c0::/33")
+	nextDNSv6RangeB = netip.MustParsePrefix("2a07:a8c1::/33")
+
+	// The first two IPs in the /24 v4 ranges can be used for DoH to NextDNS.
+	//
+	// They're Anycast and usually okay, but NextDNS has some locations that
+	// don't do BGP and can get results for querying them over DoH to find the
+	// IPv4 address of "dns.mynextdns.io" and find an even better result.
+	//
+	// Note that the Tailscale DNS client does not do any of the "IP address
+	// linking" that NextDNS can do with its IPv4 addresses. These addresses
+	// are only used for DoH.
+	nextDNSv4RangeA = netip.MustParsePrefix("45.90.28.0/24")
+	nextDNSv4RangeB = netip.MustParsePrefix("45.90.30.0/24")
+	nextDNSv4One    = nextDNSv4RangeA.Addr()
+	nextDNSv4Two    = nextDNSv4RangeB.Addr()
+
+	// Wikimedia DNS server IPs (anycast)
+	wikimediaDNSv4Addr = netip.MustParseAddr(wikimediaDNSv4)
+	wikimediaDNSv6Addr = netip.MustParseAddr(wikimediaDNSv6)
+
+	// The Control D IPv6 ranges (primary and secondary). The customer ID is
+	// encoded in the ipv6 address is used (in base 36 form) as the DoH query
+	controlDv6RangeA = netip.MustParsePrefix("2606:1a40::/48")
+	controlDv6RangeB = netip.MustParsePrefix("2606:1a40:1::/48")
+	controlDv4One    = netip.MustParseAddr("76.76.2.22")
+	controlDv4Two    = netip.MustParseAddr("76.76.10.22")
+)
+
+// nextDNSv6Gen generates a NextDNS IPv6 address from the upper 8 bytes in the
+// provided ip and using id as the lowest 0-8 bytes.
+func nextDNSv6Gen(ip netip.Addr, id []byte) netip.Addr {
+	if len(id) > 12 {
+		return netip.Addr{}
+	}
+	a := ip.As16()
+	copy(a[16-len(id):], id)
+	return netip.AddrFrom16(a)
+}
+
+// controlDv6Gen generates a Control D IPv6 address from provided ip and id.
+//
+// The id is taken from the DoH query path component and represents a unique resolver configuration.
+// e.g. https://dns.controld.com/hyq3ipr2ct
+func controlDv6Gen(ip netip.Addr, id string) netip.Addr {
+	b := make([]byte, 8)
+	decoded, err := strconv.ParseUint(id, 36, 64)
+	if err != nil {
+		log.Printf("controlDv6Gen: failed to parse id %q: %v", id, err)
+	}
+	binary.BigEndian.PutUint64(b, decoded)
+	a := ip.AsSlice()
+	copy(a[6:14], b)
+	addr, _ := netip.AddrFromSlice(a)
+	return addr
+}
+
+// IPIsDoHOnlyServer reports whether ip is a DNS server that should only use
+// DNS-over-HTTPS (not regular port 53 DNS).
+func IPIsDoHOnlyServer(ip netip.Addr) bool {
+	return nextDNSv6RangeA.Contains(ip) || nextDNSv6RangeB.Contains(ip) ||
+		nextDNSv4RangeA.Contains(ip) || nextDNSv4RangeB.Contains(ip) ||
+		ip == wikimediaDNSv4Addr || ip == wikimediaDNSv6Addr ||
+		controlDv6RangeA.Contains(ip) || controlDv6RangeB.Contains(ip) ||
+		ip == controlDv4One || ip == controlDv4Two
+}

vendor/tailscale.com/net/dns/recursive/recursive.go

@@ -0,0 +1,621 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package recursive implements a simple recursive DNS resolver.
+package recursive
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/miekg/dns"
+	"tailscale.com/envknob"
+	"tailscale.com/net/netns"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/dnsname"
+	"tailscale.com/util/mak"
+	"tailscale.com/util/multierr"
+	"tailscale.com/util/slicesx"
+)
+
+const (
+	// maxDepth is how deep from the root nameservers we'll recurse when
+	// resolving; passing this limit will instead return an error.
+	//
+	// maxDepth must be at least 20 to resolve "console.aws.amazon.com",
+	// which is a domain with a moderately complicated DNS setup. The
+	// current value of 30 was chosen semi-arbitrarily to ensure that we
+	// have about 50% headroom.
+	maxDepth = 30
+	// numStartingServers is the number of root nameservers that we use as
+	// initial candidates for our recursion.
+	numStartingServers = 3
+	// udpQueryTimeout is the amount of time we wait for a UDP response
+	// from a nameserver before falling back to a TCP connection.
+	udpQueryTimeout = 5 * time.Second
+
+	// These constants aren't typed in the DNS package, so we create typed
+	// versions here to avoid having to do repeated type casts.
+	qtypeA    dns.Type = dns.Type(dns.TypeA)
+	qtypeAAAA dns.Type = dns.Type(dns.TypeAAAA)
+)
+
+var (
+	// ErrMaxDepth is returned when recursive resolving exceeds the maximum
+	// depth limit for this package.
+	ErrMaxDepth = fmt.Errorf("exceeded max depth %d when resolving", maxDepth)
+
+	// ErrAuthoritativeNoResponses is the error returned when an
+	// authoritative nameserver indicates that there are no responses to
+	// the given query.
+	ErrAuthoritativeNoResponses = errors.New("authoritative server returned no responses")
+
+	// ErrNoResponses is returned when our resolution process completes
+	// with no valid responses from any nameserver, but no authoritative
+	// server explicitly returned NXDOMAIN.
+	ErrNoResponses = errors.New("no responses to query")
+)
+
+var rootServersV4 = []netip.Addr{
+	netip.MustParseAddr("198.41.0.4"),     // a.root-servers.net
+	netip.MustParseAddr("170.247.170.2"),  // b.root-servers.net
+	netip.MustParseAddr("192.33.4.12"),    // c.root-servers.net
+	netip.MustParseAddr("199.7.91.13"),    // d.root-servers.net
+	netip.MustParseAddr("192.203.230.10"), // e.root-servers.net
+	netip.MustParseAddr("192.5.5.241"),    // f.root-servers.net
+	netip.MustParseAddr("192.112.36.4"),   // g.root-servers.net
+	netip.MustParseAddr("198.97.190.53"),  // h.root-servers.net
+	netip.MustParseAddr("192.36.148.17"),  // i.root-servers.net
+	netip.MustParseAddr("192.58.128.30"),  // j.root-servers.net
+	netip.MustParseAddr("193.0.14.129"),   // k.root-servers.net
+	netip.MustParseAddr("199.7.83.42"),    // l.root-servers.net
+	netip.MustParseAddr("202.12.27.33"),   // m.root-servers.net
+}
+
+var rootServersV6 = []netip.Addr{
+	netip.MustParseAddr("2001:503:ba3e::2:30"), // a.root-servers.net
+	netip.MustParseAddr("2801:1b8:10::b"),      // b.root-servers.net
+	netip.MustParseAddr("2001:500:2::c"),       // c.root-servers.net
+	netip.MustParseAddr("2001:500:2d::d"),      // d.root-servers.net
+	netip.MustParseAddr("2001:500:a8::e"),      // e.root-servers.net
+	netip.MustParseAddr("2001:500:2f::f"),      // f.root-servers.net
+	netip.MustParseAddr("2001:500:12::d0d"),    // g.root-servers.net
+	netip.MustParseAddr("2001:500:1::53"),      // h.root-servers.net
+	netip.MustParseAddr("2001:7fe::53"),        // i.root-servers.net
+	netip.MustParseAddr("2001:503:c27::2:30"),  // j.root-servers.net
+	netip.MustParseAddr("2001:7fd::1"),         // k.root-servers.net
+	netip.MustParseAddr("2001:500:9f::42"),     // l.root-servers.net
+	netip.MustParseAddr("2001:dc3::35"),        // m.root-servers.net
+}
+
+var debug = envknob.RegisterBool("TS_DEBUG_RECURSIVE_DNS")
+
+// Resolver is a recursive DNS resolver that is designed for looking up A and AAAA records.
+type Resolver struct {
+	// Dialer is used to create outbound connections. If nil, a zero
+	// net.Dialer will be used instead.
+	Dialer netns.Dialer
+
+	// Logf is the logging function to use; if none is specified, then logs
+	// will be dropped.
+	Logf logger.Logf
+
+	// NoIPv6, if set, will prevent this package from querying for AAAA
+	// records and will avoid contacting nameservers over IPv6.
+	NoIPv6 bool
+
+	// Test mocks
+	testQueryHook    func(name dnsname.FQDN, nameserver netip.Addr, protocol string, qtype dns.Type) (*dns.Msg, error)
+	testExchangeHook func(nameserver netip.Addr, network string, msg *dns.Msg) (*dns.Msg, error)
+	rootServers      []netip.Addr
+	timeNow          func() time.Time
+
+	// Caching
+	// NOTE(andrew): if we make resolution parallel, this needs a mutex
+	queryCache map[dnsQuery]dnsMsgWithExpiry
+
+	// Possible future additions:
+	//    - Additional nameservers? From the system maybe?
+	//    - NoIPv4 for IPv4
+	//    - DNS-over-HTTPS or DNS-over-TLS support
+}
+
+// queryState stores all state during the course of a single query
+type queryState struct {
+	// rootServers are the root nameservers to start from
+	rootServers []netip.Addr
+
+	// TODO: metrics?
+}
+
+type dnsQuery struct {
+	nameserver netip.Addr
+	name       dnsname.FQDN
+	qtype      dns.Type
+}
+
+func (q dnsQuery) String() string {
+	return fmt.Sprintf("dnsQuery{nameserver:%q,name:%q,qtype:%v}", q.nameserver.String(), q.name, q.qtype)
+}
+
+type dnsMsgWithExpiry struct {
+	*dns.Msg
+	expiresAt time.Time
+}
+
+func (r *Resolver) now() time.Time {
+	if r.timeNow != nil {
+		return r.timeNow()
+	}
+	return time.Now()
+}
+
+func (r *Resolver) logf(format string, args ...any) {
+	if r.Logf == nil {
+		return
+	}
+	r.Logf(format, args...)
+}
+
+func (r *Resolver) depthlogf(depth int, format string, args ...any) {
+	if r.Logf == nil || !debug() {
+		return
+	}
+	prefix := fmt.Sprintf("[%d] %s", depth, strings.Repeat("  ", depth))
+	r.Logf(prefix+format, args...)
+}
+
+var defaultDialer net.Dialer
+
+func (r *Resolver) dialer() netns.Dialer {
+	if r.Dialer != nil {
+		return r.Dialer
+	}
+
+	return &defaultDialer
+}
+
+func (r *Resolver) newState() *queryState {
+	var rootServers []netip.Addr
+	if len(r.rootServers) > 0 {
+		rootServers = r.rootServers
+	} else {
+		// Select a random subset of root nameservers to start from, since if
+		// we don't get responses from those, something else has probably gone
+		// horribly wrong.
+		roots4 := slices.Clone(rootServersV4)
+		slicesx.Shuffle(roots4)
+		roots4 = roots4[:numStartingServers]
+
+		var roots6 []netip.Addr
+		if !r.NoIPv6 {
+			roots6 = slices.Clone(rootServersV6)
+			slicesx.Shuffle(roots6)
+			roots6 = roots6[:numStartingServers]
+		}
+
+		// Interleave the root servers so that we try to contact them over
+		// IPv4, then IPv6, IPv4, IPv6, etc.
+		rootServers = slicesx.Interleave(roots4, roots6)
+	}
+
+	return &queryState{
+		rootServers: rootServers,
+	}
+}
+
+// Resolve will perform a recursive DNS resolution for the provided name,
+// starting at a randomly-chosen root DNS server, and return the A and AAAA
+// responses as a slice of netip.Addrs along with the minimum TTL for the
+// returned records.
+func (r *Resolver) Resolve(ctx context.Context, name string) (addrs []netip.Addr, minTTL time.Duration, err error) {
+	dnsName, err := dnsname.ToFQDN(name)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	qstate := r.newState()
+
+	r.logf("querying IPv4 addresses for: %q", name)
+	addrs4, minTTL4, err4 := r.resolveRecursiveFromRoot(ctx, qstate, 0, dnsName, qtypeA)
+
+	var (
+		addrs6  []netip.Addr
+		minTTL6 time.Duration
+		err6    error
+	)
+	if !r.NoIPv6 {
+		r.logf("querying IPv6 addresses for: %q", name)
+		addrs6, minTTL6, err6 = r.resolveRecursiveFromRoot(ctx, qstate, 0, dnsName, qtypeAAAA)
+	}
+
+	if err4 != nil && err6 != nil {
+		if err4 == err6 {
+			return nil, 0, err4
+		}
+
+		return nil, 0, multierr.New(err4, err6)
+	}
+	if err4 != nil {
+		return addrs6, minTTL6, nil
+	} else if err6 != nil {
+		return addrs4, minTTL4, nil
+	}
+
+	minTTL = minTTL4
+	if minTTL6 < minTTL {
+		minTTL = minTTL6
+	}
+
+	addrs = append(addrs4, addrs6...)
+	if len(addrs) == 0 {
+		return nil, 0, ErrNoResponses
+	}
+
+	slicesx.Shuffle(addrs)
+	return addrs, minTTL, nil
+}
+
+func (r *Resolver) resolveRecursiveFromRoot(
+	ctx context.Context,
+	qstate *queryState,
+	depth int,
+	name dnsname.FQDN, // what we're querying
+	qtype dns.Type,
+) ([]netip.Addr, time.Duration, error) {
+	r.depthlogf(depth, "resolving %q from root (type: %v)", name, qtype)
+
+	var depthError bool
+	for _, server := range qstate.rootServers {
+		addrs, minTTL, err := r.resolveRecursive(ctx, qstate, depth, name, server, qtype)
+		if err == nil {
+			return addrs, minTTL, err
+		} else if errors.Is(err, ErrAuthoritativeNoResponses) {
+			return nil, 0, ErrAuthoritativeNoResponses
+		} else if errors.Is(err, ErrMaxDepth) {
+			depthError = true
+		}
+	}
+
+	if depthError {
+		return nil, 0, ErrMaxDepth
+	}
+	return nil, 0, ErrNoResponses
+}
+
+func (r *Resolver) resolveRecursive(
+	ctx context.Context,
+	qstate *queryState,
+	depth int,
+	name dnsname.FQDN, // what we're querying
+	nameserver netip.Addr,
+	qtype dns.Type,
+) ([]netip.Addr, time.Duration, error) {
+	if depth == maxDepth {
+		r.depthlogf(depth, "not recursing past maximum depth")
+		return nil, 0, ErrMaxDepth
+	}
+
+	// Ask this nameserver for an answer.
+	resp, err := r.queryNameserver(ctx, depth, name, nameserver, qtype)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	// If we get an actual answer from the nameserver, then return it.
+	var (
+		answers []netip.Addr
+		cnames  []dnsname.FQDN
+		minTTL  = 24 * 60 * 60 // 24 hours in seconds
+	)
+	for _, answer := range resp.Answer {
+		if crec, ok := answer.(*dns.CNAME); ok {
+			cnameFQDN, err := dnsname.ToFQDN(crec.Target)
+			if err != nil {
+				r.logf("bad CNAME %q returned: %v", crec.Target, err)
+				continue
+			}
+
+			cnames = append(cnames, cnameFQDN)
+			continue
+		}
+
+		addr := addrFromRecord(answer)
+		if !addr.IsValid() {
+			r.logf("[unexpected] invalid record in %T answer", answer)
+		} else if addr.Is4() && qtype != qtypeA {
+			r.logf("[unexpected] got IPv4 answer but qtype=%v", qtype)
+		} else if addr.Is6() && qtype != qtypeAAAA {
+			r.logf("[unexpected] got IPv6 answer but qtype=%v", qtype)
+		} else {
+			answers = append(answers, addr)
+			minTTL = min(minTTL, int(answer.Header().Ttl))
+		}
+	}
+
+	if len(answers) > 0 {
+		r.depthlogf(depth, "got answers for %q: %v", name, answers)
+		return answers, time.Duration(minTTL) * time.Second, nil
+	}
+
+	r.depthlogf(depth, "no answers for %q", name)
+
+	// If we have a non-zero number of CNAMEs, then try resolving those
+	// (from the root again) and return the first one that succeeds.
+	//
+	// TODO: return the union of all responses?
+	// TODO: parallelism?
+	if len(cnames) > 0 {
+		r.depthlogf(depth, "got CNAME responses for %q: %v", name, cnames)
+	}
+	var cnameDepthError bool
+	for _, cname := range cnames {
+		answers, minTTL, err := r.resolveRecursiveFromRoot(ctx, qstate, depth+1, cname, qtype)
+		if err == nil {
+			return answers, minTTL, nil
+		} else if errors.Is(err, ErrAuthoritativeNoResponses) {
+			return nil, 0, ErrAuthoritativeNoResponses
+		} else if errors.Is(err, ErrMaxDepth) {
+			cnameDepthError = true
+		}
+	}
+
+	// If this is an authoritative response, then we know that continuing
+	// to look further is not going to result in any answers and we should
+	// bail out.
+	if resp.MsgHdr.Authoritative {
+		// If we failed to recurse into a CNAME due to a depth limit,
+		// propagate that here.
+		if cnameDepthError {
+			return nil, 0, ErrMaxDepth
+		}
+
+		r.depthlogf(depth, "got authoritative response with no answers; stopping")
+		return nil, 0, ErrAuthoritativeNoResponses
+	}
+
+	r.depthlogf(depth, "got %d NS responses and %d ADDITIONAL responses for %q", len(resp.Ns), len(resp.Extra), name)
+
+	// No CNAMEs and no answers; see if we got any AUTHORITY responses,
+	// which indicate which nameservers to query next.
+	var authorities []dnsname.FQDN
+	for _, rr := range resp.Ns {
+		ns, ok := rr.(*dns.NS)
+		if !ok {
+			continue
+		}
+
+		nsName, err := dnsname.ToFQDN(ns.Ns)
+		if err != nil {
+			r.logf("unexpected bad NS name %q: %v", ns.Ns, err)
+			continue
+		}
+
+		authorities = append(authorities, nsName)
+	}
+
+	// Also check for "glue" records, which are IP addresses provided by
+	// the DNS server for authority responses; these are required when the
+	// authority server is a subdomain of what's being resolved.
+	glueRecords := make(map[dnsname.FQDN][]netip.Addr)
+	for _, rr := range resp.Extra {
+		name, err := dnsname.ToFQDN(rr.Header().Name)
+		if err != nil {
+			r.logf("unexpected bad Name %q in Extra addr: %v", rr.Header().Name, err)
+			continue
+		}
+
+		if addr := addrFromRecord(rr); addr.IsValid() {
+			glueRecords[name] = append(glueRecords[name], addr)
+		} else {
+			r.logf("unexpected bad Extra %T addr", rr)
+		}
+	}
+
+	// Try authorities with glue records first, to minimize the number of
+	// additional DNS queries that we need to make.
+	authoritiesGlue, authoritiesNoGlue := slicesx.Partition(authorities, func(aa dnsname.FQDN) bool {
+		return len(glueRecords[aa]) > 0
+	})
+
+	authorityDepthError := false
+
+	r.depthlogf(depth, "authorities with glue records for recursion: %v", authoritiesGlue)
+	for _, authority := range authoritiesGlue {
+		for _, nameserver := range glueRecords[authority] {
+			answers, minTTL, err := r.resolveRecursive(ctx, qstate, depth+1, name, nameserver, qtype)
+			if err == nil {
+				return answers, minTTL, nil
+			} else if errors.Is(err, ErrAuthoritativeNoResponses) {
+				return nil, 0, ErrAuthoritativeNoResponses
+			} else if errors.Is(err, ErrMaxDepth) {
+				authorityDepthError = true
+			}
+		}
+	}
+
+	r.depthlogf(depth, "authorities with no glue records for recursion: %v", authoritiesNoGlue)
+	for _, authority := range authoritiesNoGlue {
+		// First, resolve the IP for the authority server from the
+		// root, querying for both IPv4 and IPv6 addresses regardless
+		// of what the current question type is.
+		//
+		// TODO: check for infinite recursion; it'll get caught by our
+		// recursion depth, but we want to bail early.
+		for _, authorityQtype := range []dns.Type{qtypeAAAA, qtypeA} {
+			answers, _, err := r.resolveRecursiveFromRoot(ctx, qstate, depth+1, authority, authorityQtype)
+			if err != nil {
+				r.depthlogf(depth, "error querying authority %q: %v", authority, err)
+				continue
+			}
+			r.depthlogf(depth, "resolved authority %q (type %v) to: %v", authority, authorityQtype, answers)
+
+			// Now, query this authority for the final address.
+			for _, nameserver := range answers {
+				answers, minTTL, err := r.resolveRecursive(ctx, qstate, depth+1, name, nameserver, qtype)
+				if err == nil {
+					return answers, minTTL, nil
+				} else if errors.Is(err, ErrAuthoritativeNoResponses) {
+					return nil, 0, ErrAuthoritativeNoResponses
+				} else if errors.Is(err, ErrMaxDepth) {
+					authorityDepthError = true
+				}
+			}
+		}
+	}
+
+	if authorityDepthError {
+		return nil, 0, ErrMaxDepth
+	}
+	return nil, 0, ErrNoResponses
+}
+
+// queryNameserver sends a query for "name" to the nameserver "nameserver" for
+// records of type "qtype", trying both UDP and TCP connections as
+// appropriate.
+func (r *Resolver) queryNameserver(
+	ctx context.Context,
+	depth int,
+	name dnsname.FQDN, // what we're querying
+	nameserver netip.Addr, // destination of query
+	qtype dns.Type,
+) (*dns.Msg, error) {
+	// TODO(andrew): we should QNAME minimisation here to avoid sending the
+	// full name to intermediate/root nameservers. See:
+	//    https://www.rfc-editor.org/rfc/rfc7816
+
+	// Handle the case where UDP is blocked by adding an explicit timeout
+	// for the UDP portion of this query.
+	udpCtx, udpCtxCancel := context.WithTimeout(ctx, udpQueryTimeout)
+	defer udpCtxCancel()
+
+	msg, err := r.queryNameserverProto(udpCtx, depth, name, nameserver, "udp", qtype)
+	if err == nil {
+		return msg, nil
+	}
+
+	msg, err2 := r.queryNameserverProto(ctx, depth, name, nameserver, "tcp", qtype)
+	if err2 == nil {
+		return msg, nil
+	}
+
+	return nil, multierr.New(err, err2)
+}
+
+// queryNameserverProto sends a query for "name" to the nameserver "nameserver"
+// for records of type "qtype" over the provided protocol (either "udp"
+// or "tcp"), and returns the DNS response or an error.
+func (r *Resolver) queryNameserverProto(
+	ctx context.Context,
+	depth int,
+	name dnsname.FQDN, // what we're querying
+	nameserver netip.Addr, // destination of query
+	protocol string,
+	qtype dns.Type,
+) (resp *dns.Msg, err error) {
+	if r.testQueryHook != nil {
+		return r.testQueryHook(name, nameserver, protocol, qtype)
+	}
+
+	now := r.now()
+	nameserverStr := nameserver.String()
+
+	cacheKey := dnsQuery{
+		nameserver: nameserver,
+		name:       name,
+		qtype:      qtype,
+	}
+	cacheEntry, ok := r.queryCache[cacheKey]
+	if ok && cacheEntry.expiresAt.Before(now) {
+		r.depthlogf(depth, "using cached response from %s about %q (type: %v)", nameserverStr, name, qtype)
+		return cacheEntry.Msg, nil
+	}
+
+	var network string
+	if nameserver.Is4() {
+		network = protocol + "4"
+	} else {
+		network = protocol + "6"
+	}
+
+	// Prepare a message asking for an appropriately-typed record
+	// for the name we're querying.
+	m := new(dns.Msg)
+	m.SetQuestion(name.WithTrailingDot(), uint16(qtype))
+
+	// Allow mocking out the network components with our exchange hook.
+	if r.testExchangeHook != nil {
+		resp, err = r.testExchangeHook(nameserver, network, m)
+	} else {
+		// Dial the current nameserver using our dialer.
+		var nconn net.Conn
+		nconn, err = r.dialer().DialContext(ctx, network, net.JoinHostPort(nameserverStr, "53"))
+		if err != nil {
+			return nil, err
+		}
+
+		var c dns.Client // TODO: share?
+		conn := &dns.Conn{
+			Conn:    nconn,
+			UDPSize: c.UDPSize,
+		}
+
+		// Send the DNS request to the current nameserver.
+		r.depthlogf(depth, "asking %s over %s about %q (type: %v)", nameserverStr, protocol, name, qtype)
+		resp, _, err = c.ExchangeWithConnContext(ctx, m, conn)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	// If the message was truncated and we're using UDP, re-run with TCP.
+	if resp.MsgHdr.Truncated && protocol == "udp" {
+		r.depthlogf(depth, "response message truncated; re-running query with TCP")
+		resp, err = r.queryNameserverProto(ctx, depth, name, nameserver, "tcp", qtype)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Find minimum expiry for all records in this message.
+	var minTTL int
+	for _, rr := range resp.Answer {
+		minTTL = min(minTTL, int(rr.Header().Ttl))
+	}
+	for _, rr := range resp.Ns {
+		minTTL = min(minTTL, int(rr.Header().Ttl))
+	}
+	for _, rr := range resp.Extra {
+		minTTL = min(minTTL, int(rr.Header().Ttl))
+	}
+
+	mak.Set(&r.queryCache, cacheKey, dnsMsgWithExpiry{
+		Msg:       resp,
+		expiresAt: now.Add(time.Duration(minTTL) * time.Second),
+	})
+	return resp, nil
+}
+
+func addrFromRecord(rr dns.RR) netip.Addr {
+	switch v := rr.(type) {
+	case *dns.A:
+		ip, ok := netip.AddrFromSlice(v.A)
+		if !ok || !ip.Is4() {
+			return netip.Addr{}
+		}
+		return ip
+	case *dns.AAAA:
+		ip, ok := netip.AddrFromSlice(v.AAAA)
+		if !ok || !ip.Is6() {
+			return netip.Addr{}
+		}
+		return ip
+	}
+	return netip.Addr{}
+}

vendor/tailscale.com/net/dns/resolvconf-workaround.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+# Copyright (c) Tailscale Inc & AUTHORS
+# SPDX-License-Identifier: BSD-3-Clause
+#
+# This script is a workaround for a vpn-unfriendly behavior of the
+# original resolvconf by Thomas Hood. Unlike the `openresolv`
+# implementation (whose binary is also called resolvconf,
+# confusingly), the original resolvconf lacks a way to specify
+# "exclusive mode" for a provider configuration. In practice, this
+# means that if Tailscale wants to install a DNS configuration, that
+# config will get "blended" with the configs from other sources,
+# rather than override those other sources.
+#
+# This script gets installed at /etc/resolvconf/update-libc.d, which
+# is a directory of hook scripts that get run after resolvconf's libc
+# helper has finished rewriting /etc/resolv.conf. It's meant to notify
+# consumers of resolv.conf of a new configuration.
+#
+# Instead, we use that hook mechanism to reach into resolvconf's
+# stuff, and rewrite the libc-generated resolv.conf to exclusively
+# contain Tailscale's configuration - effectively implementing
+# exclusive mode ourselves in post-production.
+
+set -e
+
+if [ -n "$TAILSCALE_RESOLVCONF_HOOK_LOOP" ]; then
+	# Hook script being invoked by itself, skip.
+	exit 0
+fi
+
+if [ ! -f tun-tailscale.inet ]; then
+	# Tailscale isn't trying to manage DNS, do nothing.
+	exit 0
+fi
+
+if ! grep resolvconf /etc/resolv.conf >/dev/null; then
+	# resolvconf isn't managing /etc/resolv.conf, do nothing.
+	exit 0
+fi
+
+# Write out a modified /etc/resolv.conf containing just our config.
+(
+	if [ -f /etc/resolvconf/resolv.conf.d/head ]; then
+		cat /etc/resolvconf/resolv.conf.d/head
+	fi
+	echo "# Tailscale workaround applied to set exclusive DNS configuration."
+	cat tun-tailscale.inet
+	if [ -f /etc/resolvconf/resolv.conf.d/base ]; then
+		# Keep options and sortlist, discard other base things since
+		# they're the things we're trying to override.
+		grep -e 'sortlist ' -e 'options ' /etc/resolvconf/resolv.conf.d/base || true
+	fi
+	if [ -f /etc/resolvconf/resolv.conf.d/tail ]; then
+		cat /etc/resolvconf/resolv.conf.d/tail
+	fi
+) >/etc/resolv.conf
+
+if [ -d /etc/resolvconf/update-libc.d ] ; then
+	# Re-notify libc watchers that we've changed resolv.conf again.
+	export TAILSCALE_RESOLVCONF_HOOK_LOOP=1
+	exec run-parts /etc/resolvconf/update-libc.d
+fi

vendor/tailscale.com/net/dns/resolvconf.go

@@ -0,0 +1,30 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux || freebsd || openbsd
+
+package dns
+
+import (
+	"bytes"
+	"os/exec"
+)
+
+func resolvconfStyle() string {
+	if _, err := exec.LookPath("resolvconf"); err != nil {
+		return ""
+	}
+	output, err := exec.Command("resolvconf", "--version").CombinedOutput()
+	if err != nil {
+		// Debian resolvconf doesn't understand --version, and
+		// exits with a specific error code.
+		if exitErr, ok := err.(*exec.ExitError); ok && exitErr.ExitCode() == 99 {
+			return "debian"
+		}
+	}
+	if bytes.HasPrefix(output, []byte("Debian resolvconf")) {
+		return "debian"
+	}
+	// Treat everything else as openresolv, by far the more popular implementation.
+	return "openresolv"
+}

vendor/tailscale.com/net/dns/resolvconffile/resolvconffile.go

@@ -0,0 +1,124 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package resolvconffile parses & serializes /etc/resolv.conf-style files.
+//
+// It's a leaf package so both net/dns and net/dns/resolver can depend
+// on it and we can unify a handful of implementations.
+//
+// The package is verbosely named to disambiguate it from resolvconf
+// the daemon, which Tailscale also supports.
+package resolvconffile
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"net/netip"
+	"os"
+	"strings"
+
+	"tailscale.com/util/dnsname"
+)
+
+// Path is the canonical location of resolv.conf.
+const Path = "/etc/resolv.conf"
+
+// Config represents a resolv.conf(5) file.
+type Config struct {
+	// Nameservers are the IP addresses of the nameservers to use.
+	Nameservers []netip.Addr
+
+	// SearchDomains are the domain suffixes to use when expanding
+	// single-label name queries. SearchDomains is additive to
+	// whatever non-Tailscale search domains the OS has.
+	SearchDomains []dnsname.FQDN
+}
+
+// Write writes c to w. It does so in one Write call.
+func (c *Config) Write(w io.Writer) error {
+	buf := new(bytes.Buffer)
+	io.WriteString(buf, "# resolv.conf(5) file generated by tailscale\n")
+	io.WriteString(buf, "# For more info, see https://tailscale.com/s/resolvconf-overwrite\n")
+	io.WriteString(buf, "# DO NOT EDIT THIS FILE BY HAND -- CHANGES WILL BE OVERWRITTEN\n\n")
+	for _, ns := range c.Nameservers {
+		io.WriteString(buf, "nameserver ")
+		io.WriteString(buf, ns.String())
+		io.WriteString(buf, "\n")
+	}
+	if len(c.SearchDomains) > 0 {
+		io.WriteString(buf, "search")
+		for _, domain := range c.SearchDomains {
+			io.WriteString(buf, " ")
+			io.WriteString(buf, domain.WithoutTrailingDot())
+		}
+		io.WriteString(buf, "\n")
+	}
+	_, err := w.Write(buf.Bytes())
+	return err
+}
+
+// Parse parses a resolv.conf file from r.
+func Parse(r io.Reader) (*Config, error) {
+	config := new(Config)
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		line := scanner.Text()
+		line, _, _ = strings.Cut(line, "#") // remove any comments
+		line = strings.TrimSpace(line)
+
+		if s, ok := strings.CutPrefix(line, "nameserver"); ok {
+			nameserver := strings.TrimSpace(s)
+			if len(nameserver) == len(s) {
+				return nil, fmt.Errorf("missing space after \"nameserver\" in %q", line)
+			}
+			ip, err := netip.ParseAddr(nameserver)
+			if err != nil {
+				return nil, err
+			}
+			config.Nameservers = append(config.Nameservers, ip)
+			continue
+		}
+
+		if s, ok := strings.CutPrefix(line, "search"); ok {
+			domains := strings.TrimSpace(s)
+			if len(domains) == len(s) {
+				// No leading space?!
+				return nil, fmt.Errorf("missing space after \"search\" in %q", line)
+			}
+			for len(domains) > 0 {
+				domain := domains
+				i := strings.IndexAny(domain, " \t")
+				if i != -1 {
+					domain = domain[:i]
+					domains = strings.TrimSpace(domains[i+1:])
+				} else {
+					domains = ""
+				}
+				fqdn, err := dnsname.ToFQDN(domain)
+				if err != nil {
+					return nil, fmt.Errorf("parsing search domain %q in %q: %w", domain, line, err)
+				}
+				config.SearchDomains = append(config.SearchDomains, fqdn)
+			}
+		}
+	}
+	return config, nil
+}
+
+// ParseFile parses the named resolv.conf file.
+func ParseFile(name string) (*Config, error) {
+	fi, err := os.Stat(name)
+	if err != nil {
+		return nil, err
+	}
+	if n := fi.Size(); n > 10<<10 {
+		return nil, fmt.Errorf("unexpectedly large %q file: %d bytes", name, n)
+	}
+	all, err := os.ReadFile(name)
+	if err != nil {
+		return nil, err
+	}
+	return Parse(bytes.NewReader(all))
+}

vendor/tailscale.com/net/dns/resolvconfpath_default.go

@@ -0,0 +1,11 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !gokrazy
+
+package dns
+
+const (
+	resolvConf = "/etc/resolv.conf"
+	backupConf = "/etc/resolv.pre-tailscale-backup.conf"
+)

vendor/tailscale.com/net/dns/resolvconfpath_gokrazy.go

@@ -0,0 +1,11 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build gokrazy
+
+package dns
+
+const (
+	resolvConf = "/tmp/resolv.conf"
+	backupConf = "/tmp/resolv.pre-tailscale-backup.conf"
+)

vendor/tailscale.com/net/dns/resolvd.go

@@ -0,0 +1,128 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build openbsd
+
+package dns
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"regexp"
+	"strings"
+
+	"tailscale.com/net/dns/resolvconffile"
+	"tailscale.com/types/logger"
+)
+
+func newResolvdManager(logf logger.Logf, interfaceName string) (*resolvdManager, error) {
+	return &resolvdManager{
+		logf:   logf,
+		ifName: interfaceName,
+		fs:     directFS{},
+	}, nil
+}
+
+// resolvdManager is an OSConfigurator which uses route(1) to teach OpenBSD's
+// resolvd(8) about DNS servers.
+type resolvdManager struct {
+	logf   logger.Logf
+	ifName string
+	fs     directFS
+}
+
+func (m *resolvdManager) SetDNS(config OSConfig) error {
+	args := []string{
+		"nameserver",
+		m.ifName,
+	}
+
+	origResolv, err := m.readAndCopy(resolvConf, backupConf, 0644)
+	if err != nil {
+		return err
+	}
+	newResolvConf := removeSearchLines(origResolv)
+
+	for _, ns := range config.Nameservers {
+		args = append(args, ns.String())
+	}
+
+	var newSearch = []string{
+		"search",
+	}
+	for _, s := range config.SearchDomains {
+		newSearch = append(newSearch, s.WithoutTrailingDot())
+	}
+
+	if len(newSearch) > 1 {
+		newResolvConf = append(newResolvConf, []byte(strings.Join(newSearch, " "))...)
+	}
+
+	err = m.fs.WriteFile(resolvConf, newResolvConf, 0644)
+	if err != nil {
+		return err
+	}
+
+	cmd := exec.Command("/sbin/route", args...)
+	return cmd.Run()
+}
+
+func (m *resolvdManager) SupportsSplitDNS() bool {
+	return false
+}
+
+func (m *resolvdManager) GetBaseConfig() (OSConfig, error) {
+	cfg, err := m.readResolvConf()
+	if err != nil {
+		return OSConfig{}, err
+	}
+
+	return cfg, nil
+}
+
+func (m *resolvdManager) Close() error {
+	// resolvd handles teardown of nameservers so we only need to write back the original
+	// config and be done.
+
+	_, err := m.readAndCopy(backupConf, resolvConf, 0644)
+	if err != nil {
+		return err
+	}
+
+	return m.fs.Remove(backupConf)
+}
+
+func (m *resolvdManager) readAndCopy(a, b string, mode os.FileMode) ([]byte, error) {
+	orig, err := m.fs.ReadFile(a)
+	if err != nil {
+		return nil, err
+	}
+	err = m.fs.WriteFile(b, orig, mode)
+	if err != nil {
+		return nil, err
+	}
+
+	return orig, nil
+}
+
+func (m resolvdManager) readResolvConf() (config OSConfig, err error) {
+	b, err := m.fs.ReadFile(resolvConf)
+	if err != nil {
+		return OSConfig{}, err
+	}
+
+	rconf, err := resolvconffile.Parse(bytes.NewReader(b))
+	if err != nil {
+		return config, err
+	}
+	return OSConfig{
+		Nameservers:   rconf.Nameservers,
+		SearchDomains: rconf.SearchDomains,
+	}, nil
+}
+
+func removeSearchLines(orig []byte) []byte {
+	re := regexp.MustCompile(`(?m)^search\s+.+$`)
+	return re.ReplaceAll(orig, []byte(""))
+}

vendor/tailscale.com/net/dns/resolved.go

@@ -0,0 +1,394 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux
+
+package dns
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/godbus/dbus/v5"
+	"golang.org/x/sys/unix"
+	"tailscale.com/health"
+	"tailscale.com/logtail/backoff"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/dnsname"
+)
+
+// DBus entities we talk to.
+//
+// DBus is an RPC bus. In particular, the bus we're talking to is the
+// system-wide bus (there is also a per-user session bus for
+// user-specific applications).
+//
+// Daemons connect to the bus, and advertise themselves under a
+// well-known object name. That object exposes paths, and each path
+// implements one or more interfaces that contain methods, properties,
+// and signals.
+//
+// Clients connect to the bus and walk that same hierarchy to invoke
+// RPCs, get/set properties, or listen for signals.
+const (
+	dbusResolvedObject                    = "org.freedesktop.resolve1"
+	dbusResolvedPath      dbus.ObjectPath = "/org/freedesktop/resolve1"
+	dbusResolvedInterface                 = "org.freedesktop.resolve1.Manager"
+	dbusPath              dbus.ObjectPath = "/org/freedesktop/DBus"
+	dbusInterface                         = "org.freedesktop.DBus"
+	dbusOwnerSignal                       = "NameOwnerChanged" // broadcast when a well-known name's owning process changes.
+)
+
+type resolvedLinkNameserver struct {
+	Family  int32
+	Address []byte
+}
+
+type resolvedLinkDomain struct {
+	Domain      string
+	RoutingOnly bool
+}
+
+// changeRequest tracks latest OSConfig and related error responses to update.
+type changeRequest struct {
+	config OSConfig     // configs OSConfigs, one per each SetDNS call
+	res    chan<- error // response channel
+}
+
+// resolvedManager is an OSConfigurator which uses the systemd-resolved DBus API.
+type resolvedManager struct {
+	ctx    context.Context
+	cancel func() // terminate the context, for close
+
+	logf   logger.Logf
+	health *health.Tracker
+	ifidx  int
+
+	configCR chan changeRequest // tracks OSConfigs changes and error responses
+}
+
+func newResolvedManager(logf logger.Logf, health *health.Tracker, interfaceName string) (*resolvedManager, error) {
+	iface, err := net.InterfaceByName(interfaceName)
+	if err != nil {
+		return nil, err
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	logf = logger.WithPrefix(logf, "dns: ")
+
+	mgr := &resolvedManager{
+		ctx:    ctx,
+		cancel: cancel,
+
+		logf:   logf,
+		health: health,
+		ifidx:  iface.Index,
+
+		configCR: make(chan changeRequest),
+	}
+
+	go mgr.run(ctx)
+
+	return mgr, nil
+}
+
+func (m *resolvedManager) SetDNS(config OSConfig) error {
+	// NOTE: don't close this channel, since it's possible that the SetDNS
+	// call will time out and return before the run loop answers, at which
+	// point it will send on the now-closed channel.
+	errc := make(chan error, 1)
+
+	select {
+	case <-m.ctx.Done():
+		return m.ctx.Err()
+	case m.configCR <- changeRequest{config, errc}:
+	}
+
+	select {
+	case <-m.ctx.Done():
+		return m.ctx.Err()
+	case err := <-errc:
+		if err != nil {
+			m.logf("failed to configure resolved: %v", err)
+		}
+		return err
+	}
+}
+
+func (m *resolvedManager) run(ctx context.Context) {
+	var (
+		conn     *dbus.Conn
+		signals  chan *dbus.Signal
+		rManager dbus.BusObject // rManager is the Resolved DBus connection
+	)
+	bo := backoff.NewBackoff("resolved-dbus", m.logf, 30*time.Second)
+	needsReconnect := make(chan bool, 1)
+	defer func() {
+		if conn != nil {
+			conn.Close()
+		}
+	}()
+
+	// Reconnect the systemBus if disconnected.
+	reconnect := func() error {
+		var err error
+		signals = make(chan *dbus.Signal, 16)
+		conn, err = dbus.SystemBus()
+		if err != nil {
+			m.logf("dbus connection error: %v", err)
+		} else {
+			m.logf("[v1] dbus connected")
+		}
+
+		if err != nil {
+			// Backoff increases time between reconnect attempts.
+			go func() {
+				bo.BackOff(ctx, err)
+				needsReconnect <- true
+			}()
+			return err
+		}
+
+		rManager = conn.Object(dbusResolvedObject, dbus.ObjectPath(dbusResolvedPath))
+
+		// Only receive the DBus signals we need to resync our config on
+		// resolved restart. Failure to set filters isn't a fatal error,
+		// we'll just receive all broadcast signals and have to ignore
+		// them on our end.
+		if err = conn.AddMatchSignal(dbus.WithMatchObjectPath(dbusPath), dbus.WithMatchInterface(dbusInterface), dbus.WithMatchMember(dbusOwnerSignal), dbus.WithMatchArg(0, dbusResolvedObject)); err != nil {
+			m.logf("[v1] Setting DBus signal filter failed: %v", err)
+		}
+		conn.Signal(signals)
+
+		// Reset backoff and SetNSOSHealth after successful on reconnect.
+		bo.BackOff(ctx, nil)
+		m.health.SetDNSOSHealth(nil)
+		return nil
+	}
+
+	// Create initial systemBus connection.
+	reconnect()
+
+	lastConfig := OSConfig{}
+
+	for {
+		select {
+		case <-ctx.Done():
+			if rManager == nil {
+				return
+			}
+			// RevertLink resets all per-interface settings on systemd-resolved to defaults.
+			// When ctx goes away systemd-resolved auto reverts.
+			// Keeping for potential use in future refactor.
+			if call := rManager.CallWithContext(ctx, dbusResolvedInterface+".RevertLink", 0, m.ifidx); call.Err != nil {
+				m.logf("[v1] RevertLink: %v", call.Err)
+				return
+			}
+			return
+		case configCR := <-m.configCR:
+			// Track and update sync with latest config change.
+			lastConfig = configCR.config
+
+			if rManager == nil {
+				configCR.res <- fmt.Errorf("resolved DBus does not have a connection")
+				continue
+			}
+			err := m.setConfigOverDBus(ctx, rManager, configCR.config)
+			configCR.res <- err
+		case <-needsReconnect:
+			if err := reconnect(); err != nil {
+				m.logf("[v1] SystemBus reconnect error %T", err)
+			}
+			continue
+		case signal, ok := <-signals:
+			// If signal ends and is nil then program tries to reconnect.
+			if !ok {
+				if err := reconnect(); err != nil {
+					m.logf("[v1] SystemBus reconnect error %T", err)
+				}
+				continue
+			}
+			// In theory the signal was filtered by DBus, but if
+			// AddMatchSignal in the constructor failed, we may be
+			// getting other spam.
+			if signal.Path != dbusPath || signal.Name != dbusInterface+"."+dbusOwnerSignal {
+				continue
+			}
+			if lastConfig.IsZero() {
+				continue
+			}
+			// signal.Body is a []any of 3 strings: bus name, previous owner, new owner.
+			if len(signal.Body) != 3 {
+				m.logf("[unexpected] DBus NameOwnerChanged len(Body) = %d, want 3")
+			}
+			if name, ok := signal.Body[0].(string); !ok || name != dbusResolvedObject {
+				continue
+			}
+			newOwner, ok := signal.Body[2].(string)
+			if !ok {
+				m.logf("[unexpected] DBus NameOwnerChanged.new_owner is a %T, not a string", signal.Body[2])
+			}
+			if newOwner == "" {
+				// systemd-resolved left the bus, no current owner,
+				// nothing to do.
+				continue
+			}
+			// The resolved bus name has a new owner, meaning resolved
+			// restarted. Reprogram current config.
+			m.logf("systemd-resolved restarted, syncing DNS config")
+			err := m.setConfigOverDBus(ctx, rManager, lastConfig)
+			// Set health while holding the lock, because this will
+			// graciously serialize the resync's health outcome with a
+			// concurrent SetDNS call.
+			m.health.SetDNSOSHealth(err)
+			if err != nil {
+				m.logf("failed to configure systemd-resolved: %v", err)
+			}
+		}
+	}
+}
+
+// setConfigOverDBus updates resolved DBus config and is only called from the run goroutine.
+func (m *resolvedManager) setConfigOverDBus(ctx context.Context, rManager dbus.BusObject, config OSConfig) error {
+	ctx, cancel := context.WithTimeout(ctx, reconfigTimeout)
+	defer cancel()
+
+	var linkNameservers = make([]resolvedLinkNameserver, len(config.Nameservers))
+	for i, server := range config.Nameservers {
+		ip := server.As16()
+		if server.Is4() {
+			linkNameservers[i] = resolvedLinkNameserver{
+				Family:  unix.AF_INET,
+				Address: ip[12:],
+			}
+		} else {
+			linkNameservers[i] = resolvedLinkNameserver{
+				Family:  unix.AF_INET6,
+				Address: ip[:],
+			}
+		}
+	}
+	err := rManager.CallWithContext(
+		ctx, dbusResolvedInterface+".SetLinkDNS", 0,
+		m.ifidx, linkNameservers,
+	).Store()
+	if err != nil {
+		return fmt.Errorf("setLinkDNS: %w", err)
+	}
+	linkDomains := make([]resolvedLinkDomain, 0, len(config.SearchDomains)+len(config.MatchDomains))
+	seenDomains := map[dnsname.FQDN]bool{}
+	for _, domain := range config.SearchDomains {
+		if seenDomains[domain] {
+			continue
+		}
+		seenDomains[domain] = true
+		linkDomains = append(linkDomains, resolvedLinkDomain{
+			Domain:      domain.WithTrailingDot(),
+			RoutingOnly: false,
+		})
+	}
+	for _, domain := range config.MatchDomains {
+		if seenDomains[domain] {
+			// Search domains act as both search and match in
+			// resolved, so it's correct to skip.
+			continue
+		}
+		seenDomains[domain] = true
+		linkDomains = append(linkDomains, resolvedLinkDomain{
+			Domain:      domain.WithTrailingDot(),
+			RoutingOnly: true,
+		})
+	}
+	if len(config.MatchDomains) == 0 && len(config.Nameservers) > 0 {
+		// Caller requested full DNS interception, install a
+		// routing-only root domain.
+		linkDomains = append(linkDomains, resolvedLinkDomain{
+			Domain:      ".",
+			RoutingOnly: true,
+		})
+	}
+
+	err = rManager.CallWithContext(
+		ctx, dbusResolvedInterface+".SetLinkDomains", 0,
+		m.ifidx, linkDomains,
+	).Store()
+	if err != nil && err.Error() == "Argument list too long" { // TODO: better error match
+		// Issue 3188: older systemd-resolved had argument length limits.
+		// Trim out the *.arpa. entries and try again.
+		err = rManager.CallWithContext(
+			ctx, dbusResolvedInterface+".SetLinkDomains", 0,
+			m.ifidx, linkDomainsWithoutReverseDNS(linkDomains),
+		).Store()
+	}
+	if err != nil {
+		return fmt.Errorf("setLinkDomains: %w", err)
+	}
+
+	if call := rManager.CallWithContext(ctx, dbusResolvedInterface+".SetLinkDefaultRoute", 0, m.ifidx, len(config.MatchDomains) == 0); call.Err != nil {
+		if dbusErr, ok := call.Err.(dbus.Error); ok && dbusErr.Name == dbus.ErrMsgUnknownMethod.Name {
+			// on some older systems like Kubuntu 18.04.6 with systemd 237 method SetLinkDefaultRoute is absent,
+			// but otherwise it's working good
+			m.logf("[v1] failed to set SetLinkDefaultRoute: %v", call.Err)
+		} else {
+			return fmt.Errorf("setLinkDefaultRoute: %w", call.Err)
+		}
+	}
+
+	// Some best-effort setting of things, but resolved should do the
+	// right thing if these fail (e.g. a really old resolved version
+	// or something).
+
+	// Disable LLMNR, we don't do multicast.
+	if call := rManager.CallWithContext(ctx, dbusResolvedInterface+".SetLinkLLMNR", 0, m.ifidx, "no"); call.Err != nil {
+		m.logf("[v1] failed to disable LLMNR: %v", call.Err)
+	}
+
+	// Disable mdns.
+	if call := rManager.CallWithContext(ctx, dbusResolvedInterface+".SetLinkMulticastDNS", 0, m.ifidx, "no"); call.Err != nil {
+		m.logf("[v1] failed to disable mdns: %v", call.Err)
+	}
+
+	// We don't support dnssec consistently right now, force it off to
+	// avoid partial failures when we split DNS internally.
+	if call := rManager.CallWithContext(ctx, dbusResolvedInterface+".SetLinkDNSSEC", 0, m.ifidx, "no"); call.Err != nil {
+		m.logf("[v1] failed to disable DNSSEC: %v", call.Err)
+	}
+
+	if call := rManager.CallWithContext(ctx, dbusResolvedInterface+".SetLinkDNSOverTLS", 0, m.ifidx, "no"); call.Err != nil {
+		m.logf("[v1] failed to disable DoT: %v", call.Err)
+	}
+
+	if call := rManager.CallWithContext(ctx, dbusResolvedInterface+".FlushCaches", 0); call.Err != nil {
+		m.logf("failed to flush resolved DNS cache: %v", call.Err)
+	}
+	return nil
+}
+
+func (m *resolvedManager) SupportsSplitDNS() bool {
+	return true
+}
+
+func (m *resolvedManager) GetBaseConfig() (OSConfig, error) {
+	return OSConfig{}, ErrGetBaseConfigNotSupported
+}
+
+func (m *resolvedManager) Close() error {
+	m.cancel() // stops the 'run' method goroutine
+	return nil
+}
+
+// linkDomainsWithoutReverseDNS returns a copy of v without
+// *.arpa. entries.
+func linkDomainsWithoutReverseDNS(v []resolvedLinkDomain) (ret []resolvedLinkDomain) {
+	for _, d := range v {
+		if strings.HasSuffix(d.Domain, ".arpa.") {
+			// Oh well. At least the rest will work.
+			continue
+		}
+		ret = append(ret, d)
+	}
+	return ret
+}

vendor/tailscale.com/net/dns/resolver/debug.go

@@ -0,0 +1,77 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package resolver
+
+import (
+	"fmt"
+	"html"
+	"net/http"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"tailscale.com/health"
+)
+
+func init() {
+	health.RegisterDebugHandler("dnsfwd", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		n, _ := strconv.Atoi(r.FormValue("n"))
+		if n <= 0 {
+			n = 100
+		} else if n > 10000 {
+			n = 10000
+		}
+		fl := fwdLogAtomic.Load()
+		if fl == nil || n != len(fl.ent) {
+			fl = &fwdLog{ent: make([]fwdLogEntry, n)}
+			fwdLogAtomic.Store(fl)
+		}
+		fl.ServeHTTP(w, r)
+	}))
+}
+
+var fwdLogAtomic atomic.Pointer[fwdLog]
+
+type fwdLog struct {
+	mu  sync.Mutex
+	pos int // ent[pos] is next entry
+	ent []fwdLogEntry
+}
+
+type fwdLogEntry struct {
+	Domain string
+	Time   time.Time
+}
+
+func (fl *fwdLog) addName(name string) {
+	if fl == nil {
+		return
+	}
+	fl.mu.Lock()
+	defer fl.mu.Unlock()
+	if len(fl.ent) == 0 {
+		return
+	}
+	fl.ent[fl.pos] = fwdLogEntry{Domain: name, Time: time.Now()}
+	fl.pos++
+	if fl.pos == len(fl.ent) {
+		fl.pos = 0
+	}
+}
+
+func (fl *fwdLog) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	fl.mu.Lock()
+	defer fl.mu.Unlock()
+
+	fmt.Fprintf(w, "<html><h1>DNS forwards</h1>")
+	now := time.Now()
+	for i := range len(fl.ent) {
+		ent := fl.ent[(i+fl.pos)%len(fl.ent)]
+		if ent.Domain == "" {
+			continue
+		}
+		fmt.Fprintf(w, "%v ago: %v<br>\n", now.Sub(ent.Time).Round(time.Second), html.EscapeString(ent.Domain))
+	}
+}

vendor/tailscale.com/net/dns/resolver/macios_ext.go

@@ -0,0 +1,26 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build ts_macext && (darwin || ios)
+
+package resolver
+
+import (
+	"errors"
+	"net"
+
+	"tailscale.com/net/netmon"
+	"tailscale.com/net/netns"
+)
+
+func init() {
+	initListenConfig = initListenConfigNetworkExtension
+}
+
+func initListenConfigNetworkExtension(nc *net.ListenConfig, netMon *netmon.Monitor, tunName string) error {
+	nif, ok := netMon.InterfaceState().Interface[tunName]
+	if !ok {
+		return errors.New("utun not found")
+	}
+	return netns.SetListenConfigInterfaceIndex(nc, nif.Interface.Index)
+}

vendor/tailscale.com/net/dns/utf.go

@@ -0,0 +1,55 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+// This code is only used in Windows builds, but is in an
+// OS-independent file so tests can run all the time.
+
+import (
+	"bytes"
+	"encoding/binary"
+	"unicode/utf16"
+)
+
+// maybeUnUTF16 tries to detect whether bs contains UTF-16, and if so
+// translates it to regular UTF-8.
+//
+// Some of wsl.exe's output get printed as UTF-16, which breaks a
+// bunch of things. Try to detect this by looking for a zero byte in
+// the first few bytes of output (which will appear if any of those
+// codepoints are basic ASCII - very likely). From that we can infer
+// that UTF-16 is being printed, and the byte order in use, and we
+// decode that back to UTF-8.
+//
+// https://github.com/microsoft/WSL/issues/4607
+func maybeUnUTF16(bs []byte) []byte {
+	if len(bs)%2 != 0 {
+		// Can't be complete UTF-16.
+		return bs
+	}
+	checkLen := 20
+	if len(bs) < checkLen {
+		checkLen = len(bs)
+	}
+	zeroOff := bytes.IndexByte(bs[:checkLen], 0)
+	if zeroOff == -1 {
+		return bs
+	}
+
+	// We assume wsl.exe is trying to print an ASCII codepoint,
+	// meaning the zero byte is in the upper 8 bits of the
+	// codepoint. That means we can use the zero's byte offset to
+	// work out if we're seeing little-endian or big-endian
+	// UTF-16.
+	var endian binary.ByteOrder = binary.LittleEndian
+	if zeroOff%2 == 0 {
+		endian = binary.BigEndian
+	}
+
+	var u16 []uint16
+	for i := 0; i < len(bs); i += 2 {
+		u16 = append(u16, endian.Uint16(bs[i:]))
+	}
+	return []byte(string(utf16.Decode(u16)))
+}

vendor/tailscale.com/net/dns/wsl_windows.go

@@ -0,0 +1,239 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dns
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"strings"
+	"syscall"
+	"time"
+
+	"golang.org/x/sys/windows"
+	"tailscale.com/health"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/winutil"
+)
+
+// wslDistros reports the names of the installed WSL2 linux distributions.
+func wslDistros() ([]string, error) {
+	// There is a bug in some builds of wsl.exe that causes it to block
+	// indefinitely while executing this operation. Set a timeout so that we don't
+	// get wedged! (Issue #7476)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	b, err := wslCombinedOutput(exec.CommandContext(ctx, "wsl.exe", "-l"))
+	if err != nil {
+		return nil, fmt.Errorf("%v: %q", err, string(b))
+	}
+
+	lines := strings.Split(string(b), "\n")
+	if len(lines) < 1 {
+		return nil, nil
+	}
+	lines = lines[1:] // drop "Windows Subsystem For Linux" header
+
+	var distros []string
+	for _, name := range lines {
+		name = strings.TrimSpace(name)
+		name = strings.TrimSuffix(name, " (Default)")
+		if name == "" {
+			continue
+		}
+		distros = append(distros, name)
+	}
+	return distros, nil
+}
+
+// wslManager is a DNS manager for WSL2 linux distributions.
+// It configures /etc/wsl.conf and /etc/resolv.conf.
+type wslManager struct {
+	logf   logger.Logf
+	health *health.Tracker
+}
+
+func newWSLManager(logf logger.Logf, health *health.Tracker) *wslManager {
+	m := &wslManager{
+		logf:   logf,
+		health: health,
+	}
+	return m
+}
+
+func (wm *wslManager) SetDNS(cfg OSConfig) error {
+	distros, err := wslDistros()
+	if err != nil {
+		return err
+	} else if len(distros) == 0 {
+		return nil
+	}
+	managers := make(map[string]*directManager)
+	for _, distro := range distros {
+		managers[distro] = newDirectManagerOnFS(wm.logf, wm.health, wslFS{
+			user:   "root",
+			distro: distro,
+		})
+	}
+
+	if !cfg.IsZero() {
+		if wm.setWSLConf(managers) {
+			// What's this? So glad you asked.
+			//
+			// WSL2 writes the /etc/resolv.conf.
+			// It is aggressive about it. Every time you execute wsl.exe,
+			// it writes it. (Opening a terminal is done by running wsl.exe.)
+			// You can turn this off using /etc/wsl.conf! But: this wsl.conf
+			// file is only parsed when the VM boots up. To do that, we
+			// have to shut down WSL2.
+			//
+			// So we do it here, before we call wsl.exe to write resolv.conf.
+			if b, err := wslCombinedOutput(wslCommand("--shutdown")); err != nil {
+				wm.logf("WSL SetDNS shutdown: %v: %s", err, b)
+			}
+		}
+	}
+
+	for distro, m := range managers {
+		if err := m.SetDNS(cfg); err != nil {
+			wm.logf("WSL(%q) SetDNS: %v", distro, err)
+		}
+	}
+	return nil
+}
+
+const wslConf = "/etc/wsl.conf"
+const wslConfSection = `# added by tailscale
+[network]
+generateResolvConf = false
+`
+
+// setWSLConf attempts to disable generateResolvConf in each WSL2 linux.
+// If any are changed, it reports true.
+func (wm *wslManager) setWSLConf(managers map[string]*directManager) (changed bool) {
+	for distro, m := range managers {
+		b, err := m.fs.ReadFile(wslConf)
+		if err != nil && !os.IsNotExist(err) {
+			wm.logf("WSL(%q) wsl.conf: read: %v", distro, err)
+			continue
+		}
+		ini := parseIni(string(b))
+		if v := ini["network"]["generateResolvConf"]; v == "" {
+			b = append(b, wslConfSection...)
+			if err := m.fs.WriteFile(wslConf, b, 0644); err != nil {
+				wm.logf("WSL(%q) wsl.conf: write: %v", distro, err)
+				continue
+			}
+			changed = true
+		}
+	}
+	return changed
+}
+
+func (m *wslManager) SupportsSplitDNS() bool { return false }
+func (m *wslManager) Close() error           { return m.SetDNS(OSConfig{}) }
+
+// wslFS is a pinholeFS implemented on top of wsl.exe.
+//
+// We access WSL2 file systems via wsl.exe instead of \\wsl$\ because
+// the netpath appears to operate as the standard user, not root.
+type wslFS struct {
+	user   string
+	distro string
+}
+
+func (fs wslFS) Stat(name string) (isRegular bool, err error) {
+	err = wslRun(fs.cmd("test", "-f", name))
+	if ee, _ := err.(*exec.ExitError); ee != nil {
+		if ee.ExitCode() == 1 {
+			return false, os.ErrNotExist
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (fs wslFS) Chmod(name string, perm os.FileMode) error {
+	return wslRun(fs.cmd("chmod", "--", fmt.Sprintf("%04o", perm), name))
+}
+
+func (fs wslFS) Rename(oldName, newName string) error {
+	return wslRun(fs.cmd("mv", "--", oldName, newName))
+}
+func (fs wslFS) Remove(name string) error { return wslRun(fs.cmd("rm", "--", name)) }
+
+func (fs wslFS) Truncate(name string) error { return fs.WriteFile(name, nil, 0644) }
+
+func (fs wslFS) ReadFile(name string) ([]byte, error) {
+	b, err := wslCombinedOutput(fs.cmd("cat", "--", name))
+	var ee *exec.ExitError
+	if errors.As(err, &ee) && ee.ExitCode() == 1 {
+		return nil, os.ErrNotExist
+	}
+	return b, err
+}
+
+func (fs wslFS) WriteFile(name string, contents []byte, perm os.FileMode) error {
+	cmd := fs.cmd("tee", "--", name)
+	cmd.Stdin = bytes.NewReader(contents)
+	cmd.Stdout = nil
+	if err := wslRun(cmd); err != nil {
+		return err
+	}
+	return wslRun(fs.cmd("chmod", "--", fmt.Sprintf("%04o", perm), name))
+}
+
+func (fs wslFS) cmd(args ...string) *exec.Cmd {
+	cmd := wslCommand("-u", fs.user, "-d", fs.distro, "-e")
+	cmd.Args = append(cmd.Args, args...)
+	return cmd
+}
+
+func wslCommand(args ...string) *exec.Cmd {
+	cmd := exec.Command("wsl.exe", args...)
+	return cmd
+}
+
+func wslCombinedOutput(cmd *exec.Cmd) ([]byte, error) {
+	buf := new(bytes.Buffer)
+	cmd.Stdout = buf
+	cmd.Stderr = buf
+	err := wslRun(cmd)
+	if err != nil {
+		return nil, err
+	}
+	return maybeUnUTF16(buf.Bytes()), nil
+}
+
+func wslRun(cmd *exec.Cmd) (err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("wslRun(%v): %w", cmd.Args, err)
+		}
+	}()
+
+	var token windows.Token
+	if u, err := user.Current(); err == nil && u.Name == "SYSTEM" {
+		// We need to switch user to run wsl.exe.
+		// https://github.com/microsoft/WSL/issues/4803
+		sessionID := winutil.WTSGetActiveConsoleSessionId()
+		if sessionID != 0xFFFFFFFF {
+			if err := windows.WTSQueryUserToken(sessionID, &token); err != nil {
+				return err
+			}
+			defer token.Close()
+		}
+	}
+
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		CreationFlags: windows.CREATE_NO_WINDOW,
+		Token:         syscall.Token(token),
+	}
+	return cmd.Run()
+}

vendor/tailscale.com/net/dnscache/dnscache.go

@@ -0,0 +1,693 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package dnscache contains a minimal DNS cache that makes a bunch of
+// assumptions that are only valid for us. Not recommended for general use.
+package dnscache
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"log"
+	"net"
+	"net/netip"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"tailscale.com/envknob"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/cloudenv"
+	"tailscale.com/util/singleflight"
+	"tailscale.com/util/slicesx"
+)
+
+var zaddr netip.Addr
+
+var single = &Resolver{
+	Forward: &net.Resolver{PreferGo: preferGoResolver()},
+}
+
+func preferGoResolver() bool {
+	// There does not appear to be a local resolver running
+	// on iOS, and NetworkExtension is good at isolating DNS.
+	// So do not use the Go resolver on macOS/iOS.
+	if runtime.GOOS == "darwin" || runtime.GOOS == "ios" {
+		return false
+	}
+
+	// The local resolver is not available on Android.
+	if runtime.GOOS == "android" {
+		return false
+	}
+
+	// Otherwise, the Go resolver is fine and slightly preferred
+	// since it's lighter, not using cgo calls & threads.
+	return true
+}
+
+// Get returns a caching Resolver singleton.
+func Get() *Resolver { return single }
+
+// Resolver is a minimal DNS caching resolver.
+//
+// The TTL is always fixed for now. It's not intended for general use.
+// Cache entries are never cleaned up so it's intended that this is
+// only used with a fixed set of hostnames.
+type Resolver struct {
+	// Forward is the resolver to use to populate the cache.
+	// If nil, net.DefaultResolver is used.
+	Forward *net.Resolver
+
+	// LookupIPFallback optionally provides a backup DNS mechanism
+	// to use if Forward returns an error or no results.
+	LookupIPFallback func(ctx context.Context, host string) ([]netip.Addr, error)
+
+	// TTL is how long to keep entries cached
+	//
+	// If zero, a default (currently 10 minutes) is used.
+	TTL time.Duration
+
+	// UseLastGood controls whether a cached entry older than TTL is used
+	// if a refresh fails.
+	UseLastGood bool
+
+	// SingleHostStaticResult, if non-nil, is the static result of IPs that is returned
+	// by Resolver.LookupIP for any hostname. When non-nil, SingleHost must also be
+	// set with the expected name.
+	SingleHostStaticResult []netip.Addr
+
+	// SingleHost is the hostname that SingleHostStaticResult is for.
+	// It is required when SingleHostStaticResult is present.
+	SingleHost string
+
+	// Logf optionally provides a log function to use for debug logs. If
+	// not present, log.Printf will be used. The prefix "dnscache: " will
+	// be added to all log messages printed with this logger.
+	Logf logger.Logf
+
+	sf singleflight.Group[string, ipRes]
+
+	mu      sync.Mutex
+	ipCache map[string]ipCacheEntry
+}
+
+// ipRes is the type used by the Resolver.sf singleflight group.
+type ipRes struct {
+	ip, ip6 netip.Addr
+	allIPs  []netip.Addr
+}
+
+type ipCacheEntry struct {
+	ip      netip.Addr   // either v4 or v6
+	ip6     netip.Addr   // nil if no v4 or no v6
+	allIPs  []netip.Addr // 1+ v4 and/or v6
+	expires time.Time
+}
+
+func (r *Resolver) fwd() *net.Resolver {
+	if r.Forward != nil {
+		return r.Forward
+	}
+	return net.DefaultResolver
+}
+
+// dlogf logs a debug message if debug logging is enabled either globally via
+// the TS_DEBUG_DNS_CACHE environment variable or via the per-Resolver
+// configuration.
+func (r *Resolver) dlogf(format string, args ...any) {
+	logf := r.Logf
+	if logf == nil {
+		logf = log.Printf
+	}
+
+	if debug() || debugLogging.Load() {
+		logf("dnscache: "+format, args...)
+	}
+}
+
+// cloudHostResolver returns a Resolver for the current cloud hosting environment.
+// It currently only supports Google Cloud.
+func (r *Resolver) cloudHostResolver() (v *net.Resolver, ok bool) {
+	switch runtime.GOOS {
+	case "android", "ios", "darwin":
+		return nil, false
+	}
+	ip := cloudenv.Get().ResolverIP()
+	if ip == "" {
+		return nil, false
+	}
+	return &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+			var d net.Dialer
+			return d.DialContext(ctx, network, net.JoinHostPort(ip, "53"))
+		},
+	}, true
+}
+
+func (r *Resolver) ttl() time.Duration {
+	if r.TTL > 0 {
+		return r.TTL
+	}
+	return 10 * time.Minute
+}
+
+var debug = envknob.RegisterBool("TS_DEBUG_DNS_CACHE")
+
+// debugLogging allows enabling debug logging at runtime, via
+// SetDebugLoggingEnabled.
+//
+// This is a global variable instead of a per-Resolver variable because we
+// create new Resolvers throughout the lifetime of the program (e.g. on every
+// new Direct client, etc.). When we enable debug logs, though, we want to do
+// so for every single created Resolver; we'd need to plumb a bunch of new code
+// through all of the intermediate packages to accomplish the same behaviour as
+// just using a global variable.
+var debugLogging atomic.Bool
+
+// SetDebugLoggingEnabled controls whether debug logging is enabled for this
+// package.
+//
+// These logs are also printed when the TS_DEBUG_DNS_CACHE envknob is set, but
+// we allow configuring this manually as well so that it can be changed at
+// runtime.
+func SetDebugLoggingEnabled(v bool) {
+	debugLogging.Store(v)
+}
+
+// LookupIP returns the host's primary IP address (either IPv4 or
+// IPv6, but preferring IPv4) and optionally its IPv6 address, if
+// there is both IPv4 and IPv6.
+//
+// If err is nil, ip will be non-nil. The v6 address may be nil even
+// with a nil error.
+func (r *Resolver) LookupIP(ctx context.Context, host string) (ip, v6 netip.Addr, allIPs []netip.Addr, err error) {
+	if r.SingleHostStaticResult != nil {
+		if r.SingleHost != host {
+			return zaddr, zaddr, nil, fmt.Errorf("dnscache: unexpected hostname %q doesn't match expected %q", host, r.SingleHost)
+		}
+		for _, naIP := range r.SingleHostStaticResult {
+			if !ip.IsValid() && naIP.Is4() {
+				ip = naIP
+			}
+			if !v6.IsValid() && naIP.Is6() {
+				v6 = naIP
+			}
+			allIPs = append(allIPs, naIP)
+		}
+		r.dlogf("returning %d static results", len(allIPs))
+		return
+	}
+	if ip, err := netip.ParseAddr(host); err == nil {
+		ip = ip.Unmap()
+		r.dlogf("%q is an IP", host)
+		return ip, zaddr, []netip.Addr{ip}, nil
+	}
+
+	if ip, ip6, allIPs, ok := r.lookupIPCache(host); ok {
+		r.dlogf("%q = %v (cached)", host, ip)
+		return ip, ip6, allIPs, nil
+	}
+
+	ch := r.sf.DoChanContext(ctx, host, func(ctx context.Context) (ret ipRes, _ error) {
+		ip, ip6, allIPs, err := r.lookupIP(ctx, host)
+		if err != nil {
+			return ret, err
+		}
+		return ipRes{ip, ip6, allIPs}, nil
+	})
+	select {
+	case res := <-ch:
+		if res.Err != nil {
+			if r.UseLastGood {
+				if ip, ip6, allIPs, ok := r.lookupIPCacheExpired(host); ok {
+					r.dlogf("%q using %v after error", host, ip)
+					return ip, ip6, allIPs, nil
+				}
+			}
+			r.dlogf("error resolving %q: %v", host, res.Err)
+			return zaddr, zaddr, nil, res.Err
+		}
+		r := res.Val
+		return r.ip, r.ip6, r.allIPs, nil
+	case <-ctx.Done():
+		r.dlogf("context done while resolving %q: %v", host, ctx.Err())
+		return zaddr, zaddr, nil, ctx.Err()
+	}
+}
+
+func (r *Resolver) lookupIPCache(host string) (ip, ip6 netip.Addr, allIPs []netip.Addr, ok bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if ent, ok := r.ipCache[host]; ok && ent.expires.After(time.Now()) {
+		return ent.ip, ent.ip6, ent.allIPs, true
+	}
+	return zaddr, zaddr, nil, false
+}
+
+func (r *Resolver) lookupIPCacheExpired(host string) (ip, ip6 netip.Addr, allIPs []netip.Addr, ok bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if ent, ok := r.ipCache[host]; ok {
+		return ent.ip, ent.ip6, ent.allIPs, true
+	}
+	return zaddr, zaddr, nil, false
+}
+
+func (r *Resolver) lookupTimeoutForHost(host string) time.Duration {
+	if r.UseLastGood {
+		if _, _, _, ok := r.lookupIPCacheExpired(host); ok {
+			// If we have some previous good value for this host,
+			// don't give this DNS lookup much time. If we're in a
+			// situation where the user's DNS server is unreachable
+			// (e.g. their corp DNS server is behind a subnet router
+			// that can't come up due to Tailscale needing to
+			// connect to itself), then we want to fail fast and let
+			// our caller (who set UseLastGood) fall back to using
+			// the last-known-good IP address.
+			return 3 * time.Second
+		}
+	}
+	return 10 * time.Second
+}
+
+func (r *Resolver) lookupIP(ctx context.Context, host string) (ip, ip6 netip.Addr, allIPs []netip.Addr, err error) {
+	if ip, ip6, allIPs, ok := r.lookupIPCache(host); ok {
+		r.dlogf("%q found in cache as %v", host, ip)
+		return ip, ip6, allIPs, nil
+	}
+
+	lookupCtx, lookupCancel := context.WithTimeout(ctx, r.lookupTimeoutForHost(host))
+	defer lookupCancel()
+	ips, err := r.fwd().LookupNetIP(lookupCtx, "ip", host)
+	if err != nil || len(ips) == 0 {
+		if resolver, ok := r.cloudHostResolver(); ok {
+			r.dlogf("resolving %q via cloud resolver", host)
+			ips, err = resolver.LookupNetIP(lookupCtx, "ip", host)
+		}
+	}
+	if (err != nil || len(ips) == 0) && r.LookupIPFallback != nil {
+		lookupCtx, lookupCancel := context.WithTimeout(ctx, 30*time.Second)
+		defer lookupCancel()
+		if err != nil {
+			r.dlogf("resolving %q using fallback resolver due to error", host)
+		} else {
+			r.dlogf("resolving %q using fallback resolver due to no returned IPs", host)
+		}
+		ips, err = r.LookupIPFallback(lookupCtx, host)
+	}
+	if err != nil {
+		return netip.Addr{}, netip.Addr{}, nil, err
+	}
+	if len(ips) == 0 {
+		return netip.Addr{}, netip.Addr{}, nil, fmt.Errorf("no IPs for %q found", host)
+	}
+
+	// Unmap everything; LookupNetIP can return mapped addresses (see #5698)
+	for i := range ips {
+		ips[i] = ips[i].Unmap()
+	}
+
+	have4 := false
+	for _, ipa := range ips {
+		if ipa.Is4() {
+			if !have4 {
+				ip6 = ip
+				ip = ipa
+				have4 = true
+			}
+		} else {
+			if have4 {
+				ip6 = ipa
+			} else {
+				ip = ipa
+			}
+		}
+	}
+	r.addIPCache(host, ip, ip6, ips, r.ttl())
+	return ip, ip6, ips, nil
+}
+
+func (r *Resolver) addIPCache(host string, ip, ip6 netip.Addr, allIPs []netip.Addr, d time.Duration) {
+	if ip.IsPrivate() {
+		// Don't cache obviously wrong entries from captive portals.
+		// TODO: use DoH or DoT for the forwarding resolver?
+		r.dlogf("%q resolved to private IP %v; using but not caching", host, ip)
+		return
+	}
+
+	r.dlogf("%q resolved to IP %v; caching", host, ip)
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.ipCache == nil {
+		r.ipCache = make(map[string]ipCacheEntry)
+	}
+	r.ipCache[host] = ipCacheEntry{
+		ip:      ip,
+		ip6:     ip6,
+		allIPs:  allIPs,
+		expires: time.Now().Add(d),
+	}
+}
+
+type DialContextFunc func(ctx context.Context, network, address string) (net.Conn, error)
+
+// Dialer returns a wrapped DialContext func that uses the provided dnsCache.
+func Dialer(fwd DialContextFunc, dnsCache *Resolver) DialContextFunc {
+	d := &dialer{
+		fwd:         fwd,
+		dnsCache:    dnsCache,
+		pastConnect: map[netip.Addr]time.Time{},
+	}
+	return d.DialContext
+}
+
+// dialer is the config and accumulated state for a dial func returned by Dialer.
+type dialer struct {
+	fwd      DialContextFunc
+	dnsCache *Resolver
+
+	mu          sync.Mutex
+	pastConnect map[netip.Addr]time.Time
+}
+
+func (d *dialer) DialContext(ctx context.Context, network, address string) (retConn net.Conn, ret error) {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil {
+		// Bogus. But just let the real dialer return an error rather than
+		// inventing a similar one.
+		return d.fwd(ctx, network, address)
+	}
+	dc := &dialCall{
+		d:       d,
+		network: network,
+		address: address,
+		host:    host,
+		port:    port,
+	}
+	defer func() {
+		// On failure, consider that our DNS might be wrong and ask the DNS fallback mechanism for
+		// some other IPs to try.
+		if !d.shouldTryBootstrap(ctx, ret, dc) {
+			return
+		}
+		ips, err := d.dnsCache.LookupIPFallback(ctx, host)
+		if err != nil {
+			// Return with original error
+			return
+		}
+		if c, err := dc.raceDial(ctx, ips); err == nil {
+			retConn = c
+			ret = nil
+			return
+		}
+	}()
+
+	ip, ip6, allIPs, err := d.dnsCache.LookupIP(ctx, host)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve %q: %w", host, err)
+	}
+	i4s := v4addrs(allIPs)
+	if len(i4s) < 2 {
+		d.dnsCache.dlogf("dialing %s, %s for %s", network, ip, address)
+		c, err := dc.dialOne(ctx, ip.Unmap())
+		if err == nil || ctx.Err() != nil || !ip6.IsValid() {
+			return c, err
+		}
+		// Fall back to trying IPv6.
+		return dc.dialOne(ctx, ip6)
+	}
+
+	// Multiple IPv4 candidates, and 0+ IPv6.
+	ipsToTry := append(i4s, v6addrs(allIPs)...)
+	return dc.raceDial(ctx, ipsToTry)
+}
+
+func (d *dialer) shouldTryBootstrap(ctx context.Context, err error, dc *dialCall) bool {
+	// No need to do anything when we succeeded.
+	if err == nil {
+		return false
+	}
+
+	// Can't try bootstrap DNS if we don't have a fallback function
+	if d.dnsCache.LookupIPFallback == nil {
+		d.dnsCache.dlogf("not using bootstrap DNS: no fallback")
+		return false
+	}
+
+	// We can't retry if the context is canceled, since any further
+	// operations with this context will fail.
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		d.dnsCache.dlogf("not using bootstrap DNS: context error: %v", ctxErr)
+		return false
+	}
+
+	wasTrustworthy := dc.dnsWasTrustworthy()
+	if wasTrustworthy {
+		d.dnsCache.dlogf("not using bootstrap DNS: DNS was trustworthy")
+		return false
+	}
+
+	return true
+}
+
+// dialCall is the state around a single call to dial.
+type dialCall struct {
+	d                            *dialer
+	network, address, host, port string
+
+	mu    sync.Mutex           // lock ordering: dialer.mu, then dialCall.mu
+	fails map[netip.Addr]error // set of IPs that failed to dial thus far
+}
+
+// dnsWasTrustworthy reports whether we think the IP address(es) we
+// tried (and failed) to dial were probably the correct IPs. Currently
+// the heuristic is whether they ever worked previously.
+func (dc *dialCall) dnsWasTrustworthy() bool {
+	dc.d.mu.Lock()
+	defer dc.d.mu.Unlock()
+	dc.mu.Lock()
+	defer dc.mu.Unlock()
+
+	if len(dc.fails) == 0 {
+		// No information.
+		return false
+	}
+
+	// If any of the IPs we failed to dial worked previously in
+	// this dialer, assume the DNS is fine.
+	for ip := range dc.fails {
+		if _, ok := dc.d.pastConnect[ip]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+func (dc *dialCall) dialOne(ctx context.Context, ip netip.Addr) (net.Conn, error) {
+	c, err := dc.d.fwd(ctx, dc.network, net.JoinHostPort(ip.String(), dc.port))
+	dc.noteDialResult(ip, err)
+	return c, err
+}
+
+// noteDialResult records that a dial to ip either succeeded or
+// failed.
+func (dc *dialCall) noteDialResult(ip netip.Addr, err error) {
+	if err == nil {
+		d := dc.d
+		d.mu.Lock()
+		defer d.mu.Unlock()
+		d.pastConnect[ip] = time.Now()
+		return
+	}
+	dc.mu.Lock()
+	defer dc.mu.Unlock()
+	if dc.fails == nil {
+		dc.fails = map[netip.Addr]error{}
+	}
+	dc.fails[ip] = err
+}
+
+// uniqueIPs returns a possibly-mutated subslice of ips, filtering out
+// dups and ones that have already failed previously.
+func (dc *dialCall) uniqueIPs(ips []netip.Addr) (ret []netip.Addr) {
+	dc.mu.Lock()
+	defer dc.mu.Unlock()
+	seen := map[netip.Addr]bool{}
+	ret = ips[:0]
+	for _, ip := range ips {
+		if seen[ip] {
+			continue
+		}
+		seen[ip] = true
+		if dc.fails[ip] != nil {
+			continue
+		}
+		ret = append(ret, ip)
+	}
+	return ret
+}
+
+// fallbackDelay is how long to wait between trying subsequent
+// addresses when multiple options are available.
+// 300ms is the same as Go's Happy Eyeballs fallbackDelay value.
+const fallbackDelay = 300 * time.Millisecond
+
+// raceDial tries to dial port on each ip in ips, starting a new race
+// dial every fallbackDelay apart, returning whichever completes first.
+func (dc *dialCall) raceDial(ctx context.Context, ips []netip.Addr) (net.Conn, error) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	type res struct {
+		c   net.Conn
+		err error
+	}
+	resc := make(chan res)           // must be unbuffered
+	failBoost := make(chan struct{}) // best effort send on dial failure
+
+	// Remove IPs that we tried & failed to dial previously
+	// (such as when we're being called after a dnsfallback lookup and get
+	// the same results)
+	ips = dc.uniqueIPs(ips)
+	if len(ips) == 0 {
+		return nil, errors.New("no IPs")
+	}
+
+	// Partition candidate list and then merge such that an IPv6 address is
+	// in the first spot if present, and then addresses are interleaved.
+	// This ensures that we're trying an IPv6 address first, then
+	// alternating between v4 and v6 in case one of the two networks is
+	// broken.
+	var iv4, iv6 []netip.Addr
+	for _, ip := range ips {
+		if ip.Is6() {
+			iv6 = append(iv6, ip)
+		} else {
+			iv4 = append(iv4, ip)
+		}
+	}
+	ips = slicesx.Interleave(iv6, iv4)
+
+	go func() {
+		for i, ip := range ips {
+			if i != 0 {
+				timer := time.NewTimer(fallbackDelay)
+				select {
+				case <-timer.C:
+				case <-failBoost:
+					timer.Stop()
+				case <-ctx.Done():
+					timer.Stop()
+					return
+				}
+			}
+			go func(ip netip.Addr) {
+				c, err := dc.dialOne(ctx, ip)
+				if err != nil {
+					// Best effort wake-up a pending dial.
+					// e.g. IPv4 dials failing quickly on an IPv6-only system.
+					// In that case we don't want to wait 300ms per IPv4 before
+					// we get to the IPv6 addresses.
+					select {
+					case failBoost <- struct{}{}:
+					default:
+					}
+				}
+				select {
+				case resc <- res{c, err}:
+				case <-ctx.Done():
+					if c != nil {
+						c.Close()
+					}
+				}
+			}(ip)
+		}
+	}()
+
+	var firstErr error
+	var fails int
+	for {
+		select {
+		case r := <-resc:
+			if r.c != nil {
+				return r.c, nil
+			}
+			fails++
+			if firstErr == nil {
+				firstErr = r.err
+			}
+			if fails == len(ips) {
+				return nil, firstErr
+			}
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+}
+
+func v4addrs(aa []netip.Addr) (ret []netip.Addr) {
+	for _, a := range aa {
+		a = a.Unmap()
+		if a.Is4() {
+			ret = append(ret, a)
+		}
+	}
+	return ret
+}
+
+func v6addrs(aa []netip.Addr) (ret []netip.Addr) {
+	for _, a := range aa {
+		if a.Is6() && !a.Is4In6() {
+			ret = append(ret, a)
+		}
+	}
+	return ret
+}
+
+// TLSDialer is like Dialer but returns a func suitable for using with net/http.Transport.DialTLSContext.
+// It returns a *tls.Conn type on success.
+// On TLS cert validation failure, it can invoke a backup DNS resolution strategy.
+func TLSDialer(fwd DialContextFunc, dnsCache *Resolver, tlsConfigBase *tls.Config) DialContextFunc {
+	tcpDialer := Dialer(fwd, dnsCache)
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		host, _, err := net.SplitHostPort(address)
+		if err != nil {
+			return nil, err
+		}
+		tcpConn, err := tcpDialer(ctx, network, address)
+		if err != nil {
+			return nil, err
+		}
+
+		cfg := cloneTLSConfig(tlsConfigBase)
+		if cfg.ServerName == "" {
+			cfg.ServerName = host
+		}
+		tlsConn := tls.Client(tcpConn, cfg)
+
+		handshakeCtx, handshakeTimeoutCancel := context.WithTimeout(ctx, 5*time.Second)
+		defer handshakeTimeoutCancel()
+		if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
+			tcpConn.Close()
+			// TODO: if err != errTLSHandshakeTimeout,
+			// assume it might be some captive portal or
+			// otherwise incorrect DNS and try the backup
+			// DNS mechanism.
+			return nil, err
+		}
+		return tlsConn, nil
+	}
+}
+
+func cloneTLSConfig(cfg *tls.Config) *tls.Config {
+	if cfg == nil {
+		return &tls.Config{}
+	}
+	return cfg.Clone()
+}

vendor/tailscale.com/net/dnscache/messagecache.go

@@ -0,0 +1,311 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package dnscache
+
+import (
+	"cmp"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+	"time"
+
+	"github.com/golang/groupcache/lru"
+	"golang.org/x/net/dns/dnsmessage"
+)
+
+// MessageCache is a cache that works at the DNS message layer,
+// with its cache keyed on a DNS wire-level question, and capable
+// of replying to DNS messages.
+//
+// Its zero value is ready for use with a default cache size.
+// Use SetMaxCacheSize to specify the cache size.
+//
+// It's safe for concurrent use.
+type MessageCache struct {
+	// Clock is a clock, for testing.
+	// If nil, time.Now is used.
+	Clock func() time.Time
+
+	mu           sync.Mutex
+	cacheSizeSet int       // 0 means default
+	cache        lru.Cache // msgQ => *msgCacheValue
+}
+
+func (c *MessageCache) now() time.Time {
+	if c.Clock != nil {
+		return c.Clock()
+	}
+	return time.Now()
+}
+
+// SetMaxCacheSize sets the maximum number of DNS cache entries that
+// can be stored.
+func (c *MessageCache) SetMaxCacheSize(n int) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.cacheSizeSet = n
+	c.pruneLocked()
+}
+
+// Flush clears the cache.
+func (c *MessageCache) Flush() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.cache.Clear()
+}
+
+// pruneLocked prunes down the cache size to the configured (or
+// default) max size.
+func (c *MessageCache) pruneLocked() {
+	max := cmp.Or(c.cacheSizeSet, 500)
+	for c.cache.Len() > max {
+		c.cache.RemoveOldest()
+	}
+}
+
+// msgQ is the MessageCache cache key.
+//
+// It's basically a golang.org/x/net/dns/dnsmessage#Question but the
+// Class is omitted (we only cache ClassINET) and we store a Go string
+// instead of a 256 byte dnsmessage.Name array.
+type msgQ struct {
+	Name string
+	Type dnsmessage.Type // A, AAAA, MX, etc
+}
+
+// A *msgCacheValue is the cached value for a msgQ (question) key.
+//
+// Despite using pointers for storage and methods, the value is
+// immutable once placed in the cache.
+type msgCacheValue struct {
+	Expires time.Time
+
+	// Answers are the minimum data to reconstruct a DNS response
+	// message. TTLs are added later when converting to a
+	// dnsmessage.Resource.
+	Answers []msgResource
+}
+
+type msgResource struct {
+	Name string
+	Type dnsmessage.Type // dnsmessage.UnknownResource.Type
+	Data []byte          // dnsmessage.UnknownResource.Data
+}
+
+// ErrCacheMiss is a sentinel error returned by MessageCache.ReplyFromCache
+// when the request can not be satisfied from cache.
+var ErrCacheMiss = errors.New("cache miss")
+
+var parserPool = &sync.Pool{
+	New: func() any { return new(dnsmessage.Parser) },
+}
+
+// ReplyFromCache writes a DNS reply to w for the provided DNS query message,
+// which must begin with the two ID bytes of a DNS message.
+//
+// If there's a cache miss, the message is invalid or unexpected,
+// ErrCacheMiss is returned. On cache hit, either nil or an error from
+// a w.Write call is returned.
+func (c *MessageCache) ReplyFromCache(w io.Writer, dnsQueryMessage []byte) error {
+	cacheKey, txID, ok := getDNSQueryCacheKey(dnsQueryMessage)
+	if !ok {
+		return ErrCacheMiss
+	}
+	now := c.now()
+
+	c.mu.Lock()
+	cacheEntI, _ := c.cache.Get(cacheKey)
+	v, ok := cacheEntI.(*msgCacheValue)
+	if ok && now.After(v.Expires) {
+		c.cache.Remove(cacheKey)
+		ok = false
+	}
+	c.mu.Unlock()
+
+	if !ok {
+		return ErrCacheMiss
+	}
+
+	ttl := uint32(v.Expires.Sub(now).Seconds())
+
+	packedRes, err := packDNSResponse(cacheKey, txID, ttl, v.Answers)
+	if err != nil {
+		return ErrCacheMiss
+	}
+	_, err = w.Write(packedRes)
+	return err
+}
+
+var (
+	errNotCacheable = errors.New("question not cacheable")
+)
+
+// AddCacheEntry adds a cache entry to the cache.
+// It returns an error if the entry could not be cached.
+func (c *MessageCache) AddCacheEntry(qPacket, res []byte) error {
+	cacheKey, qID, ok := getDNSQueryCacheKey(qPacket)
+	if !ok {
+		return errNotCacheable
+	}
+	now := c.now()
+	v := &msgCacheValue{}
+
+	p := parserPool.Get().(*dnsmessage.Parser)
+	defer parserPool.Put(p)
+
+	resh, err := p.Start(res)
+	if err != nil {
+		return fmt.Errorf("reading header in response: %w", err)
+	}
+	if resh.ID != qID {
+		return fmt.Errorf("response ID doesn't match query ID")
+	}
+	q, err := p.Question()
+	if err != nil {
+		return fmt.Errorf("reading 1st question in response: %w", err)
+	}
+	if _, err := p.Question(); err != dnsmessage.ErrSectionDone {
+		if err == nil {
+			return errors.New("unexpected 2nd question in response")
+		}
+		return fmt.Errorf("after reading 1st question in response: %w", err)
+	}
+	if resName := asciiLowerName(q.Name).String(); resName != cacheKey.Name {
+		return fmt.Errorf("response question name %q != question name %q", resName, cacheKey.Name)
+	}
+	for {
+		rh, err := p.AnswerHeader()
+		if err == dnsmessage.ErrSectionDone {
+			break
+		}
+		if err != nil {
+			return fmt.Errorf("reading answer: %w", err)
+		}
+		res, err := p.UnknownResource()
+		if err != nil {
+			return fmt.Errorf("reading resource: %w", err)
+		}
+		if rh.Class != dnsmessage.ClassINET {
+			continue
+		}
+
+		// Set the cache entry's expiration to the soonest
+		// we've seen. (They should all be the same, though)
+		expires := now.Add(time.Duration(rh.TTL) * time.Second)
+		if v.Expires.IsZero() || expires.Before(v.Expires) {
+			v.Expires = expires
+		}
+		v.Answers = append(v.Answers, msgResource{
+			Name: rh.Name.String(),
+			Type: rh.Type,
+			Data: res.Data, // doesn't alias; a copy from dnsmessage.unpackUnknownResource
+		})
+	}
+	c.addCacheValue(cacheKey, v)
+	return nil
+}
+
+func (c *MessageCache) addCacheValue(cacheKey msgQ, v *msgCacheValue) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.cache.Add(cacheKey, v)
+	c.pruneLocked()
+}
+
+func getDNSQueryCacheKey(msg []byte) (cacheKey msgQ, txID uint16, ok bool) {
+	p := parserPool.Get().(*dnsmessage.Parser)
+	defer parserPool.Put(p)
+	h, err := p.Start(msg)
+	const dnsHeaderSize = 12
+	if err != nil || h.OpCode != 0 || h.Response || h.Truncated ||
+		len(msg) < dnsHeaderSize { // p.Start checks this anyway, but to be explicit for slicing below
+		return cacheKey, 0, false
+	}
+	var (
+		numQ    = binary.BigEndian.Uint16(msg[4:6])
+		numAns  = binary.BigEndian.Uint16(msg[6:8])
+		numAuth = binary.BigEndian.Uint16(msg[8:10])
+		numAddn = binary.BigEndian.Uint16(msg[10:12])
+	)
+	_ = numAddn // ignore this for now; do client OSes send EDNS additional? assume so, ignore.
+	if !(numQ == 1 && numAns == 0 && numAuth == 0) {
+		// Something weird. We don't want to deal with it.
+		return cacheKey, 0, false
+	}
+	q, err := p.Question()
+	if err != nil {
+		// Already verified numQ == 1 so shouldn't happen, but:
+		return cacheKey, 0, false
+	}
+	if q.Class != dnsmessage.ClassINET {
+		// We only cache the Internet class.
+		return cacheKey, 0, false
+	}
+	return msgQ{Name: asciiLowerName(q.Name).String(), Type: q.Type}, h.ID, true
+}
+
+func asciiLowerName(n dnsmessage.Name) dnsmessage.Name {
+	nb := n.Data[:]
+	if int(n.Length) < len(n.Data) {
+		nb = nb[:n.Length]
+	}
+	for i, b := range nb {
+		if 'A' <= b && b <= 'Z' {
+			n.Data[i] += 0x20
+		}
+	}
+	return n
+}
+
+// packDNSResponse builds a DNS response for the given question and
+// transaction ID. The response resource records will have the
+// same provided TTL.
+func packDNSResponse(q msgQ, txID uint16, ttl uint32, answers []msgResource) ([]byte, error) {
+	var baseMem []byte // TODO: guess a max size based on looping over answers?
+	b := dnsmessage.NewBuilder(baseMem, dnsmessage.Header{
+		ID:            txID,
+		Response:      true,
+		OpCode:        0,
+		Authoritative: false,
+		Truncated:     false,
+		RCode:         dnsmessage.RCodeSuccess,
+	})
+	name, err := dnsmessage.NewName(q.Name)
+	if err != nil {
+		return nil, err
+	}
+	if err := b.StartQuestions(); err != nil {
+		return nil, err
+	}
+	if err := b.Question(dnsmessage.Question{
+		Name:  name,
+		Type:  q.Type,
+		Class: dnsmessage.ClassINET,
+	}); err != nil {
+		return nil, err
+	}
+	if err := b.StartAnswers(); err != nil {
+		return nil, err
+	}
+	for _, r := range answers {
+		name, err := dnsmessage.NewName(r.Name)
+		if err != nil {
+			return nil, err
+		}
+		if err := b.UnknownResource(dnsmessage.ResourceHeader{
+			Name:  name,
+			Type:  r.Type,
+			Class: dnsmessage.ClassINET,
+			TTL:   ttl,
+		}, dnsmessage.UnknownResource{
+			Type: r.Type,
+			Data: r.Data,
+		}); err != nil {
+			return nil, err
+		}
+	}
+	return b.Finish()
+}

vendor/tailscale.com/net/dnsfallback/dns-fallback-servers.json

@@ -0,0 +1,280 @@
+{
+	"Regions": {
+		"1": {
+			"RegionID": 1,
+			"RegionCode": "r1",
+			"RegionName": "r1",
+			"Nodes": [
+				{
+					"Name": "1c",
+					"RegionID": 1,
+					"HostName": "derp1c.tailscale.com",
+					"IPv4": "104.248.8.210",
+					"IPv6": "2604:a880:800:10::7a0:e001",
+					"CanPort80": true
+				},
+				{
+					"Name": "1d",
+					"RegionID": 1,
+					"HostName": "derp1d.tailscale.com",
+					"IPv4": "165.22.33.71",
+					"IPv6": "2604:a880:800:10::7fe:f001",
+					"CanPort80": true
+				},
+				{
+					"Name": "1e",
+					"RegionID": 1,
+					"HostName": "derp1e.tailscale.com",
+					"IPv4": "64.225.56.166",
+					"IPv6": "2604:a880:800:10::873:4001",
+					"CanPort80": true
+				}
+			]
+		},
+		"10": {
+			"RegionID": 10,
+			"RegionCode": "r10",
+			"RegionName": "r10",
+			"Nodes": [
+				{
+					"Name": "10a",
+					"RegionID": 10,
+					"HostName": "derp10.tailscale.com",
+					"IPv4": "137.220.36.168",
+					"IPv6": "2001:19f0:8001:2d9:5400:2ff:feef:bbb1",
+					"CanPort80": true
+				}
+			]
+		},
+		"11": {
+			"RegionID": 11,
+			"RegionCode": "r11",
+			"RegionName": "r11",
+			"Nodes": [
+				{
+					"Name": "11a",
+					"RegionID": 11,
+					"HostName": "derp11.tailscale.com",
+					"IPv4": "18.230.97.74",
+					"IPv6": "2600:1f1e:ee4:5611:ec5c:1736:d43b:a454",
+					"CanPort80": true
+				}
+			]
+		},
+		"12": {
+			"RegionID": 12,
+			"RegionCode": "r12",
+			"RegionName": "r12",
+			"Nodes": [
+				{
+					"Name": "12a",
+					"RegionID": 12,
+					"HostName": "derp12.tailscale.com",
+					"IPv4": "216.128.144.130",
+					"IPv6": "2001:19f0:5c01:289:5400:3ff:fe8d:cb5e",
+					"CanPort80": true
+				},
+				{
+					"Name": "12b",
+					"RegionID": 12,
+					"HostName": "derp12b.tailscale.com",
+					"IPv4": "45.63.71.144",
+					"IPv6": "2001:19f0:5c01:48a:5400:3ff:fe8d:cb5f",
+					"CanPort80": true
+				},
+				{
+					"Name": "12c",
+					"RegionID": 12,
+					"HostName": "derp12c.tailscale.com",
+					"IPv4": "149.28.119.105",
+					"IPv6": "2001:19f0:5c01:2cb:5400:3ff:fe8d:cb60",
+					"CanPort80": true
+				}
+			]
+		},
+		"2": {
+			"RegionID": 2,
+			"RegionCode": "r2",
+			"RegionName": "r2",
+			"Nodes": [
+				{
+					"Name": "2d",
+					"RegionID": 2,
+					"HostName": "derp2d.tailscale.com",
+					"IPv4": "192.73.252.65",
+					"IPv6": "2607:f740:0:3f::287",
+					"CanPort80": true
+				},
+				{
+					"Name": "2e",
+					"RegionID": 2,
+					"HostName": "derp2e.tailscale.com",
+					"IPv4": "192.73.252.134",
+					"IPv6": "2607:f740:0:3f::44c",
+					"CanPort80": true
+				},
+				{
+					"Name": "2f",
+					"RegionID": 2,
+					"HostName": "derp2f.tailscale.com",
+					"IPv4": "208.111.34.178",
+					"IPv6": "2607:f740:0:3f::f4",
+					"CanPort80": true
+				}
+			]
+		},
+		"3": {
+			"RegionID": 3,
+			"RegionCode": "r3",
+			"RegionName": "r3",
+			"Nodes": [
+				{
+					"Name": "3a",
+					"RegionID": 3,
+					"HostName": "derp3.tailscale.com",
+					"IPv4": "68.183.179.66",
+					"IPv6": "2400:6180:0:d1::67d:8001",
+					"CanPort80": true
+				}
+			]
+		},
+		"4": {
+			"RegionID": 4,
+			"RegionCode": "r4",
+			"RegionName": "r4",
+			"Nodes": [
+				{
+					"Name": "4c",
+					"RegionID": 4,
+					"HostName": "derp4c.tailscale.com",
+					"IPv4": "134.122.77.138",
+					"IPv6": "2a03:b0c0:3:d0::1501:6001",
+					"CanPort80": true
+				},
+				{
+					"Name": "4d",
+					"RegionID": 4,
+					"HostName": "derp4d.tailscale.com",
+					"IPv4": "134.122.94.167",
+					"IPv6": "2a03:b0c0:3:d0::1501:b001",
+					"CanPort80": true
+				},
+				{
+					"Name": "4e",
+					"RegionID": 4,
+					"HostName": "derp4e.tailscale.com",
+					"IPv4": "134.122.74.153",
+					"IPv6": "2a03:b0c0:3:d0::29:9001",
+					"CanPort80": true
+				}
+			]
+		},
+		"5": {
+			"RegionID": 5,
+			"RegionCode": "r5",
+			"RegionName": "r5",
+			"Nodes": [
+				{
+					"Name": "5a",
+					"RegionID": 5,
+					"HostName": "derp5.tailscale.com",
+					"IPv4": "103.43.75.49",
+					"IPv6": "2001:19f0:5801:10b7:5400:2ff:feaa:284c",
+					"CanPort80": true
+				}
+			]
+		},
+		"6": {
+			"RegionID": 6,
+			"RegionCode": "r6",
+			"RegionName": "r6",
+			"Nodes": [
+				{
+					"Name": "6a",
+					"RegionID": 6,
+					"HostName": "derp6.tailscale.com",
+					"IPv4": "68.183.90.120",
+					"IPv6": "2400:6180:100:d0::982:d001",
+					"CanPort80": true
+				}
+			]
+		},
+		"7": {
+			"RegionID": 7,
+			"RegionCode": "r7",
+			"RegionName": "r7",
+			"Nodes": [
+				{
+					"Name": "7a",
+					"RegionID": 7,
+					"HostName": "derp7.tailscale.com",
+					"IPv4": "167.179.89.145",
+					"IPv6": "2401:c080:1000:467f:5400:2ff:feee:22aa",
+					"CanPort80": true
+				}
+			]
+		},
+		"8": {
+			"RegionID": 8,
+			"RegionCode": "r8",
+			"RegionName": "r8",
+			"Nodes": [
+				{
+					"Name": "8b",
+					"RegionID": 8,
+					"HostName": "derp8b.tailscale.com",
+					"IPv4": "46.101.74.201",
+					"IPv6": "2a03:b0c0:1:d0::ec1:e001",
+					"CanPort80": true
+				},
+				{
+					"Name": "8c",
+					"RegionID": 8,
+					"HostName": "derp8c.tailscale.com",
+					"IPv4": "206.189.16.32",
+					"IPv6": "2a03:b0c0:1:d0::e1f:4001",
+					"CanPort80": true
+				},
+				{
+					"Name": "8d",
+					"RegionID": 8,
+					"HostName": "derp8d.tailscale.com",
+					"IPv4": "178.62.44.132",
+					"IPv6": "2a03:b0c0:1:d0::e08:e001",
+					"CanPort80": true
+				}
+			]
+		},
+		"9": {
+			"RegionID": 9,
+			"RegionCode": "r9",
+			"RegionName": "r9",
+			"Nodes": [
+				{
+					"Name": "9a",
+					"RegionID": 9,
+					"HostName": "derp9.tailscale.com",
+					"IPv4": "207.148.3.137",
+					"IPv6": "2001:19f0:6401:1d9c:5400:2ff:feef:bb82",
+					"CanPort80": true
+				},
+				{
+					"Name": "9b",
+					"RegionID": 9,
+					"HostName": "derp9b.tailscale.com",
+					"IPv4": "144.202.67.195",
+					"IPv6": "2001:19f0:6401:eb5:5400:3ff:fe8d:6d9b",
+					"CanPort80": true
+				},
+				{
+					"Name": "9c",
+					"RegionID": 9,
+					"HostName": "derp9c.tailscale.com",
+					"IPv4": "155.138.243.219",
+					"IPv6": "2001:19f0:6401:fe7:5400:3ff:fe8d:6d9c",
+					"CanPort80": true
+				}
+			]
+		}
+	}
+}

vendor/tailscale.com/net/dnsfallback/dnsfallback.go

@@ -0,0 +1,436 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package dnsfallback contains a DNS fallback mechanism
+// for starting up Tailscale when the system DNS is broken or otherwise unavailable.
+//
+// The data is backed by a JSON file `dns-fallback-servers.json` that is updated
+// by `update-dns-fallbacks.go`:
+//
+//	(cd net/dnsfallback; go run update-dns-fallbacks.go)
+package dnsfallback
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"os"
+	"reflect"
+	"slices"
+	"sync/atomic"
+	"time"
+
+	"tailscale.com/atomicfile"
+	"tailscale.com/envknob"
+	"tailscale.com/health"
+	"tailscale.com/net/dns/recursive"
+	"tailscale.com/net/netmon"
+	"tailscale.com/net/netns"
+	"tailscale.com/net/tlsdial"
+	"tailscale.com/net/tshttpproxy"
+	"tailscale.com/tailcfg"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/singleflight"
+	"tailscale.com/util/slicesx"
+)
+
+var (
+	optRecursiveResolver     = envknob.RegisterOptBool("TS_DNSFALLBACK_RECURSIVE_RESOLVER")
+	disableRecursiveResolver = envknob.RegisterBool("TS_DNSFALLBACK_DISABLE_RECURSIVE_RESOLVER") // legacy pre-1.52 env knob name
+)
+
+type resolveResult struct {
+	addrs  []netip.Addr
+	minTTL time.Duration
+}
+
+// MakeLookupFunc creates a function that can be used to resolve hostnames
+// (e.g. as a LookupIPFallback from dnscache.Resolver).
+// The netMon parameter is optional; if non-nil it's used to do faster interface lookups.
+func MakeLookupFunc(logf logger.Logf, netMon *netmon.Monitor) func(ctx context.Context, host string) ([]netip.Addr, error) {
+	fr := &fallbackResolver{
+		logf:   logf,
+		netMon: netMon,
+	}
+	return fr.Lookup
+}
+
+// fallbackResolver contains the state and configuration for a DNS resolution
+// function.
+type fallbackResolver struct {
+	logf          logger.Logf
+	netMon        *netmon.Monitor // or nil
+	healthTracker *health.Tracker // or nil
+	sf            singleflight.Group[string, resolveResult]
+
+	// for tests
+	waitForCompare bool
+}
+
+func (fr *fallbackResolver) Lookup(ctx context.Context, host string) ([]netip.Addr, error) {
+	// If they've explicitly disabled the recursive resolver with the legacy
+	// TS_DNSFALLBACK_DISABLE_RECURSIVE_RESOLVER envknob or not set the
+	// newer TS_DNSFALLBACK_RECURSIVE_RESOLVER to true, then don't use the
+	// recursive resolver. (tailscale/corp#15261) In the future, we might
+	// change the default (the opt.Bool being unset) to mean enabled.
+	if disableRecursiveResolver() || !optRecursiveResolver().EqualBool(true) {
+		return lookup(ctx, host, fr.logf, fr.healthTracker, fr.netMon)
+	}
+
+	addrsCh := make(chan []netip.Addr, 1)
+
+	// Run the recursive resolver in the background so we can
+	// compare the results. For tests, we also allow waiting for the
+	// comparison to complete; normally, we do this entirely asynchronously
+	// so as not to block the caller.
+	var done chan struct{}
+	if fr.waitForCompare {
+		done = make(chan struct{})
+		go func() {
+			defer close(done)
+			fr.compareWithRecursive(ctx, addrsCh, host)
+		}()
+	} else {
+		go fr.compareWithRecursive(ctx, addrsCh, host)
+	}
+
+	addrs, err := lookup(ctx, host, fr.logf, fr.healthTracker, fr.netMon)
+	if err != nil {
+		addrsCh <- nil
+		return nil, err
+	}
+
+	addrsCh <- slices.Clone(addrs)
+	if fr.waitForCompare {
+		select {
+		case <-done:
+		case <-ctx.Done():
+		}
+	}
+	return addrs, nil
+}
+
+// compareWithRecursive is responsible for comparing the DNS resolution
+// performed via the "normal" path (bootstrap DNS requests to the DERP servers)
+// with DNS resolution performed with our in-process recursive DNS resolver.
+//
+// It will select on addrsCh to read exactly one set of addrs (returned by the
+// "normal" path) and compare against the results returned by the recursive
+// resolver. If ctx is canceled, then it will abort.
+func (fr *fallbackResolver) compareWithRecursive(
+	ctx context.Context,
+	addrsCh <-chan []netip.Addr,
+	host string,
+) {
+	logf := logger.WithPrefix(fr.logf, "recursive: ")
+
+	// Ensure that we catch panics while we're testing this
+	// code path; this should never panic, but we don't
+	// want to take down the process by having the panic
+	// propagate to the top of the goroutine's stack and
+	// then terminate.
+	defer func() {
+		if r := recover(); r != nil {
+			logf("bootstrap DNS: recovered panic: %v", r)
+			metricRecursiveErrors.Add(1)
+		}
+	}()
+
+	// Don't resolve the same host multiple times
+	// concurrently; if we end up in a tight loop, this can
+	// take up a lot of CPU.
+	var didRun bool
+	result, err, _ := fr.sf.Do(host, func() (resolveResult, error) {
+		didRun = true
+		resolver := &recursive.Resolver{
+			Dialer: netns.NewDialer(logf, fr.netMon),
+			Logf:   logf,
+		}
+		addrs, minTTL, err := resolver.Resolve(ctx, host)
+		if err != nil {
+			logf("error using recursive resolver: %v", err)
+			metricRecursiveErrors.Add(1)
+			return resolveResult{}, err
+		}
+		return resolveResult{addrs, minTTL}, nil
+	})
+
+	// The singleflight function handled errors; return if
+	// there was one. Additionally, don't bother doing the
+	// comparison if we waited on another singleflight
+	// caller; the results are likely to be the same, so
+	// rather than spam the logs we can just exit and let
+	// the singleflight call that did execute do the
+	// comparison.
+	//
+	// Returning here is safe because the addrsCh channel
+	// is buffered, so the main function won't block even
+	// if we never read from it.
+	if err != nil || !didRun {
+		return
+	}
+
+	addrs, minTTL := result.addrs, result.minTTL
+	compareAddr := func(a, b netip.Addr) int { return a.Compare(b) }
+	slices.SortFunc(addrs, compareAddr)
+
+	// Wait for a response from the main function; try this once before we
+	// check whether the context is canceled since selects are
+	// nondeterministic.
+	var oldAddrs []netip.Addr
+	select {
+	case oldAddrs = <-addrsCh:
+		// All good; continue
+	default:
+		// Now block.
+		select {
+		case oldAddrs = <-addrsCh:
+		case <-ctx.Done():
+			return
+		}
+	}
+	slices.SortFunc(oldAddrs, compareAddr)
+
+	matches := slices.Equal(addrs, oldAddrs)
+
+	logf("bootstrap DNS comparison: matches=%v oldAddrs=%v addrs=%v minTTL=%v", matches, oldAddrs, addrs, minTTL)
+
+	if matches {
+		metricRecursiveMatches.Add(1)
+	} else {
+		metricRecursiveMismatches.Add(1)
+	}
+}
+
+func lookup(ctx context.Context, host string, logf logger.Logf, ht *health.Tracker, netMon *netmon.Monitor) ([]netip.Addr, error) {
+	if ip, err := netip.ParseAddr(host); err == nil && ip.IsValid() {
+		return []netip.Addr{ip}, nil
+	}
+
+	type nameIP struct {
+		dnsName string
+		ip      netip.Addr
+	}
+
+	dm := GetDERPMap()
+
+	var cands4, cands6 []nameIP
+	for _, dr := range dm.Regions {
+		for _, n := range dr.Nodes {
+			if ip, err := netip.ParseAddr(n.IPv4); err == nil {
+				cands4 = append(cands4, nameIP{n.HostName, ip})
+			}
+			if ip, err := netip.ParseAddr(n.IPv6); err == nil {
+				cands6 = append(cands6, nameIP{n.HostName, ip})
+			}
+		}
+	}
+	slicesx.Shuffle(cands4)
+	slicesx.Shuffle(cands6)
+
+	const maxCands = 6
+	var cands []nameIP // up to maxCands alternating v4/v6 as long as we have both
+	for (len(cands4) > 0 || len(cands6) > 0) && len(cands) < maxCands {
+		if len(cands4) > 0 {
+			cands = append(cands, cands4[0])
+			cands4 = cands4[1:]
+		}
+		if len(cands6) > 0 {
+			cands = append(cands, cands6[0])
+			cands6 = cands6[1:]
+		}
+	}
+	if len(cands) == 0 {
+		return nil, fmt.Errorf("no DNS fallback options for %q", host)
+	}
+	for _, cand := range cands {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		logf("trying bootstrapDNS(%q, %q) for %q ...", cand.dnsName, cand.ip, host)
+		ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
+		defer cancel()
+		dm, err := bootstrapDNSMap(ctx, cand.dnsName, cand.ip, host, logf, ht, netMon)
+		if err != nil {
+			logf("bootstrapDNS(%q, %q) for %q error: %v", cand.dnsName, cand.ip, host, err)
+			continue
+		}
+		if ips := dm[host]; len(ips) > 0 {
+			slicesx.Shuffle(ips)
+			logf("bootstrapDNS(%q, %q) for %q = %v", cand.dnsName, cand.ip, host, ips)
+			return ips, nil
+		}
+	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	return nil, fmt.Errorf("no DNS fallback candidates remain for %q", host)
+}
+
+// serverName and serverIP of are, say, "derpN.tailscale.com".
+// queryName is the name being sought (e.g. "controlplane.tailscale.com"), passed as hint.
+//
+// ht may be nil.
+func bootstrapDNSMap(ctx context.Context, serverName string, serverIP netip.Addr, queryName string, logf logger.Logf, ht *health.Tracker, netMon *netmon.Monitor) (dnsMap, error) {
+	dialer := netns.NewDialer(logf, netMon)
+	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr.DisableKeepAlives = true // This transport is meant to be used once.
+	tr.Proxy = tshttpproxy.ProxyFromEnvironment
+	tr.DialContext = func(ctx context.Context, netw, addr string) (net.Conn, error) {
+		return dialer.DialContext(ctx, "tcp", net.JoinHostPort(serverIP.String(), "443"))
+	}
+	tr.TLSClientConfig = tlsdial.Config(serverName, ht, tr.TLSClientConfig)
+	c := &http.Client{Transport: tr}
+	req, err := http.NewRequestWithContext(ctx, "GET", "https://"+serverName+"/bootstrap-dns?q="+url.QueryEscape(queryName), nil)
+	if err != nil {
+		return nil, err
+	}
+	dm := make(dnsMap)
+	res, err := c.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != 200 {
+		return nil, errors.New(res.Status)
+	}
+	if err := json.NewDecoder(res.Body).Decode(&dm); err != nil {
+		return nil, err
+	}
+	return dm, nil
+}
+
+// dnsMap is the JSON type returned by the DERP /bootstrap-dns handler:
+// https://derp10.tailscale.com/bootstrap-dns
+type dnsMap map[string][]netip.Addr
+
+// GetDERPMap returns a fallback DERP map that is always available, useful for basic
+// bootstrapping purposes. The dynamically updated DERP map in LocalBackend should
+// always be preferred over this. Use this DERP map only when the control plane is
+// unreachable or hasn't been reached yet. The DERP servers in the returned map also
+// run a fallback DNS server.
+func GetDERPMap() *tailcfg.DERPMap {
+	dm := getStaticDERPMap()
+
+	// Merge in any DERP servers from the cached map that aren't in the
+	// static map; this ensures that we're getting new region(s) while not
+	// overriding the built-in fallbacks if things go horribly wrong and we
+	// get a bad DERP map.
+	//
+	// TODO(andrew): should we expect OmitDefaultRegions here? We're not
+	// forwarding traffic, just resolving DNS, so maybe we can ignore that
+	// value anyway?
+	cached := cachedDERPMap.Load()
+	if cached == nil {
+		return dm
+	}
+
+	for id, region := range cached.Regions {
+		dr, ok := dm.Regions[id]
+		if !ok {
+			dm.Regions[id] = region
+			continue
+		}
+
+		// Add any nodes that we don't already have.
+		seen := make(map[string]bool)
+		for _, n := range dr.Nodes {
+			seen[n.HostName] = true
+		}
+		for _, n := range region.Nodes {
+			if !seen[n.HostName] {
+				dr.Nodes = append(dr.Nodes, n)
+			}
+		}
+	}
+
+	return dm
+}
+
+// getStaticDERPMap returns the DERP map that was compiled into this binary.
+func getStaticDERPMap() *tailcfg.DERPMap {
+	dm := new(tailcfg.DERPMap)
+	if err := json.Unmarshal(staticDERPMapJSON, dm); err != nil {
+		panic(err)
+	}
+	return dm
+}
+
+//go:embed dns-fallback-servers.json
+var staticDERPMapJSON []byte
+
+// cachedDERPMap is the path to a cached DERP map that we loaded from our on-disk cache.
+var cachedDERPMap atomic.Pointer[tailcfg.DERPMap]
+
+// cachePath is the path to the DERP map cache file, set by SetCachePath via
+// ipnserver.New() if we have a state directory.
+var cachePath string
+
+// UpdateCache stores the DERP map cache back to disk.
+//
+// The caller must not mutate 'c' after calling this function.
+func UpdateCache(c *tailcfg.DERPMap, logf logger.Logf) {
+	// Don't do anything if nothing changed.
+	curr := cachedDERPMap.Load()
+	if reflect.DeepEqual(curr, c) {
+		return
+	}
+
+	d, err := json.Marshal(c)
+	if err != nil {
+		logf("[v1] dnsfallback: UpdateCache error marshaling: %v", err)
+		return
+	}
+
+	// Only store after we're confident this is at least valid JSON
+	cachedDERPMap.Store(c)
+
+	// Don't try writing if we don't have a cache path set; this can happen
+	// when we don't have a state path (e.g. /var/lib/tailscale) configured.
+	if cachePath != "" {
+		err = atomicfile.WriteFile(cachePath, d, 0600)
+		if err != nil {
+			logf("[v1] dnsfallback: UpdateCache error writing: %v", err)
+			return
+		}
+	}
+}
+
+// SetCachePath sets the path to the on-disk DERP map cache that we store and
+// update. Additionally, if a file at this path exists, we load it and merge it
+// with the DERP map baked into the binary.
+//
+// This function should be called before any calls to UpdateCache, as it is not
+// concurrency-safe.
+func SetCachePath(path string, logf logger.Logf) {
+	cachePath = path
+
+	f, err := os.Open(path)
+	if err != nil {
+		logf("[v1] dnsfallback: SetCachePath error reading %q: %v", path, err)
+		return
+	}
+	defer f.Close()
+
+	dm := new(tailcfg.DERPMap)
+	if err := json.NewDecoder(f).Decode(dm); err != nil {
+		logf("[v1] dnsfallback: SetCachePath error decoding %q: %v", path, err)
+		return
+	}
+
+	cachedDERPMap.Store(dm)
+	logf("[v2] dnsfallback: SetCachePath loaded cached DERP map")
+}
+
+var (
+	metricRecursiveMatches    = clientmetric.NewCounter("dnsfallback_recursive_matches")
+	metricRecursiveMismatches = clientmetric.NewCounter("dnsfallback_recursive_mismatches")
+	metricRecursiveErrors     = clientmetric.NewCounter("dnsfallback_recursive_errors")
+)

vendor/tailscale.com/net/flowtrack/flowtrack.go

@@ -0,0 +1,165 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+//
+// Original implementation (from same author) from which this was derived was:
+// https://github.com/golang/groupcache/blob/5b532d6fd5efaf7fa130d4e859a2fde0fc3a9e1b/lru/lru.go
+// ... which was Apache licensed:
+// https://github.com/golang/groupcache/blob/master/LICENSE
+
+// Package flowtrack contains types for tracking TCP/UDP flows by 4-tuples.
+package flowtrack
+
+import (
+	"container/list"
+	"encoding/json"
+	"fmt"
+	"net/netip"
+
+	"tailscale.com/types/ipproto"
+)
+
+// MakeTuple makes a Tuple out of netip.AddrPort values.
+func MakeTuple(proto ipproto.Proto, src, dst netip.AddrPort) Tuple {
+	return Tuple{
+		proto:   proto,
+		src:     src.Addr().As16(),
+		srcPort: src.Port(),
+		dst:     dst.Addr().As16(),
+		dstPort: dst.Port(),
+	}
+}
+
+// Tuple is a 5-tuple of proto, source and destination IP and port.
+//
+// This struct originally used netip.AddrPort, but that was about twice as slow
+// when used as a map key due to the alignment and extra space for the IPv6 zone
+// pointers (unneeded for all our current 2024-06-17 flowtrack needs).
+//
+// This struct is packed optimally and doesn't contain gaps or pointers.
+type Tuple struct {
+	src     [16]byte
+	dst     [16]byte
+	srcPort uint16
+	dstPort uint16
+	proto   ipproto.Proto
+}
+
+func (t Tuple) SrcAddr() netip.Addr {
+	return netip.AddrFrom16(t.src).Unmap()
+}
+
+func (t Tuple) DstAddr() netip.Addr {
+	return netip.AddrFrom16(t.dst).Unmap()
+}
+
+func (t Tuple) SrcPort() uint16 { return t.srcPort }
+func (t Tuple) DstPort() uint16 { return t.dstPort }
+
+func (t Tuple) String() string {
+	return fmt.Sprintf("(%v %v => %v)", t.proto,
+		netip.AddrPortFrom(t.SrcAddr(), t.srcPort),
+		netip.AddrPortFrom(t.DstAddr(), t.dstPort))
+}
+
+func (t Tuple) MarshalJSON() ([]byte, error) {
+	return json.Marshal(tupleOld{
+		Proto: t.proto,
+		Src:   netip.AddrPortFrom(t.SrcAddr(), t.srcPort),
+		Dst:   netip.AddrPortFrom(t.DstAddr(), t.dstPort),
+	})
+}
+
+func (t *Tuple) UnmarshalJSON(b []byte) error {
+	var ot tupleOld
+	if err := json.Unmarshal(b, &ot); err != nil {
+		return err
+	}
+	*t = MakeTuple(ot.Proto, ot.Src, ot.Dst)
+	return nil
+}
+
+// tupleOld is the old JSON representation of Tuple, before
+// we split and rearranged the fields for efficiency. This type
+// is the JSON adapter type to make sure we still generate
+// the same JSON as before.
+type tupleOld struct {
+	Proto ipproto.Proto  `json:"proto"`
+	Src   netip.AddrPort `json:"src"`
+	Dst   netip.AddrPort `json:"dst"`
+}
+
+// Cache is an LRU cache keyed by Tuple.
+//
+// The zero value is valid to use.
+//
+// It is not safe for concurrent access.
+type Cache[Value any] struct {
+	// MaxEntries is the maximum number of cache entries before
+	// an item is evicted. Zero means no limit.
+	MaxEntries int
+
+	ll *list.List
+	m  map[Tuple]*list.Element // of *entry
+}
+
+// entry is the container/list element type.
+type entry[Value any] struct {
+	key   Tuple
+	value Value
+}
+
+// Add adds a value to the cache, set or updating its associated
+// value.
+//
+// If MaxEntries is non-zero and the length of the cache is greater
+// after any addition, the least recently used value is evicted.
+func (c *Cache[Value]) Add(key Tuple, value Value) {
+	if c.m == nil {
+		c.m = make(map[Tuple]*list.Element)
+		c.ll = list.New()
+	}
+	if ee, ok := c.m[key]; ok {
+		c.ll.MoveToFront(ee)
+		ee.Value.(*entry[Value]).value = value
+		return
+	}
+	ele := c.ll.PushFront(&entry[Value]{key, value})
+	c.m[key] = ele
+	if c.MaxEntries != 0 && c.Len() > c.MaxEntries {
+		c.RemoveOldest()
+	}
+}
+
+// Get looks up a key's value from the cache, also reporting
+// whether it was present.
+func (c *Cache[Value]) Get(key Tuple) (value *Value, ok bool) {
+	if ele, hit := c.m[key]; hit {
+		c.ll.MoveToFront(ele)
+		return &ele.Value.(*entry[Value]).value, true
+	}
+	return nil, false
+}
+
+// Remove removes the provided key from the cache if it was present.
+func (c *Cache[Value]) Remove(key Tuple) {
+	if ele, hit := c.m[key]; hit {
+		c.removeElement(ele)
+	}
+}
+
+// RemoveOldest removes the oldest item from the cache, if any.
+func (c *Cache[Value]) RemoveOldest() {
+	if c.ll != nil {
+		if ele := c.ll.Back(); ele != nil {
+			c.removeElement(ele)
+		}
+	}
+}
+
+func (c *Cache[Value]) removeElement(e *list.Element) {
+	c.ll.Remove(e)
+	delete(c.m, e.Value.(*entry[Value]).key)
+}
+
+// Len returns the number of items in the cache.
+func (c *Cache[Value]) Len() int { return len(c.m) }

vendor/tailscale.com/net/ipset/ipset.go

@@ -0,0 +1,106 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package ipset provides code for creating efficient IP-in-set lookup functions
+// with different implementations depending on the set.
+package ipset
+
+import (
+	"net/netip"
+
+	"github.com/gaissmai/bart"
+	"tailscale.com/types/views"
+	"tailscale.com/util/set"
+)
+
+// FalseContainsIPFunc is shorthand for NewContainsIPFunc(views.Slice[netip.Prefix]{}).
+func FalseContainsIPFunc() func(ip netip.Addr) bool {
+	return emptySet
+}
+
+func emptySet(ip netip.Addr) bool { return false }
+
+func bartLookup(t *bart.Table[struct{}]) func(netip.Addr) bool {
+	return func(ip netip.Addr) bool {
+		_, ok := t.Lookup(ip)
+		return ok
+	}
+}
+
+func prefixContainsLoop(addrs []netip.Prefix) func(netip.Addr) bool {
+	return func(ip netip.Addr) bool {
+		for _, p := range addrs {
+			if p.Contains(ip) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+func oneIP(ip1 netip.Addr) func(netip.Addr) bool {
+	return func(ip netip.Addr) bool { return ip == ip1 }
+}
+
+func twoIP(ip1, ip2 netip.Addr) func(netip.Addr) bool {
+	return func(ip netip.Addr) bool { return ip == ip1 || ip == ip2 }
+}
+
+func ipInMap(m set.Set[netip.Addr]) func(netip.Addr) bool {
+	return func(ip netip.Addr) bool {
+		_, ok := m[ip]
+		return ok
+	}
+}
+
+// pathForTest is a test hook for NewContainsIPFunc, to test that it took the
+// right construction path.
+var pathForTest = func(string) {}
+
+// NewContainsIPFunc returns a func that reports whether ip is in addrs.
+//
+// The returned func is optimized for the length of contents of addrs.
+func NewContainsIPFunc(addrs views.Slice[netip.Prefix]) func(ip netip.Addr) bool {
+	// Specialize the three common cases: no address, just IPv4
+	// (or just IPv6), and both IPv4 and IPv6.
+	if addrs.Len() == 0 {
+		pathForTest("empty")
+		return emptySet
+	}
+	// If any addr is a prefix with more than a single IP, then do either a
+	// linear scan or a bart table, depending on the number of addrs.
+	if addrs.ContainsFunc(func(p netip.Prefix) bool { return !p.IsSingleIP() }) {
+		if addrs.Len() == 1 {
+			pathForTest("one-prefix")
+			return addrs.At(0).Contains
+		}
+		if addrs.Len() <= 6 {
+			// Small enough to do a linear search.
+			pathForTest("linear-contains")
+			return prefixContainsLoop(addrs.AsSlice())
+		}
+		pathForTest("bart")
+		// Built a bart table.
+		t := &bart.Table[struct{}]{}
+		for i := range addrs.Len() {
+			t.Insert(addrs.At(i), struct{}{})
+		}
+		return bartLookup(t)
+	}
+	// Fast paths for 1 and 2 IPs:
+	if addrs.Len() == 1 {
+		pathForTest("one-ip")
+		return oneIP(addrs.At(0).Addr())
+	}
+	if addrs.Len() == 2 {
+		pathForTest("two-ip")
+		return twoIP(addrs.At(0).Addr(), addrs.At(1).Addr())
+	}
+	// General case:
+	pathForTest("ip-map")
+	m := set.Set[netip.Addr]{}
+	for i := range addrs.Len() {
+		m.Add(addrs.At(i).Addr())
+	}
+	return ipInMap(m)
+}

vendor/tailscale.com/net/memnet/conn.go

@@ -0,0 +1,114 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package memnet
+
+import (
+	"net"
+	"net/netip"
+	"time"
+)
+
+// NetworkName is the network name returned by [net.Addr.Network]
+// for [net.Conn.LocalAddr] and [net.Conn.RemoteAddr] from the [Conn] type.
+const NetworkName = "mem"
+
+// Conn is a net.Conn that can additionally have its reads and writes blocked and unblocked.
+type Conn interface {
+	net.Conn
+
+	// SetReadBlock blocks or unblocks the Read method of this Conn.
+	// It reports an error if the existing value matches the new value,
+	// or if the Conn has been Closed.
+	SetReadBlock(bool) error
+
+	// SetWriteBlock blocks or unblocks the Write method of this Conn.
+	// It reports an error if the existing value matches the new value,
+	// or if the Conn has been Closed.
+	SetWriteBlock(bool) error
+}
+
+// NewConn creates a pair of Conns that are wired together by pipes.
+func NewConn(name string, maxBuf int) (Conn, Conn) {
+	r := NewPipe(name+"|0", maxBuf)
+	w := NewPipe(name+"|1", maxBuf)
+
+	return &connHalf{r: r, w: w}, &connHalf{r: w, w: r}
+}
+
+// NewTCPConn creates a pair of Conns that are wired together by pipes.
+func NewTCPConn(src, dst netip.AddrPort, maxBuf int) (local Conn, remote Conn) {
+	r := NewPipe(src.String(), maxBuf)
+	w := NewPipe(dst.String(), maxBuf)
+
+	lAddr := net.TCPAddrFromAddrPort(src)
+	rAddr := net.TCPAddrFromAddrPort(dst)
+
+	return &connHalf{r: r, w: w, remote: rAddr, local: lAddr}, &connHalf{r: w, w: r, remote: lAddr, local: rAddr}
+}
+
+type connAddr string
+
+func (a connAddr) Network() string { return NetworkName }
+func (a connAddr) String() string  { return string(a) }
+
+type connHalf struct {
+	local, remote net.Addr
+	r, w          *Pipe
+}
+
+func (c *connHalf) LocalAddr() net.Addr {
+	if c.local != nil {
+		return c.local
+	}
+	return connAddr(c.r.name)
+}
+
+func (c *connHalf) RemoteAddr() net.Addr {
+	if c.remote != nil {
+		return c.remote
+	}
+	return connAddr(c.w.name)
+}
+
+func (c *connHalf) Read(b []byte) (n int, err error) {
+	return c.r.Read(b)
+}
+func (c *connHalf) Write(b []byte) (n int, err error) {
+	return c.w.Write(b)
+}
+
+func (c *connHalf) Close() error {
+	if err := c.w.Close(); err != nil {
+		return err
+	}
+	return c.r.Close()
+}
+
+func (c *connHalf) SetDeadline(t time.Time) error {
+	err1 := c.SetReadDeadline(t)
+	err2 := c.SetWriteDeadline(t)
+	if err1 != nil {
+		return err1
+	}
+	return err2
+}
+func (c *connHalf) SetReadDeadline(t time.Time) error {
+	return c.r.SetReadDeadline(t)
+}
+func (c *connHalf) SetWriteDeadline(t time.Time) error {
+	return c.w.SetWriteDeadline(t)
+}
+
+func (c *connHalf) SetReadBlock(b bool) error {
+	if b {
+		return c.r.Block()
+	}
+	return c.r.Unblock()
+}
+func (c *connHalf) SetWriteBlock(b bool) error {
+	if b {
+		return c.w.Block()
+	}
+	return c.w.Unblock()
+}

vendor/tailscale.com/net/memnet/listener.go

@@ -0,0 +1,100 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package memnet
+
+import (
+	"context"
+	"net"
+	"strings"
+	"sync"
+)
+
+const (
+	bufferSize = 256 * 1024
+)
+
+// Listener is a net.Listener using NewConn to create pairs of network
+// connections connected in memory using a buffered pipe. It also provides a
+// Dial method to establish new connections.
+type Listener struct {
+	addr      connAddr
+	ch        chan Conn
+	closeOnce sync.Once
+	closed    chan struct{}
+
+	// NewConn, if non-nil, is called to create a new pair of connections
+	// when dialing. If nil, NewConn is used.
+	NewConn func(network, addr string, maxBuf int) (Conn, Conn)
+}
+
+// Listen returns a new Listener for the provided address.
+func Listen(addr string) *Listener {
+	return &Listener{
+		addr:   connAddr(addr),
+		ch:     make(chan Conn),
+		closed: make(chan struct{}),
+	}
+}
+
+// Addr implements net.Listener.Addr.
+func (l *Listener) Addr() net.Addr {
+	return l.addr
+}
+
+// Close closes the pipe listener.
+func (l *Listener) Close() error {
+	l.closeOnce.Do(func() {
+		close(l.closed)
+	})
+	return nil
+}
+
+// Accept blocks until a new connection is available or the listener is closed.
+func (l *Listener) Accept() (net.Conn, error) {
+	select {
+	case c := <-l.ch:
+		return c, nil
+	case <-l.closed:
+		return nil, net.ErrClosed
+	}
+}
+
+// Dial connects to the listener using the provided context.
+// The provided Context must be non-nil. If the context expires before the
+// connection is complete, an error is returned. Once successfully connected
+// any expiration of the context will not affect the connection.
+func (l *Listener) Dial(ctx context.Context, network, addr string) (_ net.Conn, err error) {
+	if !strings.HasSuffix(network, "tcp") {
+		return nil, net.UnknownNetworkError(network)
+	}
+	if connAddr(addr) != l.addr {
+		return nil, &net.AddrError{
+			Err:  "invalid address",
+			Addr: addr,
+		}
+	}
+
+	newConn := l.NewConn
+	if newConn == nil {
+		newConn = func(network, addr string, maxBuf int) (Conn, Conn) {
+			return NewConn(addr, maxBuf)
+		}
+	}
+	c, s := newConn(network, addr, bufferSize)
+	defer func() {
+		if err != nil {
+			c.Close()
+			s.Close()
+		}
+	}()
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-l.closed:
+		return nil, net.ErrClosed
+	case l.ch <- s:
+		return c, nil
+	}
+}

vendor/tailscale.com/net/memnet/memnet.go

@@ -0,0 +1,8 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package memnet implements an in-memory network implementation.
+// It is useful for dialing and listening on in-memory addresses
+// in tests and other situations where you don't want to use the
+// network.
+package memnet

vendor/tailscale.com/net/memnet/pipe.go

@@ -0,0 +1,244 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package memnet
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"os"
+	"sync"
+	"time"
+)
+
+const debugPipe = false
+
+// Pipe implements an in-memory FIFO with timeouts.
+type Pipe struct {
+	name   string
+	maxBuf int
+	mu     sync.Mutex
+	cnd    *sync.Cond
+
+	blocked          bool
+	closed           bool
+	buf              bytes.Buffer
+	readTimeout      time.Time
+	writeTimeout     time.Time
+	cancelReadTimer  func()
+	cancelWriteTimer func()
+}
+
+// NewPipe creates a Pipe with a buffer size fixed at maxBuf.
+func NewPipe(name string, maxBuf int) *Pipe {
+	p := &Pipe{
+		name:   name,
+		maxBuf: maxBuf,
+	}
+	p.cnd = sync.NewCond(&p.mu)
+	return p
+}
+
+// readOrBlock attempts to read from the buffer, if the buffer is empty and
+// the connection hasn't been closed it will block until there is a change.
+func (p *Pipe) readOrBlock(b []byte) (int, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if !p.readTimeout.IsZero() && !time.Now().Before(p.readTimeout) {
+		return 0, os.ErrDeadlineExceeded
+	}
+	if p.blocked {
+		p.cnd.Wait()
+		return 0, nil
+	}
+
+	n, err := p.buf.Read(b)
+	// err will either be nil or io.EOF.
+	if err == io.EOF {
+		if p.closed {
+			return n, err
+		}
+		// Wait for something to change.
+		p.cnd.Wait()
+	}
+	return n, nil
+}
+
+// Read implements io.Reader.
+// Once the buffer is drained (i.e. after Close), subsequent calls will
+// return io.EOF.
+func (p *Pipe) Read(b []byte) (n int, err error) {
+	if debugPipe {
+		orig := b
+		defer func() {
+			log.Printf("Pipe(%q).Read(%q) n=%d, err=%v", p.name, string(orig[:n]), n, err)
+		}()
+	}
+	for n == 0 {
+		n2, err := p.readOrBlock(b)
+		if err != nil {
+			return n2, err
+		}
+		n += n2
+	}
+	p.cnd.Signal()
+	return n, nil
+}
+
+// writeOrBlock attempts to write to the buffer, if the buffer is full it will
+// block until there is a change.
+func (p *Pipe) writeOrBlock(b []byte) (int, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.closed {
+		return 0, net.ErrClosed
+	}
+	if !p.writeTimeout.IsZero() && !time.Now().Before(p.writeTimeout) {
+		return 0, os.ErrDeadlineExceeded
+	}
+	if p.blocked {
+		p.cnd.Wait()
+		return 0, nil
+	}
+
+	// Optimistically we want to write the entire slice.
+	n := len(b)
+	if limit := p.maxBuf - p.buf.Len(); limit < n {
+		// However, we don't have enough capacity to write everything.
+		n = limit
+	}
+	if n == 0 {
+		// Wait for something to change.
+		p.cnd.Wait()
+		return 0, nil
+	}
+
+	p.buf.Write(b[:n])
+	p.cnd.Signal()
+	return n, nil
+}
+
+// Write implements io.Writer.
+func (p *Pipe) Write(b []byte) (n int, err error) {
+	if debugPipe {
+		orig := b
+		defer func() {
+			log.Printf("Pipe(%q).Write(%q) n=%d, err=%v", p.name, string(orig), n, err)
+		}()
+	}
+	for len(b) > 0 {
+		n2, err := p.writeOrBlock(b)
+		if err != nil {
+			return n + n2, err
+		}
+		n += n2
+		b = b[n2:]
+	}
+	return n, nil
+}
+
+// Close closes the pipe.
+func (p *Pipe) Close() error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.closed = true
+	p.blocked = false
+	if p.cancelWriteTimer != nil {
+		p.cancelWriteTimer()
+		p.cancelWriteTimer = nil
+	}
+	if p.cancelReadTimer != nil {
+		p.cancelReadTimer()
+		p.cancelReadTimer = nil
+	}
+	p.cnd.Broadcast()
+
+	return nil
+}
+
+func (p *Pipe) deadlineTimer(t time.Time) func() {
+	if t.IsZero() {
+		return nil
+	}
+	if t.Before(time.Now()) {
+		p.cnd.Broadcast()
+		return nil
+	}
+	ctx, cancel := context.WithDeadline(context.Background(), t)
+	go func() {
+		<-ctx.Done()
+		if ctx.Err() == context.DeadlineExceeded {
+			p.cnd.Broadcast()
+		}
+	}()
+	return cancel
+}
+
+// SetReadDeadline sets the deadline for future Read calls.
+func (p *Pipe) SetReadDeadline(t time.Time) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.readTimeout = t
+	// If we already have a deadline, cancel it and create a new one.
+	if p.cancelReadTimer != nil {
+		p.cancelReadTimer()
+		p.cancelReadTimer = nil
+	}
+	p.cancelReadTimer = p.deadlineTimer(t)
+	return nil
+}
+
+// SetWriteDeadline sets the deadline for future Write calls.
+func (p *Pipe) SetWriteDeadline(t time.Time) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.writeTimeout = t
+	// If we already have a deadline, cancel it and create a new one.
+	if p.cancelWriteTimer != nil {
+		p.cancelWriteTimer()
+		p.cancelWriteTimer = nil
+	}
+	p.cancelWriteTimer = p.deadlineTimer(t)
+	return nil
+}
+
+// Block will cause all calls to Read and Write to block until they either
+// timeout, are unblocked or the pipe is closed.
+func (p *Pipe) Block() error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	closed := p.closed
+	blocked := p.blocked
+	p.blocked = true
+
+	if closed {
+		return fmt.Errorf("memnet.Pipe(%q).Block: closed", p.name)
+	}
+	if blocked {
+		return fmt.Errorf("memnet.Pipe(%q).Block: already blocked", p.name)
+	}
+	p.cnd.Broadcast()
+	return nil
+}
+
+// Unblock will cause all blocked Read/Write calls to continue execution.
+func (p *Pipe) Unblock() error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	closed := p.closed
+	blocked := p.blocked
+	p.blocked = false
+
+	if closed {
+		return fmt.Errorf("memnet.Pipe(%q).Block: closed", p.name)
+	}
+	if !blocked {
+		return fmt.Errorf("memnet.Pipe(%q).Block: already unblocked", p.name)
+	}
+	p.cnd.Broadcast()
+	return nil
+}

vendor/tailscale.com/net/netaddr/netaddr.go

@@ -0,0 +1,49 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netaddr is a transitional package while we finish migrating from inet.af/netaddr
+// to Go 1.18's net/netip.
+//
+// TODO(bradfitz): delete this package eventually. Tracking bug is
+// https://github.com/tailscale/tailscale/issues/5162
+package netaddr
+
+import (
+	"net"
+	"net/netip"
+)
+
+// IPv4 returns the IP of the IPv4 address a.b.c.d.
+func IPv4(a, b, c, d uint8) netip.Addr {
+	return netip.AddrFrom4([4]byte{a, b, c, d})
+}
+
+// Unmap returns the provided AddrPort with its Addr IP component Unmap'ed.
+//
+// See https://github.com/golang/go/issues/53607#issuecomment-1203466984
+func Unmap(ap netip.AddrPort) netip.AddrPort {
+	return netip.AddrPortFrom(ap.Addr().Unmap(), ap.Port())
+}
+
+// FromStdIPNet returns an IPPrefix from the standard library's IPNet type.
+// If std is invalid, ok is false.
+func FromStdIPNet(std *net.IPNet) (prefix netip.Prefix, ok bool) {
+	ip, ok := netip.AddrFromSlice(std.IP)
+	if !ok {
+		return netip.Prefix{}, false
+	}
+	ip = ip.Unmap()
+
+	if l := len(std.Mask); l != net.IPv4len && l != net.IPv6len {
+		// Invalid mask.
+		return netip.Prefix{}, false
+	}
+
+	ones, bits := std.Mask.Size()
+	if ones == 0 && bits == 0 {
+		// IPPrefix does not support non-contiguous masks.
+		return netip.Prefix{}, false
+	}
+
+	return netip.PrefixFrom(ip, ones), true
+}

vendor/tailscale.com/net/netcheck/standalone.go

@@ -0,0 +1,102 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netcheck
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+
+	"tailscale.com/net/netaddr"
+	"tailscale.com/net/netns"
+	"tailscale.com/net/stun"
+	"tailscale.com/types/logger"
+	"tailscale.com/types/nettype"
+	"tailscale.com/util/multierr"
+)
+
+// Standalone creates the necessary UDP sockets on the given bindAddr and starts
+// an IO loop so that the Client can perform active probes with no further need
+// for external driving of IO (no need to set/implement SendPacket, or call
+// ReceiveSTUNPacket). It must be called prior to starting any reports and is
+// shut down by cancellation of the provided context. If both IPv4 and IPv6 fail
+// to bind, errors will be returned, if one or both protocols can bind no error
+// is returned.
+func (c *Client) Standalone(ctx context.Context, bindAddr string) error {
+	if c.NetMon == nil {
+		panic("netcheck.Client.NetMon must be set")
+	}
+	if bindAddr == "" {
+		bindAddr = ":0"
+	}
+	var errs []error
+
+	u4, err := nettype.MakePacketListenerWithNetIP(netns.Listener(c.logf, c.NetMon)).ListenPacket(ctx, "udp4", bindAddr)
+	if err != nil {
+		c.logf("udp4: %v", err)
+		errs = append(errs, err)
+	} else {
+		go readPackets(ctx, c.logf, u4, c.ReceiveSTUNPacket)
+	}
+
+	u6, err := nettype.MakePacketListenerWithNetIP(netns.Listener(c.logf, c.NetMon)).ListenPacket(ctx, "udp6", bindAddr)
+	if err != nil {
+		c.logf("udp6: %v", err)
+		errs = append(errs, err)
+	} else {
+		go readPackets(ctx, c.logf, u6, c.ReceiveSTUNPacket)
+	}
+
+	c.SendPacket = func(pkt []byte, dst netip.AddrPort) (int, error) {
+		pc := u4
+		if dst.Addr().Is6() {
+			pc = u6
+		}
+		if pc == nil {
+			return 0, errors.New("no UDP socket")
+		}
+
+		return pc.WriteToUDPAddrPort(pkt, dst)
+	}
+
+	// If both v4 and v6 failed, report an error, otherwise let one succeed.
+	if len(errs) == 2 {
+		return multierr.New(errs...)
+	}
+	return nil
+}
+
+// readPackets reads STUN packets from pc until there's an error or ctx is done.
+// In either case, it closes pc.
+func readPackets(ctx context.Context, logf logger.Logf, pc nettype.PacketConn, recv func([]byte, netip.AddrPort)) {
+	done := make(chan struct{})
+	defer close(done)
+
+	go func() {
+		select {
+		case <-ctx.Done():
+		case <-done:
+		}
+		pc.Close()
+	}()
+
+	var buf [64 << 10]byte
+	for {
+		n, addr, err := pc.ReadFromUDPAddrPort(buf[:])
+		if err != nil {
+			if ctx.Err() != nil {
+				return
+			}
+			logf("ReadFrom: %v", err)
+			return
+		}
+		pkt := buf[:n]
+		if !stun.Is(pkt) {
+			continue
+		}
+		if ap := netaddr.Unmap(addr); ap.IsValid() {
+			recv(pkt, ap)
+		}
+	}
+}

vendor/tailscale.com/net/neterror/neterror.go

@@ -0,0 +1,82 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package neterror classifies network errors.
+package neterror
+
+import (
+	"errors"
+	"fmt"
+	"runtime"
+	"syscall"
+)
+
+var errEPERM error = syscall.EPERM // box it into interface just once
+
+// TreatAsLostUDP reports whether err is an error from a UDP send
+// operation that should be treated as a UDP packet that just got
+// lost.
+//
+// Notably, on Linux this reports true for EPERM errors (from outbound
+// firewall blocks) which aren't really send errors; they're just
+// sends that are never going to make it because the local OS blocked
+// it.
+func TreatAsLostUDP(err error) bool {
+	if err == nil {
+		return false
+	}
+	switch runtime.GOOS {
+	case "linux":
+		// Linux, while not documented in the man page,
+		// returns EPERM when there's an OUTPUT rule with -j
+		// DROP or -j REJECT.  We use this very specific
+		// Linux+EPERM check rather than something super broad
+		// like net.Error.Temporary which could be anything.
+		//
+		// For now we only do this on Linux, as such outgoing
+		// firewall violations mapping to syscall errors
+		// hasn't yet been observed on other OSes.
+		return errors.Is(err, errEPERM)
+	}
+	return false
+}
+
+var packetWasTruncated func(error) bool // non-nil on Windows at least
+
+// PacketWasTruncated reports whether err indicates truncation but the RecvFrom
+// that generated err was otherwise successful. On Windows, Go's UDP RecvFrom
+// calls WSARecvFrom which returns the WSAEMSGSIZE error code when the received
+// datagram is larger than the provided buffer. When that happens, both a valid
+// size and an error are returned (as per the partial fix for golang/go#14074).
+// If the WSAEMSGSIZE error is returned, then we ignore the error to get
+// semantics similar to the POSIX operating systems. One caveat is that it
+// appears that the source address is not returned when WSAEMSGSIZE occurs, but
+// we do not currently look at the source address.
+func PacketWasTruncated(err error) bool {
+	if packetWasTruncated == nil {
+		return false
+	}
+	return packetWasTruncated(err)
+}
+
+var shouldDisableUDPGSO func(error) bool // non-nil on Linux
+
+func ShouldDisableUDPGSO(err error) bool {
+	if shouldDisableUDPGSO == nil {
+		return false
+	}
+	return shouldDisableUDPGSO(err)
+}
+
+type ErrUDPGSODisabled struct {
+	OnLaddr  string
+	RetryErr error
+}
+
+func (e ErrUDPGSODisabled) Error() string {
+	return fmt.Sprintf("disabled UDP GSO on %s, NIC(s) may not support checksum offload", e.OnLaddr)
+}
+
+func (e ErrUDPGSODisabled) Unwrap() error {
+	return e.RetryErr
+}

vendor/tailscale.com/net/neterror/neterror_linux.go

@@ -0,0 +1,26 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package neterror
+
+import (
+	"errors"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+func init() {
+	shouldDisableUDPGSO = func(err error) bool {
+		var serr *os.SyscallError
+		if errors.As(err, &serr) {
+			// EIO is returned by udp_send_skb() if the device driver does not
+			// have tx checksumming enabled, which is a hard requirement of
+			// UDP_SEGMENT. See:
+			// https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man7/udp.7?id=806eabd74910447f21005160e90957bde4db0183#n228
+			// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv4/udp.c?h=v6.2&id=c9c3395d5e3dcc6daee66c6908354d47bf98cb0c#n942
+			return serr.Err == unix.EIO
+		}
+		return false
+	}
+}

vendor/tailscale.com/net/neterror/neterror_windows.go

@@ -0,0 +1,16 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package neterror
+
+import (
+	"errors"
+
+	"golang.org/x/sys/windows"
+)
+
+func init() {
+	packetWasTruncated = func(err error) bool {
+		return errors.Is(err, windows.WSAEMSGSIZE)
+	}
+}

vendor/tailscale.com/net/netkernelconf/netkernelconf.go

@@ -0,0 +1,5 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netkernelconf contains code for checking kernel netdev config.
+package netkernelconf

vendor/tailscale.com/net/netkernelconf/netkernelconf_default.go

@@ -0,0 +1,18 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !linux
+
+package netkernelconf
+
+// CheckUDPGROForwarding is unimplemented for non-Linux platforms. Refer to the
+// docstring in _linux.go.
+func CheckUDPGROForwarding(tunInterface, defaultRouteInterface string) (warn, err error) {
+	return nil, nil
+}
+
+// SetUDPGROForwarding is unimplemented for non-Linux platforms. Refer to the
+// docstring in _linux.go.
+func SetUDPGROForwarding(tunInterface, defaultRouteInterface string) error {
+	return nil
+}

vendor/tailscale.com/net/netkernelconf/netkernelconf_linux.go

@@ -0,0 +1,82 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netkernelconf
+
+import (
+	"fmt"
+
+	"github.com/safchain/ethtool"
+)
+
+const (
+	rxWantFeature      = "rx-udp-gro-forwarding"
+	rxDoNotWantFeature = "rx-gro-list"
+	txFeature          = "tx-udp-segmentation"
+)
+
+// CheckUDPGROForwarding checks if the machine is optimally configured to
+// forward UDP packets between the default route and Tailscale TUN interfaces.
+// It returns a non-nil warn in the case that the configuration is suboptimal.
+// It returns a non-nil err in the case that an error is encountered while
+// performing the check.
+func CheckUDPGROForwarding(tunInterface, defaultRouteInterface string) (warn, err error) {
+	const kbLink = "\nSee https://tailscale.com/s/ethtool-config-udp-gro"
+	errWithPrefix := func(format string, a ...any) error {
+		const errPrefix = "couldn't check system's UDP GRO forwarding configuration, "
+		return fmt.Errorf(errPrefix+format, a...)
+	}
+	e, err := ethtool.NewEthtool()
+	if err != nil {
+		return nil, errWithPrefix("failed to init ethtool: %v", err)
+	}
+	defer e.Close()
+	tunFeatures, err := e.Features(tunInterface)
+	if err != nil {
+		return nil, errWithPrefix("failed to retrieve TUN device features: %v", err)
+	}
+	if !tunFeatures[txFeature] {
+		// if txFeature is disabled/nonexistent on the TUN then UDP GRO
+		// forwarding doesn't matter, we won't be taking advantage of it.
+		return nil, nil
+	}
+	defaultFeatures, err := e.Features(defaultRouteInterface)
+	if err != nil {
+		return nil, errWithPrefix("failed to retrieve default route interface features: %v", err)
+	}
+	defaultHasRxWant, ok := defaultFeatures[rxWantFeature]
+	if !ok {
+		// unlikely the feature is nonexistant with txFeature in the TUN driver
+		// being added to the kernel later than rxWantFeature, but let's be sure
+		return nil, nil
+	}
+	if !defaultHasRxWant || defaultFeatures[rxDoNotWantFeature] {
+		return fmt.Errorf("UDP GRO forwarding is suboptimally configured on %s, UDP forwarding throughput capability will increase with a configuration change.%s", defaultRouteInterface, kbLink), nil
+	}
+	return nil, nil
+}
+
+// SetUDPGROForwarding enables UDP GRO forwarding for the provided default
+// interface. It validates if the provided tun interface has UDP segmentation
+// enabled and, if not, returns an error. See
+// https://tailscale.com/kb/1320/performance-best-practices#linux-optimizations-for-subnet-routers-and-exit-nodes
+func SetUDPGROForwarding(tunInterface, defaultInterface string) error {
+	e, err := ethtool.NewEthtool()
+	if err != nil {
+		return fmt.Errorf("failed to init ethtool: %w", err)
+	}
+	defer e.Close()
+	tunFeatures, err := e.Features(tunInterface)
+	if err != nil {
+		return fmt.Errorf("failed to retrieve TUN device features: %w", err)
+	}
+	if !tunFeatures[txFeature] {
+		// if txFeature is disabled/nonexistent on the TUN then UDP GRO
+		// forwarding doesn't matter, we won't be taking advantage of it.
+		return fmt.Errorf("Not enabling UDP GRO forwarding as UDP segmentation is disabled for Tailscale interface")
+	}
+	if err := e.Change(defaultInterface, map[string]bool{rxWantFeature: true, rxDoNotWantFeature: false}); err != nil {
+		return fmt.Errorf("error enabling UDP GRO forwarding: %w", err)
+	}
+	return nil
+}

vendor/tailscale.com/net/netknob/netknob.go

@@ -0,0 +1,29 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netknob has Tailscale network knobs.
+package netknob
+
+import (
+	"runtime"
+	"time"
+)
+
+// PlatformTCPKeepAlive returns the default net.Dialer.KeepAlive
+// value for the current runtime.GOOS.
+func PlatformTCPKeepAlive() time.Duration {
+	switch runtime.GOOS {
+	case "ios", "android":
+		// Disable TCP keep-alives on mobile platforms.
+		// See https://github.com/golang/go/issues/48622.
+		//
+		// TODO(bradfitz): in 1.17.x, try disabling TCP
+		// keep-alives on for all platforms.
+		return -1
+	}
+
+	// Otherwise, default to 30 seconds, which is mostly what we
+	// used to do. In some places we used the zero value, which Go
+	// defaults to 15 seconds. But 30 seconds is fine.
+	return 30 * time.Second
+}

vendor/tailscale.com/net/netmon/defaultroute_bsd.go

@@ -0,0 +1,26 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Common code for FreeBSD. This might also work on other
+// BSD systems (e.g. OpenBSD) but has not been tested.
+// Not used on iOS or macOS. See defaultroute_darwin.go.
+
+//go:build freebsd
+
+package netmon
+
+import "net"
+
+func defaultRoute() (d DefaultRouteDetails, err error) {
+	idx, err := DefaultRouteInterfaceIndex()
+	if err != nil {
+		return d, err
+	}
+	iface, err := net.InterfaceByIndex(idx)
+	if err != nil {
+		return d, err
+	}
+	d.InterfaceName = iface.Name
+	d.InterfaceIndex = idx
+	return d, nil
+}

vendor/tailscale.com/net/netmon/defaultroute_darwin.go

@@ -0,0 +1,96 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build darwin || ios
+
+package netmon
+
+import (
+	"log"
+	"net"
+
+	"tailscale.com/syncs"
+)
+
+var (
+	lastKnownDefaultRouteIfName syncs.AtomicValue[string]
+)
+
+// UpdateLastKnownDefaultRouteInterface is called by ipn-go-bridge in the iOS app when
+// our NWPathMonitor instance detects a network path transition.
+func UpdateLastKnownDefaultRouteInterface(ifName string) {
+	if ifName == "" {
+		return
+	}
+	if old := lastKnownDefaultRouteIfName.Swap(ifName); old != ifName {
+		log.Printf("defaultroute_darwin: update from Swift, ifName = %s (was %s)", ifName, old)
+	}
+}
+
+func defaultRoute() (d DefaultRouteDetails, err error) {
+	// We cannot rely on the delegated interface data on darwin. The NetworkExtension framework
+	// seems to set the delegate interface only once, upon the *creation* of the VPN tunnel.
+	// If a network transition (e.g. from Wi-Fi to Cellular) happens while the tunnel is
+	// connected, it will be ignored and we will still try to set Wi-Fi as the default route
+	// because the delegated interface is not updated by the NetworkExtension framework.
+	//
+	// We work around this on the Swift side with a NWPathMonitor instance that observes
+	// the interface name of the first currently satisfied network path. Our Swift code will
+	// call into `UpdateLastKnownDefaultRouteInterface`, so we can rely on that when it is set.
+	//
+	// If for any reason the Swift machinery didn't work and we don't get any updates, we will
+	// fallback to the BSD logic.
+
+	// Start by getting all available interfaces.
+	interfaces, err := netInterfaces()
+	if err != nil {
+		log.Printf("defaultroute_darwin: could not get interfaces: %v", err)
+		return d, ErrNoGatewayIndexFound
+	}
+
+	getInterfaceByName := func(name string) *Interface {
+		for _, ifc := range interfaces {
+			if ifc.Name != name {
+				continue
+			}
+
+			if !ifc.IsUp() {
+				log.Printf("defaultroute_darwin: %s is down", name)
+				return nil
+			}
+
+			addrs, _ := ifc.Addrs()
+			if len(addrs) == 0 {
+				log.Printf("defaultroute_darwin: %s has no addresses", name)
+				return nil
+			}
+			return &ifc
+		}
+		return nil
+	}
+
+	// Did Swift set lastKnownDefaultRouteInterface? If so, we should use it and don't bother
+	// with anything else. However, for sanity, do check whether Swift gave us with an interface
+	// that exists, is up, and has an address.
+	if swiftIfName := lastKnownDefaultRouteIfName.Load(); swiftIfName != "" {
+		ifc := getInterfaceByName(swiftIfName)
+		if ifc != nil {
+			d.InterfaceName = ifc.Name
+			d.InterfaceIndex = ifc.Index
+			return d, nil
+		}
+	}
+
+	// Fallback to the BSD logic
+	idx, err := DefaultRouteInterfaceIndex()
+	if err != nil {
+		return d, err
+	}
+	iface, err := net.InterfaceByIndex(idx)
+	if err != nil {
+		return d, err
+	}
+	d.InterfaceName = iface.Name
+	d.InterfaceIndex = idx
+	return d, nil
+}

vendor/tailscale.com/net/netmon/interfaces_android.go

@@ -0,0 +1,183 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netmon
+
+import (
+	"bytes"
+	"errors"
+	"log"
+	"net/netip"
+	"os/exec"
+	"sync/atomic"
+
+	"go4.org/mem"
+	"golang.org/x/sys/unix"
+	"tailscale.com/net/netaddr"
+	"tailscale.com/syncs"
+	"tailscale.com/util/lineread"
+)
+
+var (
+	lastKnownDefaultRouteIfName syncs.AtomicValue[string]
+)
+
+var procNetRoutePath = "/proc/net/route"
+
+// maxProcNetRouteRead is the max number of lines to read from
+// /proc/net/route looking for a default route.
+const maxProcNetRouteRead = 1000
+
+func init() {
+	likelyHomeRouterIP = likelyHomeRouterIPAndroid
+}
+
+var procNetRouteErr atomic.Bool
+
+// errStopReading is a sentinel error value used internally by
+// lineread.File callers to stop reading. It doesn't escape to
+// callers/users.
+var errStopReading = errors.New("stop reading")
+
+/*
+Parse 10.0.0.1 out of:
+
+$ cat /proc/net/route
+Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask            MTU     Window  IRTT
+ens18   00000000        0100000A        0003    0       0       0       00000000        0       0       0
+ens18   0000000A        00000000        0001    0       0       0       0000FFFF        0       0       0
+*/
+func likelyHomeRouterIPAndroid() (ret netip.Addr, myIP netip.Addr, ok bool) {
+	if procNetRouteErr.Load() {
+		// If we failed to read /proc/net/route previously, don't keep trying.
+		return likelyHomeRouterIPHelper()
+	}
+	lineNum := 0
+	var f []mem.RO
+	err := lineread.File(procNetRoutePath, func(line []byte) error {
+		lineNum++
+		if lineNum == 1 {
+			// Skip header line.
+			return nil
+		}
+		if lineNum > maxProcNetRouteRead {
+			return errStopReading
+		}
+		f = mem.AppendFields(f[:0], mem.B(line))
+		if len(f) < 4 {
+			return nil
+		}
+		gwHex, flagsHex := f[2], f[3]
+		flags, err := mem.ParseUint(flagsHex, 16, 16)
+		if err != nil {
+			return nil // ignore error, skip line and keep going
+		}
+		if flags&(unix.RTF_UP|unix.RTF_GATEWAY) != unix.RTF_UP|unix.RTF_GATEWAY {
+			return nil
+		}
+		ipu32, err := mem.ParseUint(gwHex, 16, 32)
+		if err != nil {
+			return nil // ignore error, skip line and keep going
+		}
+		ip := netaddr.IPv4(byte(ipu32), byte(ipu32>>8), byte(ipu32>>16), byte(ipu32>>24))
+		if ip.IsPrivate() {
+			ret = ip
+			return errStopReading
+		}
+		return nil
+	})
+	if errors.Is(err, errStopReading) {
+		err = nil
+	}
+	if err != nil {
+		procNetRouteErr.Store(true)
+		return likelyHomeRouterIP()
+	}
+	if ret.IsValid() {
+		// Try to get the local IP of the interface associated with
+		// this route to short-circuit finding the IP associated with
+		// this gateway. This isn't fatal if it fails.
+		if len(f) > 0 && !disableLikelyHomeRouterIPSelf() {
+			ForeachInterface(func(ni Interface, pfxs []netip.Prefix) {
+				// Ensure this is the same interface
+				if !f[0].EqualString(ni.Name) {
+					return
+				}
+
+				// Find the first IPv4 address and use it.
+				for _, pfx := range pfxs {
+					if addr := pfx.Addr(); addr.Is4() {
+						myIP = addr
+						break
+					}
+				}
+			})
+		}
+
+		return ret, myIP, true
+	}
+	if lineNum >= maxProcNetRouteRead {
+		// If we went over our line limit without finding an answer, assume
+		// we're a big fancy Linux router (or at least not a home system)
+		// and set the error bit so we stop trying this in the future (and wasting CPU).
+		// See https://github.com/tailscale/tailscale/issues/7621.
+		//
+		// Remember that "likelyHomeRouterIP" exists purely to find the port
+		// mapping service (UPnP, PMP, PCP) often present on a home router. If we hit
+		// the route (line) limit without finding an answer, we're unlikely to ever
+		// find one in the future.
+		procNetRouteErr.Store(true)
+	}
+	return netip.Addr{}, netip.Addr{}, false
+}
+
+// Android apps don't have permission to read /proc/net/route, at
+// least on Google devices and the Android emulator.
+func likelyHomeRouterIPHelper() (ret netip.Addr, _ netip.Addr, ok bool) {
+	cmd := exec.Command("/system/bin/ip", "route", "show", "table", "0")
+	out, err := cmd.StdoutPipe()
+	if err != nil {
+		return
+	}
+	if err := cmd.Start(); err != nil {
+		log.Printf("interfaces: running /system/bin/ip: %v", err)
+		return
+	}
+	// Search for line like "default via 10.0.2.2 dev radio0 table 1016 proto static mtu 1500 "
+	lineread.Reader(out, func(line []byte) error {
+		const pfx = "default via "
+		if !mem.HasPrefix(mem.B(line), mem.S(pfx)) {
+			return nil
+		}
+		line = line[len(pfx):]
+		sp := bytes.IndexByte(line, ' ')
+		if sp == -1 {
+			return nil
+		}
+		ipb := line[:sp]
+		if ip, err := netip.ParseAddr(string(ipb)); err == nil && ip.Is4() {
+			ret = ip
+			log.Printf("interfaces: found Android default route %v", ip)
+		}
+		return nil
+	})
+	cmd.Process.Kill()
+	cmd.Wait()
+	return ret, netip.Addr{}, ret.IsValid()
+}
+
+// UpdateLastKnownDefaultRouteInterface is called by libtailscale in the Android app when
+// the connectivity manager detects a network path transition. If ifName is "", network has been lost.
+// After updating the interface, Android calls Monitor.InjectEvent(), triggering a link change.
+func UpdateLastKnownDefaultRouteInterface(ifName string) {
+	if old := lastKnownDefaultRouteIfName.Swap(ifName); old != ifName {
+		log.Printf("defaultroute: update from Android, ifName = %s (was %s)", ifName, old)
+	}
+}
+
+func defaultRoute() (d DefaultRouteDetails, err error) {
+	if ifName := lastKnownDefaultRouteIfName.Load(); ifName != "" {
+		d.InterfaceName = ifName
+	}
+	return d, nil
+}

vendor/tailscale.com/net/netmon/interfaces_bsd.go

@@ -0,0 +1,153 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Common code for FreeBSD and Darwin. This might also work on other
+// BSD systems (e.g. OpenBSD) but has not been tested.
+
+//go:build darwin || freebsd
+
+package netmon
+
+import (
+	"errors"
+	"fmt"
+	"log"
+	"net/netip"
+	"syscall"
+
+	"golang.org/x/net/route"
+	"golang.org/x/sys/unix"
+	"tailscale.com/net/netaddr"
+)
+
+// ErrNoGatewayIndexFound is returned by DefaultRouteInterfaceIndex when no
+// default route is found.
+var ErrNoGatewayIndexFound = errors.New("no gateway index found")
+
+// DefaultRouteInterfaceIndex returns the index of the network interface that
+// owns the default route. It returns the first IPv4 or IPv6 default route it
+// finds (it does not prefer one or the other).
+func DefaultRouteInterfaceIndex() (int, error) {
+	// $ netstat -nr
+	// Routing tables
+	// Internet:
+	// Destination        Gateway            Flags        Netif Expire
+	// default            10.0.0.1           UGSc           en0         <-- want this one
+	// default            10.0.0.1           UGScI          en1
+
+	// From man netstat:
+	// U       RTF_UP           Route usable
+	// G       RTF_GATEWAY      Destination requires forwarding by intermediary
+	// S       RTF_STATIC       Manually added
+	// c       RTF_PRCLONING    Protocol-specified generate new routes on use
+	// I       RTF_IFSCOPE      Route is associated with an interface scope
+
+	rib, err := fetchRoutingTable()
+	if err != nil {
+		return 0, fmt.Errorf("route.FetchRIB: %w", err)
+	}
+	msgs, err := parseRoutingTable(rib)
+	if err != nil {
+		return 0, fmt.Errorf("route.ParseRIB: %w", err)
+	}
+	for _, m := range msgs {
+		rm, ok := m.(*route.RouteMessage)
+		if !ok {
+			continue
+		}
+		if isDefaultGateway(rm) {
+			if delegatedIndex, err := getDelegatedInterface(rm.Index); err == nil && delegatedIndex != 0 {
+				return delegatedIndex, nil
+			} else if err != nil {
+				log.Printf("interfaces_bsd: could not get delegated interface: %v", err)
+			}
+			return rm.Index, nil
+		}
+	}
+	return 0, ErrNoGatewayIndexFound
+}
+
+func init() {
+	likelyHomeRouterIP = likelyHomeRouterIPBSDFetchRIB
+}
+
+func likelyHomeRouterIPBSDFetchRIB() (ret, myIP netip.Addr, ok bool) {
+	rib, err := fetchRoutingTable()
+	if err != nil {
+		log.Printf("routerIP/FetchRIB: %v", err)
+		return ret, myIP, false
+	}
+	msgs, err := parseRoutingTable(rib)
+	if err != nil {
+		log.Printf("routerIP/ParseRIB: %v", err)
+		return ret, myIP, false
+	}
+	for _, m := range msgs {
+		rm, ok := m.(*route.RouteMessage)
+		if !ok {
+			continue
+		}
+		if !isDefaultGateway(rm) {
+			continue
+		}
+
+		gw, ok := rm.Addrs[unix.RTAX_GATEWAY].(*route.Inet4Addr)
+		if !ok {
+			continue
+		}
+		// If the route entry has an interface address associated with
+		// it, then parse and return that. This is optional.
+		if len(rm.Addrs) >= unix.RTAX_IFA {
+			if addr, ok := rm.Addrs[unix.RTAX_IFA].(*route.Inet4Addr); ok {
+				myIP = netaddr.IPv4(addr.IP[0], addr.IP[1], addr.IP[2], addr.IP[3])
+			}
+		}
+
+		return netaddr.IPv4(gw.IP[0], gw.IP[1], gw.IP[2], gw.IP[3]), myIP, true
+	}
+
+	return ret, myIP, false
+}
+
+var v4default = [4]byte{0, 0, 0, 0}
+var v6default = [16]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+
+func isDefaultGateway(rm *route.RouteMessage) bool {
+	if rm.Flags&unix.RTF_GATEWAY == 0 {
+		return false
+	}
+	// Defined locally because FreeBSD does not have unix.RTF_IFSCOPE.
+	const RTF_IFSCOPE = 0x1000000
+	if rm.Flags&RTF_IFSCOPE != 0 {
+		return false
+	}
+
+	// Addrs is [RTAX_DST, RTAX_GATEWAY, RTAX_NETMASK, ...]
+	if len(rm.Addrs) <= unix.RTAX_NETMASK {
+		return false
+	}
+
+	dst := rm.Addrs[unix.RTAX_DST]
+	netmask := rm.Addrs[unix.RTAX_NETMASK]
+	if dst == nil || netmask == nil {
+		return false
+	}
+
+	if dst.Family() == syscall.AF_INET && netmask.Family() == syscall.AF_INET {
+		dstAddr, dstOk := dst.(*route.Inet4Addr)
+		nmAddr, nmOk := netmask.(*route.Inet4Addr)
+		if dstOk && nmOk && dstAddr.IP == v4default && nmAddr.IP == v4default {
+			return true
+		}
+	}
+
+	if dst.Family() == syscall.AF_INET6 && netmask.Family() == syscall.AF_INET6 {
+		dstAddr, dstOk := dst.(*route.Inet6Addr)
+		nmAddr, nmOk := netmask.(*route.Inet6Addr)
+		if dstOk && nmOk && dstAddr.IP == v6default && nmAddr.IP == v6default {
+			return true
+		}
+	}
+
+	return false
+}

vendor/tailscale.com/net/netmon/interfaces_darwin.go

@@ -0,0 +1,111 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netmon
+
+import (
+	"fmt"
+	"net"
+	"strings"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/net/route"
+	"golang.org/x/sys/unix"
+	"tailscale.com/util/mak"
+)
+
+// fetchRoutingTable calls route.FetchRIB, fetching NET_RT_DUMP2.
+func fetchRoutingTable() (rib []byte, err error) {
+	return route.FetchRIB(syscall.AF_UNSPEC, syscall.NET_RT_DUMP2, 0)
+}
+
+func parseRoutingTable(rib []byte) ([]route.Message, error) {
+	return route.ParseRIB(syscall.NET_RT_IFLIST2, rib)
+}
+
+var ifNames struct {
+	sync.Mutex
+	m map[int]string // ifindex => name
+}
+
+func init() {
+	interfaceDebugExtras = interfaceDebugExtrasDarwin
+}
+
+// getDelegatedInterface returns the interface index of the underlying interface
+// for the given interface index. 0 is returned if the interface does not
+// delegate.
+func getDelegatedInterface(ifIndex int) (int, error) {
+	ifNames.Lock()
+	defer ifNames.Unlock()
+
+	// To get the delegated interface, we do what ifconfig does and use the
+	// SIOCGIFDELEGATE ioctl. It operates in term of a ifreq struct, which
+	// has to be populated with a interface name. To avoid having to do a
+	// interface index -> name lookup every time, we cache interface names
+	// (since indexes and names are stable after boot).
+	ifName, ok := ifNames.m[ifIndex]
+	if !ok {
+		iface, err := net.InterfaceByIndex(ifIndex)
+		if err != nil {
+			return 0, err
+		}
+		ifName = iface.Name
+		mak.Set(&ifNames.m, ifIndex, ifName)
+	}
+
+	// Only tunnels (like Tailscale itself) have a delegated interface, avoid
+	// the ioctl if we can.
+	if !strings.HasPrefix(ifName, "utun") {
+		return 0, nil
+	}
+
+	// We don't cache the result of the ioctl, since the delegated interface can
+	// change, e.g. if the user changes the preferred service order in the
+	// network preference pane.
+	fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
+	if err != nil {
+		return 0, err
+	}
+	defer unix.Close(fd)
+
+	// Match the ifreq struct/union from the bsd/net/if.h header in the Darwin
+	// open source release.
+	var ifr struct {
+		ifr_name      [unix.IFNAMSIZ]byte
+		ifr_delegated uint32
+	}
+	copy(ifr.ifr_name[:], ifName)
+
+	// SIOCGIFDELEGATE is not in the Go x/sys package or in the public macOS
+	// <sys/sockio.h> headers. However, it is in the Darwin/xnu open source
+	// release (and is used by ifconfig, see
+	// https://github.com/apple-oss-distributions/network_cmds/blob/6ccdc225ad5aa0d23ea5e7d374956245d2462427/ifconfig.tproj/ifconfig.c#L2183-L2187).
+	// We generate its value by evaluating the `_IOWR('i', 157, struct ifreq)`
+	// macro, which is how it's defined in
+	// https://github.com/apple/darwin-xnu/blob/2ff845c2e033bd0ff64b5b6aa6063a1f8f65aa32/bsd/sys/sockio.h#L264
+	const SIOCGIFDELEGATE = 0xc020699d
+
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_IOCTL,
+		uintptr(fd),
+		uintptr(SIOCGIFDELEGATE),
+		uintptr(unsafe.Pointer(&ifr)))
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(ifr.ifr_delegated), nil
+}
+
+func interfaceDebugExtrasDarwin(ifIndex int) (string, error) {
+	delegated, err := getDelegatedInterface(ifIndex)
+	if err != nil {
+		return "", err
+	}
+	if delegated == 0 {
+		return "", nil
+	}
+	return fmt.Sprintf("delegated=%d", delegated), nil
+}

vendor/tailscale.com/net/netmon/interfaces_defaultrouteif_todo.go

@@ -0,0 +1,14 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !linux && !windows && !darwin && !freebsd && !android
+
+package netmon
+
+import "errors"
+
+var errTODO = errors.New("TODO")
+
+func defaultRoute() (DefaultRouteDetails, error) {
+	return DefaultRouteDetails{}, errTODO
+}

vendor/tailscale.com/net/netmon/interfaces_freebsd.go

@@ -0,0 +1,28 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// This might work on other BSDs, but only tested on FreeBSD.
+
+//go:build freebsd
+
+package netmon
+
+import (
+	"syscall"
+
+	"golang.org/x/net/route"
+	"golang.org/x/sys/unix"
+)
+
+// fetchRoutingTable calls route.FetchRIB, fetching NET_RT_DUMP.
+func fetchRoutingTable() (rib []byte, err error) {
+	return route.FetchRIB(syscall.AF_UNSPEC, unix.NET_RT_DUMP, 0)
+}
+
+func parseRoutingTable(rib []byte) ([]route.Message, error) {
+	return route.ParseRIB(syscall.NET_RT_IFLIST, rib)
+}
+
+func getDelegatedInterface(ifIndex int) (int, error) {
+	return 0, nil
+}

vendor/tailscale.com/net/netmon/interfaces_linux.go

@@ -0,0 +1,262 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !android
+
+package netmon
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/netip"
+	"os"
+	"strings"
+	"sync/atomic"
+
+	"github.com/jsimonetti/rtnetlink"
+	"github.com/mdlayher/netlink"
+	"go4.org/mem"
+	"golang.org/x/sys/unix"
+	"tailscale.com/net/netaddr"
+	"tailscale.com/util/lineread"
+)
+
+func init() {
+	likelyHomeRouterIP = likelyHomeRouterIPLinux
+}
+
+var procNetRouteErr atomic.Bool
+
+// errStopReading is a sentinel error value used internally by
+// lineread.File callers to stop reading. It doesn't escape to
+// callers/users.
+var errStopReading = errors.New("stop reading")
+
+/*
+Parse 10.0.0.1 out of:
+
+$ cat /proc/net/route
+Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask            MTU     Window  IRTT
+ens18   00000000        0100000A        0003    0       0       0       00000000        0       0       0
+ens18   0000000A        00000000        0001    0       0       0       0000FFFF        0       0       0
+*/
+func likelyHomeRouterIPLinux() (ret netip.Addr, myIP netip.Addr, ok bool) {
+	if procNetRouteErr.Load() {
+		// If we failed to read /proc/net/route previously, don't keep trying.
+		return ret, myIP, false
+	}
+	lineNum := 0
+	var f []mem.RO
+	err := lineread.File(procNetRoutePath, func(line []byte) error {
+		lineNum++
+		if lineNum == 1 {
+			// Skip header line.
+			return nil
+		}
+		if lineNum > maxProcNetRouteRead {
+			return errStopReading
+		}
+		f = mem.AppendFields(f[:0], mem.B(line))
+		if len(f) < 4 {
+			return nil
+		}
+		gwHex, flagsHex := f[2], f[3]
+		flags, err := mem.ParseUint(flagsHex, 16, 16)
+		if err != nil {
+			return nil // ignore error, skip line and keep going
+		}
+		if flags&(unix.RTF_UP|unix.RTF_GATEWAY) != unix.RTF_UP|unix.RTF_GATEWAY {
+			return nil
+		}
+		ipu32, err := mem.ParseUint(gwHex, 16, 32)
+		if err != nil {
+			return nil // ignore error, skip line and keep going
+		}
+		ip := netaddr.IPv4(byte(ipu32), byte(ipu32>>8), byte(ipu32>>16), byte(ipu32>>24))
+		if ip.IsPrivate() {
+			ret = ip
+			return errStopReading
+		}
+		return nil
+	})
+	if errors.Is(err, errStopReading) {
+		err = nil
+	}
+	if err != nil {
+		procNetRouteErr.Store(true)
+		log.Printf("interfaces: failed to read /proc/net/route: %v", err)
+	}
+	if ret.IsValid() {
+		// Try to get the local IP of the interface associated with
+		// this route to short-circuit finding the IP associated with
+		// this gateway. This isn't fatal if it fails.
+		if len(f) > 0 && !disableLikelyHomeRouterIPSelf() {
+			ForeachInterface(func(ni Interface, pfxs []netip.Prefix) {
+				// Ensure this is the same interface
+				if !f[0].EqualString(ni.Name) {
+					return
+				}
+
+				// Find the first IPv4 address and use it.
+				for _, pfx := range pfxs {
+					if addr := pfx.Addr(); addr.Is4() {
+						myIP = addr
+						break
+					}
+				}
+			})
+		}
+
+		return ret, myIP, true
+	}
+	if lineNum >= maxProcNetRouteRead {
+		// If we went over our line limit without finding an answer, assume
+		// we're a big fancy Linux router (or at least not a home system)
+		// and set the error bit so we stop trying this in the future (and wasting CPU).
+		// See https://github.com/tailscale/tailscale/issues/7621.
+		//
+		// Remember that "likelyHomeRouterIP" exists purely to find the port
+		// mapping service (UPnP, PMP, PCP) often present on a home router. If we hit
+		// the route (line) limit without finding an answer, we're unlikely to ever
+		// find one in the future.
+		procNetRouteErr.Store(true)
+	}
+	return netip.Addr{}, netip.Addr{}, false
+}
+
+func defaultRoute() (d DefaultRouteDetails, err error) {
+	v, err := defaultRouteInterfaceProcNet()
+	if err == nil {
+		d.InterfaceName = v
+		return d, nil
+	}
+	// Issue 4038: the default route (such as on Unifi UDM Pro)
+	// might be in a non-default table, so it won't show up in
+	// /proc/net/route. Use netlink to find the default route.
+	//
+	// TODO(bradfitz): this allocates a fair bit. We should track
+	// this in net/interfaces/monitor instead and have
+	// interfaces.GetState take a netmon.Monitor or similar so the
+	// routing table can be cached and the monitor's existing
+	// subscription to route changes can update the cached state,
+	// rather than querying the whole thing every time like
+	// defaultRouteFromNetlink does.
+	//
+	// Then we should just always try to use the cached route
+	// table from netlink every time, and only use /proc/net/route
+	// as a fallback for weird environments where netlink might be
+	// banned but /proc/net/route is emulated (e.g. stuff like
+	// Cloud Run?).
+	return defaultRouteFromNetlink()
+}
+
+func defaultRouteFromNetlink() (d DefaultRouteDetails, err error) {
+	c, err := rtnetlink.Dial(&netlink.Config{Strict: true})
+	if err != nil {
+		return d, fmt.Errorf("defaultRouteFromNetlink: Dial: %w", err)
+	}
+	defer c.Close()
+	rms, err := c.Route.List()
+	if err != nil {
+		return d, fmt.Errorf("defaultRouteFromNetlink: List: %w", err)
+	}
+	for _, rm := range rms {
+		if rm.Attributes.Gateway == nil {
+			// A default route has a gateway. If it doesn't, skip it.
+			continue
+		}
+		if rm.Attributes.Dst != nil {
+			// A default route has a nil destination to mean anything
+			// so ignore any route for a specific destination.
+			// TODO(bradfitz): better heuristic?
+			// empirically this seems like enough.
+			continue
+		}
+		// TODO(bradfitz): care about address family, if
+		// callers ever start caring about v4-vs-v6 default
+		// route differences.
+		idx := int(rm.Attributes.OutIface)
+		if idx == 0 {
+			continue
+		}
+		if iface, err := net.InterfaceByIndex(idx); err == nil {
+			d.InterfaceName = iface.Name
+			d.InterfaceIndex = idx
+			return d, nil
+		}
+	}
+	return d, errNoDefaultRoute
+}
+
+var zeroRouteBytes = []byte("00000000")
+var procNetRoutePath = "/proc/net/route"
+
+// maxProcNetRouteRead is the max number of lines to read from
+// /proc/net/route looking for a default route.
+const maxProcNetRouteRead = 1000
+
+var errNoDefaultRoute = errors.New("no default route found")
+
+func defaultRouteInterfaceProcNetInternal(bufsize int) (string, error) {
+	f, err := os.Open(procNetRoutePath)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	br := bufio.NewReaderSize(f, bufsize)
+	lineNum := 0
+	for {
+		lineNum++
+		line, err := br.ReadSlice('\n')
+		if err == io.EOF || lineNum > maxProcNetRouteRead {
+			return "", errNoDefaultRoute
+		}
+		if err != nil {
+			return "", err
+		}
+		if !bytes.Contains(line, zeroRouteBytes) {
+			continue
+		}
+		fields := strings.Fields(string(line))
+		ifc := fields[0]
+		ip := fields[1]
+		netmask := fields[7]
+
+		if strings.HasPrefix(ifc, "tailscale") ||
+			strings.HasPrefix(ifc, "wg") {
+			continue
+		}
+		if ip == "00000000" && netmask == "00000000" {
+			// default route
+			return ifc, nil // interface name
+		}
+	}
+}
+
+// returns string interface name and an error.
+// io.EOF: full route table processed, no default route found.
+// other io error: something went wrong reading the route file.
+func defaultRouteInterfaceProcNet() (string, error) {
+	rc, err := defaultRouteInterfaceProcNetInternal(128)
+	if rc == "" && (errors.Is(err, io.EOF) || err == nil) {
+		// https://github.com/google/gvisor/issues/5732
+		// On a regular Linux kernel you can read the first 128 bytes of /proc/net/route,
+		// then come back later to read the next 128 bytes and so on.
+		//
+		// In Google Cloud Run, where /proc/net/route comes from gVisor, you have to
+		// read it all at once. If you read only the first few bytes then the second
+		// read returns 0 bytes no matter how much originally appeared to be in the file.
+		//
+		// At the time of this writing (Mar 2021) Google Cloud Run has eth0 and eth1
+		// with a 384 byte /proc/net/route. We allocate a large buffer to ensure we'll
+		// read it all in one call.
+		return defaultRouteInterfaceProcNetInternal(4096)
+	}
+	return rc, err
+}

vendor/tailscale.com/net/netmon/interfaces_windows.go

@@ -0,0 +1,278 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netmon
+
+import (
+	"log"
+	"net/netip"
+	"net/url"
+	"strings"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
+	"tailscale.com/tsconst"
+)
+
+const (
+	fallbackInterfaceMetric = uint32(0) // Used if we cannot get the actual interface metric
+)
+
+func init() {
+	likelyHomeRouterIP = likelyHomeRouterIPWindows
+	getPAC = getPACWindows
+}
+
+func likelyHomeRouterIPWindows() (ret netip.Addr, _ netip.Addr, ok bool) {
+	rs, err := winipcfg.GetIPForwardTable2(windows.AF_INET)
+	if err != nil {
+		log.Printf("routerIP/GetIPForwardTable2 error: %v", err)
+		return
+	}
+
+	var ifaceMetricCache map[winipcfg.LUID]uint32
+
+	getIfaceMetric := func(luid winipcfg.LUID) (metric uint32) {
+		if ifaceMetricCache == nil {
+			ifaceMetricCache = make(map[winipcfg.LUID]uint32)
+		} else if m, ok := ifaceMetricCache[luid]; ok {
+			return m
+		}
+
+		if iface, err := luid.IPInterface(windows.AF_INET); err == nil {
+			metric = iface.Metric
+		} else {
+			log.Printf("routerIP/luid.IPInterface error: %v", err)
+			metric = fallbackInterfaceMetric
+		}
+
+		ifaceMetricCache[luid] = metric
+		return
+	}
+
+	v4unspec := netip.IPv4Unspecified()
+	var best *winipcfg.MibIPforwardRow2 // best (lowest metric) found so far, or nil
+
+	for i := range rs {
+		r := &rs[i]
+		if r.Loopback || r.DestinationPrefix.PrefixLength != 0 || r.DestinationPrefix.Prefix().Addr().Unmap() != v4unspec {
+			// Not a default route, so skip
+			continue
+		}
+
+		ip := r.NextHop.Addr().Unmap()
+		if !ip.IsValid() {
+			// Not a valid gateway, so skip (won't happen though)
+			continue
+		}
+
+		if best == nil {
+			best = r
+			ret = ip
+			continue
+		}
+
+		// We can get here only if there are multiple default gateways defined (rare case),
+		// in which case we need to calculate the effective metric.
+		// Effective metric is sum of interface metric and route metric offset
+		if ifaceMetricCache == nil {
+			// If we're here it means that previous route still isn't updated, so update it
+			best.Metric += getIfaceMetric(best.InterfaceLUID)
+		}
+		r.Metric += getIfaceMetric(r.InterfaceLUID)
+
+		if best.Metric > r.Metric || best.Metric == r.Metric && ret.Compare(ip) > 0 {
+			// Pick the route with lower metric, or lower IP if metrics are equal
+			best = r
+			ret = ip
+		}
+	}
+
+	if ret.IsValid() && !ret.IsPrivate() {
+		// Default route has a non-private gateway
+		return netip.Addr{}, netip.Addr{}, false
+	}
+
+	return ret, netip.Addr{}, ret.IsValid()
+}
+
+// NonTailscaleMTUs returns a map of interface LUID to interface MTU,
+// for all interfaces except Tailscale tunnels.
+func NonTailscaleMTUs() (map[winipcfg.LUID]uint32, error) {
+	mtus := map[winipcfg.LUID]uint32{}
+	ifs, err := NonTailscaleInterfaces()
+	for luid, iface := range ifs {
+		mtus[luid] = iface.MTU
+	}
+	return mtus, err
+}
+
+func notTailscaleInterface(iface *winipcfg.IPAdapterAddresses) bool {
+	// TODO(bradfitz): do this without the Description method's
+	// utf16-to-string allocation. But at least we only do it for
+	// the virtual interfaces, for which there won't be many.
+	if iface.IfType != winipcfg.IfTypePropVirtual {
+		return true
+	}
+	desc := iface.Description()
+	return !(strings.Contains(desc, tsconst.WintunInterfaceDesc) ||
+		strings.Contains(desc, tsconst.WintunInterfaceDesc0_14))
+}
+
+// NonTailscaleInterfaces returns a map of interface LUID to interface
+// for all interfaces except Tailscale tunnels.
+func NonTailscaleInterfaces() (map[winipcfg.LUID]*winipcfg.IPAdapterAddresses, error) {
+	return getInterfaces(windows.AF_UNSPEC, winipcfg.GAAFlagIncludeAllInterfaces, notTailscaleInterface)
+}
+
+// getInterfaces returns a map of interfaces keyed by their LUID for
+// all interfaces matching the provided match predicate.
+//
+// The family (AF_UNSPEC, AF_INET, or AF_INET6) and flags are passed
+// to winipcfg.GetAdaptersAddresses.
+func getInterfaces(family winipcfg.AddressFamily, flags winipcfg.GAAFlags, match func(*winipcfg.IPAdapterAddresses) bool) (map[winipcfg.LUID]*winipcfg.IPAdapterAddresses, error) {
+	ifs, err := winipcfg.GetAdaptersAddresses(family, flags)
+	if err != nil {
+		return nil, err
+	}
+	ret := map[winipcfg.LUID]*winipcfg.IPAdapterAddresses{}
+	for _, iface := range ifs {
+		if match(iface) {
+			ret[iface.LUID] = iface
+		}
+	}
+	return ret, nil
+}
+
+// GetWindowsDefault returns the interface that has the non-Tailscale
+// default route for the given address family.
+//
+// It returns (nil, nil) if no interface is found.
+//
+// The family must be one of AF_INET or AF_INET6.
+func GetWindowsDefault(family winipcfg.AddressFamily) (*winipcfg.IPAdapterAddresses, error) {
+	ifs, err := getInterfaces(family, winipcfg.GAAFlagIncludeAllInterfaces, func(iface *winipcfg.IPAdapterAddresses) bool {
+		switch iface.IfType {
+		case winipcfg.IfTypeSoftwareLoopback:
+			return false
+		}
+		switch family {
+		case windows.AF_INET:
+			if iface.Flags&winipcfg.IPAAFlagIpv4Enabled == 0 {
+				return false
+			}
+		case windows.AF_INET6:
+			if iface.Flags&winipcfg.IPAAFlagIpv6Enabled == 0 {
+				return false
+			}
+		}
+		return iface.OperStatus == winipcfg.IfOperStatusUp && notTailscaleInterface(iface)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	routes, err := winipcfg.GetIPForwardTable2(family)
+	if err != nil {
+		return nil, err
+	}
+
+	bestMetric := ^uint32(0)
+	var bestIface *winipcfg.IPAdapterAddresses
+	for _, route := range routes {
+		if route.DestinationPrefix.PrefixLength != 0 {
+			// Not a default route.
+			continue
+		}
+		iface := ifs[route.InterfaceLUID]
+		if iface == nil {
+			continue
+		}
+
+		// Microsoft docs say:
+		//
+		// "The actual route metric used to compute the route
+		// preferences for IPv4 is the summation of the route
+		// metric offset specified in the Metric member of the
+		// MIB_IPFORWARD_ROW2 structure and the interface
+		// metric specified in this member for IPv4"
+		metric := route.Metric
+		switch family {
+		case windows.AF_INET:
+			metric += iface.Ipv4Metric
+		case windows.AF_INET6:
+			metric += iface.Ipv6Metric
+		}
+		if metric < bestMetric {
+			bestMetric = metric
+			bestIface = iface
+		}
+	}
+
+	return bestIface, nil
+}
+
+func defaultRoute() (d DefaultRouteDetails, err error) {
+	// We always return the IPv4 default route.
+	// TODO(bradfitz): adjust API if/when anything cares. They could in theory differ, though,
+	// in which case we might send traffic to the wrong interface.
+	iface, err := GetWindowsDefault(windows.AF_INET)
+	if err != nil {
+		return d, err
+	}
+	if iface != nil {
+		d.InterfaceName = iface.FriendlyName()
+		d.InterfaceDesc = iface.Description()
+		d.InterfaceIndex = int(iface.IfIndex)
+	}
+	return d, nil
+}
+
+var (
+	winHTTP                  = windows.NewLazySystemDLL("winhttp.dll")
+	detectAutoProxyConfigURL = winHTTP.NewProc("WinHttpDetectAutoProxyConfigUrl")
+
+	kernel32   = windows.NewLazySystemDLL("kernel32.dll")
+	globalFree = kernel32.NewProc("GlobalFree")
+)
+
+const (
+	winHTTP_AUTO_DETECT_TYPE_DHCP  = 0x00000001
+	winHTTP_AUTO_DETECT_TYPE_DNS_A = 0x00000002
+)
+
+func getPACWindows() string {
+	var res *uint16
+	r, _, e := detectAutoProxyConfigURL.Call(
+		winHTTP_AUTO_DETECT_TYPE_DHCP|winHTTP_AUTO_DETECT_TYPE_DNS_A,
+		uintptr(unsafe.Pointer(&res)),
+	)
+	if r == 1 {
+		if res == nil {
+			log.Printf("getPACWindows: unexpected success with nil result")
+			return ""
+		}
+		defer globalFree.Call(uintptr(unsafe.Pointer(res)))
+		s := windows.UTF16PtrToString(res)
+		s = strings.TrimSpace(s)
+		if s == "" {
+			return "" // Issue 2357: invalid URL "\n" from winhttp; ignoring
+		}
+		if _, err := url.Parse(s); err != nil {
+			log.Printf("getPACWindows: invalid URL %q from winhttp; ignoring", s)
+			return ""
+		}
+		return s
+	}
+	const (
+		ERROR_WINHTTP_AUTODETECTION_FAILED = 12180
+	)
+	if e == syscall.Errno(ERROR_WINHTTP_AUTODETECTION_FAILED) {
+		// Common case on networks without advertised PAC.
+		return ""
+	}
+	log.Printf("getPACWindows: %T=%v", e, e) // syscall.Errno=0x....
+	return ""
+}

vendor/tailscale.com/net/netmon/netmon.go

@@ -0,0 +1,626 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package monitor provides facilities for monitoring network
+// interface and route changes. It primarily exists to know when
+// portable devices move between different networks.
+package netmon
+
+import (
+	"encoding/json"
+	"errors"
+	"net/netip"
+	"runtime"
+	"sync"
+	"time"
+
+	"tailscale.com/types/logger"
+	"tailscale.com/util/clientmetric"
+	"tailscale.com/util/set"
+)
+
+// pollWallTimeInterval is how often we check the time to check
+// for big jumps in wall (non-monotonic) time as a backup mechanism
+// to get notified of a sleeping device waking back up.
+// Usually there are also minor network change events on wake that let
+// us check the wall time sooner than this.
+const pollWallTimeInterval = 15 * time.Second
+
+// message represents a message returned from an osMon.
+type message interface {
+	// Ignore is whether we should ignore this message.
+	ignore() bool
+}
+
+// osMon is the interface that each operating system-specific
+// implementation of the link monitor must implement.
+type osMon interface {
+	Close() error
+
+	// Receive returns a new network interface change message. It
+	// should block until there's either something to return, or
+	// until the osMon is closed. After a Close, the returned
+	// error is ignored.
+	Receive() (message, error)
+
+	// IsInterestingInterface reports whether the provided interface should
+	// be considered for network change events.
+	IsInterestingInterface(iface string) bool
+}
+
+// Monitor represents a monitoring instance.
+type Monitor struct {
+	logf   logger.Logf
+	om     osMon         // nil means not supported on this platform
+	change chan bool     // send false to wake poller, true to also force ChangeDeltas be sent
+	stop   chan struct{} // closed on Stop
+	static bool          // static Monitor that doesn't actually monitor
+
+	// Things that must be set early, before use,
+	// and not change at runtime.
+	tsIfName string // tailscale interface name, if known/set ("tailscale0", "utun3", ...)
+
+	mu         sync.Mutex // guards all following fields
+	cbs        set.HandleSet[ChangeFunc]
+	ruleDelCB  set.HandleSet[RuleDeleteCallback]
+	ifState    *State
+	gwValid    bool       // whether gw and gwSelfIP are valid
+	gw         netip.Addr // our gateway's IP
+	gwSelfIP   netip.Addr // our own IP address (that corresponds to gw)
+	started    bool
+	closed     bool
+	goroutines sync.WaitGroup
+	wallTimer  *time.Timer // nil until Started; re-armed AfterFunc per tick
+	lastWall   time.Time
+	timeJumped bool // whether we need to send a changed=true after a big time jump
+}
+
+// ChangeFunc is a callback function registered with Monitor that's called when the
+// network changed.
+type ChangeFunc func(*ChangeDelta)
+
+// ChangeDelta describes the difference between two network states.
+type ChangeDelta struct {
+	// Monitor is the network monitor that sent this delta.
+	Monitor *Monitor
+
+	// Old is the old interface state, if known.
+	// It's nil if the old state is unknown.
+	// Do not mutate it.
+	Old *State
+
+	// New is the new network state.
+	// It is always non-nil.
+	// Do not mutate it.
+	New *State
+
+	// Major is our legacy boolean of whether the network changed in some major
+	// way.
+	//
+	// Deprecated: do not remove. As of 2023-08-23 we're in a renewed effort to
+	// remove it and ask specific qustions of ChangeDelta instead. Look at Old
+	// and New (or add methods to ChangeDelta) instead of using Major.
+	Major bool
+
+	// TimeJumped is whether there was a big jump in wall time since the last
+	// time we checked. This is a hint that a mobile sleeping device might have
+	// come out of sleep.
+	TimeJumped bool
+
+	// TODO(bradfitz): add some lazy cached fields here as needed with methods
+	// on *ChangeDelta to let callers ask specific questions
+}
+
+// New instantiates and starts a monitoring instance.
+// The returned monitor is inactive until it's started by the Start method.
+// Use RegisterChangeCallback to get notified of network changes.
+func New(logf logger.Logf) (*Monitor, error) {
+	logf = logger.WithPrefix(logf, "monitor: ")
+	m := &Monitor{
+		logf:     logf,
+		change:   make(chan bool, 1),
+		stop:     make(chan struct{}),
+		lastWall: wallTime(),
+	}
+	st, err := m.interfaceStateUncached()
+	if err != nil {
+		return nil, err
+	}
+	m.ifState = st
+
+	m.om, err = newOSMon(logf, m)
+	if err != nil {
+		return nil, err
+	}
+	if m.om == nil {
+		return nil, errors.New("newOSMon returned nil, nil")
+	}
+
+	return m, nil
+}
+
+// NewStatic returns a Monitor that's a one-time snapshot of the network state
+// but doesn't actually monitor for changes. It should only be used in tests
+// and situations like cleanups or short-lived CLI programs.
+func NewStatic() *Monitor {
+	m := &Monitor{static: true}
+	if st, err := m.interfaceStateUncached(); err == nil {
+		m.ifState = st
+	}
+	return m
+}
+
+// InterfaceState returns the latest snapshot of the machine's network
+// interfaces.
+//
+// The returned value is owned by Mon; it must not be modified.
+func (m *Monitor) InterfaceState() *State {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.ifState
+}
+
+func (m *Monitor) interfaceStateUncached() (*State, error) {
+	return GetState()
+}
+
+// SetTailscaleInterfaceName sets the name of the Tailscale interface. For
+// example, "tailscale0", "tun0", "utun3", etc.
+//
+// This must be called only early in tailscaled startup before the monitor is
+// used.
+func (m *Monitor) SetTailscaleInterfaceName(ifName string) {
+	m.tsIfName = ifName
+}
+
+// GatewayAndSelfIP returns the current network's default gateway, and
+// the machine's default IP for that gateway.
+//
+// It's the same as interfaces.LikelyHomeRouterIP, but it caches the
+// result until the monitor detects a network change.
+func (m *Monitor) GatewayAndSelfIP() (gw, myIP netip.Addr, ok bool) {
+	if m.static {
+		return
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.gwValid {
+		return m.gw, m.gwSelfIP, true
+	}
+	gw, myIP, ok = LikelyHomeRouterIP()
+	changed := false
+	if ok {
+		changed = m.gw != gw || m.gwSelfIP != myIP
+		m.gw, m.gwSelfIP = gw, myIP
+		m.gwValid = true
+	}
+	if changed {
+		m.logf("gateway and self IP changed: gw=%v self=%v", m.gw, m.gwSelfIP)
+	}
+	return gw, myIP, ok
+}
+
+// RegisterChangeCallback adds callback to the set of parties to be
+// notified (in their own goroutine) when the network state changes.
+// To remove this callback, call unregister (or close the monitor).
+func (m *Monitor) RegisterChangeCallback(callback ChangeFunc) (unregister func()) {
+	if m.static {
+		return func() {}
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	handle := m.cbs.Add(callback)
+	return func() {
+		m.mu.Lock()
+		defer m.mu.Unlock()
+		delete(m.cbs, handle)
+	}
+}
+
+// RuleDeleteCallback is a callback when a Linux IP policy routing
+// rule is deleted. The table is the table number (52, 253, 354) and
+// priority is the priority order number (for Tailscale rules
+// currently: 5210, 5230, 5250, 5270)
+type RuleDeleteCallback func(table uint8, priority uint32)
+
+// RegisterRuleDeleteCallback adds callback to the set of parties to be
+// notified (in their own goroutine) when a Linux ip rule is deleted.
+// To remove this callback, call unregister (or close the monitor).
+func (m *Monitor) RegisterRuleDeleteCallback(callback RuleDeleteCallback) (unregister func()) {
+	if m.static {
+		return func() {}
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	handle := m.ruleDelCB.Add(callback)
+	return func() {
+		m.mu.Lock()
+		defer m.mu.Unlock()
+		delete(m.ruleDelCB, handle)
+	}
+}
+
+// Start starts the monitor.
+// A monitor can only be started & closed once.
+func (m *Monitor) Start() {
+	if m.static {
+		return
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.started || m.closed {
+		return
+	}
+	m.started = true
+
+	if shouldMonitorTimeJump {
+		m.wallTimer = time.AfterFunc(pollWallTimeInterval, m.pollWallTime)
+	}
+
+	if m.om == nil {
+		return
+	}
+	m.goroutines.Add(2)
+	go m.pump()
+	go m.debounce()
+}
+
+// Close closes the monitor.
+func (m *Monitor) Close() error {
+	if m.static {
+		return nil
+	}
+	m.mu.Lock()
+	if m.closed {
+		m.mu.Unlock()
+		return nil
+	}
+	m.closed = true
+	close(m.stop)
+
+	if m.wallTimer != nil {
+		m.wallTimer.Stop()
+	}
+
+	var err error
+	if m.om != nil {
+		err = m.om.Close()
+	}
+
+	started := m.started
+	m.mu.Unlock()
+
+	if started {
+		m.goroutines.Wait()
+	}
+	return err
+}
+
+// InjectEvent forces the monitor to pretend there was a network
+// change and re-check the state of the network. Any registered
+// ChangeFunc callbacks will be called within the event coalescing
+// period (under a fraction of a second).
+func (m *Monitor) InjectEvent() {
+	if m.static {
+		return
+	}
+	select {
+	case m.change <- true:
+	default:
+		// Another change signal is already
+		// buffered. Debounce will wake up soon
+		// enough.
+	}
+}
+
+// Poll forces the monitor to pretend there was a network
+// change and re-check the state of the network.
+//
+// This is like InjectEvent but only fires ChangeFunc callbacks
+// if the network state differed at all.
+func (m *Monitor) Poll() {
+	if m.static {
+		return
+	}
+	select {
+	case m.change <- false:
+	default:
+	}
+}
+
+func (m *Monitor) stopped() bool {
+	select {
+	case <-m.stop:
+		return true
+	default:
+		return false
+	}
+}
+
+// pump continuously retrieves messages from the connection, notifying
+// the change channel of changes, and stopping when a stop is issued.
+func (m *Monitor) pump() {
+	defer m.goroutines.Done()
+	for !m.stopped() {
+		msg, err := m.om.Receive()
+		if err != nil {
+			if m.stopped() {
+				return
+			}
+			// Keep retrying while we're not closed.
+			m.logf("error from link monitor: %v", err)
+			time.Sleep(time.Second)
+			continue
+		}
+		if rdm, ok := msg.(ipRuleDeletedMessage); ok {
+			m.notifyRuleDeleted(rdm)
+			continue
+		}
+		if msg.ignore() {
+			continue
+		}
+		m.Poll()
+	}
+}
+
+func (m *Monitor) notifyRuleDeleted(rdm ipRuleDeletedMessage) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for _, cb := range m.ruleDelCB {
+		go cb(rdm.table, rdm.priority)
+	}
+}
+
+// isInterestingInterface reports whether the provided interface should be
+// considered when checking for network state changes.
+// The ips parameter should be the IPs of the provided interface.
+func (m *Monitor) isInterestingInterface(i Interface, ips []netip.Prefix) bool {
+	if !m.om.IsInterestingInterface(i.Name) {
+		return false
+	}
+
+	return true
+}
+
+// debounce calls the callback function with a delay between events
+// and exits when a stop is issued.
+func (m *Monitor) debounce() {
+	defer m.goroutines.Done()
+	for {
+		var forceCallbacks bool
+		select {
+		case <-m.stop:
+			return
+		case forceCallbacks = <-m.change:
+		}
+
+		if newState, err := m.interfaceStateUncached(); err != nil {
+			m.logf("interfaces.State: %v", err)
+		} else {
+			m.handlePotentialChange(newState, forceCallbacks)
+		}
+
+		select {
+		case <-m.stop:
+			return
+		case <-time.After(250 * time.Millisecond):
+		}
+	}
+}
+
+var (
+	metricChangeEq       = clientmetric.NewCounter("netmon_link_change_eq")
+	metricChange         = clientmetric.NewCounter("netmon_link_change")
+	metricChangeTimeJump = clientmetric.NewCounter("netmon_link_change_timejump")
+	metricChangeMajor    = clientmetric.NewCounter("netmon_link_change_major")
+)
+
+// handlePotentialChange considers whether newState is different enough to wake
+// up callers and updates the monitor's state if so.
+//
+// If forceCallbacks is true, they're always notified.
+func (m *Monitor) handlePotentialChange(newState *State, forceCallbacks bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	oldState := m.ifState
+	timeJumped := shouldMonitorTimeJump && m.checkWallTimeAdvanceLocked()
+	if !timeJumped && !forceCallbacks && oldState.Equal(newState) {
+		// Exactly equal. Nothing to do.
+		metricChangeEq.Add(1)
+		return
+	}
+
+	delta := &ChangeDelta{
+		Monitor:    m,
+		Old:        oldState,
+		New:        newState,
+		TimeJumped: timeJumped,
+	}
+
+	delta.Major = m.IsMajorChangeFrom(oldState, newState)
+	if delta.Major {
+		m.gwValid = false
+		m.ifState = newState
+
+		if s1, s2 := oldState.String(), delta.New.String(); s1 == s2 {
+			m.logf("[unexpected] network state changed, but stringification didn't: %v", s1)
+			m.logf("[unexpected] old: %s", jsonSummary(oldState))
+			m.logf("[unexpected] new: %s", jsonSummary(newState))
+		}
+	}
+	// See if we have a queued or new time jump signal.
+	if timeJumped {
+		m.resetTimeJumpedLocked()
+		if !delta.Major {
+			// Only log if it wasn't an interesting change.
+			m.logf("time jumped (probably wake from sleep); synthesizing major change event")
+			delta.Major = true
+		}
+	}
+	metricChange.Add(1)
+	if delta.Major {
+		metricChangeMajor.Add(1)
+	}
+	if delta.TimeJumped {
+		metricChangeTimeJump.Add(1)
+	}
+	for _, cb := range m.cbs {
+		go cb(delta)
+	}
+}
+
+// IsMajorChangeFrom reports whether the transition from s1 to s2 is
+// a "major" change, where major roughly means it's worth tearing down
+// a bunch of connections and rebinding.
+//
+// TODO(bradiftz): tigten this definition.
+func (m *Monitor) IsMajorChangeFrom(s1, s2 *State) bool {
+	if s1 == nil && s2 == nil {
+		return false
+	}
+	if s1 == nil || s2 == nil {
+		return true
+	}
+	if s1.HaveV6 != s2.HaveV6 ||
+		s1.HaveV4 != s2.HaveV4 ||
+		s1.IsExpensive != s2.IsExpensive ||
+		s1.DefaultRouteInterface != s2.DefaultRouteInterface ||
+		s1.HTTPProxy != s2.HTTPProxy ||
+		s1.PAC != s2.PAC {
+		return true
+	}
+	for iname, i := range s1.Interface {
+		if iname == m.tsIfName {
+			// Ignore changes in the Tailscale interface itself.
+			continue
+		}
+		ips := s1.InterfaceIPs[iname]
+		if !m.isInterestingInterface(i, ips) {
+			continue
+		}
+		i2, ok := s2.Interface[iname]
+		if !ok {
+			return true
+		}
+		ips2, ok := s2.InterfaceIPs[iname]
+		if !ok {
+			return true
+		}
+		if !i.Equal(i2) || !prefixesMajorEqual(ips, ips2) {
+			return true
+		}
+	}
+	// Iterate over s2 in case there is a field in s2 that doesn't exist in s1
+	for iname, i := range s2.Interface {
+		if iname == m.tsIfName {
+			// Ignore changes in the Tailscale interface itself.
+			continue
+		}
+		ips := s2.InterfaceIPs[iname]
+		if !m.isInterestingInterface(i, ips) {
+			continue
+		}
+		i1, ok := s1.Interface[iname]
+		if !ok {
+			return true
+		}
+		ips1, ok := s1.InterfaceIPs[iname]
+		if !ok {
+			return true
+		}
+		if !i.Equal(i1) || !prefixesMajorEqual(ips, ips1) {
+			return true
+		}
+	}
+	return false
+}
+
+// prefixesMajorEqual reports whether a and b are equal after ignoring
+// boring things like link-local, loopback, and multicast addresses.
+func prefixesMajorEqual(a, b []netip.Prefix) bool {
+	// trim returns a subslice of p with link local unicast,
+	// loopback, and multicast prefixes removed from the front.
+	trim := func(p []netip.Prefix) []netip.Prefix {
+		for len(p) > 0 {
+			a := p[0].Addr()
+			if a.IsLinkLocalUnicast() || a.IsLoopback() || a.IsMulticast() {
+				p = p[1:]
+				continue
+			}
+			break
+		}
+		return p
+	}
+	for {
+		a = trim(a)
+		b = trim(b)
+		if len(a) == 0 || len(b) == 0 {
+			return len(a) == 0 && len(b) == 0
+		}
+		if a[0] != b[0] {
+			return false
+		}
+		a, b = a[1:], b[1:]
+	}
+}
+
+func jsonSummary(x any) any {
+	j, err := json.Marshal(x)
+	if err != nil {
+		return err
+	}
+	return j
+}
+
+func wallTime() time.Time {
+	// From time package's docs: "The canonical way to strip a
+	// monotonic clock reading is to use t = t.Round(0)."
+	return time.Now().Round(0)
+}
+
+func (m *Monitor) pollWallTime() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	if m.checkWallTimeAdvanceLocked() {
+		m.InjectEvent()
+	}
+	m.wallTimer.Reset(pollWallTimeInterval)
+}
+
+// shouldMonitorTimeJump is whether we keep a regular periodic timer running in
+// the background watching for jumps in wall time.
+//
+// We don't do this on mobile platforms for battery reasons, and because these
+// platforms don't really sleep in the same way.
+const shouldMonitorTimeJump = runtime.GOOS != "android" && runtime.GOOS != "ios"
+
+// checkWallTimeAdvanceLocked reports whether wall time jumped more than 150% of
+// pollWallTimeInterval, indicating we probably just came out of sleep. Once a
+// time jump is detected it must be reset by calling resetTimeJumpedLocked.
+func (m *Monitor) checkWallTimeAdvanceLocked() bool {
+	if !shouldMonitorTimeJump {
+		panic("unreachable") // if callers are correct
+	}
+	now := wallTime()
+	if now.Sub(m.lastWall) > pollWallTimeInterval*3/2 {
+		m.timeJumped = true // it is reset by debounce.
+	}
+	m.lastWall = now
+	return m.timeJumped
+}
+
+// resetTimeJumpedLocked consumes the signal set by checkWallTimeAdvanceLocked.
+func (m *Monitor) resetTimeJumpedLocked() {
+	m.timeJumped = false
+}
+
+type ipRuleDeletedMessage struct {
+	table    uint8
+	priority uint32
+}
+
+func (ipRuleDeletedMessage) ignore() bool { return true }

vendor/tailscale.com/net/netmon/netmon_darwin.go

@@ -0,0 +1,225 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netmon
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+	"sync"
+
+	"golang.org/x/net/route"
+	"golang.org/x/sys/unix"
+	"tailscale.com/net/netaddr"
+	"tailscale.com/types/logger"
+)
+
+const debugRouteMessages = false
+
+// unspecifiedMessage is a minimal message implementation that should not
+// be ignored. In general, OS-specific implementations should use better
+// types and avoid this if they can.
+type unspecifiedMessage struct{}
+
+func (unspecifiedMessage) ignore() bool { return false }
+
+func newOSMon(logf logger.Logf, _ *Monitor) (osMon, error) {
+	fd, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, 0)
+	if err != nil {
+		return nil, err
+	}
+	return &darwinRouteMon{
+		logf: logf,
+		fd:   fd,
+	}, nil
+}
+
+type darwinRouteMon struct {
+	logf      logger.Logf
+	fd        int // AF_ROUTE socket
+	buf       [2 << 10]byte
+	closeOnce sync.Once
+}
+
+func (m *darwinRouteMon) Close() error {
+	var err error
+	m.closeOnce.Do(func() {
+		err = unix.Close(m.fd)
+	})
+	return err
+}
+
+func (m *darwinRouteMon) Receive() (message, error) {
+	for {
+		n, err := unix.Read(m.fd, m.buf[:])
+		if err != nil {
+			return nil, err
+		}
+		msgs, err := route.ParseRIB(route.RIBTypeRoute, m.buf[:n])
+		if err != nil {
+			if debugRouteMessages {
+				m.logf("read %d bytes (% 02x), failed to parse RIB: %v", n, m.buf[:n], err)
+			}
+			return unspecifiedMessage{}, nil
+		}
+		if len(msgs) == 0 {
+			if debugRouteMessages {
+				m.logf("read %d bytes with no messages (% 02x)", n, m.buf[:n])
+			}
+			continue
+		}
+		nSkip := 0
+		for _, msg := range msgs {
+			if m.skipMessage(msg) {
+				nSkip++
+			}
+		}
+		if debugRouteMessages {
+			m.logf("read %d bytes, %d messages (%d skipped)", n, len(msgs), nSkip)
+			if nSkip < len(msgs) {
+				m.logMessages(msgs)
+			}
+		}
+		if nSkip == len(msgs) {
+			continue
+		}
+		return unspecifiedMessage{}, nil
+	}
+}
+
+func (m *darwinRouteMon) skipMessage(msg route.Message) bool {
+	switch msg := msg.(type) {
+	case *route.InterfaceMulticastAddrMessage:
+		return true
+	case *route.InterfaceAddrMessage:
+		return m.skipInterfaceAddrMessage(msg)
+	case *route.RouteMessage:
+		return m.skipRouteMessage(msg)
+	}
+	return false
+}
+
+// addrType returns addrs[rtaxType], if that (the route address type) exists,
+// else it returns nil.
+//
+// The RTAX_* constants at https://github.com/apple/darwin-xnu/blob/main/bsd/net/route.h
+// for what each address index represents.
+func addrType(addrs []route.Addr, rtaxType int) route.Addr {
+	if len(addrs) > rtaxType {
+		return addrs[rtaxType]
+	}
+	return nil
+}
+
+func (m *darwinRouteMon) IsInterestingInterface(iface string) bool {
+	baseName := strings.TrimRight(iface, "0123456789")
+	switch baseName {
+	// TODO(maisem): figure out what this list should actually be.
+	case "llw", "awdl", "ipsec":
+		return false
+	}
+	return true
+}
+
+func (m *darwinRouteMon) skipInterfaceAddrMessage(msg *route.InterfaceAddrMessage) bool {
+	if la, ok := addrType(msg.Addrs, unix.RTAX_IFP).(*route.LinkAddr); ok {
+		if !m.IsInterestingInterface(la.Name) {
+			return true
+		}
+	}
+	return false
+}
+
+func (m *darwinRouteMon) skipRouteMessage(msg *route.RouteMessage) bool {
+	if ip := ipOfAddr(addrType(msg.Addrs, unix.RTAX_DST)); ip.IsLinkLocalUnicast() {
+		// Skip those like:
+		// dst = fe80::b476:66ff:fe30:c8f6%15
+		return true
+	}
+	return false
+}
+
+func (m *darwinRouteMon) logMessages(msgs []route.Message) {
+	for i, msg := range msgs {
+		switch msg := msg.(type) {
+		default:
+			m.logf("  [%d] %T", i, msg)
+		case *route.InterfaceAddrMessage:
+			m.logf("  [%d] InterfaceAddrMessage: ver=%d, type=%v, flags=0x%x, idx=%v",
+				i, msg.Version, msg.Type, msg.Flags, msg.Index)
+			m.logAddrs(msg.Addrs)
+		case *route.InterfaceMulticastAddrMessage:
+			m.logf("  [%d] InterfaceMulticastAddrMessage: ver=%d, type=%v, flags=0x%x, idx=%v",
+				i, msg.Version, msg.Type, msg.Flags, msg.Index)
+			m.logAddrs(msg.Addrs)
+		case *route.RouteMessage:
+			m.logf("  [%d] RouteMessage: ver=%d, type=%v, flags=0x%x, idx=%v, id=%v, seq=%v, err=%v",
+				i, msg.Version, msg.Type, msg.Flags, msg.Index, msg.ID, msg.Seq, msg.Err)
+			m.logAddrs(msg.Addrs)
+		}
+	}
+}
+
+func (m *darwinRouteMon) logAddrs(addrs []route.Addr) {
+	for i, a := range addrs {
+		if a == nil {
+			continue
+		}
+		m.logf("      %v = %v", rtaxName(i), fmtAddr(a))
+	}
+}
+
+// ipOfAddr returns the route.Addr (possibly nil) as a netip.Addr
+// (possibly zero).
+func ipOfAddr(a route.Addr) netip.Addr {
+	switch a := a.(type) {
+	case *route.Inet4Addr:
+		return netaddr.IPv4(a.IP[0], a.IP[1], a.IP[2], a.IP[3])
+	case *route.Inet6Addr:
+		ip := netip.AddrFrom16(a.IP)
+		if a.ZoneID != 0 {
+			ip = ip.WithZone(fmt.Sprint(a.ZoneID)) // TODO: look up net.InterfaceByIndex? but it might be changing?
+		}
+		return ip
+	}
+	return netip.Addr{}
+}
+
+func fmtAddr(a route.Addr) any {
+	if a == nil {
+		return nil
+	}
+	if ip := ipOfAddr(a); ip.IsValid() {
+		return ip
+	}
+	switch a := a.(type) {
+	case *route.LinkAddr:
+		return fmt.Sprintf("[LinkAddr idx=%v name=%q addr=%x]", a.Index, a.Name, a.Addr)
+	default:
+		return fmt.Sprintf("%T: %+v", a, a)
+	}
+}
+
+// See https://github.com/apple/darwin-xnu/blob/main/bsd/net/route.h
+func rtaxName(i int) string {
+	switch i {
+	case unix.RTAX_DST:
+		return "dst"
+	case unix.RTAX_GATEWAY:
+		return "gateway"
+	case unix.RTAX_NETMASK:
+		return "netmask"
+	case unix.RTAX_GENMASK:
+		return "genmask"
+	case unix.RTAX_IFP: // "interface name sockaddr present"
+		return "IFP"
+	case unix.RTAX_IFA: // "interface addr sockaddr present"
+		return "IFA"
+	case unix.RTAX_AUTHOR:
+		return "author"
+	case unix.RTAX_BRD:
+		return "BRD"
+	}
+	return fmt.Sprint(i)
+}

vendor/tailscale.com/net/netmon/netmon_freebsd.go

@@ -0,0 +1,56 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netmon
+
+import (
+	"bufio"
+	"fmt"
+	"net"
+	"strings"
+
+	"tailscale.com/types/logger"
+)
+
+// unspecifiedMessage is a minimal message implementation that should not
+// be ignored. In general, OS-specific implementations should use better
+// types and avoid this if they can.
+type unspecifiedMessage struct{}
+
+func (unspecifiedMessage) ignore() bool { return false }
+
+// devdConn implements osMon using devd(8).
+type devdConn struct {
+	conn net.Conn
+}
+
+func newOSMon(logf logger.Logf, m *Monitor) (osMon, error) {
+	conn, err := net.Dial("unixpacket", "/var/run/devd.seqpacket.pipe")
+	if err != nil {
+		logf("devd dial error: %v, falling back to polling method", err)
+		return newPollingMon(logf, m)
+	}
+	return &devdConn{conn}, nil
+}
+
+func (c *devdConn) IsInterestingInterface(iface string) bool { return true }
+
+func (c *devdConn) Close() error {
+	return c.conn.Close()
+}
+
+func (c *devdConn) Receive() (message, error) {
+	for {
+		msg, err := bufio.NewReader(c.conn).ReadString('\n')
+		if err != nil {
+			return nil, fmt.Errorf("reading devd socket: %v", err)
+		}
+		// Only return messages related to the network subsystem.
+		if !strings.Contains(msg, "system=IFNET") {
+			continue
+		}
+		// TODO: this is where the devd-specific message would
+		// get converted into a "standard" event message and returned.
+		return unspecifiedMessage{}, nil
+	}
+}

vendor/tailscale.com/net/netmon/netmon_linux.go

@@ -0,0 +1,290 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !android
+
+package netmon
+
+import (
+	"net"
+	"net/netip"
+	"time"
+
+	"github.com/jsimonetti/rtnetlink"
+	"github.com/mdlayher/netlink"
+	"golang.org/x/sys/unix"
+	"tailscale.com/envknob"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/logger"
+)
+
+var debugNetlinkMessages = envknob.RegisterBool("TS_DEBUG_NETLINK")
+
+// unspecifiedMessage is a minimal message implementation that should not
+// be ignored. In general, OS-specific implementations should use better
+// types and avoid this if they can.
+type unspecifiedMessage struct{}
+
+func (unspecifiedMessage) ignore() bool { return false }
+
+// nlConn wraps a *netlink.Conn and returns a monitor.Message
+// instead of a netlink.Message. Currently, messages are discarded,
+// but down the line, when messages trigger different logic depending
+// on the type of event, this provides the capability of handling
+// each architecture-specific message in a generic fashion.
+type nlConn struct {
+	logf     logger.Logf
+	conn     *netlink.Conn
+	buffered []netlink.Message
+
+	// addrCache maps interface indices to a set of addresses, and is
+	// used to suppress duplicate RTM_NEWADDR messages. It is populated
+	// by RTM_NEWADDR messages and de-populated by RTM_DELADDR. See
+	// issue #4282.
+	addrCache map[uint32]map[netip.Addr]bool
+}
+
+func newOSMon(logf logger.Logf, m *Monitor) (osMon, error) {
+	conn, err := netlink.Dial(unix.NETLINK_ROUTE, &netlink.Config{
+		// Routes get us most of the events of interest, but we need
+		// address as well to cover things like DHCP deciding to give
+		// us a new address upon renewal - routing wouldn't change,
+		// but all reachability would.
+		Groups: unix.RTMGRP_IPV4_IFADDR | unix.RTMGRP_IPV6_IFADDR |
+			unix.RTMGRP_IPV4_ROUTE | unix.RTMGRP_IPV6_ROUTE |
+			unix.RTMGRP_IPV4_RULE, // no IPV6_RULE in x/sys/unix
+	})
+	if err != nil {
+		// Google Cloud Run does not implement NETLINK_ROUTE RTMGRP support
+		logf("monitor_linux: AF_NETLINK RTMGRP failed, falling back to polling")
+		return newPollingMon(logf, m)
+	}
+	return &nlConn{logf: logf, conn: conn, addrCache: make(map[uint32]map[netip.Addr]bool)}, nil
+}
+
+func (c *nlConn) IsInterestingInterface(iface string) bool { return true }
+
+func (c *nlConn) Close() error { return c.conn.Close() }
+
+func (c *nlConn) Receive() (message, error) {
+	if len(c.buffered) == 0 {
+		var err error
+		c.buffered, err = c.conn.Receive()
+		if err != nil {
+			return nil, err
+		}
+		if len(c.buffered) == 0 {
+			// Unexpected. Not seen in wild, but sleep defensively.
+			time.Sleep(time.Second)
+			return ignoreMessage{}, nil
+		}
+	}
+	msg := c.buffered[0]
+	c.buffered = c.buffered[1:]
+
+	// See https://github.com/torvalds/linux/blob/master/include/uapi/linux/rtnetlink.h
+	// And https://man7.org/linux/man-pages/man7/rtnetlink.7.html
+	switch msg.Header.Type {
+	case unix.RTM_NEWADDR, unix.RTM_DELADDR:
+		var rmsg rtnetlink.AddressMessage
+		if err := rmsg.UnmarshalBinary(msg.Data); err != nil {
+			c.logf("failed to parse type %v: %v", msg.Header.Type, err)
+			return unspecifiedMessage{}, nil
+		}
+
+		nip := netaddrIP(rmsg.Attributes.Address)
+
+		if debugNetlinkMessages() {
+			typ := "RTM_NEWADDR"
+			if msg.Header.Type == unix.RTM_DELADDR {
+				typ = "RTM_DELADDR"
+			}
+
+			// label attributes are seemingly only populated for IPv4 addresses in the wild.
+			label := rmsg.Attributes.Label
+			if label == "" {
+				itf, err := net.InterfaceByIndex(int(rmsg.Index))
+				if err == nil {
+					label = itf.Name
+				}
+			}
+
+			c.logf("%s: %s(%d) %s / %s", typ, label, rmsg.Index, rmsg.Attributes.Address, rmsg.Attributes.Local)
+		}
+
+		addrs := c.addrCache[rmsg.Index]
+
+		// Ignore duplicate RTM_NEWADDR messages using c.addrCache to
+		// detect them. See nlConn.addrcache and issue #4282.
+		if msg.Header.Type == unix.RTM_NEWADDR {
+			if addrs == nil {
+				addrs = make(map[netip.Addr]bool)
+				c.addrCache[rmsg.Index] = addrs
+			}
+
+			if addrs[nip] {
+				if debugNetlinkMessages() {
+					c.logf("ignored duplicate RTM_NEWADDR for %s", nip)
+				}
+				return ignoreMessage{}, nil
+			}
+
+			addrs[nip] = true
+		} else { // msg.Header.Type == unix.RTM_DELADDR
+			if addrs != nil {
+				delete(addrs, nip)
+			}
+
+			if len(addrs) == 0 {
+				delete(c.addrCache, rmsg.Index)
+			}
+		}
+
+		nam := &newAddrMessage{
+			IfIndex: rmsg.Index,
+			Addr:    nip,
+			Delete:  msg.Header.Type == unix.RTM_DELADDR,
+		}
+		if debugNetlinkMessages() {
+			c.logf("%+v", nam)
+		}
+		return nam, nil
+	case unix.RTM_NEWROUTE, unix.RTM_DELROUTE:
+		typeStr := "RTM_NEWROUTE"
+		if msg.Header.Type == unix.RTM_DELROUTE {
+			typeStr = "RTM_DELROUTE"
+		}
+		var rmsg rtnetlink.RouteMessage
+		if err := rmsg.UnmarshalBinary(msg.Data); err != nil {
+			c.logf("%s: failed to parse: %v", typeStr, err)
+			return unspecifiedMessage{}, nil
+		}
+		src := netaddrIPPrefix(rmsg.Attributes.Src, rmsg.SrcLength)
+		dst := netaddrIPPrefix(rmsg.Attributes.Dst, rmsg.DstLength)
+		gw := netaddrIP(rmsg.Attributes.Gateway)
+
+		if msg.Header.Type == unix.RTM_NEWROUTE &&
+			(rmsg.Attributes.Table == 255 || rmsg.Attributes.Table == 254) &&
+			(dst.Addr().IsMulticast() || dst.Addr().IsLinkLocalUnicast()) {
+
+			if debugNetlinkMessages() {
+				c.logf("%s ignored", typeStr)
+			}
+
+			// Normal Linux route changes on new interface coming up; don't log or react.
+			return ignoreMessage{}, nil
+		}
+
+		if rmsg.Table == tsTable && dst.IsSingleIP() {
+			// Don't log. Spammy and normal to see a bunch of these on start-up,
+			// which we make ourselves.
+		} else if tsaddr.IsTailscaleIP(dst.Addr()) {
+			// Verbose only.
+			c.logf("%s: [v1] src=%v, dst=%v, gw=%v, outif=%v, table=%v", typeStr,
+				condNetAddrPrefix(src), condNetAddrPrefix(dst), condNetAddrIP(gw),
+				rmsg.Attributes.OutIface, rmsg.Attributes.Table)
+		} else {
+			c.logf("%s: src=%v, dst=%v, gw=%v, outif=%v, table=%v", typeStr,
+				condNetAddrPrefix(src), condNetAddrPrefix(dst), condNetAddrIP(gw),
+				rmsg.Attributes.OutIface, rmsg.Attributes.Table)
+		}
+		if msg.Header.Type == unix.RTM_DELROUTE {
+			// Just logging it for now.
+			// (Debugging https://github.com/tailscale/tailscale/issues/643)
+			return unspecifiedMessage{}, nil
+		}
+
+		nrm := &newRouteMessage{
+			Table:   rmsg.Table,
+			Src:     src,
+			Dst:     dst,
+			Gateway: gw,
+		}
+		if debugNetlinkMessages() {
+			c.logf("%+v", nrm)
+		}
+		return nrm, nil
+	case unix.RTM_NEWRULE:
+		// Probably ourselves adding it.
+		return ignoreMessage{}, nil
+	case unix.RTM_DELRULE:
+		// For https://github.com/tailscale/tailscale/issues/1591 where
+		// systemd-networkd deletes our rules.
+		var rmsg rtnetlink.RouteMessage
+		err := rmsg.UnmarshalBinary(msg.Data)
+		if err != nil {
+			c.logf("ip rule deleted; failed to parse netlink message: %v", err)
+		} else {
+			c.logf("ip rule deleted: %+v", rmsg)
+			// On `ip -4 rule del pref 5210 table main`, logs:
+			// monitor: ip rule deleted: {Family:2 DstLength:0 SrcLength:0 Tos:0 Table:254 Protocol:0 Scope:0 Type:1 Flags:0 Attributes:{Dst:<nil> Src:<nil> Gateway:<nil> OutIface:0 Priority:5210 Table:254 Mark:4294967295 Expires:<nil> Metrics:<nil> Multipath:[]}}
+		}
+		rdm := ipRuleDeletedMessage{
+			table:    rmsg.Table,
+			priority: rmsg.Attributes.Priority,
+		}
+		if debugNetlinkMessages() {
+			c.logf("%+v", rdm)
+		}
+		return rdm, nil
+	case unix.RTM_NEWLINK, unix.RTM_DELLINK:
+		// This is an unhandled message, but don't print an error.
+		// See https://github.com/tailscale/tailscale/issues/6806
+		return unspecifiedMessage{}, nil
+	default:
+		c.logf("unhandled netlink msg type %+v, %q", msg.Header, msg.Data)
+		return unspecifiedMessage{}, nil
+	}
+}
+
+func netaddrIP(std net.IP) netip.Addr {
+	ip, _ := netip.AddrFromSlice(std)
+	return ip.Unmap()
+}
+
+func netaddrIPPrefix(std net.IP, bits uint8) netip.Prefix {
+	ip, _ := netip.AddrFromSlice(std)
+	return netip.PrefixFrom(ip.Unmap(), int(bits))
+}
+
+func condNetAddrPrefix(ipp netip.Prefix) string {
+	if !ipp.Addr().IsValid() {
+		return ""
+	}
+	return ipp.String()
+}
+
+func condNetAddrIP(ip netip.Addr) string {
+	if !ip.IsValid() {
+		return ""
+	}
+	return ip.String()
+}
+
+// newRouteMessage is a message for a new route being added.
+type newRouteMessage struct {
+	Src, Dst netip.Prefix
+	Gateway  netip.Addr
+	Table    uint8
+}
+
+const tsTable = 52
+
+func (m *newRouteMessage) ignore() bool {
+	return m.Table == tsTable || tsaddr.IsTailscaleIP(m.Dst.Addr())
+}
+
+// newAddrMessage is a message for a new address being added.
+type newAddrMessage struct {
+	Delete  bool
+	Addr    netip.Addr
+	IfIndex uint32 // interface index
+}
+
+func (m *newAddrMessage) ignore() bool {
+	return tsaddr.IsTailscaleIP(m.Addr)
+}
+
+type ignoreMessage struct{}
+
+func (ignoreMessage) ignore() bool { return true }

vendor/tailscale.com/net/netmon/netmon_polling.go

@@ -0,0 +1,21 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build (!linux && !freebsd && !windows && !darwin) || android
+
+package netmon
+
+import (
+	"tailscale.com/types/logger"
+)
+
+func newOSMon(logf logger.Logf, m *Monitor) (osMon, error) {
+	return newPollingMon(logf, m)
+}
+
+// unspecifiedMessage is a minimal message implementation that should not
+// be ignored. In general, OS-specific implementations should use better
+// types and avoid this if they can.
+type unspecifiedMessage struct{}
+
+func (unspecifiedMessage) ignore() bool { return false }

vendor/tailscale.com/net/netmon/netmon_windows.go

@@ -0,0 +1,190 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netmon
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/logger"
+)
+
+var (
+	errClosed = errors.New("closed")
+)
+
+type eventMessage struct {
+	eventType string
+}
+
+func (eventMessage) ignore() bool { return false }
+
+type winMon struct {
+	logf                  logger.Logf
+	ctx                   context.Context
+	cancel                context.CancelFunc
+	isActive              func() bool
+	messagec              chan eventMessage
+	addressChangeCallback *winipcfg.UnicastAddressChangeCallback
+	routeChangeCallback   *winipcfg.RouteChangeCallback
+
+	mu      sync.Mutex
+	lastLog time.Time // time we last logged about any windows change event
+
+	// noDeadlockTicker exists just to have something scheduled as
+	// far as the Go runtime is concerned. Otherwise "tailscaled
+	// debug --monitor" thinks it's deadlocked with nothing to do,
+	// as Go's runtime doesn't know about callbacks registered with
+	// Windows.
+	noDeadlockTicker *time.Ticker
+}
+
+func newOSMon(logf logger.Logf, pm *Monitor) (osMon, error) {
+	m := &winMon{
+		logf:             logf,
+		isActive:         pm.isActive,
+		messagec:         make(chan eventMessage, 1),
+		noDeadlockTicker: time.NewTicker(5000 * time.Hour), // arbitrary
+	}
+	m.ctx, m.cancel = context.WithCancel(context.Background())
+
+	var err error
+	m.addressChangeCallback, err = winipcfg.RegisterUnicastAddressChangeCallback(m.unicastAddressChanged)
+	if err != nil {
+		m.logf("winipcfg.RegisterUnicastAddressChangeCallback error: %v", err)
+		m.cancel()
+		return nil, err
+	}
+
+	m.routeChangeCallback, err = winipcfg.RegisterRouteChangeCallback(m.routeChanged)
+	if err != nil {
+		m.addressChangeCallback.Unregister()
+		m.logf("winipcfg.RegisterRouteChangeCallback error: %v", err)
+		m.cancel()
+		return nil, err
+	}
+
+	return m, nil
+}
+
+func (m *winMon) IsInterestingInterface(iface string) bool { return true }
+
+func (m *winMon) Close() (ret error) {
+	m.cancel()
+	m.noDeadlockTicker.Stop()
+
+	if m.addressChangeCallback != nil {
+		if err := m.addressChangeCallback.Unregister(); err != nil {
+			m.logf("addressChangeCallback.Unregister error: %v", err)
+			ret = err
+		} else {
+			m.addressChangeCallback = nil
+		}
+	}
+
+	if m.routeChangeCallback != nil {
+		if err := m.routeChangeCallback.Unregister(); err != nil {
+			m.logf("routeChangeCallback.Unregister error: %v", err)
+			ret = err
+		} else {
+			m.routeChangeCallback = nil
+		}
+	}
+
+	return
+}
+
+func (m *winMon) Receive() (message, error) {
+	if m.ctx.Err() != nil {
+		m.logf("Receive call on closed monitor")
+		return nil, errClosed
+	}
+
+	t0 := time.Now()
+
+	select {
+	case msg := <-m.messagec:
+		now := time.Now()
+		m.mu.Lock()
+		sinceLast := now.Sub(m.lastLog)
+		m.lastLog = now
+		m.mu.Unlock()
+		// If it's either been awhile since we last logged
+		// anything, or if this some route/addr that's not
+		// about a Tailscale IP ("ts" prefix), then log. This
+		// is mainly limited to suppress the flood about our own
+		// route updates after connecting to a large tailnet
+		// and all the IPv4 /32 routes.
+		if sinceLast > 5*time.Second || !strings.HasPrefix(msg.eventType, "ts") {
+			m.logf("got windows change event after %v: evt=%s", time.Since(t0).Round(time.Millisecond), msg.eventType)
+		}
+		return msg, nil
+	case <-m.ctx.Done():
+		return nil, errClosed
+	}
+}
+
+// unicastAddressChanged is the callback we register with Windows to call when unicast address changes.
+func (m *winMon) unicastAddressChanged(_ winipcfg.MibNotificationType, row *winipcfg.MibUnicastIPAddressRow) {
+	if !m.isActive() {
+		// Avoid starting a goroutine that sends events to messagec,
+		// or sending messages to messagec directly, if the monitor
+		// hasn't started and Receive is not yet reading from messagec.
+		//
+		// Doing so can lead to goroutine leaks or deadlocks, especially
+		// if the monitor is never started.
+		return
+	}
+
+	what := "addr"
+	if ip := row.Address.Addr(); ip.IsValid() && tsaddr.IsTailscaleIP(ip.Unmap()) {
+		what = "tsaddr"
+	}
+
+	// start a goroutine to finish our work, to return to Windows out of this callback
+	go m.somethingChanged(what)
+}
+
+// routeChanged is the callback we register with Windows to call when route changes.
+func (m *winMon) routeChanged(_ winipcfg.MibNotificationType, row *winipcfg.MibIPforwardRow2) {
+	if !m.isActive() {
+		// Avoid starting a goroutine that sends events to messagec,
+		// or sending messages to messagec directly, if the monitor
+		// hasn't started and Receive is not yet reading from messagec.
+		//
+		// Doing so can lead to goroutine leaks or deadlocks, especially
+		// if the monitor is never started.
+		return
+	}
+
+	what := "route"
+	ip := row.DestinationPrefix.Prefix().Addr().Unmap()
+	if ip.IsValid() && tsaddr.IsTailscaleIP(ip) {
+		what = "tsroute"
+	}
+	// start a goroutine to finish our work, to return to Windows out of this callback
+	go m.somethingChanged(what)
+}
+
+// somethingChanged gets called from OS callbacks whenever address or route changes.
+func (m *winMon) somethingChanged(evt string) {
+	select {
+	case <-m.ctx.Done():
+		return
+	case m.messagec <- eventMessage{eventType: evt}:
+		return
+	}
+}
+
+// isActive reports whether this monitor has been started and not yet closed.
+func (m *Monitor) isActive() bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.started && !m.closed
+}

vendor/tailscale.com/net/netmon/polling.go

@@ -0,0 +1,86 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !windows && !darwin
+
+package netmon
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"runtime"
+	"sync"
+	"time"
+
+	"tailscale.com/types/logger"
+)
+
+func newPollingMon(logf logger.Logf, m *Monitor) (osMon, error) {
+	return &pollingMon{
+		logf: logf,
+		m:    m,
+		stop: make(chan struct{}),
+	}, nil
+}
+
+// pollingMon is a bad but portable implementation of the link monitor
+// that works by polling the interface state every 10 seconds, in lieu
+// of anything to subscribe to.
+type pollingMon struct {
+	logf logger.Logf
+	m    *Monitor
+
+	closeOnce sync.Once
+	stop      chan struct{}
+}
+
+func (pm *pollingMon) IsInterestingInterface(iface string) bool {
+	return true
+}
+
+func (pm *pollingMon) Close() error {
+	pm.closeOnce.Do(func() {
+		close(pm.stop)
+	})
+	return nil
+}
+
+func (pm *pollingMon) isCloudRun() bool {
+	// https: //cloud.google.com/run/docs/reference/container-contract#env-vars
+	if os.Getenv("K_REVISION") == "" || os.Getenv("K_CONFIGURATION") == "" ||
+		os.Getenv("K_SERVICE") == "" || os.Getenv("PORT") == "" {
+		return false
+	}
+	vers, err := os.ReadFile("/proc/version")
+	if err != nil {
+		pm.logf("Failed to read /proc/version: %v", err)
+		return false
+	}
+	return string(bytes.TrimSpace(vers)) == "Linux version 4.4.0 #1 SMP Sun Jan 10 15:06:54 PST 2016"
+}
+
+func (pm *pollingMon) Receive() (message, error) {
+	d := 10 * time.Second
+	if runtime.GOOS == "android" {
+		// We'll have Android notify the link monitor to wake up earlier,
+		// so this can go very slowly there, to save battery.
+		// https://github.com/tailscale/tailscale/issues/1427
+		d = 10 * time.Minute
+	} else if pm.isCloudRun() {
+		// Cloud Run routes never change at runtime. the containers are killed within
+		// 15 minutes by default, set the interval long enough to be effectively infinite.
+		pm.logf("monitor polling: Cloud Run detected, reduce polling interval to 24h")
+		d = 24 * time.Hour
+	}
+	timer := time.NewTimer(d)
+	defer timer.Stop()
+	for {
+		select {
+		case <-timer.C:
+			return unspecifiedMessage{}, nil
+		case <-pm.stop:
+			return nil, errors.New("stopped")
+		}
+	}
+}

vendor/tailscale.com/net/netmon/state.go

@@ -0,0 +1,773 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netmon
+
+import (
+	"bytes"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"runtime"
+	"slices"
+	"sort"
+	"strings"
+
+	"tailscale.com/envknob"
+	"tailscale.com/hostinfo"
+	"tailscale.com/net/netaddr"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/net/tshttpproxy"
+)
+
+// LoginEndpointForProxyDetermination is the URL used for testing
+// which HTTP proxy the system should use.
+var LoginEndpointForProxyDetermination = "https://controlplane.tailscale.com/"
+
+func isUp(nif *net.Interface) bool       { return nif.Flags&net.FlagUp != 0 }
+func isLoopback(nif *net.Interface) bool { return nif.Flags&net.FlagLoopback != 0 }
+
+func isProblematicInterface(nif *net.Interface) bool {
+	name := nif.Name
+	// Don't try to send disco/etc packets over zerotier; they effectively
+	// DoS each other by doing traffic amplification, both of them
+	// preferring/trying to use each other for transport. See:
+	// https://github.com/tailscale/tailscale/issues/1208
+	if strings.HasPrefix(name, "zt") || (runtime.GOOS == "windows" && strings.Contains(name, "ZeroTier")) {
+		return true
+	}
+	return false
+}
+
+// LocalAddresses returns the machine's IP addresses, separated by
+// whether they're loopback addresses. If there are no regular addresses
+// it will return any IPv4 linklocal or IPv6 unique local addresses because we
+// know of environments where these are used with NAT to provide connectivity.
+func LocalAddresses() (regular, loopback []netip.Addr, err error) {
+	// TODO(crawshaw): don't serve interface addresses that we are routing
+	ifaces, err := netInterfaces()
+	if err != nil {
+		return nil, nil, err
+	}
+	var regular4, regular6, linklocal4, ula6 []netip.Addr
+	for _, iface := range ifaces {
+		stdIf := iface.Interface
+		if !isUp(stdIf) || isProblematicInterface(stdIf) {
+			// Skip down interfaces and ones that are
+			// problematic that we don't want to try to
+			// send Tailscale traffic over.
+			continue
+		}
+		ifcIsLoopback := isLoopback(stdIf)
+
+		addrs, err := iface.Addrs()
+		if err != nil {
+			return nil, nil, err
+		}
+		for _, a := range addrs {
+			switch v := a.(type) {
+			case *net.IPNet:
+				ip, ok := netip.AddrFromSlice(v.IP)
+				if !ok {
+					continue
+				}
+				ip = ip.Unmap()
+				// TODO(apenwarr): don't special case cgNAT.
+				// In the general wireguard case, it might
+				// very well be something we can route to
+				// directly, because both nodes are
+				// behind the same CGNAT router.
+				if tsaddr.IsTailscaleIP(ip) {
+					continue
+				}
+				if ip.IsLoopback() || ifcIsLoopback {
+					loopback = append(loopback, ip)
+				} else if ip.IsLinkLocalUnicast() {
+					if ip.Is4() {
+						linklocal4 = append(linklocal4, ip)
+					}
+
+					// We know of no cases where the IPv6 fe80:: addresses
+					// are used to provide WAN connectivity. It is also very
+					// common for users to have no IPv6 WAN connectivity,
+					// but their OS supports IPv6 so they have an fe80::
+					// address. We don't want to report all of those
+					// IPv6 LL to Control.
+				} else if ip.Is6() && ip.IsPrivate() {
+					// Google Cloud Run uses NAT with IPv6 Unique
+					// Local Addresses to provide IPv6 connectivity.
+					ula6 = append(ula6, ip)
+				} else {
+					if ip.Is4() {
+						regular4 = append(regular4, ip)
+					} else {
+						regular6 = append(regular6, ip)
+					}
+				}
+			}
+		}
+	}
+	if len(regular4) == 0 && len(regular6) == 0 {
+		// if we have no usable IP addresses then be willing to accept
+		// addresses we otherwise wouldn't, like:
+		//   + 169.254.x.x (AWS Lambda and Azure App Services use NAT with these)
+		//   + IPv6 ULA (Google Cloud Run uses these with address translation)
+		regular4 = linklocal4
+		regular6 = ula6
+	}
+	regular = append(regular4, regular6...)
+	sortIPs(regular)
+	sortIPs(loopback)
+	return regular, loopback, nil
+}
+
+func sortIPs(s []netip.Addr) {
+	sort.Slice(s, func(i, j int) bool { return s[i].Less(s[j]) })
+}
+
+// Interface is a wrapper around Go's net.Interface with some extra methods.
+type Interface struct {
+	*net.Interface
+	AltAddrs []net.Addr // if non-nil, returned by Addrs
+	Desc     string     // extra description (used on Windows)
+}
+
+func (i Interface) IsLoopback() bool { return isLoopback(i.Interface) }
+func (i Interface) IsUp() bool       { return isUp(i.Interface) }
+func (i Interface) Addrs() ([]net.Addr, error) {
+	if i.AltAddrs != nil {
+		return i.AltAddrs, nil
+	}
+	return i.Interface.Addrs()
+}
+
+// ForeachInterfaceAddress is a wrapper for GetList, then
+// List.ForeachInterfaceAddress.
+func ForeachInterfaceAddress(fn func(Interface, netip.Prefix)) error {
+	ifaces, err := GetInterfaceList()
+	if err != nil {
+		return err
+	}
+	return ifaces.ForeachInterfaceAddress(fn)
+}
+
+// ForeachInterfaceAddress calls fn for each interface in ifaces, with
+// all its addresses. The IPPrefix's IP is the IP address assigned to
+// the interface, and Bits are the subnet mask.
+func (ifaces InterfaceList) ForeachInterfaceAddress(fn func(Interface, netip.Prefix)) error {
+	for _, iface := range ifaces {
+		addrs, err := iface.Addrs()
+		if err != nil {
+			return err
+		}
+		for _, a := range addrs {
+			switch v := a.(type) {
+			case *net.IPNet:
+				if pfx, ok := netaddr.FromStdIPNet(v); ok {
+					fn(iface, pfx)
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// ForeachInterface is a wrapper for GetList, then
+// List.ForeachInterface.
+func ForeachInterface(fn func(Interface, []netip.Prefix)) error {
+	ifaces, err := GetInterfaceList()
+	if err != nil {
+		return err
+	}
+	return ifaces.ForeachInterface(fn)
+}
+
+// ForeachInterface calls fn for each interface in ifaces, with
+// all its addresses. The IPPrefix's IP is the IP address assigned to
+// the interface, and Bits are the subnet mask.
+func (ifaces InterfaceList) ForeachInterface(fn func(Interface, []netip.Prefix)) error {
+	for _, iface := range ifaces {
+		addrs, err := iface.Addrs()
+		if err != nil {
+			return err
+		}
+		var pfxs []netip.Prefix
+		for _, a := range addrs {
+			switch v := a.(type) {
+			case *net.IPNet:
+				if pfx, ok := netaddr.FromStdIPNet(v); ok {
+					pfxs = append(pfxs, pfx)
+				}
+			}
+		}
+		sort.Slice(pfxs, func(i, j int) bool {
+			return pfxs[i].Addr().Less(pfxs[j].Addr())
+		})
+		fn(iface, pfxs)
+	}
+	return nil
+}
+
+// State is intended to store the state of the machine's network interfaces,
+// routing table, and other network configuration.
+// For now it's pretty basic.
+type State struct {
+	// InterfaceIPs maps from an interface name to the IP addresses
+	// configured on that interface. Each address is represented as an
+	// IPPrefix, where the IP is the interface IP address and Bits is
+	// the subnet mask.
+	InterfaceIPs map[string][]netip.Prefix
+	Interface    map[string]Interface
+
+	// HaveV6 is whether this machine has an IPv6 Global or Unique Local Address
+	// which might provide connectivity on a non-Tailscale interface that's up.
+	HaveV6 bool
+
+	// HaveV4 is whether the machine has some non-localhost,
+	// non-link-local IPv4 address on a non-Tailscale interface that's up.
+	HaveV4 bool
+
+	// IsExpensive is whether the current network interface is
+	// considered "expensive", which currently means LTE/etc
+	// instead of Wifi. This field is not populated by GetState.
+	IsExpensive bool
+
+	// DefaultRouteInterface is the interface name for the
+	// machine's default route.
+	//
+	// It is not yet populated on all OSes.
+	//
+	// When non-empty, its value is the map key into Interface and
+	// InterfaceIPs.
+	DefaultRouteInterface string
+
+	// HTTPProxy is the HTTP proxy to use, if any.
+	HTTPProxy string
+
+	// PAC is the URL to the Proxy Autoconfig URL, if applicable.
+	PAC string
+}
+
+func (s *State) String() string {
+	var sb strings.Builder
+	fmt.Fprintf(&sb, "interfaces.State{defaultRoute=%v ", s.DefaultRouteInterface)
+	if s.DefaultRouteInterface != "" {
+		if iface, ok := s.Interface[s.DefaultRouteInterface]; ok && iface.Desc != "" {
+			fmt.Fprintf(&sb, "(%s) ", iface.Desc)
+		}
+	}
+	sb.WriteString("ifs={")
+	var ifs []string
+	for k := range s.Interface {
+		if s.keepInterfaceInStringSummary(k) {
+			ifs = append(ifs, k)
+		}
+	}
+	sort.Slice(ifs, func(i, j int) bool {
+		upi, upj := s.Interface[ifs[i]].IsUp(), s.Interface[ifs[j]].IsUp()
+		if upi != upj {
+			// Up sorts before down.
+			return upi
+		}
+		return ifs[i] < ifs[j]
+	})
+	for i, ifName := range ifs {
+		if i > 0 {
+			sb.WriteString(" ")
+		}
+		iface := s.Interface[ifName]
+		if iface.Interface == nil {
+			fmt.Fprintf(&sb, "%s:nil", ifName)
+			continue
+		}
+		if !iface.IsUp() {
+			fmt.Fprintf(&sb, "%s:down", ifName)
+			continue
+		}
+		fmt.Fprintf(&sb, "%s:[", ifName)
+		needSpace := false
+		for _, pfx := range s.InterfaceIPs[ifName] {
+			a := pfx.Addr()
+			if a.IsMulticast() {
+				continue
+			}
+			fam := "4"
+			if a.Is6() {
+				fam = "6"
+			}
+			if needSpace {
+				sb.WriteString(" ")
+			}
+			needSpace = true
+			switch {
+			case a.IsLoopback():
+				fmt.Fprintf(&sb, "lo%s", fam)
+			case a.IsLinkLocalUnicast():
+				fmt.Fprintf(&sb, "llu%s", fam)
+			default:
+				fmt.Fprintf(&sb, "%s", pfx)
+			}
+		}
+		sb.WriteString("]")
+	}
+	sb.WriteString("}")
+
+	if s.IsExpensive {
+		sb.WriteString(" expensive")
+	}
+	if s.HTTPProxy != "" {
+		fmt.Fprintf(&sb, " httpproxy=%s", s.HTTPProxy)
+	}
+	if s.PAC != "" {
+		fmt.Fprintf(&sb, " pac=%s", s.PAC)
+	}
+	fmt.Fprintf(&sb, " v4=%v v6=%v}", s.HaveV4, s.HaveV6)
+	return sb.String()
+}
+
+// Equal reports whether s and s2 are exactly equal.
+func (s *State) Equal(s2 *State) bool {
+	if s == nil && s2 == nil {
+		return true
+	}
+	if s == nil || s2 == nil {
+		return false
+	}
+	if s.HaveV6 != s2.HaveV6 ||
+		s.HaveV4 != s2.HaveV4 ||
+		s.IsExpensive != s2.IsExpensive ||
+		s.DefaultRouteInterface != s2.DefaultRouteInterface ||
+		s.HTTPProxy != s2.HTTPProxy ||
+		s.PAC != s2.PAC {
+		return false
+	}
+	// If s2 has more interfaces than s, it's not equal.
+	if len(s.Interface) != len(s2.Interface) || len(s.InterfaceIPs) != len(s2.InterfaceIPs) {
+		return false
+	}
+	// Now that we know that both states have the same number of
+	// interfaces, we can check each interface in s against s2. If it's not
+	// present or not exactly equal, then the states are not equal.
+	for iname, i := range s.Interface {
+		i2, ok := s2.Interface[iname]
+		if !ok {
+			return false
+		}
+		if !i.Equal(i2) {
+			return false
+		}
+	}
+	for iname, vv := range s.InterfaceIPs {
+		if !slices.Equal(vv, s2.InterfaceIPs[iname]) {
+			return false
+		}
+	}
+	return true
+}
+
+// HasIP reports whether any interface has the provided IP address.
+func (s *State) HasIP(ip netip.Addr) bool {
+	if s == nil {
+		return false
+	}
+	for _, pv := range s.InterfaceIPs {
+		for _, p := range pv {
+			if p.Contains(ip) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func (a Interface) Equal(b Interface) bool {
+	if (a.Interface == nil) != (b.Interface == nil) {
+		return false
+	}
+	if !(a.Desc == b.Desc && netAddrsEqual(a.AltAddrs, b.AltAddrs)) {
+		return false
+	}
+	if a.Interface != nil && !(a.Index == b.Index &&
+		a.MTU == b.MTU &&
+		a.Name == b.Name &&
+		a.Flags == b.Flags &&
+		bytes.Equal([]byte(a.HardwareAddr), []byte(b.HardwareAddr))) {
+		return false
+	}
+	return true
+}
+
+func (s *State) HasPAC() bool { return s != nil && s.PAC != "" }
+
+// AnyInterfaceUp reports whether any interface seems like it has Internet access.
+func (s *State) AnyInterfaceUp() bool {
+	if runtime.GOOS == "js" || runtime.GOOS == "tamago" {
+		return true
+	}
+	return s != nil && (s.HaveV4 || s.HaveV6)
+}
+
+func netAddrsEqual(a, b []net.Addr) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i, av := range a {
+		if av.Network() != b[i].Network() || av.String() != b[i].String() {
+			return false
+		}
+	}
+	return true
+}
+
+func hasTailscaleIP(pfxs []netip.Prefix) bool {
+	for _, pfx := range pfxs {
+		if tsaddr.IsTailscaleIP(pfx.Addr()) {
+			return true
+		}
+	}
+	return false
+}
+
+func isTailscaleInterface(name string, ips []netip.Prefix) bool {
+	if runtime.GOOS == "darwin" && strings.HasPrefix(name, "utun") && hasTailscaleIP(ips) {
+		// On macOS in the sandboxed app (at least as of
+		// 2021-02-25), we often see two utun devices
+		// (e.g. utun4 and utun7) with the same IPv4 and IPv6
+		// addresses. Just remove all utun devices with
+		// Tailscale IPs until we know what's happening with
+		// macOS NetworkExtensions and utun devices.
+		return true
+	}
+	return name == "Tailscale" || // as it is on Windows
+		strings.HasPrefix(name, "tailscale") // TODO: use --tun flag value, etc; see TODO in method doc
+}
+
+// getPAC, if non-nil, returns the current PAC file URL.
+var getPAC func() string
+
+// GetState returns the state of all the current machine's network interfaces.
+//
+// It does not set the returned State.IsExpensive. The caller can populate that.
+//
+// Deprecated: use netmon.Monitor.InterfaceState instead.
+func GetState() (*State, error) {
+	s := &State{
+		InterfaceIPs: make(map[string][]netip.Prefix),
+		Interface:    make(map[string]Interface),
+	}
+	if err := ForeachInterface(func(ni Interface, pfxs []netip.Prefix) {
+		ifUp := ni.IsUp()
+		s.Interface[ni.Name] = ni
+		s.InterfaceIPs[ni.Name] = append(s.InterfaceIPs[ni.Name], pfxs...)
+		if !ifUp || isTailscaleInterface(ni.Name, pfxs) {
+			return
+		}
+		for _, pfx := range pfxs {
+			if pfx.Addr().IsLoopback() {
+				continue
+			}
+			s.HaveV6 = s.HaveV6 || isUsableV6(pfx.Addr())
+			s.HaveV4 = s.HaveV4 || isUsableV4(pfx.Addr())
+		}
+	}); err != nil {
+		return nil, err
+	}
+
+	dr, _ := DefaultRoute()
+	s.DefaultRouteInterface = dr.InterfaceName
+
+	// Populate description (for Windows, primarily) if present.
+	if desc := dr.InterfaceDesc; desc != "" {
+		if iface, ok := s.Interface[dr.InterfaceName]; ok {
+			iface.Desc = desc
+			s.Interface[dr.InterfaceName] = iface
+		}
+	}
+
+	if s.AnyInterfaceUp() {
+		req, err := http.NewRequest("GET", LoginEndpointForProxyDetermination, nil)
+		if err != nil {
+			return nil, err
+		}
+		if u, err := tshttpproxy.ProxyFromEnvironment(req); err == nil && u != nil {
+			s.HTTPProxy = u.String()
+		}
+		if getPAC != nil {
+			s.PAC = getPAC()
+		}
+	}
+
+	return s, nil
+}
+
+// HTTPOfListener returns the HTTP address to ln.
+// If the listener is listening on the unspecified address, it
+// it tries to find a reasonable interface address on the machine to use.
+func HTTPOfListener(ln net.Listener) string {
+	ta, ok := ln.Addr().(*net.TCPAddr)
+	if !ok || !ta.IP.IsUnspecified() {
+		return fmt.Sprintf("http://%v/", ln.Addr())
+	}
+
+	var goodIP string
+	var privateIP string
+	ForeachInterfaceAddress(func(i Interface, pfx netip.Prefix) {
+		ip := pfx.Addr()
+		if ip.IsPrivate() {
+			if privateIP == "" {
+				privateIP = ip.String()
+			}
+			return
+		}
+		goodIP = ip.String()
+	})
+	if privateIP != "" {
+		goodIP = privateIP
+	}
+	if goodIP != "" {
+		return fmt.Sprintf("http://%v/", net.JoinHostPort(goodIP, fmt.Sprint(ta.Port)))
+	}
+	return fmt.Sprintf("http://localhost:%v/", fmt.Sprint(ta.Port))
+
+}
+
+// likelyHomeRouterIP, if present, is a platform-specific function that is used
+// to determine the likely home router IP of the current system. The signature
+// of this function is:
+//
+//	func() (homeRouter, localAddr netip.Addr, ok bool)
+//
+// It should return a homeRouter IP and ok=true, or no homeRouter IP and
+// ok=false. Optionally, an implementation can return the "self" IP address as
+// well, which will be used instead of attempting to determine it by reading
+// the system's interfaces.
+var likelyHomeRouterIP func() (netip.Addr, netip.Addr, bool)
+
+// For debugging the new behaviour where likelyHomeRouterIP can return the
+// "self" IP; should remove after we're confidant this won't cause issues.
+var disableLikelyHomeRouterIPSelf = envknob.RegisterBool("TS_DEBUG_DISABLE_LIKELY_HOME_ROUTER_IP_SELF")
+
+// LikelyHomeRouterIP returns the likely IP of the residential router,
+// which will always be an IPv4 private address, if found.
+// In addition, it returns the IP address of the current machine on
+// the LAN using that gateway.
+// This is used as the destination for UPnP, NAT-PMP, PCP, etc queries.
+func LikelyHomeRouterIP() (gateway, myIP netip.Addr, ok bool) {
+	// If we don't have a way to get the home router IP, then we can't do
+	// anything; just return.
+	if likelyHomeRouterIP == nil {
+		return
+	}
+
+	// Get the gateway next; if that fails, we can't continue.
+	gateway, myIP, ok = likelyHomeRouterIP()
+	if !ok {
+		return
+	}
+
+	// If the platform-specific implementation returned a valid myIP, then
+	// we can return it as-is without needing to iterate through all
+	// interface addresses.
+	if disableLikelyHomeRouterIPSelf() {
+		myIP = netip.Addr{}
+	}
+	if myIP.IsValid() {
+		return
+	}
+
+	// The platform-specific implementation didn't return a valid myIP;
+	// iterate through all interfaces and try to find the correct one.
+	ForeachInterfaceAddress(func(i Interface, pfx netip.Prefix) {
+		if !i.IsUp() {
+			// Skip interfaces that aren't up.
+			return
+		} else if myIP.IsValid() {
+			// We already have a valid self IP; skip this one.
+			return
+		}
+
+		ip := pfx.Addr()
+		if !ip.IsValid() || !ip.Is4() {
+			// Skip IPs that aren't valid or aren't IPv4, since we
+			// always return an IPv4 address.
+			return
+		}
+
+		// If this prefix ("interface") doesn't contain the gateway,
+		// then we skip it; this can happen if we have multiple valid
+		// interfaces and the interface with the route to the internet
+		// is ordered after another valid+running interface.
+		if !pfx.Contains(gateway) {
+			return
+		}
+
+		if gateway.IsPrivate() && ip.IsPrivate() {
+			myIP = ip
+			ok = true
+			return
+		}
+	})
+	return gateway, myIP, myIP.IsValid()
+}
+
+// isUsableV4 reports whether ip is a usable IPv4 address which could
+// conceivably be used to get Internet connectivity. Globally routable and
+// private IPv4 addresses are always Usable, and link local 169.254.x.x
+// addresses are in some environments.
+func isUsableV4(ip netip.Addr) bool {
+	if !ip.Is4() || ip.IsLoopback() {
+		return false
+	}
+	if ip.IsLinkLocalUnicast() {
+		switch hostinfo.GetEnvType() {
+		case hostinfo.AWSLambda:
+			return true
+		case hostinfo.AzureAppService:
+			return true
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// isUsableV6 reports whether ip is a usable IPv6 address which could
+// conceivably be used to get Internet connectivity. Globally routable
+// IPv6 addresses are always Usable, and Unique Local Addresses
+// (fc00::/7) are in some environments used with address translation.
+func isUsableV6(ip netip.Addr) bool {
+	return v6Global1.Contains(ip) ||
+		(ip.Is6() && ip.IsPrivate() && !tsaddr.TailscaleULARange().Contains(ip))
+}
+
+var (
+	v6Global1 = netip.MustParsePrefix("2000::/3")
+)
+
+// keepInterfaceInStringSummary reports whether the named interface should be included
+// in the String method's summary string.
+func (s *State) keepInterfaceInStringSummary(ifName string) bool {
+	iface, ok := s.Interface[ifName]
+	if !ok || iface.Interface == nil {
+		return false
+	}
+	if ifName == s.DefaultRouteInterface {
+		return true
+	}
+	up := iface.IsUp()
+	for _, p := range s.InterfaceIPs[ifName] {
+		a := p.Addr()
+		if a.IsLinkLocalUnicast() || a.IsLoopback() {
+			continue
+		}
+		if up || a.IsGlobalUnicast() || a.IsPrivate() {
+			return true
+		}
+	}
+	return false
+}
+
+var altNetInterfaces func() ([]Interface, error)
+
+// RegisterInterfaceGetter sets the function that's used to query
+// the system network interfaces.
+func RegisterInterfaceGetter(getInterfaces func() ([]Interface, error)) {
+	altNetInterfaces = getInterfaces
+}
+
+// InterfaceList is a list of interfaces on the machine.
+type InterfaceList []Interface
+
+// GetInterfaceList returns the list of interfaces on the machine.
+func GetInterfaceList() (InterfaceList, error) {
+	return netInterfaces()
+}
+
+// netInterfaces is a wrapper around the standard library's net.Interfaces
+// that returns a []*Interface instead of a []net.Interface.
+// It exists because Android SDK 30 no longer permits Go's net.Interfaces
+// to work (Issue 2293); this wrapper lets us the Android app register
+// an alternate implementation.
+func netInterfaces() ([]Interface, error) {
+	if altNetInterfaces != nil {
+		return altNetInterfaces()
+	}
+	ifs, err := net.Interfaces()
+	if err != nil {
+		return nil, err
+	}
+	ret := make([]Interface, len(ifs))
+	for i := range ifs {
+		ret[i].Interface = &ifs[i]
+	}
+	return ret, nil
+}
+
+// DefaultRouteDetails are the details about a default route returned
+// by DefaultRoute.
+type DefaultRouteDetails struct {
+	// InterfaceName is the interface name. It must always be populated.
+	// It's like "eth0" (Linux), "Ethernet 2" (Windows), "en0" (macOS).
+	InterfaceName string
+
+	// InterfaceDesc is populated on Windows at least. It's a
+	// longer description, like "Red Hat VirtIO Ethernet Adapter".
+	InterfaceDesc string
+
+	// InterfaceIndex is like net.Interface.Index.
+	// Zero means not populated.
+	InterfaceIndex int
+
+	// TODO(bradfitz): break this out into v4-vs-v6 once that need arises.
+}
+
+// DefaultRouteInterface is like DefaultRoute but only returns the
+// interface name.
+func DefaultRouteInterface() (string, error) {
+	dr, err := DefaultRoute()
+	if err != nil {
+		return "", err
+	}
+	return dr.InterfaceName, nil
+}
+
+// DefaultRoute returns details of the network interface that owns
+// the default route, not including any tailscale interfaces.
+func DefaultRoute() (DefaultRouteDetails, error) {
+	return defaultRoute()
+}
+
+// HasCGNATInterface reports whether there are any non-Tailscale interfaces that
+// use a CGNAT IP range.
+func HasCGNATInterface() (bool, error) {
+	hasCGNATInterface := false
+	cgnatRange := tsaddr.CGNATRange()
+	err := ForeachInterface(func(i Interface, pfxs []netip.Prefix) {
+		if hasCGNATInterface || !i.IsUp() || isTailscaleInterface(i.Name, pfxs) {
+			return
+		}
+		for _, pfx := range pfxs {
+			if cgnatRange.Overlaps(pfx) {
+				hasCGNATInterface = true
+				break
+			}
+		}
+	})
+	if err != nil {
+		return false, err
+	}
+	return hasCGNATInterface, nil
+}
+
+var interfaceDebugExtras func(ifIndex int) (string, error)
+
+// InterfaceDebugExtras returns extra debugging information about an interface
+// if any (an empty string will be returned if there are no additional details).
+// Formatting is platform-dependent and should not be parsed.
+func InterfaceDebugExtras(ifIndex int) (string, error) {
+	if interfaceDebugExtras != nil {
+		return interfaceDebugExtras(ifIndex)
+	}
+	return "", nil
+}

vendor/tailscale.com/net/netns/mksyscall.go

@@ -0,0 +1,9 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netns
+
+//go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go mksyscall.go
+//go:generate go run golang.org/x/tools/cmd/goimports -w zsyscall_windows.go
+
+//sys getBestInterfaceEx(sockaddr *winipcfg.RawSockaddrInet, bestIfaceIndex *uint32) (ret error) = iphlpapi.GetBestInterfaceEx

vendor/tailscale.com/net/netns/netns.go

@@ -0,0 +1,135 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netns contains the common code for using the Go net package
+// in a logical "network namespace" to avoid routing loops where
+// Tailscale-created packets would otherwise loop back through
+// Tailscale routes.
+//
+// Despite the name netns, the exact mechanism used differs by
+// operating system, and perhaps even by version of the OS.
+//
+// The netns package also handles connecting via SOCKS proxies when
+// configured by the environment.
+package netns
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"sync/atomic"
+
+	"tailscale.com/net/netknob"
+	"tailscale.com/net/netmon"
+	"tailscale.com/types/logger"
+)
+
+var disabled atomic.Bool
+
+// SetEnabled enables or disables netns for the process.
+// It defaults to being enabled.
+func SetEnabled(on bool) {
+	disabled.Store(!on)
+}
+
+var bindToInterfaceByRoute atomic.Bool
+
+// SetBindToInterfaceByRoute enables or disables whether we use the system's
+// route information to bind to a particular interface. It is the same as
+// setting the TS_BIND_TO_INTERFACE_BY_ROUTE.
+//
+// Currently, this only changes the behaviour on macOS and Windows.
+func SetBindToInterfaceByRoute(v bool) {
+	bindToInterfaceByRoute.Store(v)
+}
+
+var disableBindConnToInterface atomic.Bool
+
+// SetDisableBindConnToInterface disables the (normal) behavior of binding
+// connections to the default network interface.
+//
+// Currently, this only has an effect on Darwin.
+func SetDisableBindConnToInterface(v bool) {
+	disableBindConnToInterface.Store(v)
+}
+
+// Listener returns a new net.Listener with its Control hook func
+// initialized as necessary to run in logical network namespace that
+// doesn't route back into Tailscale.
+func Listener(logf logger.Logf, netMon *netmon.Monitor) *net.ListenConfig {
+	if netMon == nil {
+		panic("netns.Listener called with nil netMon")
+	}
+	if disabled.Load() {
+		return new(net.ListenConfig)
+	}
+	return &net.ListenConfig{Control: control(logf, netMon)}
+}
+
+// NewDialer returns a new Dialer using a net.Dialer with its Control
+// hook func initialized as necessary to run in a logical network
+// namespace that doesn't route back into Tailscale. It also handles
+// using a SOCKS if configured in the environment with ALL_PROXY.
+func NewDialer(logf logger.Logf, netMon *netmon.Monitor) Dialer {
+	if netMon == nil {
+		panic("netns.NewDialer called with nil netMon")
+	}
+	return FromDialer(logf, netMon, &net.Dialer{
+		KeepAlive: netknob.PlatformTCPKeepAlive(),
+	})
+}
+
+// FromDialer returns sets d.Control as necessary to run in a logical
+// network namespace that doesn't route back into Tailscale. It also
+// handles using a SOCKS if configured in the environment with
+// ALL_PROXY.
+func FromDialer(logf logger.Logf, netMon *netmon.Monitor, d *net.Dialer) Dialer {
+	if netMon == nil {
+		panic("netns.FromDialer called with nil netMon")
+	}
+	if disabled.Load() {
+		return d
+	}
+	d.Control = control(logf, netMon)
+	if wrapDialer != nil {
+		return wrapDialer(d)
+	}
+	return d
+}
+
+// IsSOCKSDialer reports whether d is SOCKS-proxying dialer as returned by
+// NewDialer or FromDialer.
+func IsSOCKSDialer(d Dialer) bool {
+	if d == nil {
+		return false
+	}
+	_, ok := d.(*net.Dialer)
+	return !ok
+}
+
+// wrapDialer, if non-nil, specifies a function to wrap a dialer in a
+// SOCKS-using dialer. It's set conditionally by socks.go.
+var wrapDialer func(Dialer) Dialer
+
+// Dialer is the interface for a dialer that can dial with or without a context.
+// It's the type implemented both by net.Dialer and the Go SOCKS dialer.
+type Dialer interface {
+	Dial(network, address string) (net.Conn, error)
+	DialContext(ctx context.Context, network, address string) (net.Conn, error)
+}
+
+func isLocalhost(addr string) bool {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		// error means the string didn't contain a port number, so use the string directly
+		host = addr
+	}
+
+	// localhost6 == RedHat /etc/hosts for ::1, ip6-loopback & ip6-localhost == Debian /etc/hosts for ::1
+	if host == "localhost" || host == "localhost6" || host == "ip6-loopback" || host == "ip6-localhost" {
+		return true
+	}
+
+	ip, _ := netip.ParseAddr(host)
+	return ip.IsLoopback()
+}

vendor/tailscale.com/net/netns/netns_android.go

@@ -0,0 +1,75 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build android
+
+package netns
+
+import (
+	"fmt"
+	"sync"
+	"syscall"
+
+	"tailscale.com/net/netmon"
+	"tailscale.com/types/logger"
+)
+
+var (
+	androidProtectFuncMu sync.Mutex
+	androidProtectFunc   func(fd int) error
+)
+
+// UseSocketMark reports whether SO_MARK is in use. Android does not use SO_MARK.
+func UseSocketMark() bool {
+	return false
+}
+
+// SetAndroidProtectFunc register a func that Android provides that JNI calls into
+// https://developer.android.com/reference/android/net/VpnService#protect(int)
+// which is documented as:
+//
+// "Protect a socket from VPN connections. After protecting, data sent
+// through this socket will go directly to the underlying network, so
+// its traffic will not be forwarded through the VPN. This method is
+// useful if some connections need to be kept outside of VPN. For
+// example, a VPN tunnel should protect itself if its destination is
+// covered by VPN routes. Otherwise its outgoing packets will be sent
+// back to the VPN interface and cause an infinite loop. This method
+// will fail if the application is not prepared or is revoked."
+//
+// A nil func disables the use the hook.
+//
+// This indirection is necessary because this is the supported, stable
+// interface to use on Android, and doing the sockopts to set the
+// fwmark return errors on Android. The actual implementation of
+// VpnService.protect ends up doing an IPC to another process on
+// Android, asking for the fwmark to be set.
+func SetAndroidProtectFunc(f func(fd int) error) {
+	androidProtectFuncMu.Lock()
+	defer androidProtectFuncMu.Unlock()
+	androidProtectFunc = f
+}
+
+func control(logger.Logf, *netmon.Monitor) func(network, address string, c syscall.RawConn) error {
+	return controlC
+}
+
+// controlC marks c as necessary to dial in a separate network namespace.
+//
+// It's intentionally the same signature as net.Dialer.Control
+// and net.ListenConfig.Control.
+func controlC(network, address string, c syscall.RawConn) error {
+	var sockErr error
+	err := c.Control(func(fd uintptr) {
+		androidProtectFuncMu.Lock()
+		f := androidProtectFunc
+		androidProtectFuncMu.Unlock()
+		if f != nil {
+			sockErr = f(int(fd))
+		}
+	})
+	if err != nil {
+		return fmt.Errorf("RawConn.Control on %T: %w", c, err)
+	}
+	return sockErr
+}

vendor/tailscale.com/net/netns/netns_darwin.go

@@ -0,0 +1,287 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build darwin
+
+package netns
+
+import (
+	"errors"
+	"fmt"
+	"log"
+	"net"
+	"net/netip"
+	"os"
+	"strings"
+	"syscall"
+
+	"golang.org/x/net/route"
+	"golang.org/x/sys/unix"
+	"tailscale.com/envknob"
+	"tailscale.com/net/netmon"
+	"tailscale.com/net/tsaddr"
+	"tailscale.com/types/logger"
+)
+
+func control(logf logger.Logf, netMon *netmon.Monitor) func(network, address string, c syscall.RawConn) error {
+	return func(network, address string, c syscall.RawConn) error {
+		return controlLogf(logf, netMon, network, address, c)
+	}
+}
+
+var bindToInterfaceByRouteEnv = envknob.RegisterBool("TS_BIND_TO_INTERFACE_BY_ROUTE")
+
+var errInterfaceStateInvalid = errors.New("interface state invalid")
+
+// controlLogf marks c as necessary to dial in a separate network namespace.
+//
+// It's intentionally the same signature as net.Dialer.Control
+// and net.ListenConfig.Control.
+func controlLogf(logf logger.Logf, netMon *netmon.Monitor, network, address string, c syscall.RawConn) error {
+	if isLocalhost(address) {
+		// Don't bind to an interface for localhost connections.
+		return nil
+	}
+
+	if disableBindConnToInterface.Load() {
+		logf("netns_darwin: binding connection to interfaces disabled")
+		return nil
+	}
+
+	idx, err := getInterfaceIndex(logf, netMon, address)
+	if err != nil {
+		// callee logged
+		return nil
+	}
+
+	return bindConnToInterface(c, network, address, idx, logf)
+}
+
+func getInterfaceIndex(logf logger.Logf, netMon *netmon.Monitor, address string) (int, error) {
+	// Helper so we can log errors.
+	defaultIdx := func() (int, error) {
+		if netMon == nil {
+			idx, err := netmon.DefaultRouteInterfaceIndex()
+			if err != nil {
+				// It's somewhat common for there to be no default gateway route
+				// (e.g. on a phone with no connectivity), don't log those errors
+				// since they are expected.
+				if !errors.Is(err, netmon.ErrNoGatewayIndexFound) {
+					logf("[unexpected] netns: DefaultRouteInterfaceIndex: %v", err)
+				}
+				return -1, err
+			}
+			return idx, nil
+		}
+		state := netMon.InterfaceState()
+		if state == nil {
+			return -1, errInterfaceStateInvalid
+		}
+
+		if iface, ok := state.Interface[state.DefaultRouteInterface]; ok {
+			return iface.Index, nil
+		}
+		return -1, errInterfaceStateInvalid
+	}
+
+	useRoute := bindToInterfaceByRoute.Load() || bindToInterfaceByRouteEnv()
+	if !useRoute {
+		return defaultIdx()
+	}
+
+	// If the address doesn't parse, use the default index.
+	addr, err := parseAddress(address)
+	if err != nil {
+		if err != errUnspecifiedHost {
+			logf("[unexpected] netns: error parsing address %q: %v", address, err)
+		}
+		return defaultIdx()
+	}
+
+	idx, err := interfaceIndexFor(addr, true /* canRecurse */)
+	if err != nil {
+		logf("netns: error in interfaceIndexFor: %v", err)
+		return defaultIdx()
+	}
+
+	// Verify that we didn't just choose the Tailscale interface;
+	// if so, we fall back to binding from the default.
+	tsif, err2 := tailscaleInterface()
+	if err2 == nil && tsif != nil && tsif.Index == idx {
+		logf("[unexpected] netns: interfaceIndexFor returned Tailscale interface")
+		return defaultIdx()
+	}
+
+	return idx, err
+}
+
+// tailscaleInterface returns the current machine's Tailscale interface, if any.
+// If none is found, (nil, nil) is returned.
+// A non-nil error is only returned on a problem listing the system interfaces.
+func tailscaleInterface() (*net.Interface, error) {
+	ifs, err := net.Interfaces()
+	if err != nil {
+		return nil, err
+	}
+	for _, iface := range ifs {
+		if !strings.HasPrefix(iface.Name, "utun") {
+			continue
+		}
+		addrs, err := iface.Addrs()
+		if err != nil {
+			continue
+		}
+		for _, a := range addrs {
+			if ipnet, ok := a.(*net.IPNet); ok {
+				nip, ok := netip.AddrFromSlice(ipnet.IP)
+				if ok && tsaddr.IsTailscaleIP(nip.Unmap()) {
+					return &iface, nil
+				}
+			}
+		}
+	}
+	return nil, nil
+}
+
+// interfaceIndexFor returns the interface index that we should bind to in
+// order to send traffic to the provided address.
+func interfaceIndexFor(addr netip.Addr, canRecurse bool) (int, error) {
+	fd, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
+	if err != nil {
+		return 0, fmt.Errorf("creating AF_ROUTE socket: %w", err)
+	}
+	defer unix.Close(fd)
+
+	var routeAddr route.Addr
+	if addr.Is4() {
+		routeAddr = &route.Inet4Addr{IP: addr.As4()}
+	} else {
+		routeAddr = &route.Inet6Addr{IP: addr.As16()}
+	}
+
+	rm := route.RouteMessage{
+		// NOTE: This is unix.RTM_VERSION, but we want to pin this to a
+		// particular constant so that it doesn't change under us if
+		// the x/sys/unix package changes down the road. Currently this
+		// is 0x5 on both Darwin x86 and ARM64.
+		Version: 0x5,
+		Type:    unix.RTM_GET,
+		Flags:   unix.RTF_UP,
+		ID:      uintptr(os.Getpid()),
+		Seq:     1,
+		Addrs: []route.Addr{
+			unix.RTAX_DST: routeAddr,
+		},
+	}
+	b, err := rm.Marshal()
+	if err != nil {
+		return 0, fmt.Errorf("marshaling RouteMessage: %w", err)
+	}
+	_, err = unix.Write(fd, b)
+	if err != nil {
+		return 0, fmt.Errorf("writing message: %w", err)
+	}
+
+	// On macOS, the RTM_GET call should return exactly one route message.
+	// Given the following sizes and constants:
+	//    - sizeof(struct rt_msghdr) = 92
+	//    - RTAX_MAX = 8
+	//    - sizeof(struct sockaddr_in6) = 28
+	//    - sizeof(struct sockaddr_in) = 16
+	//    - sizeof(struct sockaddr_dl) = 20
+	//
+	// The maximum buffer size should be:
+	//    sizeof(struct rt_msghdr) + RTAX_MAX*sizeof(struct sockaddr_in6)
+	//    = 92 + 8*28
+	//    = 316
+	//
+	// During my testing, responses are typically ~120 bytes.
+	//
+	// We provide a much larger buffer just in case we're off by a bit, or
+	// the kernel decides to return more than one message; 2048 bytes
+	// should be plenty here. This also means we can do a single Read.
+	var buf [2048]byte
+	n, err := unix.Read(fd, buf[:])
+	if err != nil {
+		return 0, fmt.Errorf("reading message: %w", err)
+	}
+	msgs, err := route.ParseRIB(route.RIBTypeRoute, buf[:n])
+	if err != nil {
+		return 0, fmt.Errorf("route.ParseRIB: %w", err)
+	}
+	if len(msgs) == 0 {
+		return 0, fmt.Errorf("no messages")
+	}
+
+	for _, msg := range msgs {
+		rm, ok := msg.(*route.RouteMessage)
+		if !ok {
+			continue
+		}
+		if rm.Version < 3 || rm.Version > 5 || rm.Type != unix.RTM_GET {
+			continue
+		}
+		if len(rm.Addrs) < unix.RTAX_GATEWAY {
+			continue
+		}
+
+		switch addr := rm.Addrs[unix.RTAX_GATEWAY].(type) {
+		case *route.LinkAddr:
+			return addr.Index, nil
+		case *route.Inet4Addr:
+			// We can get a gateway IP; recursively call ourselves
+			// (exactly once) to get the link (and thus index) for
+			// the gateway IP.
+			if canRecurse {
+				return interfaceIndexFor(netip.AddrFrom4(addr.IP), false)
+			}
+		case *route.Inet6Addr:
+			// As above.
+			if canRecurse {
+				return interfaceIndexFor(netip.AddrFrom16(addr.IP), false)
+			}
+		default:
+			// Unknown type; skip it
+			continue
+		}
+	}
+
+	return 0, fmt.Errorf("no valid address found")
+}
+
+// SetListenConfigInterfaceIndex sets lc.Control such that sockets are bound
+// to the provided interface index.
+func SetListenConfigInterfaceIndex(lc *net.ListenConfig, ifIndex int) error {
+	if lc == nil {
+		return errors.New("nil ListenConfig")
+	}
+	if lc.Control != nil {
+		return errors.New("ListenConfig.Control already set")
+	}
+	lc.Control = func(network, address string, c syscall.RawConn) error {
+		return bindConnToInterface(c, network, address, ifIndex, log.Printf)
+	}
+	return nil
+}
+
+func bindConnToInterface(c syscall.RawConn, network, address string, ifIndex int, logf logger.Logf) error {
+	v6 := strings.Contains(address, "]:") || strings.HasSuffix(network, "6") // hacky test for v6
+	proto := unix.IPPROTO_IP
+	opt := unix.IP_BOUND_IF
+	if v6 {
+		proto = unix.IPPROTO_IPV6
+		opt = unix.IPV6_BOUND_IF
+	}
+
+	var sockErr error
+	err := c.Control(func(fd uintptr) {
+		sockErr = unix.SetsockoptInt(int(fd), proto, opt, ifIndex)
+	})
+	if sockErr != nil {
+		logf("[unexpected] netns: bindConnToInterface(%q, %q), v6=%v, index=%v: %v", network, address, v6, ifIndex, sockErr)
+	}
+	if err != nil {
+		return fmt.Errorf("RawConn.Control on %T: %w", c, err)
+	}
+	return sockErr
+}

vendor/tailscale.com/net/netns/netns_default.go

@@ -0,0 +1,22 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !linux && !windows && !darwin
+
+package netns
+
+import (
+	"syscall"
+
+	"tailscale.com/net/netmon"
+	"tailscale.com/types/logger"
+)
+
+func control(logger.Logf, *netmon.Monitor) func(network, address string, c syscall.RawConn) error {
+	return controlC
+}
+
+// controlC does nothing to c.
+func controlC(network, address string, c syscall.RawConn) error {
+	return nil
+}

vendor/tailscale.com/net/netns/netns_dw.go

@@ -0,0 +1,27 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build darwin || windows
+
+package netns
+
+import (
+	"errors"
+	"net"
+	"net/netip"
+)
+
+var errUnspecifiedHost = errors.New("unspecified host")
+
+func parseAddress(address string) (addr netip.Addr, err error) {
+	host, _, err := net.SplitHostPort(address)
+	if err != nil {
+		// error means the string didn't contain a port number, so use the string directly
+		host = address
+	}
+	if host == "" {
+		return addr, errUnspecifiedHost
+	}
+
+	return netip.ParseAddr(host)
+}

vendor/tailscale.com/net/netns/netns_linux.go

@@ -0,0 +1,133 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build linux && !android
+
+package netns
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"sync"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+	"tailscale.com/envknob"
+	"tailscale.com/net/netmon"
+	"tailscale.com/types/logger"
+	"tailscale.com/util/linuxfw"
+)
+
+// socketMarkWorksOnce is the sync.Once & cached value for useSocketMark.
+var socketMarkWorksOnce struct {
+	sync.Once
+	v bool
+}
+
+// socketMarkWorks returns whether SO_MARK works.
+func socketMarkWorks() bool {
+	addr, err := net.ResolveUDPAddr("udp", "127.0.0.1:1")
+	if err != nil {
+		return true // unsure, returning true does the least harm.
+	}
+
+	sConn, err := net.DialUDP("udp", nil, addr)
+	if err != nil {
+		return true // unsure, return true
+	}
+	defer sConn.Close()
+
+	rConn, err := sConn.SyscallConn()
+	if err != nil {
+		return true // unsure, return true
+	}
+
+	var sockErr error
+	err = rConn.Control(func(fd uintptr) {
+		sockErr = setBypassMark(fd)
+	})
+	if err != nil || sockErr != nil {
+		return false
+	}
+
+	return true
+}
+
+var forceBindToDevice = envknob.RegisterBool("TS_FORCE_LINUX_BIND_TO_DEVICE")
+
+// UseSocketMark reports whether SO_MARK is in use.
+// If it doesn't, we have to use SO_BINDTODEVICE on our sockets instead.
+func UseSocketMark() bool {
+	if forceBindToDevice() {
+		return false
+	}
+	socketMarkWorksOnce.Do(func() {
+		socketMarkWorksOnce.v = socketMarkWorks()
+	})
+	return socketMarkWorksOnce.v
+}
+
+// ignoreErrors returns true if we should ignore setsocketopt errors in
+// this instance.
+func ignoreErrors() bool {
+	if os.Getuid() != 0 {
+		// only root can manipulate these socket flags
+		return true
+	}
+	return false
+}
+
+func control(logger.Logf, *netmon.Monitor) func(network, address string, c syscall.RawConn) error {
+	return controlC
+}
+
+// controlC marks c as necessary to dial in a separate network namespace.
+//
+// It's intentionally the same signature as net.Dialer.Control
+// and net.ListenConfig.Control.
+func controlC(network, address string, c syscall.RawConn) error {
+	if isLocalhost(address) {
+		// Don't bind to an interface for localhost connections.
+		return nil
+	}
+
+	var sockErr error
+	err := c.Control(func(fd uintptr) {
+		if UseSocketMark() {
+			sockErr = setBypassMark(fd)
+		} else {
+			sockErr = bindToDevice(fd)
+		}
+	})
+	if err != nil {
+		return fmt.Errorf("RawConn.Control on %T: %w", c, err)
+	}
+	if sockErr != nil && ignoreErrors() {
+		// TODO(bradfitz): maybe log once? probably too spammy for e.g. CLI tools like tailscale netcheck.
+		return nil
+	}
+	return sockErr
+}
+
+func setBypassMark(fd uintptr) error {
+	if err := unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, linuxfw.TailscaleBypassMarkNum); err != nil {
+		return fmt.Errorf("setting SO_MARK bypass: %w", err)
+	}
+	return nil
+}
+
+func bindToDevice(fd uintptr) error {
+	ifc, err := netmon.DefaultRouteInterface()
+	if err != nil {
+		// Make sure we bind to *some* interface,
+		// or we could get a routing loop.
+		// "lo" is always wrong, but if we don't have
+		// a default route anyway, it doesn't matter.
+		ifc = "lo"
+	}
+	if err := unix.SetsockoptString(int(fd), unix.SOL_SOCKET, unix.SO_BINDTODEVICE, ifc); err != nil {
+		return fmt.Errorf("setting SO_BINDTODEVICE: %w", err)
+	}
+	return nil
+}

vendor/tailscale.com/net/netns/netns_windows.go

@@ -0,0 +1,224 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netns
+
+import (
+	"fmt"
+	"math/bits"
+	"net/netip"
+	"strings"
+	"syscall"
+
+	"golang.org/x/sys/cpu"
+	"golang.org/x/sys/windows"
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
+	"tailscale.com/envknob"
+	"tailscale.com/net/netmon"
+	"tailscale.com/tsconst"
+	"tailscale.com/types/logger"
+)
+
+func interfaceIndex(iface *winipcfg.IPAdapterAddresses) uint32 {
+	if iface == nil {
+		// The zero ifidx means "unspecified". If we end up passing zero
+		// to bindSocket*(), it unsets the binding and lets the socket
+		// behave as normal again, which is what we want if there's no
+		// default route we can use.
+		return 0
+	}
+	return iface.IfIndex
+}
+
+func defaultInterfaceIndex(family winipcfg.AddressFamily) (uint32, error) {
+	iface, err := netmon.GetWindowsDefault(family)
+	if err != nil {
+		return 0, err
+	}
+
+	return interfaceIndex(iface), nil
+}
+
+func control(logf logger.Logf, _ *netmon.Monitor) func(network, address string, c syscall.RawConn) error {
+	return func(network, address string, c syscall.RawConn) error {
+		return controlC(logf, network, address, c)
+	}
+}
+
+var bindToInterfaceByRouteEnv = envknob.RegisterBool("TS_BIND_TO_INTERFACE_BY_ROUTE")
+
+// controlC binds c to the Windows interface that holds a default
+// route, and is not the Tailscale WinTun interface.
+func controlC(logf logger.Logf, network, address string, c syscall.RawConn) (err error) {
+	if isLocalhost(address) {
+		// Don't bind to an interface for localhost connections,
+		// otherwise we get:
+		//   connectex: The requested address is not valid in its context
+		// (The derphttp tests were failing)
+		return nil
+	}
+
+	canV4, canV6 := false, false
+	switch network {
+	case "tcp", "udp":
+		canV4, canV6 = true, true
+	case "tcp4", "udp4":
+		canV4 = true
+	case "tcp6", "udp6":
+		canV6 = true
+	}
+
+	var defIfaceIdxV4, defIfaceIdxV6 uint32
+	if canV4 {
+		defIfaceIdxV4, err = defaultInterfaceIndex(windows.AF_INET)
+		if err != nil {
+			return fmt.Errorf("defaultInterfaceIndex(AF_INET): %w", err)
+		}
+	}
+
+	if canV6 {
+		defIfaceIdxV6, err = defaultInterfaceIndex(windows.AF_INET6)
+		if err != nil {
+			return fmt.Errorf("defaultInterfaceIndex(AF_INET6): %w", err)
+		}
+	}
+
+	var ifaceIdxV4, ifaceIdxV6 uint32
+	if useRoute := bindToInterfaceByRoute.Load() || bindToInterfaceByRouteEnv(); useRoute {
+		addr, err := parseAddress(address)
+		if err == nil {
+			if canV4 && (addr.Is4() || addr.Is4In6()) {
+				addrV4 := addr.Unmap()
+				ifaceIdxV4, err = getInterfaceIndex(logf, addrV4, defIfaceIdxV4)
+				if err != nil {
+					return fmt.Errorf("getInterfaceIndex(%v): %w", addrV4, err)
+				}
+			}
+
+			if canV6 && addr.Is6() {
+				ifaceIdxV6, err = getInterfaceIndex(logf, addr, defIfaceIdxV6)
+				if err != nil {
+					return fmt.Errorf("getInterfaceIndex(%v): %w", addr, err)
+				}
+			}
+		} else {
+			if err != errUnspecifiedHost {
+				logf("[unexpected] netns: error parsing address %q: %v", address, err)
+			}
+			ifaceIdxV4, ifaceIdxV6 = defIfaceIdxV4, defIfaceIdxV6
+		}
+	} else {
+		ifaceIdxV4, ifaceIdxV6 = defIfaceIdxV4, defIfaceIdxV6
+	}
+
+	if canV4 {
+		if err := bindSocket4(c, ifaceIdxV4); err != nil {
+			return fmt.Errorf("bindSocket4(%d): %w", ifaceIdxV4, err)
+		}
+	}
+
+	if canV6 {
+		if err := bindSocket6(c, ifaceIdxV6); err != nil {
+			return fmt.Errorf("bindSocket6(%d): %w", ifaceIdxV6, err)
+		}
+	}
+
+	return nil
+}
+
+func getInterfaceIndex(logf logger.Logf, addr netip.Addr, defaultIdx uint32) (idx uint32, err error) {
+	idx, err = interfaceIndexFor(addr)
+	if err != nil {
+		return defaultIdx, fmt.Errorf("interfaceIndexFor: %w", err)
+	}
+
+	isTS, err := isTailscaleInterface(idx)
+	if err != nil {
+		return defaultIdx, fmt.Errorf("isTailscaleInterface: %w", err)
+	}
+	if isTS {
+		return defaultIdx, nil
+	}
+	return idx, nil
+}
+
+func isTailscaleInterface(ifaceIdx uint32) (bool, error) {
+	ifaceLUID, err := winipcfg.LUIDFromIndex(ifaceIdx)
+	if err != nil {
+		return false, err
+	}
+
+	iface, err := ifaceLUID.Interface()
+	if err != nil {
+		return false, err
+	}
+
+	result := iface.Type == winipcfg.IfTypePropVirtual &&
+		strings.Contains(iface.Description(), tsconst.WintunInterfaceDesc)
+	return result, nil
+}
+
+func interfaceIndexFor(addr netip.Addr) (uint32, error) {
+	var sockaddr winipcfg.RawSockaddrInet
+	if err := sockaddr.SetAddr(addr); err != nil {
+		return 0, err
+	}
+
+	var idx uint32
+	if err := getBestInterfaceEx(&sockaddr, &idx); err != nil {
+		return 0, err
+	}
+
+	return idx, nil
+}
+
+// sockoptBoundInterface is the value of IP_UNICAST_IF and IPV6_UNICAST_IF.
+//
+// See https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
+// and https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ipv6-socket-options
+const sockoptBoundInterface = 31
+
+// bindSocket4 binds the given RawConn to the network interface with
+// index ifidx, for IPv4 traffic only.
+func bindSocket4(c syscall.RawConn, ifidx uint32) error {
+	// For IPv4 (but NOT IPv6) the interface index must be passed
+	// as a big-endian integer (regardless of platform endianness)
+	// because the underlying sockopt takes either an IPv4 address
+	// or an index shoved into IPv4 address representation (an IP
+	// in 0.0.0.0/8 means it's actually an index).
+	//
+	// See https://docs.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
+	// and IP_UNICAST_IF.
+	indexAsAddr := nativeToBigEndian(ifidx)
+	var controlErr error
+	err := c.Control(func(fd uintptr) {
+		controlErr = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, sockoptBoundInterface, int(indexAsAddr))
+	})
+	if err != nil {
+		return err
+	}
+	return controlErr
+}
+
+// bindSocket6 binds the given RawConn to the network interface with
+// index ifidx, for IPv6 traffic only.
+func bindSocket6(c syscall.RawConn, ifidx uint32) error {
+	var controlErr error
+	err := c.Control(func(fd uintptr) {
+		controlErr = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, sockoptBoundInterface, int(ifidx))
+	})
+	if err != nil {
+		return err
+	}
+	return controlErr
+}
+
+// nativeToBigEndian returns i converted into big-endian
+// representation, suitable for passing to Windows APIs that require a
+// mangled uint32.
+func nativeToBigEndian(i uint32) uint32 {
+	if cpu.IsBigEndian {
+		return i
+	}
+	return bits.ReverseBytes32(i)
+}

vendor/tailscale.com/net/netns/socks.go

@@ -0,0 +1,19 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !ios && !js
+
+package netns
+
+import "golang.org/x/net/proxy"
+
+func init() {
+	wrapDialer = wrapSocks
+}
+
+func wrapSocks(d Dialer) Dialer {
+	if cd, ok := proxy.FromEnvironmentUsing(d).(Dialer); ok {
+		return cd
+	}
+	return d
+}

vendor/tailscale.com/net/netns/zsyscall_windows.go

@@ -0,0 +1,53 @@
+// Code generated by 'go generate'; DO NOT EDIT.
+
+package netns
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return errERROR_EINVAL
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modiphlpapi = windows.NewLazySystemDLL("iphlpapi.dll")
+
+	procGetBestInterfaceEx = modiphlpapi.NewProc("GetBestInterfaceEx")
+)
+
+func getBestInterfaceEx(sockaddr *winipcfg.RawSockaddrInet, bestIfaceIndex *uint32) (ret error) {
+	r0, _, _ := syscall.Syscall(procGetBestInterfaceEx.Addr(), 2, uintptr(unsafe.Pointer(sockaddr)), uintptr(unsafe.Pointer(bestIfaceIndex)), 0)
+	if r0 != 0 {
+		ret = syscall.Errno(r0)
+	}
+	return
+}

vendor/tailscale.com/net/netstat/netstat.go

@@ -0,0 +1,35 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netstat returns the local machine's network connection table.
+package netstat
+
+import (
+	"errors"
+	"net/netip"
+	"runtime"
+)
+
+var ErrNotImplemented = errors.New("not implemented for GOOS=" + runtime.GOOS)
+
+type Entry struct {
+	Local, Remote netip.AddrPort
+	Pid           int
+	State         string // TODO: type?
+	OSMetadata    OSMetadata
+}
+
+// Table contains local machine's TCP connection entries.
+//
+// Currently only TCP (IPv4 and IPv6) are included.
+type Table struct {
+	Entries []Entry
+}
+
+// Get returns the connection table.
+//
+// It returns ErrNotImplemented if the table is not available for the
+// current operating system.
+func Get() (*Table, error) {
+	return get()
+}

vendor/tailscale.com/net/netstat/netstat_noimpl.go

@@ -0,0 +1,14 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !windows
+
+package netstat
+
+// OSMetadata includes any additional OS-specific information that may be
+// obtained during the retrieval of a given Entry.
+type OSMetadata struct{}
+
+func get() (*Table, error) {
+	return nil, ErrNotImplemented
+}

vendor/tailscale.com/net/netstat/netstat_windows.go

@@ -0,0 +1,287 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netstat
+
+import (
+	"errors"
+	"fmt"
+	"math/bits"
+	"net/netip"
+	"unsafe"
+
+	"golang.org/x/sys/cpu"
+	"golang.org/x/sys/windows"
+	"tailscale.com/net/netaddr"
+)
+
+// OSMetadata includes any additional OS-specific information that may be
+// obtained during the retrieval of a given Entry.
+type OSMetadata interface {
+	// GetModule returns the entry's module name.
+	//
+	// It returns ("", nil) if no entry is found. As of 2023-01-27, any returned
+	// error is silently discarded by its sole caller in portlist_windows.go and
+	// treated equivalently as returning ("", nil), but this may change in the
+	// future. An error should only be returned in casees that are worthy of
+	// being logged at least.
+	GetModule() (string, error)
+}
+
+// See https://docs.microsoft.com/en-us/windows/win32/api/iphlpapi/nf-iphlpapi-getextendedtcptable
+
+// TCP_TABLE_OWNER_MODULE_ALL means to include the PID and module. The table type
+// we get back from Windows depends on AF_INET vs AF_INET6:
+// MIB_TCPTABLE_OWNER_MODULE for v4 or MIB_TCP6TABLE_OWNER_MODULE for v6.
+const tcpTableOwnerModuleAll = 8
+
+// TCPIP_OWNER_MODULE_BASIC_INFO means to request "basic information" about the
+// owner module.
+const tcpipOwnerModuleBasicInfo = 0
+
+var (
+	iphlpapi                    = windows.NewLazySystemDLL("iphlpapi.dll")
+	getTCPTable                 = iphlpapi.NewProc("GetExtendedTcpTable")
+	getOwnerModuleFromTcpEntry  = iphlpapi.NewProc("GetOwnerModuleFromTcpEntry")
+	getOwnerModuleFromTcp6Entry = iphlpapi.NewProc("GetOwnerModuleFromTcp6Entry")
+	// TODO: GetExtendedUdpTable also? if/when needed.
+)
+
+// See https://web.archive.org/web/20221219211913/https://learn.microsoft.com/en-us/windows/win32/api/tcpmib/ns-tcpmib-mib_tcprow_owner_module
+type _MIB_TCPROW_OWNER_MODULE struct {
+	state            uint32
+	localAddr        uint32
+	localPort        uint32
+	remoteAddr       uint32
+	remotePort       uint32
+	pid              uint32
+	createTimestamp  int64
+	owningModuleInfo [16]uint64
+}
+
+func (row *_MIB_TCPROW_OWNER_MODULE) asEntry() Entry {
+	return Entry{
+		Local:      ipport4(row.localAddr, port(&row.localPort)),
+		Remote:     ipport4(row.remoteAddr, port(&row.remotePort)),
+		Pid:        int(row.pid),
+		State:      state(row.state),
+		OSMetadata: row,
+	}
+}
+
+type _MIB_TCPTABLE_OWNER_MODULE struct {
+	numEntries uint32
+	table      _MIB_TCPROW_OWNER_MODULE
+}
+
+func (m *_MIB_TCPTABLE_OWNER_MODULE) getRows() []_MIB_TCPROW_OWNER_MODULE {
+	return unsafe.Slice(&m.table, m.numEntries)
+}
+
+// See https://web.archive.org/web/20221219212442/https://learn.microsoft.com/en-us/windows/win32/api/tcpmib/ns-tcpmib-mib_tcp6row_owner_module
+type _MIB_TCP6ROW_OWNER_MODULE struct {
+	localAddr        [16]byte
+	localScope       uint32
+	localPort        uint32
+	remoteAddr       [16]byte
+	remoteScope      uint32
+	remotePort       uint32
+	state            uint32
+	pid              uint32
+	createTimestamp  int64
+	owningModuleInfo [16]uint64
+}
+
+func (row *_MIB_TCP6ROW_OWNER_MODULE) asEntry() Entry {
+	return Entry{
+		Local:      ipport6(row.localAddr, row.localScope, port(&row.localPort)),
+		Remote:     ipport6(row.remoteAddr, row.remoteScope, port(&row.remotePort)),
+		Pid:        int(row.pid),
+		State:      state(row.state),
+		OSMetadata: row,
+	}
+}
+
+type _MIB_TCP6TABLE_OWNER_MODULE struct {
+	numEntries uint32
+	table      _MIB_TCP6ROW_OWNER_MODULE
+}
+
+func (m *_MIB_TCP6TABLE_OWNER_MODULE) getRows() []_MIB_TCP6ROW_OWNER_MODULE {
+	return unsafe.Slice(&m.table, m.numEntries)
+}
+
+// See https://web.archive.org/web/20221219213143/https://learn.microsoft.com/en-us/windows/win32/api/iprtrmib/ns-iprtrmib-tcpip_owner_module_basic_info
+type _TCPIP_OWNER_MODULE_BASIC_INFO struct {
+	moduleName *uint16
+	modulePath *uint16
+}
+
+func get() (*Table, error) {
+	t := new(Table)
+	if err := t.addEntries(windows.AF_INET); err != nil {
+		return nil, fmt.Errorf("failed to get IPv4 entries: %w", err)
+	}
+	if err := t.addEntries(windows.AF_INET6); err != nil {
+		return nil, fmt.Errorf("failed to get IPv6 entries: %w", err)
+	}
+	return t, nil
+}
+
+func (t *Table) addEntries(fam int) error {
+	var size uint32
+	var addr unsafe.Pointer
+	var buf []byte
+	for {
+		err, _, _ := getTCPTable.Call(
+			uintptr(addr),
+			uintptr(unsafe.Pointer(&size)),
+			1, // sorted
+			uintptr(fam),
+			tcpTableOwnerModuleAll,
+			0, // reserved; "must be zero"
+		)
+		if err == 0 {
+			break
+		}
+		if err == uintptr(windows.ERROR_INSUFFICIENT_BUFFER) {
+			const maxSize = 10 << 20
+			if size > maxSize || size < 4 {
+				return fmt.Errorf("unreasonable kernel-reported size %d", size)
+			}
+			buf = make([]byte, size)
+			addr = unsafe.Pointer(&buf[0])
+			continue
+		}
+		return windows.Errno(err)
+	}
+	if len(buf) < int(size) {
+		return errors.New("unexpected size growth from system call")
+	}
+	buf = buf[:size]
+
+	switch fam {
+	case windows.AF_INET:
+		info := (*_MIB_TCPTABLE_OWNER_MODULE)(unsafe.Pointer(&buf[0]))
+		rows := info.getRows()
+		for _, row := range rows {
+			t.Entries = append(t.Entries, row.asEntry())
+		}
+	case windows.AF_INET6:
+		info := (*_MIB_TCP6TABLE_OWNER_MODULE)(unsafe.Pointer(&buf[0]))
+		rows := info.getRows()
+		for _, row := range rows {
+			t.Entries = append(t.Entries, row.asEntry())
+		}
+	}
+
+	return nil
+}
+
+var states = []string{
+	"",
+	"CLOSED",
+	"LISTEN",
+	"SYN-SENT",
+	"SYN-RECEIVED",
+	"ESTABLISHED",
+	"FIN-WAIT-1",
+	"FIN-WAIT-2",
+	"CLOSE-WAIT",
+	"CLOSING",
+	"LAST-ACK",
+	"DELETE-TCB",
+}
+
+func state(v uint32) string {
+	if v < uint32(len(states)) {
+		return states[v]
+	}
+	return fmt.Sprintf("unknown-state-%d", v)
+}
+
+func ipport4(addr uint32, port uint16) netip.AddrPort {
+	if !cpu.IsBigEndian {
+		addr = bits.ReverseBytes32(addr)
+	}
+	return netip.AddrPortFrom(
+		netaddr.IPv4(byte(addr>>24), byte(addr>>16), byte(addr>>8), byte(addr)),
+		port)
+}
+
+func ipport6(addr [16]byte, scope uint32, port uint16) netip.AddrPort {
+	ip := netip.AddrFrom16(addr).Unmap()
+	if scope != 0 {
+		// TODO: something better here?
+		ip = ip.WithZone(fmt.Sprint(scope))
+	}
+	return netip.AddrPortFrom(ip, port)
+}
+
+func port(v *uint32) uint16 {
+	if !cpu.IsBigEndian {
+		return uint16(bits.ReverseBytes32(*v) >> 16)
+	}
+	return uint16(*v >> 16)
+}
+
+type moduleInfoConstraint interface {
+	_MIB_TCPROW_OWNER_MODULE | _MIB_TCP6ROW_OWNER_MODULE
+}
+
+// moduleInfo implements OSMetadata.GetModule. It calls
+// getOwnerModuleFromTcpEntry or getOwnerModuleFromTcp6Entry.
+//
+// See
+// https://learn.microsoft.com/en-us/windows/win32/api/iphlpapi/nf-iphlpapi-getownermodulefromtcpentry
+//
+// It may return "", nil indicating a successful call but with empty data.
+func moduleInfo[entryType moduleInfoConstraint](entry *entryType, proc *windows.LazyProc) (string, error) {
+	var buf []byte
+	var desiredLen uint32
+	var addr unsafe.Pointer
+
+	for {
+		e, _, _ := proc.Call(
+			uintptr(unsafe.Pointer(entry)),
+			uintptr(tcpipOwnerModuleBasicInfo),
+			uintptr(addr),
+			uintptr(unsafe.Pointer(&desiredLen)),
+		)
+		err := windows.Errno(e)
+		if err == windows.ERROR_SUCCESS {
+			break
+		}
+		if err == windows.ERROR_NOT_FOUND {
+			return "", nil
+		}
+		if err != windows.ERROR_INSUFFICIENT_BUFFER {
+			return "", err
+		}
+		if desiredLen > 1<<20 {
+			// Sanity check before allocating too much.
+			return "", nil
+		}
+		buf = make([]byte, desiredLen)
+		addr = unsafe.Pointer(&buf[0])
+	}
+	if addr == nil {
+		// GetOwnerModuleFromTcp*Entry can apparently return ERROR_SUCCESS
+		// (NO_ERROR) on the first call without the usual first
+		// ERROR_INSUFFICIENT_BUFFER result. Windows said success, so interpret
+		// that was sucessfully not having data.
+		return "", nil
+	}
+	basicInfo := (*_TCPIP_OWNER_MODULE_BASIC_INFO)(addr)
+	return windows.UTF16PtrToString(basicInfo.moduleName), nil
+}
+
+// GetModule implements OSMetadata.
+func (m *_MIB_TCPROW_OWNER_MODULE) GetModule() (string, error) {
+	return moduleInfo(m, getOwnerModuleFromTcpEntry)
+}
+
+// GetModule implements OSMetadata.
+func (m *_MIB_TCP6ROW_OWNER_MODULE) GetModule() (string, error) {
+	return moduleInfo(m, getOwnerModuleFromTcp6Entry)
+}

vendor/tailscale.com/net/netutil/default_interface_portable.go

@@ -0,0 +1,64 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netutil
+
+import (
+	"errors"
+	"net"
+	"net/netip"
+)
+
+// DefaultInterfacePortable looks up the current default interface using a portable lookup method that
+// works on most systems with a BSD style socket interface.
+//
+// Returns the interface name and IP address of the default route interface.
+//
+// If the default cannot be determined, an error is returned.
+// Requires that there is a route on the system servicing UDP IPv4.
+func DefaultInterfacePortable() (string, netip.Addr, error) {
+	// Note: UDP dial just performs a connect(2), and doesn't actually send a packet.
+	c, err := net.Dial("udp4", "8.8.8.8:53")
+	if err != nil {
+		return "", netip.Addr{}, err
+	}
+	laddr := c.LocalAddr().(*net.UDPAddr)
+	c.Close()
+
+	ifs, err := net.Interfaces()
+	if err != nil {
+		return "", netip.Addr{}, err
+	}
+
+	var (
+		iface *net.Interface
+		ipnet *net.IPNet
+	)
+	for _, ifc := range ifs {
+		addrs, err := ifc.Addrs()
+		if err != nil {
+			return "", netip.Addr{}, err
+		}
+		for _, addr := range addrs {
+			if ipn, ok := addr.(*net.IPNet); ok {
+				if ipn.Contains(laddr.IP) {
+					if ipnet == nil {
+						ipnet = ipn
+						iface = &ifc
+					} else {
+						newSize, _ := ipn.Mask.Size()
+						oldSize, _ := ipnet.Mask.Size()
+						if newSize > oldSize {
+							ipnet = ipn
+							iface = &ifc
+						}
+					}
+				}
+			}
+		}
+	}
+	if iface == nil {
+		return "", netip.Addr{}, errors.New("no default interface")
+	}
+	return iface.Name, laddr.AddrPort().Addr(), nil
+}

vendor/tailscale.com/net/netutil/ip_forward.go

@@ -0,0 +1,327 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netutil
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"net/netip"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"tailscale.com/net/netmon"
+)
+
+// protocolsRequiredForForwarding reports whether IPv4 and/or IPv6 protocols are
+// required to forward the specified routes.
+// The state param must be specified.
+func protocolsRequiredForForwarding(routes []netip.Prefix, state *netmon.State) (v4, v6 bool) {
+	if len(routes) == 0 {
+		// Nothing to route, so no need to warn.
+		return false, false
+	}
+
+	localIPs := make(map[netip.Addr]bool)
+	for _, addrs := range state.InterfaceIPs {
+		for _, pfx := range addrs {
+			localIPs[pfx.Addr()] = true
+		}
+	}
+
+	for _, r := range routes {
+		// It's possible to advertise a route to one of the local
+		// machine's local IPs. IP forwarding isn't required for this
+		// to work, so we shouldn't warn for such exports.
+		if r.IsSingleIP() && localIPs[r.Addr()] {
+			continue
+		}
+		if r.Addr().Is4() {
+			v4 = true
+		} else {
+			v6 = true
+		}
+	}
+	return v4, v6
+}
+
+// CheckIPForwarding reports whether IP forwarding is enabled correctly
+// for subnet routing and exit node functionality on any interface.
+// The state param must not be nil.
+// The routes should only be advertised routes, and should not contain the
+// nodes Tailscale IPs.
+// It returns an error if it is unable to determine if IP forwarding is enabled.
+// It returns a warning describing configuration issues if IP forwarding is
+// non-functional or partly functional.
+func CheckIPForwarding(routes []netip.Prefix, state *netmon.State) (warn, err error) {
+	if runtime.GOOS != "linux" {
+		switch runtime.GOOS {
+		case "dragonfly", "freebsd", "netbsd", "openbsd":
+			return fmt.Errorf("Subnet routing and exit nodes only work with additional manual configuration on %v, and is not currently officially supported.", runtime.GOOS), nil
+		}
+		return nil, nil
+	}
+	if state == nil {
+		return nil, fmt.Errorf("Couldn't check system's IP forwarding configuration; no link state")
+	}
+	const kbLink = "\nSee https://tailscale.com/s/ip-forwarding"
+	wantV4, wantV6 := protocolsRequiredForForwarding(routes, state)
+	if !wantV4 && !wantV6 {
+		return nil, nil
+	}
+
+	v4e, err := ipForwardingEnabledLinux(ipv4, "")
+	if err != nil {
+		return nil, fmt.Errorf("Couldn't check system's IP forwarding configuration, subnet routing/exit nodes may not work: %w%s", err, kbLink)
+	}
+	v6e, err := ipForwardingEnabledLinux(ipv6, "")
+	if err != nil {
+		return nil, fmt.Errorf("Couldn't check system's IP forwarding configuration, subnet routing/exit nodes may not work: %w%s", err, kbLink)
+	}
+
+	if v4e && v6e {
+		// IP forwarding is enabled systemwide, all is well.
+		return nil, nil
+	}
+
+	if !wantV4 {
+		if !v6e {
+			return nil, fmt.Errorf("IPv6 forwarding is disabled, subnet routing/exit nodes may not work.%s", kbLink)
+		}
+		return nil, nil
+	}
+	// IP forwarding isn't enabled globally, but it might be enabled
+	// on a per-interface basis. Check if it's on for all interfaces,
+	// and warn appropriately if it's not.
+	// Note: you might be wondering why we check only the state of
+	// ipv6.conf.all.forwarding, rather than per-interface forwarding
+	// configuration. According to kernel documentation, it seems
+	// that to actually forward packets, you need to enable
+	// forwarding globally, and the per-interface forwarding
+	// setting only alters other things such as how router
+	// advertisements are handled. The kernel itself warns that
+	// enabling forwarding per-interface and not globally will
+	// probably not work, so I feel okay calling those configs
+	// broken until we have proof otherwise.
+	var (
+		anyEnabled bool
+		warnings   []string
+	)
+	if wantV6 && !v6e {
+		warnings = append(warnings, "IPv6 forwarding is disabled.")
+	}
+	for _, iface := range state.Interface {
+		if iface.Name == "lo" {
+			continue
+		}
+		v4e, err := ipForwardingEnabledLinux(ipv4, iface.Name)
+		if err != nil {
+			return nil, fmt.Errorf("Couldn't check system's IP forwarding configuration, subnet routing/exit nodes may not work: %w%s", err, kbLink)
+		} else if !v4e {
+			warnings = append(warnings, fmt.Sprintf("Traffic received on %s won't be forwarded (%s disabled)", iface.Name, ipForwardSysctlKey(dotFormat, ipv4, iface.Name)))
+		} else {
+			anyEnabled = true
+		}
+	}
+	if !anyEnabled {
+		// IP forwarding is completely disabled, just say that rather
+		// than enumerate all the interfaces on the system.
+		return fmt.Errorf("IP forwarding is disabled, subnet routing/exit nodes will not work.%s", kbLink), nil
+	}
+	if len(warnings) > 0 {
+		// If partially enabled, enumerate the bits that won't work.
+		return fmt.Errorf("%s\nSubnet routes and exit nodes may not work correctly.%s", strings.Join(warnings, "\n"), kbLink), nil
+	}
+
+	return nil, nil
+}
+
+// CheckReversePathFiltering reports whether reverse path filtering is either
+// disabled or set to 'loose' mode for exit node functionality on any
+// interface.
+//
+// The routes should only be advertised routes, and should not contain the
+// node's Tailscale IPs.
+//
+// This function returns an error if it is unable to determine whether reverse
+// path filtering is enabled, or a warning describing configuration issues if
+// reverse path fitering is non-functional or partly functional.
+func CheckReversePathFiltering(state *netmon.State) (warn []string, err error) {
+	if runtime.GOOS != "linux" {
+		return nil, nil
+	}
+
+	if state == nil {
+		return nil, errors.New("no link state")
+	}
+
+	// The kernel uses the maximum value for rp_filter between the 'all'
+	// setting and each per-interface config, so we need to fetch both.
+	allSetting, err := reversePathFilterValueLinux("all")
+	if err != nil {
+		return nil, fmt.Errorf("reading global rp_filter value: %w", err)
+	}
+
+	const (
+		filtOff    = 0
+		filtStrict = 1
+		filtLoose  = 2
+	)
+
+	// Because the kernel use the max rp_filter value, each interface will use 'loose', so we
+	// can abort early.
+	if allSetting == filtLoose {
+		return nil, nil
+	}
+
+	for _, iface := range state.Interface {
+		if iface.IsLoopback() {
+			continue
+		}
+
+		iSetting, err := reversePathFilterValueLinux(iface.Name)
+		if err != nil {
+			return nil, fmt.Errorf("reading interface rp_filter value for %q: %w", iface.Name, err)
+		}
+		// Perform the same max() that the kernel does
+		if allSetting > iSetting {
+			iSetting = allSetting
+		}
+		if iSetting == filtStrict {
+			warn = append(warn, fmt.Sprintf("interface %q has strict reverse-path filtering enabled", iface.Name))
+		}
+	}
+	return warn, nil
+}
+
+// ipForwardSysctlKey returns the sysctl key for the given protocol and iface.
+// When the dotFormat parameter is true the output is formatted as `net.ipv4.ip_forward`,
+// else it is `net/ipv4/ip_forward`
+func ipForwardSysctlKey(format sysctlFormat, p protocol, iface string) string {
+	if iface == "" {
+		if format == dotFormat {
+			if p == ipv4 {
+				return "net.ipv4.ip_forward"
+			}
+			return "net.ipv6.conf.all.forwarding"
+		}
+		if p == ipv4 {
+			return "net/ipv4/ip_forward"
+		}
+		return "net/ipv6/conf/all/forwarding"
+	}
+
+	var k string
+	if p == ipv4 {
+		k = "net/ipv4/conf/%s/forwarding"
+	} else {
+		k = "net/ipv6/conf/%s/forwarding"
+	}
+	if format == dotFormat {
+		// Swap the delimiters.
+		iface = strings.ReplaceAll(iface, ".", "/")
+		k = strings.ReplaceAll(k, "/", ".")
+	}
+	return fmt.Sprintf(k, iface)
+}
+
+// rpFilterSysctlKey returns the sysctl key for the given iface.
+//
+// Format controls whether the output is formatted as
+// `net.ipv4.conf.iface.rp_filter` or `net/ipv4/conf/iface/rp_filter`.
+func rpFilterSysctlKey(format sysctlFormat, iface string) string {
+	// No iface means all interfaces
+	if iface == "" {
+		iface = "all"
+	}
+
+	k := "net/ipv4/conf/%s/rp_filter"
+	if format == dotFormat {
+		// Swap the delimiters.
+		iface = strings.ReplaceAll(iface, ".", "/")
+		k = strings.ReplaceAll(k, "/", ".")
+	}
+	return fmt.Sprintf(k, iface)
+}
+
+type sysctlFormat int
+
+const (
+	dotFormat sysctlFormat = iota
+	slashFormat
+)
+
+type protocol int
+
+const (
+	ipv4 protocol = iota
+	ipv6
+)
+
+// ipForwardingEnabledLinux reports whether the IP Forwarding is enabled for the
+// given interface.
+// The iface param determines which interface to check against, "" means to check
+// global config.
+// This is Linux-specific: it only reads from /proc/sys and doesn't shell out to
+// sysctl (which on Linux just reads from /proc/sys anyway).
+func ipForwardingEnabledLinux(p protocol, iface string) (bool, error) {
+	k := ipForwardSysctlKey(slashFormat, p, iface)
+	bs, err := os.ReadFile(filepath.Join("/proc/sys", k))
+	if err != nil {
+		if os.IsNotExist(err) {
+			// If IPv6 is disabled, sysctl keys like "net.ipv6.conf.all.forwarding" just don't
+			// exist on disk. But first diagnose whether procfs is even mounted before assuming
+			// absence means false.
+			if fi, err := os.Stat("/proc/sys"); err != nil {
+				return false, fmt.Errorf("failed to check sysctl %v; no procfs? %w", k, err)
+			} else if !fi.IsDir() {
+				return false, fmt.Errorf("failed to check sysctl %v; /proc/sys isn't a directory, is %v", k, fi.Mode())
+			}
+			return false, nil
+		}
+		return false, err
+	}
+
+	val, err := strconv.ParseInt(string(bytes.TrimSpace(bs)), 10, 32)
+	if err != nil {
+		return false, fmt.Errorf("couldn't parse %s: %w", k, err)
+	}
+	// 0 = disabled, 1 = enabled, 2 = enabled (but uncommon)
+	// https://github.com/tailscale/tailscale/issues/8375
+	if val < 0 || val > 2 {
+		return false, fmt.Errorf("unexpected value %d for %s", val, k)
+	}
+	on := val == 1 || val == 2
+	return on, nil
+}
+
+// reversePathFilterValueLinux reports the reverse path filter setting on Linux
+// for the given interface.
+//
+// The iface param determines which interface to check against; the empty
+// string means to check the global config.
+//
+// This function tries to look up the value directly from `/proc/sys`, and
+// falls back to using the `sysctl` command on failure.
+func reversePathFilterValueLinux(iface string) (int, error) {
+	k := rpFilterSysctlKey(slashFormat, iface)
+	bs, err := os.ReadFile(filepath.Join("/proc/sys", k))
+	if err != nil {
+		// Fall back to the sysctl command
+		k := rpFilterSysctlKey(dotFormat, iface)
+		bs, err = exec.Command("sysctl", "-n", k).Output()
+		if err != nil {
+			return -1, fmt.Errorf("couldn't check %s (%v)", k, err)
+		}
+	}
+	v, err := strconv.Atoi(string(bytes.TrimSpace(bs)))
+	if err != nil {
+		return -1, fmt.Errorf("couldn't parse %s (%v)", k, err)
+	}
+	return v, nil
+}

vendor/tailscale.com/net/netutil/netutil.go

@@ -0,0 +1,111 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package netutil contains misc shared networking code & types.
+package netutil
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"sync"
+)
+
+// NewOneConnListener returns a net.Listener that returns c on its
+// first Accept and EOF thereafter.
+//
+// The returned Listener's Addr method returns addr if non-nil. If nil,
+// Addr returns a non-nil dummy address instead.
+func NewOneConnListener(c net.Conn, addr net.Addr) net.Listener {
+	if addr == nil {
+		addr = dummyAddr("one-conn-listener")
+	}
+	return &oneConnListener{
+		addr: addr,
+		conn: c,
+	}
+}
+
+type oneConnListener struct {
+	addr net.Addr
+
+	mu   sync.Mutex
+	conn net.Conn
+}
+
+func (ln *oneConnListener) Accept() (c net.Conn, err error) {
+	ln.mu.Lock()
+	defer ln.mu.Unlock()
+	c = ln.conn
+	if c == nil {
+		err = io.EOF
+		return
+	}
+	err = nil
+	ln.conn = nil
+	return
+}
+
+func (ln *oneConnListener) Addr() net.Addr { return ln.addr }
+
+func (ln *oneConnListener) Close() error {
+	ln.Accept() // guarantee future call returns io.EOF
+	return nil
+}
+
+type dummyAddr string
+
+func (a dummyAddr) Network() string { return string(a) }
+func (a dummyAddr) String() string  { return string(a) }
+
+// NewDrainBufConn returns a net.Conn conditionally wrapping c,
+// prefixing any bytes that are in initialReadBuf, which may be nil.
+func NewDrainBufConn(c net.Conn, initialReadBuf *bufio.Reader) net.Conn {
+	r := initialReadBuf
+	if r != nil && r.Buffered() == 0 {
+		r = nil
+	}
+	return &drainBufConn{c, r}
+}
+
+// drainBufConn is a net.Conn with an initial bunch of bytes in a
+// bufio.Reader. Read drains the bufio.Reader until empty, then passes
+// through subsequent reads to the Conn directly.
+type drainBufConn struct {
+	net.Conn
+	r *bufio.Reader
+}
+
+func (b *drainBufConn) Read(bs []byte) (int, error) {
+	if b.r == nil {
+		return b.Conn.Read(bs)
+	}
+	n, err := b.r.Read(bs)
+	if b.r.Buffered() == 0 {
+		b.r = nil
+	}
+	return n, err
+}
+
+// NewAltReadWriteCloserConn returns a net.Conn that wraps rwc (for
+// Read, Write, and Close) and c (for all other methods).
+func NewAltReadWriteCloserConn(rwc io.ReadWriteCloser, c net.Conn) net.Conn {
+	return wrappedConn{c, rwc}
+}
+
+type wrappedConn struct {
+	net.Conn
+	rwc io.ReadWriteCloser
+}
+
+func (w wrappedConn) Read(bs []byte) (int, error) {
+	return w.rwc.Read(bs)
+}
+
+func (w wrappedConn) Write(bs []byte) (int, error) {
+	return w.rwc.Write(bs)
+}
+
+func (w wrappedConn) Close() error {
+	return w.rwc.Close()
+}

vendor/tailscale.com/net/netutil/routes.go

@@ -0,0 +1,89 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package netutil
+
+import (
+	"encoding/binary"
+	"fmt"
+	"net/netip"
+	"sort"
+	"strings"
+
+	"tailscale.com/net/tsaddr"
+)
+
+func validateViaPrefix(ipp netip.Prefix) error {
+	if !tsaddr.IsViaPrefix(ipp) {
+		return fmt.Errorf("%v is not a 4-in-6 prefix", ipp)
+	}
+	if ipp.Bits() < (128 - 32) {
+		return fmt.Errorf("%v 4-in-6 prefix must be at least a /%v", ipp, 128-32)
+	}
+	a := ipp.Addr().As16()
+	// The first 64 bits of a are the via prefix.
+	// The next 32 bits are the "site ID".
+	// The last 32 bits are the IPv4.
+	//
+	// We used to only allow advertising site IDs from 0-255, but we have
+	// since relaxed this (as of 2024-01) to allow IDs from 0-65535.
+	siteID := binary.BigEndian.Uint32(a[8:12])
+	if siteID > 0xFFFF {
+		return fmt.Errorf("route %v contains invalid site ID %08x; must be 0xffff or less", ipp, siteID)
+	}
+	return nil
+}
+
+// CalcAdvertiseRoutes calculates the requested routes to be advertised by a node.
+// advertiseRoutes is the user-provided, comma-separated list of routes (IP addresses or CIDR prefixes) to advertise.
+// advertiseDefaultRoute indicates whether the node should act as an exit node and advertise default routes.
+func CalcAdvertiseRoutes(advertiseRoutes string, advertiseDefaultRoute bool) ([]netip.Prefix, error) {
+	routeMap := map[netip.Prefix]bool{}
+	if advertiseRoutes != "" {
+		var default4, default6 bool
+		advroutes := strings.Split(advertiseRoutes, ",")
+		for _, s := range advroutes {
+			ipp, err := netip.ParsePrefix(s)
+			if err != nil {
+				return nil, fmt.Errorf("%q is not a valid IP address or CIDR prefix", s)
+			}
+			if ipp != ipp.Masked() {
+				return nil, fmt.Errorf("%s has non-address bits set; expected %s", ipp, ipp.Masked())
+			}
+			if tsaddr.IsViaPrefix(ipp) {
+				if err := validateViaPrefix(ipp); err != nil {
+					return nil, err
+				}
+			}
+			if ipp == tsaddr.AllIPv4() {
+				default4 = true
+			} else if ipp == tsaddr.AllIPv6() {
+				default6 = true
+			}
+			routeMap[ipp] = true
+		}
+		if default4 && !default6 {
+			return nil, fmt.Errorf("%s advertised without its IPv6 counterpart, please also advertise %s", tsaddr.AllIPv4(), tsaddr.AllIPv6())
+		} else if default6 && !default4 {
+			return nil, fmt.Errorf("%s advertised without its IPv4 counterpart, please also advertise %s", tsaddr.AllIPv6(), tsaddr.AllIPv4())
+		}
+	}
+	if advertiseDefaultRoute {
+		routeMap[tsaddr.AllIPv4()] = true
+		routeMap[tsaddr.AllIPv6()] = true
+	}
+	if len(routeMap) == 0 {
+		return nil, nil
+	}
+	routes := make([]netip.Prefix, 0, len(routeMap))
+	for r := range routeMap {
+		routes = append(routes, r)
+	}
+	sort.Slice(routes, func(i, j int) bool {
+		if routes[i].Bits() != routes[j].Bits() {
+			return routes[i].Bits() < routes[j].Bits()
+		}
+		return routes[i].Addr().Less(routes[j].Addr())
+	})
+	return routes, nil
+}

vendor/tailscale.com/net/packet/checksum/checksum.go

@@ -0,0 +1,197 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package checksum provides functions for updating checksums in parsed packets.
+package checksum
+
+import (
+	"encoding/binary"
+	"net/netip"
+
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"tailscale.com/net/packet"
+	"tailscale.com/types/ipproto"
+)
+
+// UpdateSrcAddr updates the source address in the packet buffer (e.g. during
+// SNAT). It also updates the checksum. Currently (2023-09-22) only TCP/UDP/ICMP
+// is supported. It panics if provided with an address in a different
+// family to the parsed packet.
+func UpdateSrcAddr(q *packet.Parsed, src netip.Addr) {
+	if src.Is6() && q.IPVersion != 6 {
+		panic("UpdateSrcAddr: cannot write IPv6 address to v4 packet")
+	} else if src.Is4() && q.IPVersion != 4 {
+		panic("UpdateSrcAddr: cannot write IPv4 address to v6 packet")
+	}
+	q.CaptureMeta.DidSNAT = true
+	q.CaptureMeta.OriginalSrc = q.Src
+
+	old := q.Src.Addr()
+	q.Src = netip.AddrPortFrom(src, q.Src.Port())
+
+	b := q.Buffer()
+	if src.Is6() {
+		v6 := src.As16()
+		copy(b[8:24], v6[:])
+		updateV6PacketChecksums(q, old, src)
+	} else {
+		v4 := src.As4()
+		copy(b[12:16], v4[:])
+		updateV4PacketChecksums(q, old, src)
+	}
+}
+
+// UpdateDstAddr updates the destination address in the packet buffer (e.g. during
+// DNAT). It also updates the checksum. Currently (2022-12-10) only TCP/UDP/ICMP
+// is supported. It panics if provided with an address in a different
+// family to the parsed packet.
+func UpdateDstAddr(q *packet.Parsed, dst netip.Addr) {
+	if dst.Is6() && q.IPVersion != 6 {
+		panic("UpdateDstAddr: cannot write IPv6 address to v4 packet")
+	} else if dst.Is4() && q.IPVersion != 4 {
+		panic("UpdateDstAddr: cannot write IPv4 address to v6 packet")
+	}
+	q.CaptureMeta.DidDNAT = true
+	q.CaptureMeta.OriginalDst = q.Dst
+
+	old := q.Dst.Addr()
+	q.Dst = netip.AddrPortFrom(dst, q.Dst.Port())
+
+	b := q.Buffer()
+	if dst.Is6() {
+		v6 := dst.As16()
+		copy(b[24:40], v6[:])
+		updateV6PacketChecksums(q, old, dst)
+	} else {
+		v4 := dst.As4()
+		copy(b[16:20], v4[:])
+		updateV4PacketChecksums(q, old, dst)
+	}
+}
+
+// updateV4PacketChecksums updates the checksums in the packet buffer.
+// Currently (2023-03-01) only TCP/UDP/ICMP over IPv4 is supported.
+// p is modified in place.
+// If p.IPProto is unknown, only the IP header checksum is updated.
+func updateV4PacketChecksums(p *packet.Parsed, old, new netip.Addr) {
+	if len(p.Buffer()) < 12 {
+		// Not enough space for an IPv4 header.
+		return
+	}
+	o4, n4 := old.As4(), new.As4()
+
+	// First update the checksum in the IP header.
+	updateV4Checksum(p.Buffer()[10:12], o4[:], n4[:])
+
+	// Now update the transport layer checksums, where applicable.
+	tr := p.Transport()
+	switch p.IPProto {
+	case ipproto.UDP, ipproto.DCCP:
+		if len(tr) < header.UDPMinimumSize {
+			// Not enough space for a UDP header.
+			return
+		}
+		updateV4Checksum(tr[6:8], o4[:], n4[:])
+	case ipproto.TCP:
+		if len(tr) < header.TCPMinimumSize {
+			// Not enough space for a TCP header.
+			return
+		}
+		updateV4Checksum(tr[16:18], o4[:], n4[:])
+	case ipproto.GRE:
+		if len(tr) < 6 {
+			// Not enough space for a GRE header.
+			return
+		}
+		if tr[0] == 1 { // checksum present
+			updateV4Checksum(tr[4:6], o4[:], n4[:])
+		}
+	case ipproto.SCTP, ipproto.ICMPv4:
+		// No transport layer update required.
+	}
+}
+
+// updateV6PacketChecksums updates the checksums in the packet buffer.
+// p is modified in place.
+// If p.IPProto is unknown, no checksums are updated.
+func updateV6PacketChecksums(p *packet.Parsed, old, new netip.Addr) {
+	if len(p.Buffer()) < 40 {
+		// Not enough space for an IPv6 header.
+		return
+	}
+	o6, n6 := tcpip.AddrFrom16Slice(old.AsSlice()), tcpip.AddrFrom16Slice(new.AsSlice())
+
+	// Now update the transport layer checksums, where applicable.
+	tr := p.Transport()
+	switch p.IPProto {
+	case ipproto.ICMPv6:
+		if len(tr) < header.ICMPv6MinimumSize {
+			return
+		}
+		header.ICMPv6(tr).UpdateChecksumPseudoHeaderAddress(o6, n6)
+	case ipproto.UDP, ipproto.DCCP:
+		if len(tr) < header.UDPMinimumSize {
+			return
+		}
+		header.UDP(tr).UpdateChecksumPseudoHeaderAddress(o6, n6, true)
+	case ipproto.TCP:
+		if len(tr) < header.TCPMinimumSize {
+			return
+		}
+		header.TCP(tr).UpdateChecksumPseudoHeaderAddress(o6, n6, true)
+	case ipproto.SCTP:
+		// No transport layer update required.
+	}
+}
+
+// updateV4Checksum calculates and updates the checksum in the packet buffer for
+// a change between old and new. The oldSum must point to the 16-bit checksum
+// field in the packet buffer that holds the old checksum value, it will be
+// updated in place.
+//
+// The old and new must be the same length, and must be an even number of bytes.
+func updateV4Checksum(oldSum, old, new []byte) {
+	if len(old) != len(new) {
+		panic("old and new must be the same length")
+	}
+	if len(old)%2 != 0 {
+		panic("old and new must be of even length")
+	}
+	/*
+		RFC 1624
+		Given the following notation:
+
+		    HC  - old checksum in header
+		    C   - one's complement sum of old header
+		    HC' - new checksum in header
+		    C'  - one's complement sum of new header
+		    m   - old value of a 16-bit field
+		    m'  - new value of a 16-bit field
+
+		    HC' = ~(C + (-m) + m')  --    [Eqn. 3]
+		    HC' = ~(~HC + ~m + m')
+
+		This can be simplified to:
+		    HC' = ~(C + ~m + m')    --    [Eqn. 3]
+		    HC' = ~C'
+		    C'  = C + ~m + m'
+	*/
+
+	c := uint32(^binary.BigEndian.Uint16(oldSum))
+
+	cPrime := c
+	for len(new) > 0 {
+		mNot := uint32(^binary.BigEndian.Uint16(old[:2]))
+		mPrime := uint32(binary.BigEndian.Uint16(new[:2]))
+		cPrime += mPrime + mNot
+		new, old = new[2:], old[2:]
+	}
+
+	// Account for overflows by adding the carry bits back into the sum.
+	for (cPrime >> 16) > 0 {
+		cPrime = cPrime&0xFFFF + cPrime>>16
+	}
+	hcPrime := ^uint16(cPrime)
+	binary.BigEndian.PutUint16(oldSum, hcPrime)
+}

vendor/tailscale.com/net/packet/doc.go

@@ -0,0 +1,15 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package packet contains packet parsing and marshaling utilities.
+//
+// Parsed provides allocation-free minimal packet header decoding, for
+// use in packet filtering. The other types in the package are for
+// constructing and marshaling packets into []bytes.
+//
+// To support allocation-free parsing, this package defines IPv4 and
+// IPv6 address types. You should prefer to use netaddr's types,
+// except where you absolutely need allocation-free IP handling
+// (i.e. in the tunnel datapath) and are willing to implement all
+// codepaths and data structures twice, once per IP family.
+package packet

vendor/tailscale.com/net/packet/header.go

@@ -0,0 +1,66 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"errors"
+	"math"
+)
+
+const tcpHeaderLength = 20
+const sctpHeaderLength = 12
+
+// maxPacketLength is the largest length that all headers support.
+// IPv4 headers using uint16 for this forces an upper bound of 64KB.
+const maxPacketLength = math.MaxUint16
+
+var (
+	// errSmallBuffer is returned when Marshal receives a buffer
+	// too small to contain the header to marshal.
+	errSmallBuffer = errors.New("buffer too small")
+	// errLargePacket is returned when Marshal receives a payload
+	// larger than the maximum representable size in header
+	// fields.
+	errLargePacket = errors.New("packet too large")
+)
+
+// Header is a packet header capable of marshaling itself into a byte
+// buffer.
+type Header interface {
+	// Len returns the length of the marshaled packet.
+	Len() int
+	// Marshal serializes the header into buf, which must be at
+	// least Len() bytes long. Implementations of Marshal assume
+	// that bytes after the first Len() are payload bytes for the
+	// purpose of computing length and checksum fields. Marshal
+	// implementations must not allocate memory.
+	Marshal(buf []byte) error
+}
+
+// HeaderChecksummer is implemented by Header implementations that
+// need to do a checksum over their payloads.
+type HeaderChecksummer interface {
+	Header
+
+	// WriteCheck writes the correct checksum into buf, which should
+	// be be the already-marshalled header and payload.
+	WriteChecksum(buf []byte)
+}
+
+// Generate generates a new packet with the given Header and
+// payload. This function allocates memory, see Header.Marshal for an
+// allocation-free option.
+func Generate(h Header, payload []byte) []byte {
+	hlen := h.Len()
+	buf := make([]byte, hlen+len(payload))
+
+	copy(buf[hlen:], payload)
+	h.Marshal(buf)
+
+	if hc, ok := h.(HeaderChecksummer); ok {
+		hc.WriteChecksum(buf)
+	}
+
+	return buf
+}

vendor/tailscale.com/net/packet/icmp.go

@@ -0,0 +1,28 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	crand "crypto/rand"
+
+	"encoding/binary"
+)
+
+// ICMPEchoPayload generates a new random ID/Sequence pair, and returns a uint32
+// derived from them, along with the id, sequence and given payload in a buffer.
+// It returns an error if the random source could not be read.
+func ICMPEchoPayload(payload []byte) (idSeq uint32, buf []byte) {
+	buf = make([]byte, len(payload)+4)
+
+	// make a completely random id/sequence combo, which is very unlikely to
+	// collide with a running ping sequence on the host system. Errors are
+	// ignored, that would result in collisions, but errors reading from the
+	// random device are rare, and will cause this process universe to soon end.
+	crand.Read(buf[:4])
+
+	idSeq = binary.LittleEndian.Uint32(buf)
+	copy(buf[4:], payload)
+
+	return
+}

vendor/tailscale.com/net/packet/icmp4.go

@@ -0,0 +1,96 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+
+	"tailscale.com/types/ipproto"
+)
+
+// icmp4HeaderLength is the size of the ICMPv4 packet header, not
+// including the outer IP layer or the variable "response data"
+// trailer.
+const icmp4HeaderLength = 4
+
+// ICMP4Type is an ICMPv4 type, as specified in
+// https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
+type ICMP4Type uint8
+
+const (
+	ICMP4EchoReply    ICMP4Type = 0x00
+	ICMP4EchoRequest  ICMP4Type = 0x08
+	ICMP4Unreachable  ICMP4Type = 0x03
+	ICMP4TimeExceeded ICMP4Type = 0x0b
+	ICMP4ParamProblem ICMP4Type = 0x12
+)
+
+func (t ICMP4Type) String() string {
+	switch t {
+	case ICMP4EchoReply:
+		return "EchoReply"
+	case ICMP4EchoRequest:
+		return "EchoRequest"
+	case ICMP4Unreachable:
+		return "Unreachable"
+	case ICMP4TimeExceeded:
+		return "TimeExceeded"
+	case ICMP4ParamProblem:
+		return "ParamProblem"
+	default:
+		return "Unknown"
+	}
+}
+
+// ICMP4Code is an ICMPv4 code, as specified in
+// https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
+type ICMP4Code uint8
+
+const (
+	ICMP4NoCode ICMP4Code = 0
+)
+
+// ICMP4Header is an IPv4+ICMPv4 header.
+type ICMP4Header struct {
+	IP4Header
+	Type ICMP4Type
+	Code ICMP4Code
+}
+
+// Len implements Header.
+func (h ICMP4Header) Len() int {
+	return h.IP4Header.Len() + icmp4HeaderLength
+}
+
+// Marshal implements Header.
+func (h ICMP4Header) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+	// The caller does not need to set this.
+	h.IPProto = ipproto.ICMPv4
+
+	buf[20] = uint8(h.Type)
+	buf[21] = uint8(h.Code)
+
+	h.IP4Header.Marshal(buf)
+
+	binary.BigEndian.PutUint16(buf[22:24], ip4Checksum(buf))
+
+	return nil
+}
+
+// ToResponse implements Header. TODO: it doesn't implement it
+// correctly, instead it statically generates an ICMP Echo Reply
+// packet.
+func (h *ICMP4Header) ToResponse() {
+	// TODO: this doesn't implement ToResponse correctly, as it
+	// assumes the ICMP request type.
+	h.Type = ICMP4EchoReply
+	h.Code = ICMP4NoCode
+	h.IP4Header.ToResponse()
+}

vendor/tailscale.com/net/packet/icmp6.go

@@ -0,0 +1,172 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package packet
+
+import (
+	"encoding/binary"
+
+	"tailscale.com/types/ipproto"
+)
+
+// icmp6HeaderLength is the size of the ICMPv6 packet header, not
+// including the outer IP layer or the variable "response data"
+// trailer.
+const icmp6HeaderLength = 4
+
+// ICMP6Type is an ICMPv6 type, as specified in
+// https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
+type ICMP6Type uint8
+
+const (
+	ICMP6Unreachable  ICMP6Type = 1
+	ICMP6PacketTooBig ICMP6Type = 2
+	ICMP6TimeExceeded ICMP6Type = 3
+	ICMP6ParamProblem ICMP6Type = 4
+	ICMP6EchoRequest  ICMP6Type = 128
+	ICMP6EchoReply    ICMP6Type = 129
+)
+
+func (t ICMP6Type) String() string {
+	switch t {
+	case ICMP6Unreachable:
+		return "Unreachable"
+	case ICMP6PacketTooBig:
+		return "PacketTooBig"
+	case ICMP6TimeExceeded:
+		return "TimeExceeded"
+	case ICMP6ParamProblem:
+		return "ParamProblem"
+	case ICMP6EchoRequest:
+		return "EchoRequest"
+	case ICMP6EchoReply:
+		return "EchoReply"
+	default:
+		return "Unknown"
+	}
+}
+
+// ICMP6Code is an ICMPv6 code, as specified in
+// https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
+type ICMP6Code uint8
+
+const (
+	ICMP6NoCode ICMP6Code = 0
+)
+
+// ICMP6Header is an IPv4+ICMPv4 header.
+type ICMP6Header struct {
+	IP6Header
+	Type ICMP6Type
+	Code ICMP6Code
+}
+
+// Len implements Header.
+func (h ICMP6Header) Len() int {
+	return h.IP6Header.Len() + icmp6HeaderLength
+}
+
+// Marshal implements Header.
+func (h ICMP6Header) Marshal(buf []byte) error {
+	if len(buf) < h.Len() {
+		return errSmallBuffer
+	}
+	if len(buf) > maxPacketLength {
+		return errLargePacket
+	}
+	// The caller does not need to set this.
+	h.IPProto = ipproto.ICMPv6
+
+	h.IP6Header.Marshal(buf)
+
+	const o = ip6HeaderLength // start offset of ICMPv6 header
+	buf[o+0] = uint8(h.Type)
+	buf[o+1] = uint8(h.Code)
+	buf[o+2] = 0 // checksum, to be filled in later
+	buf[o+3] = 0 // checksum, to be filled in later
+	return nil
+}
+
+// ToResponse implements Header. TODO: it doesn't implement it
+// correctly, instead it statically generates an ICMP Echo Reply
+// packet.
+func (h *ICMP6Header) ToResponse() {
+	// TODO: this doesn't implement ToResponse correctly, as it
+	// assumes the ICMP request type.
+	h.Type = ICMP6EchoReply
+	h.Code = ICMP6NoCode
+	h.IP6Header.ToResponse()
+}
+
+// WriteChecksum implements HeaderChecksummer, writing just the checksum bytes
+// into the otherwise fully marshaled ICMP6 packet p (which should include the
+// IPv6 header, ICMPv6 header, and payload).
+func (h ICMP6Header) WriteChecksum(p []byte) {
+	const payOff = ip6HeaderLength + icmp6HeaderLength
+	xsum := icmp6Checksum(p[ip6HeaderLength:payOff], h.Src.As16(), h.Dst.As16(), p[payOff:])
+	binary.BigEndian.PutUint16(p[ip6HeaderLength+2:], xsum)
+}
+
+// Adapted from gVisor:
+
+// icmp6Checksum calculates the ICMP checksum over the provided ICMPv6
+// header (without the IPv6 header), IPv6 src/dst addresses and the
+// payload.
+//
+// The header's existing checksum must be zeroed.
+func icmp6Checksum(header []byte, src, dst [16]byte, payload []byte) uint16 {
+	// Calculate the IPv6 pseudo-header upper-layer checksum.
+	xsum := checksumBytes(src[:], 0)
+	xsum = checksumBytes(dst[:], xsum)
+
+	var scratch [4]byte
+	binary.BigEndian.PutUint32(scratch[:], uint32(len(header)+len(payload)))
+	xsum = checksumBytes(scratch[:], xsum)
+	xsum = checksumBytes(append(scratch[:0], 0, 0, 0, uint8(ipproto.ICMPv6)), xsum)
+	xsum = checksumBytes(payload, xsum)
+
+	var hdrz [icmp6HeaderLength]byte
+	copy(hdrz[:], header)
+	// Zero out the header.
+	hdrz[2] = 0
+	hdrz[3] = 0
+	xsum = ^checksumBytes(hdrz[:], xsum)
+	return xsum
+}
+
+// checksumCombine combines the two uint16 to form their
+// checksum. This is done by adding them and the carry.
+//
+// Note that checksum a must have been computed on an even number of
+// bytes.
+func checksumCombine(a, b uint16) uint16 {
+	v := uint32(a) + uint32(b)
+	return uint16(v + v>>16)
+}
+
+// checksumBytes calculates the checksum (as defined in RFC 1071) of
+// the bytes in buf.
+//
+// The initial checksum must have been computed on an even number of bytes.
+func checksumBytes(buf []byte, initial uint16) uint16 {
+	v := uint32(initial)
+
+	odd := len(buf)%2 == 1
+	if odd {
+		v += uint32(buf[0])
+		buf = buf[1:]
+	}
+
+	n := len(buf)
+	odd = n&1 != 0
+	if odd {
+		n--
+		v += uint32(buf[n]) << 8
+	}
+
+	for i := 0; i < n; i += 2 {
+		v += (uint32(buf[i]) << 8) + uint32(buf[i+1])
+	}
+
+	return checksumCombine(uint16(v), uint16(v>>16))
+}