Update

vendor/tailscale.com/appc/conn25.go

@@ -1,110 +1,46 @@
-// Copyright (c) Tailscale Inc & AUTHORS
+// Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
 package appc
 
 import (
-	"net/netip"
-	"sync"
+	"fmt"
+	"strings"
 
 	"tailscale.com/tailcfg"
+	"tailscale.com/tailcfg/nodecap"
+	"tailscale.com/types/appctype"
+	"tailscale.com/types/dnstype"
 )
 
-// Conn25 holds the developing state for the as yet nascent next generation app connector.
-// There is currently (2025-12-08) no actual app connecting functionality.
-type Conn25 struct {
-	mu         sync.Mutex
-	transitIPs map[tailcfg.NodeID]map[netip.Addr]netip.Addr
-}
+const AppConnectorsExperimentalAttrName = "tailscale.com/app-connectors-experimental"
 
-const dupeTransitIPMessage = "Duplicate transit address in ConnectorTransitIPRequest"
+// DNSAddrScheme is the custom URI scheme used for conn25-managed split DNS
+// entries to determine the destination at query time rather than configuration
+// time.
+const DNSAddrScheme = "tailscale-app"
 
-// HandleConnectorTransitIPRequest creates a ConnectorTransitIPResponse in response to a ConnectorTransitIPRequest.
-// It updates the connectors mapping of TransitIP->DestinationIP per peer (tailcfg.NodeID).
-// If a peer has stored this mapping in the connector Conn25 will route traffic to TransitIPs to DestinationIPs for that peer.
-func (c *Conn25) HandleConnectorTransitIPRequest(nid tailcfg.NodeID, ctipr ConnectorTransitIPRequest) ConnectorTransitIPResponse {
-	resp := ConnectorTransitIPResponse{}
-	seen := map[netip.Addr]bool{}
-	for _, each := range ctipr.TransitIPs {
-		if seen[each.TransitIP] {
-			resp.TransitIPs = append(resp.TransitIPs, TransitIPResponse{
-				Code:    OtherFailure,
-				Message: dupeTransitIPMessage,
-			})
-			continue
+func AppDNSRoutes(hasCap func(c nodecap.Cap) bool, self tailcfg.NodeView) map[string][]*dnstype.Resolver {
+	if !hasCap(AppConnectorsExperimentalAttrName) {
+		return nil
+	}
+	apps, err := tailcfg.UnmarshalNodeCapViewJSON[appctype.AppConnectorAttr](self.CapMap(), AppConnectorsExperimentalAttrName)
+	if err != nil {
+		return nil
+	}
+	appNamesByDomain := map[string]string{}
+	for _, app := range apps {
+		for _, domain := range app.Domains {
+			domain, _ = strings.CutPrefix(domain, "*.")
+			domain = strings.ToLower(domain)
+			// in the case of multiple apps specifying the same domain (which is misconfiguration
+			// that should be validated at point of input) last write wins.
+			appNamesByDomain[domain] = app.Name
 		}
-		tipresp := c.handleTransitIPRequest(nid, each)
-		seen[each.TransitIP] = true
-		resp.TransitIPs = append(resp.TransitIPs, tipresp)
 	}
-	return resp
-}
-
-func (c *Conn25) handleTransitIPRequest(nid tailcfg.NodeID, tipr TransitIPRequest) TransitIPResponse {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if c.transitIPs == nil {
-		c.transitIPs = make(map[tailcfg.NodeID]map[netip.Addr]netip.Addr)
+	m := make(map[string][]*dnstype.Resolver, len(appNamesByDomain))
+	for domain, appName := range appNamesByDomain {
+		m[domain] = []*dnstype.Resolver{{Addr: fmt.Sprintf("%s:%s", DNSAddrScheme, appName), UseWithExitNode: true}}
 	}
-	peerMap, ok := c.transitIPs[nid]
-	if !ok {
-		peerMap = make(map[netip.Addr]netip.Addr)
-		c.transitIPs[nid] = peerMap
-	}
-	peerMap[tipr.TransitIP] = tipr.DestinationIP
-	return TransitIPResponse{}
-}
-
-func (c *Conn25) transitIPTarget(nid tailcfg.NodeID, tip netip.Addr) netip.Addr {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.transitIPs[nid][tip]
-}
-
-// TransitIPRequest details a single TransitIP allocation request from a client to a
-// connector.
-type TransitIPRequest struct {
-	// TransitIP is the intermediate destination IP that will be received at this
-	// connector and will be replaced by DestinationIP when performing DNAT.
-	TransitIP netip.Addr `json:"transitIP,omitzero"`
-
-	// DestinationIP is the final destination IP that connections to the TransitIP
-	// should be mapped to when performing DNAT.
-	DestinationIP netip.Addr `json:"destinationIP,omitzero"`
-}
-
-// ConnectorTransitIPRequest is the request body for a PeerAPI request to
-// /connector/transit-ip and can include zero or more TransitIP allocation requests.
-type ConnectorTransitIPRequest struct {
-	// TransitIPs is the list of requested mappings.
-	TransitIPs []TransitIPRequest `json:"transitIPs,omitempty"`
-}
-
-// TransitIPResponseCode appears in TransitIPResponse and signifies success or failure status.
-type TransitIPResponseCode int
-
-const (
-	// OK indicates that the mapping was created as requested.
-	OK TransitIPResponseCode = 0
-
-	// OtherFailure indicates that the mapping failed for a reason that does not have
-	// another relevant [TransitIPResponsecode].
-	OtherFailure TransitIPResponseCode = 1
-)
-
-// TransitIPResponse is the response to a TransitIPRequest
-type TransitIPResponse struct {
-	// Code is an error code indicating success or failure of the [TransitIPRequest].
-	Code TransitIPResponseCode `json:"code,omitzero"`
-	// Message is an error message explaining what happened, suitable for logging but
-	// not necessarily suitable for displaying in a UI to non-technical users. It
-	// should be empty when [Code] is [OK].
-	Message string `json:"message,omitzero"`
-}
-
-// ConnectorTransitIPResponse is the response to a ConnectorTransitIPRequest
-type ConnectorTransitIPResponse struct {
-	// TransitIPs is the list of outcomes for each requested mapping. Elements
-	// correspond to the order of [ConnectorTransitIPRequest.TransitIPs].
-	TransitIPs []TransitIPResponse `json:"transitIPs,omitempty"`
+	return m
 }