tsnet

package
v1.92.4-sing-box-1.13-... Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 8, 2026 License: BSD-3-Clause Imports: 61 Imported by: 1

Documentation

Overview

Package tsnet provides Tailscale as a library.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type FallbackTCPHandler 

type FallbackTCPHandler func(src, dst netip.AddrPort) (handler func(net.Conn), intercept bool)

FallbackTCPHandler describes the callback which conditionally handles an incoming TCP flow for the provided (src/port, dst/port) 4-tuple. These are registered as handlers of last resort, and are called only if no listener could handle the incoming flow.

If the callback returns intercept=false, the flow is rejected.

When intercept=true, the behavior depends on whether the returned handler is non-nil: if nil, the connection is rejected. If non-nil, handler takes over the TCP conn.

type FunnelOption 

type FunnelOption interface {
	// contains filtered or unexported methods
}

FunnelOption is an option passed to ListenFunnel to configure the listener.

func FunnelOnly 

func FunnelOnly() FunnelOption

FunnelOnly configures the listener to only respond to connections from Tailscale Funnel. The local tailnet will not be able to connect to the listener.

func FunnelTLSConfig 

func FunnelTLSConfig(conf *tls.Config) FunnelOption

FunnelTLSConfig configures the TLS configuration for Server.ListenFunnel

This is rarely needed but can permit requiring client certificates, specific ciphers suites, etc.

The provided conf should at least be able to get a certificate, setting GetCertificate, Certificates or GetConfigForClient appropriately. The most common configuration is to set GetCertificate to Server.LocalClient's GetCertificate method.

Unless FunnelOnly is also used, the configuration is also used for in-tailnet connections that don't arrive over Funnel.

type Server 

type Server struct {
	// Dir specifies the name of the directory to use for
	// state. If empty, a directory is selected automatically
	// under os.UserConfigDir (https://golang.org/pkg/os/#UserConfigDir).
	// based on the name of the binary.
	//
	// If you want to use multiple tsnet services in the same
	// binary, you will need to make sure that Dir is set uniquely
	// for each service. A good pattern for this is to have a
	// "base" directory (such as your mutable storage folder) and
	// then append the hostname on the end of it.
	Dir string

	// Store specifies the state store to use.
	//
	// If nil, a new FileStore is initialized at `Dir/tailscaled.state`.
	// See tailscale.com/ipn/store for supported stores.
	//
	// Logs will automatically be uploaded to log.tailscale.com,
	// where the configuration file for logging will be saved at
	// `Dir/tailscaled.log.conf`.
	Store ipn.StateStore

	// Hostname is the hostname to present to the control server.
	// If empty, the binary name is used.
	Hostname string

	// UserLogf, if non-nil, specifies the logger to use for logs generated by
	// the Server itself intended to be seen by the user such as the AuthURL for
	// login and status updates. If unset, log.Printf is used.
	UserLogf logger.Logf

	// Logf, if set is used for logs generated by the backend such as the
	// LocalBackend and MagicSock. It is verbose and intended for debugging.
	// If unset, logs are discarded.
	Logf logger.Logf

	// Ephemeral, if true, specifies that the instance should register
	// as an Ephemeral node (https://tailscale.com/s/ephemeral-nodes).
	Ephemeral bool

	// AuthKey, if non-empty, is the auth key to create the node
	// and will be preferred over the TS_AUTHKEY environment
	// variable. If the node is already created (from state
	// previously stored in Store), then this field is not
	// used.
	AuthKey string

	// ControlURL optionally specifies the coordination server URL.
	// If empty, the Tailscale default is used.
	ControlURL string

	// RunWebClient, if true, runs a client for managing this node over
	// its Tailscale interface on port 5252.
	RunWebClient bool

	// Port is the UDP port to listen on for WireGuard and peer-to-peer
	// traffic. If zero, a port is automatically selected. Leave this
	// field at zero unless you know what you are doing.
	Port uint16

	// AdvertiseTags specifies tags that should be applied to this node, for
	// purposes of ACL enforcement. These can be referenced from the ACL policy
	// document. Note that advertising a tag on the client doesn't guarantee
	// that the control server will allow the node to adopt that tag.
	AdvertiseTags []string

	Dialer     N.Dialer
	LookupHook dnscache.LookupHookFunc
	OnlyTCP443 bool
	DNS        dns.OSConfigurator
	HTTPClient *http.Client
	TunDevice  wgTun.Device
	Router     router.Router
	// contains filtered or unexported fields
}

Server is an embedded Tailscale server.

Its exported fields may be changed until the first method call.

func (*Server) CapturePcap 

func (s *Server) CapturePcap(ctx context.Context, pcapFile string) error

CapturePcap can be called by the application code compiled with tsnet to save a pcap of packets which the netstack within tsnet sees. This is expected to be useful during debugging, probably not useful for production.

Packets will be written to the pcap until the process exits. The pcap needs a Lua dissector to be installed in WireShark in order to decode properly: wgengine/capture/ts-dissector.lua in this repository. https://tailscale.com/kb/1023/troubleshooting/#can-i-examine-network-traffic-inside-the-encrypted-tunnel

func (*Server) CertDomains 

func (s *Server) CertDomains() []string

CertDomains returns the list of domains for which the server can provide TLS certificates. These are also the DNS names for the Server. If the server is not running, it returns nil.

func (*Server) Close 

func (s *Server) Close() error

Close stops the server.

It must not be called before or concurrently with Start.

func (*Server) Dial 

func (s *Server) Dial(ctx context.Context, network, address string) (net.Conn, error)

Dial connects to the address on the tailnet. It will start the server if it has not been started yet.

func (*Server) ExportLocalBackend 

func (s *Server) ExportLocalBackend() *ipnlocal.LocalBackend

func (*Server) ExportNetstack 

func (s *Server) ExportNetstack() *netstack.Impl

func (*Server) GetRootPath 

func (s *Server) GetRootPath() string

GetRootPath returns the root path of the tsnet server. This is where the state file and other data is stored.

func (*Server) Listen 

func (s *Server) Listen(network, addr string) (net.Listener, error)

Listen announces only on the Tailscale network. It will start the server if it has not been started yet.

Listeners which do not specify an IP address will match for traffic for the local node (that is, a destination address of the IPv4 or IPv6 address of this node) only. To listen for traffic on other addresses such as those routed inbound via subnet routes, explicitly specify the listening address or use RegisterFallbackTCPHandler.

func (*Server) ListenFunnel 

func (s *Server) ListenFunnel(network, addr string, opts ...FunnelOption) (net.Listener, error)

ListenFunnel announces on the public internet using Tailscale Funnel.

It also by default listens on your local tailnet, so connections can come from either inside or outside your network. To restrict connections to be just from the internet, use the FunnelOnly option.

Currently (2023-03-10), Funnel only supports TCP on ports 443, 8443, and 10000. The supported host name is limited to that configured for the tsnet.Server. As such, the standard way to create funnel is: 

s.ListenFunnel("tcp", ":443")

and the only other supported addrs currently are ":8443" and ":10000".

It will start the server if it has not been started yet.

func (*Server) ListenPacket 

func (s *Server) ListenPacket(network, addr string) (net.PacketConn, error)

ListenPacket announces on the Tailscale network.

The network must be "udp", "udp4" or "udp6". The addr must be of the form "ip:port" (or "[ip]:port") where ip is a valid IPv4 or IPv6 address corresponding to "udp4" or "udp6" respectively. IP must be specified.

If s has not been started yet, it will be started.

func (*Server) ListenTLS 

func (s *Server) ListenTLS(network, addr string) (net.Listener, error)

ListenTLS announces only on the Tailscale network. It returns a TLS listener wrapping the tsnet listener. It will start the server if it has not been started yet.

func (*Server) LocalClient 

func (s *Server) LocalClient() (*local.Client, error)

LocalClient returns a LocalClient that speaks to s.

It will start the server if it has not been started yet. If the server's already been started successfully, it doesn't return an error.

func (*Server) LogtailWriter 

func (s *Server) LogtailWriter() io.Writer

LogtailWriter returns an io.Writer that writes to Tailscale's logging service and will be only visible to Tailscale's support team. Logs written there cannot be retrieved by the user. This method always returns a non-nil value.

func (*Server) Loopback 

func (s *Server) Loopback() (addr string, proxyCred, localAPICred string, err error)

Loopback starts a routing server on a loopback address.

The server has multiple functions.

It can be used as a SOCKS5 proxy onto the tailnet. Authentication is required with the username "tsnet" and the value of proxyCred used as the password.

The HTTP server also serves out the "LocalAPI" on /localapi. As the LocalAPI is powerful, access to endpoints requires BOTH passing a "Sec-Tailscale: localapi" HTTP header and passing localAPICred as basic auth.

If you only need to use the LocalAPI from Go, then prefer LocalClient as it does not require communication via TCP.

func (*Server) RegisterFallbackTCPHandler 

func (s *Server) RegisterFallbackTCPHandler(cb FallbackTCPHandler) func()

RegisterFallbackTCPHandler registers a callback which will be called to handle a TCP flow to this tsnet node, for which no listeners will handle.

If multiple fallback handlers are registered, they will be called in an undefined order. See FallbackTCPHandler for details on handling a flow.

The returned function can be used to deregister this callback.

func (*Server) Start 

func (s *Server) Start() error

Start connects the server to the tailnet. Optional: any calls to Dial/Listen will also call Start.

func (*Server) Sys 

func (s *Server) Sys() *tsd.System

Sys returns a handle to the Tailscale subsystems of this node.

This is not a stable API, nor are the APIs of the returned subsystems.

func (*Server) TailscaleIPs 

func (s *Server) TailscaleIPs() (ip4, ip6 netip.Addr)

TailscaleIPs returns IPv4 and IPv6 addresses for this node. If the node has not yet joined a tailnet or is otherwise unaware of its own IP addresses, the returned ip4, ip6 will be !netip.IsValid().

func (*Server) Up 

func (s *Server) Up(ctx context.Context) (*ipnstate.Status, error)

Up connects the server to the tailnet and waits until it is running. On success it returns the current status, including a Tailscale IP address.

Source Files

View all Source files

Directories

Path Synopsis
example
tshello command
The tshello server demonstrates how to use Tailscale as a library.
 The tshello server demonstrates how to use Tailscale as a library.
tsnet-funnel command
The tsnet-funnel server demonstrates how to use tsnet with Funnel.
 The tsnet-funnel server demonstrates how to use tsnet with Funnel.
tsnet-http-client command
The tshello server demonstrates how to use Tailscale as a library.
 The tshello server demonstrates how to use Tailscale as a library.
web-client command
The web-client command demonstrates serving the Tailscale web client over tsnet.
 The web-client command demonstrates serving the Tailscale web client over tsnet.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.