tailcfg

package

v1.92.2Latest Latest

This package is not in the latest version of its module.

Go to latest Published: Dec 10, 2025 License:BSD-3-ClauseImports:27Imported by:276

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/tailscale/tailscale

Documentation ¶

Overview¶

Package tailcfg contains types used by the Tailscale protocol with betweenthe node and the coordination server.

Index¶

Constants¶

View Source

const (MachineUnknown      =MachineStatus(iota)MachineUnauthorized// server has yet to approveMachineAuthorized// server has approvedMachineInvalid// server has explicitly rejected this machine key)

View Source

const (TCP        =ServiceProto("tcp")UDP        =ServiceProto("udp")PeerAPI4   =ServiceProto("peerapi4")PeerAPI6   =ServiceProto("peerapi6")PeerAPIDNS =ServiceProto("peerapi-dns-proxy"))

View Source

const (// SignatureNone indicates that there is no signature, no Timestamp is// required (but may be specified if desired), and both DeviceCert and// Signature should be empty.SignatureNone =SignatureType(iota)// SignatureUnknown represents an unknown signature scheme, which should// be considered an error if seen.SignatureUnknown// SignatureV1 is computed as RSA-PSS-Sign(privateKeyForDeviceCert,// SHA256(Timestamp || ServerIdentity || DeviceCert || ServerShortPubKey ||// MachineShortPubKey)). The PSS salt length is equal to hash length// (rsa.PSSSaltLengthEqualsHash). Device cert is required.// Deprecated: uses old key serialization format.SignatureV1// SignatureV2 is computed as RSA-PSS-Sign(privateKeyForDeviceCert,// SHA256(Timestamp || ServerIdentity || DeviceCert || ServerPubKey ||// MachinePubKey)). The PSS salt length is equal to hash length// (rsa.PSSSaltLengthEqualsHash). Device cert is required.SignatureV2)

View Source

const (EndpointUnknownType    =EndpointType(0)EndpointLocal          =EndpointType(1)EndpointSTUN           =EndpointType(2)EndpointPortmapped     =EndpointType(3)EndpointSTUN4LocalPort =EndpointType(4)// hard NAT: STUN'ed IPv4 address + local fixed portEndpointExplicitConf   =EndpointType(5)// explicitly configured (routing to be done by client))

View Source

const (// AuditNodeDisconnect action is sent when a node has disconnected// from the control plane.  The details must include a reason in the Details// field, either generated, or entered by the user.AuditNodeDisconnect =ClientAuditAction("DISCONNECT_NODE"))

View Source

const DerpMagicIP = "127.3.3.40"

DerpMagicIP is a fake WireGuard endpoint IP address that means touse DERP. When used (in the Node.DERP field), the port number ofthe WireGuard endpoint is the DERP region ID number to use.

Mnemonic: 3.3.40 are numbers above the keys D, E, R, P.

View Source

const DotInvalid = ".invalid"

DotInvalid is a fake DNS TLD used in tests for an invalid hostname.

View Source

const LBHeader = "Ts-Lb"

LBHeader is the HTTP request header used to provide a load balancer orinternal reverse proxy with information about the request body without thereverse proxy needing to read the body to parse it out. Think of it akin toan HTTP Host header or SNI. The value may be absent (notably for old clients)but if present, it should match the request. A non-empty value that doesn'tmatch the request body's.

The possible values depend on the request path, but for /machine (Noise)requests, they'll usually be a node public key (in key.NodePublic.Stringformat), matching the Request JSON body's NodeKey.

Note that this is not a security or authentication header; it's strictlydenormalized redundant data as an optimization.

For some request types, the header may have multiple values. (e.g. OldNodeKeyvs NodeKey)

Variables¶

View Source

var DerpMagicIPAddr =netip.MustParseAddr(DerpMagicIP)

View Source

var FilterAllowAll = []FilterRule{{SrcIPs: []string{"*"},DstPorts: []NetPortRange{{IP:    "*",Ports:PortRange{0, 65535},}},},}

View Source

var PortRangeAny =PortRange{0, 65535}

Functions¶

funcCheckTag ¶added inv0.98.1

func CheckTag(tagstring)error

CheckTag validates tag for use as an ACL tag.For now we allow only ascii alphanumeric tags, and they need to startwith a letter. No unicode shenanigans allowed, and we reserve punctuationmarks other than '-' for a possible future URI scheme.

Because we're ignoring unicode entirely, we can treat utf-8 as a series ofbytes. Anything >= 128 is disqualified anyway.

We might relax these rules later.

funcClone ¶added inv1.2.0

func Clone(dst, srcany)bool

Clone duplicates src into dst and reports whether it succeeded.To succeed, <src, dst> must be of types <*T, *T> or <*T, **T>,where T is one of User,Node,Hostinfo,NetInfo,Login,DNSConfig,RegisterResponse,RegisterResponseAuth,RegisterRequest,DERPHomeParams,DERPRegion,DERPMap,DERPNode,SSHRule,SSHAction,SSHPrincipal,ControlDialPlan,Location,UserProfile,VIPService,SSHPolicy.

funcIsKnownServiceProto ¶added inv1.76.0

func IsKnownServiceProto(spServiceProto)bool

IsKnownServiceProto checks whether sp represents a known-valid value ofServiceProto.

funcUnmarshalCapJSON ¶added inv1.48.0

func UnmarshalCapJSON[Tany](cmPeerCapMap, capPeerCapability) ([]T,error)

UnmarshalCapJSON unmarshals each JSON value in cm[cap] as T.If cap does not exist in cm, it returns (nil, nil).It returns an error if the values cannot be unmarshaled into the provided type.

funcUnmarshalCapViewJSON ¶added inv1.82.0

func UnmarshalCapViewJSON[Tany](cmviews.MapSlice[PeerCapability,RawMessage], capPeerCapability) ([]T,error)

UnmarshalCapViewJSON unmarshals each JSON value in cm.Get(cap) as T.If cap does not exist in cm, it returns (nil, nil).It returns an error if the values cannot be unmarshaled into the provided type.

funcUnmarshalNodeCapJSON ¶added inv1.50.0

func UnmarshalNodeCapJSON[Tany](cmNodeCapMap, capNodeCapability) ([]T,error)

UnmarshalNodeCapJSON unmarshals each JSON value in cm[cap] as T.If cap does not exist in cm, it returns (nil, nil).It returns an error if the values cannot be unmarshaled into the provided type.

funcUnmarshalNodeCapViewJSON ¶added inv1.82.0

func UnmarshalNodeCapViewJSON[Tany](cmviews.MapSlice[NodeCapability,RawMessage], capNodeCapability) ([]T,error)

UnmarshalNodeCapViewJSON unmarshals each JSON value in cm.Get(cap) as T.If cap does not exist in cm, it returns (nil, nil).It returns an error if the values cannot be unmarshaled into the provided type.

Types¶

typeAttrUpdate ¶added inv1.80.0

type AttrUpdate map[string]any

AttrUpdate is a map of attributes to update.Attributes not in the map are left unchanged.The value can be a string, float64, bool, or nil to delete.

Seehttps://tailscale.com/s/api-device-posture-attrs.

TODO(bradfitz): add struct type for specifying optional associated datafor each attribute value, like an expiry time?

typeAuditLogRequest ¶added inv1.82.0

type AuditLogRequest struct {// Version is the client's current CapabilityVersion.VersionCapabilityVersion `json:",omitzero"`// NodeKey is the client's current node key.NodeKeykey.NodePublic `json:",omitzero"`// Action is the action to be logged. It must correspond to a known action in the control plane.ActionClientAuditAction `json:",omitzero"`// Details is an opaque string, specific to the action being logged.  Empty strings may not// be valid depending on the action being logged.Detailsstring `json:",omitzero"`// Timestamp is the time at which the audit log was generated on the node.Timestamptime.Time `json:",omitzero"`}

AuditLogRequest represents an audit log request to be sent to the control plane.

This is JSON-encoded and sent over the control plane connection to:POST https://<control-plane>/machine/audit-log

typeC2NAppConnectorDomainRoutesResponse ¶added inv1.54.0

type C2NAppConnectorDomainRoutesResponse struct {// Domains is a map of lower case domain names with no trailing dot,// to a list of resolved IP addresses.Domains map[string][]netip.Addr}

C2NAppConnectorDomainRoutesResponse contains a map of domains toslice of addresses, indicating what IP addresses have been resolvedfor each domain.

typeC2NDebugNetmapRequest ¶added inv1.90.0

type C2NDebugNetmapRequest struct {// Candidate is an optional full MapResponse to be used for generating a candidate// network map. If unset, only the current network map is returned.Candidate *MapResponse `json:"candidate,omitzero"`// OmitFields is an optional list of netmap fields to omit from the response.// If unset, no fields are omitted.OmitFields []string `json:"omitFields,omitzero"`}

C2NDebugNetmapRequest is the request (from control to node) for the/debug/netmap handler.

typeC2NDebugNetmapResponse ¶added inv1.90.0

type C2NDebugNetmapResponse struct {// Current is the current network map (netmap.NetworkMap).Currentjson.RawMessage `json:"current"`// Candidate is a network map produced based on the candidate MapResponse.Candidatejson.RawMessage `json:"candidate,omitzero"`}

C2NDebugNetmapResponse is the response (from node to control) from the/debug/netmap handler. It contains the current network map and, if acandidate full MapResponse was provided in the request, a candidate networkmap generated from it.To avoid import cycles, and reflect the non-stable nature ofnetmap.NetworkMap values, they are returned as json.RawMessage.

typeC2NPostureIdentityResponse ¶added inv1.52.0

type C2NPostureIdentityResponse struct {// SerialNumbers is a list of serial numbers of the client machine.SerialNumbers []string `json:",omitempty"`// IfaceHardwareAddrs is a list of hardware addresses (MAC addresses)// of the client machine's network interfaces.IfaceHardwareAddrs []string `json:",omitempty"`// PostureDisabled indicates if the machine has opted out of// device posture collection.PostureDisabledbool `json:",omitempty"`}

C2NPostureIdentityResponse contains either a set of identifying serialnumbers and hardware addresses from the client, or a boolean flagindicating that the machine has opted out of posture collection.

typeC2NSSHUsernamesRequest ¶added inv1.32.0

type C2NSSHUsernamesRequest struct {// Exclude optionally specifies usernames to exclude// from the response.Exclude map[string]bool `json:",omitempty"`// Max is the maximum number of usernames to return.// If zero, a default limit is used.Maxint `json:",omitempty"`}

C2NSSHUsernamesRequest is the request for the /ssh/usernames.A GET request without a request body is equivalent to the zero value of this type.Otherwise, a POST request with a JSON-encoded request body is expected.

typeC2NSSHUsernamesResponse ¶added inv1.32.0

type C2NSSHUsernamesResponse struct {// Usernames is the list of usernames to suggest. If the machine has many// users, this list may be truncated. If getting the list of usernames might// be too slow or unavailable, this list might be empty. This is effectively// just a best effort set of hints.Usernames []string}

C2NSSHUsernamesResponse is the response (from node to control) from the/ssh/usernames handler.

It returns username auto-complete suggestions for a user to SSH to this node.It's only shown to people who already have SSH access to the node. If thisreturns multiple usernames, only the usernames that would have access per thetailnet's ACLs are shown to the user so as to not leak the existence ofusernames.

typeC2NTLSCertInfo ¶added inv1.56.0

type C2NTLSCertInfo struct {// Valid means that the node has a cached and valid (not expired)// certificate.Validbool `json:",omitempty"`// Error is the error string if the certificate is not valid. If error is// non-empty, the other booleans below might say why.Errorstring `json:",omitempty"`// Missing is whether the error string indicates a missing certificate// that's never been fetched or isn't on disk.Missingbool `json:",omitempty"`// Expired is whether the error string indicates an expired certificate.Expiredbool `json:",omitempty"`NotBeforestring `json:",omitempty"`// RFC3339, if ValidNotAfterstring `json:",omitempty"`// RFC3339, if Valid}

C2NTLSCertInfo describes the state of a cached TLS certificate.

typeC2NUpdateResponse ¶added inv1.50.0

type C2NUpdateResponse struct {// Err is the error message, if any.Errstring `json:",omitempty"`// Enabled indicates whether the user has opted in to updates triggered from// control.Enabledbool// Supported indicates whether remote updates are supported on this// OS/platform.Supportedbool// Started indicates whether the update has started.Startedbool}

C2NUpdateResponse is the response (from node to control) from the /updatehandler. It tells control the status of its request for the node to updateits Tailscale installation.

typeC2NVIPServicesResponse ¶added inv1.80.0

type C2NVIPServicesResponse struct {// VIPServices is the list of VIP services that the node is currently serving.VIPServices []*VIPService `json:",omitempty"`// ServicesHash is the hash of VIPServices to allow the control server to detect// changes. This value matches what is reported in latest [Hostinfo.ServicesHash].ServicesHashstring}

C2NVIPServicesResponse is the response (from node to control) from the/vip-services handler.

It returns the list of VIPServices that the node is currently serving withtheir port info and whether they are active or not. It also returns a hash ofthe response to allow the control server to detect changes.

typeCapGrant ¶added inv1.24.0

type CapGrant struct {// Dsts are the destination IP ranges that this capability// grant matches.Dsts []netip.Prefix// Caps are the capabilities the source IP matched by// FilterRule.SrcIPs are granted to the destination IP,// matched by Dsts.// Deprecated: use CapMap instead.Caps []PeerCapability `json:",omitempty"`// CapMap is a map of capabilities to their values.// The key is the capability name, and the value is a list of// values for that capability.CapMapPeerCapMap `json:",omitempty"`}

CapGrant grants capabilities in a FilterRule.

typeCapabilityVersion ¶added inv1.24.0

type CapabilityVersionint

CapabilityVersion represents the client's capability level. Thatis, it can be thought of as the client's simple version number: asingle monotonically increasing integer, rather than the relativelycomplex x.y.z-xxxxx semver+hash(es). Whenever the client gains acapability or wants to negotiate a change in semantics with theserver (control plane), peers (over PeerAPI), or frontend (overLocalAPI), bump this number and document what's new.

Previously (prior to 2022-03-06), it was known as the "MapRequestversion" or "mapVer" or "map cap" and that name and usage persistsin places.

const CurrentCapabilityVersionCapabilityVersion = 131

CurrentCapabilityVersion is the current capability version of the codebase.

History of versions:

3: implicit compression, keep-alives
4: opt-in keep-alives via KeepAlive field, opt-in compression via Compress
5: 2020-10-19, implies IncludeIPv6, delta Peers/UserProfiles, supports MagicDNS
6: 2020-12-07: means MapResponse.PacketFilter nil means unchanged
7: 2020-12-15: FilterRule.SrcIPs accepts CIDRs+ranges, doesn't warn about 0.0.0.0/::
8: 2020-12-19: client can buggily receive IPv6 addresses and routes if beta enabled server-side
9: 2020-12-30: client doesn't auto-add implicit search domains from peers; only DNSConfig.Domains
10: 2021-01-17: client understands MapResponse.PeerSeenChange
11: 2021-03-03: client understands IPv6, multiple default routes, and goroutine dumping
12: 2021-03-04: client understands PingRequest
13: 2021-03-19: client understands FilterRule.IPProto
14: 2021-04-07: client understands DNSConfig.Routes and DNSConfig.Resolvers
15: 2021-04-12: client treats nil MapResponse.DNSConfig as meaning unchanged
16: 2021-04-15: client understands Node.Online, MapResponse.OnlineChange
17: 2021-04-18: MapResponse.Domain empty means unchanged
18: 2021-04-19: MapResponse.Node nil means unchanged (all fields now omitempty)
19: 2021-04-21: MapResponse.Debug.SleepSeconds
20: 2021-06-11: MapResponse.LastSeen used even less (https://github.com/tailscale/tailscale/issues/2107)
21: 2021-06-15: added MapResponse.DNSConfig.CertDomains
22: 2021-06-16: added MapResponse.DNSConfig.ExtraRecords
23: 2021-08-25: DNSConfig.Routes values may be empty (for ExtraRecords support in 1.14.1+)
24: 2021-09-18: MapResponse.Health from control to node; node shows in "tailscale status"
25: 2021-11-01: MapResponse.Debug.Exit
26: 2022-01-12: (nothing, just bumping for 1.20.0)
27: 2022-02-18: start of SSHPolicy being respected
28: 2022-03-09: client can communicate over Noise.
29: 2022-03-21: MapResponse.PopBrowserURL
30: 2022-03-22: client can request id tokens.
31: 2022-04-15: PingRequest & PingResponse TSMP & disco support
32: 2022-04-17: client knows FilterRule.CapMatch
33: 2022-07-20: added MapResponse.PeersChangedPatch (DERPRegion + Endpoints)
34: 2022-08-02: client understands CapabilityFileSharingTarget
36: 2022-08-02: added PeersChangedPatch.{Key,DiscoKey,Online,LastSeen,KeyExpiry,Capabilities}
37: 2022-08-09: added Debug.{SetForceBackgroundSTUN,SetRandomizeClientPort}; Debug are sticky
38: 2022-08-11: added PingRequest.URLIsNoise
39: 2022-08-15: clients can talk Noise over arbitrary HTTPS port
40: 2022-08-22: added Node.KeySignature, PeersChangedPatch.KeySignature
41: 2022-08-30: uses 100.100.100.100 for route-less ExtraRecords if global nameservers is set
42: 2022-09-06: NextDNS DoH support; seehttps://github.com/tailscale/tailscale/pull/5556
43: 2022-09-21: clients can return usernames for SSH
44: 2022-09-22: MapResponse.ControlDialPlan
45: 2022-09-26: c2n /debug/{goroutines,prefs,metrics}
46: 2022-10-04: c2n /debug/component-logging
47: 2022-10-11: Register{Request,Response}.NodeKeySignature
48: 2022-11-02: Node.UnsignedPeerAPIOnly
49: 2022-11-03: Client understands EarlyNoise
50: 2022-11-14: Client understands CapabilityIngress
51: 2022-11-30: Client understands CapabilityTailnetLockAlpha
52: 2023-01-05: client can handle c2n POST /logtail/flush
53: 2023-01-18: client respects explicit Node.Expired + auto-sets based on Node.KeyExpiry
54: 2023-01-19: Node.Cap added, PeersChangedPatch.Cap, uses Node.Cap for ExitDNS before Hostinfo.Services fallback
55: 2023-01-23: start of c2n GET+POST /update handler
56: 2023-01-24: Client understands CapabilityDebugTSDNSResolution
57: 2023-01-25: Client understands CapabilityBindToInterfaceByRoute
58: 2023-03-10: Client retries lite map updates before restarting map poll.
59: 2023-03-16: Client understands Peers[].SelfNodeV4MasqAddrForThisPeer
60: 2023-04-06: Client understands IsWireGuardOnly
61: 2023-04-18: Client understand SSHAction.SSHRecorderFailureAction
62: 2023-05-05: Client can notify control over noise for SSHEventNotificationRequest recording failure events
63: 2023-06-08: Client understands SSHAction.AllowRemotePortForwarding.
64: 2023-07-11: Client understands s/CapabilityTailnetLockAlpha/CapabilityTailnetLock
65: 2023-07-12: Client understands DERPMap.HomeParams + incremental DERPMap updates with params
66: 2023-07-23: UserProfile.Groups added (available via WhoIs) (removed in 87)
67: 2023-07-25: Client understands PeerCapMap
68: 2023-08-09: Client has dedicated updateRoutine; MapRequest.Stream true means ignore Hostinfo+Endpoints
69: 2023-08-16: removed Debug.LogHeap* + GoroutineDumpURL; added c2n /debug/logheap
70: 2023-08-16: removed most Debug fields; added NodeAttrDisable*, NodeAttrDebug* instead
71: 2023-08-17: added NodeAttrOneCGNATEnable, NodeAttrOneCGNATDisable
72: 2023-08-23: TS-2023-006 UPnP issue fixed; UPnP can now be used again
73: 2023-09-01: Non-Windows clients expect to receive ClientVersion
74: 2023-09-18: Client understands NodeCapMap
75: 2023-09-12: Client understands NodeAttrDNSForwarderDisableTCPRetries
76: 2023-09-20: Client understands ExitNodeDNSResolvers for IsWireGuardOnly nodes
77: 2023-10-03: Client understands Peers[].SelfNodeV6MasqAddrForThisPeer
78: 2023-10-05: can handle c2n Wake-on-LAN sending
79: 2023-10-05: Client understands UrgentSecurityUpdate in ClientVersion
80: 2023-11-16: can handle c2n GET /tls-cert-status
81: 2023-11-17: MapResponse.PacketFilters (incremental packet filter updates)
82: 2023-12-01: Client understands NodeAttrLinuxMustUseIPTables, NodeAttrLinuxMustUseNfTables, c2n /netfilter-kind
83: 2023-12-18: Client understands DefaultAutoUpdate
84: 2024-01-04: Client understands SeamlessKeyRenewal
85: 2024-01-05: Client understands MaxKeyDuration
86: 2024-01-23: Client understands NodeAttrProbeUDPLifetime
87: 2024-02-11: UserProfile.Groups removed (added in 66)
88: 2024-03-05: Client understands NodeAttrSuggestExitNode
89: 2024-03-23: Client no longer respects deleted PeerChange.Capabilities (use CapMap)
90: 2024-04-03: Client understands PeerCapabilityTaildrive.
91: 2024-04-24: Client understands PeerCapabilityTaildriveSharer.
92: 2024-05-06: Client understands NodeAttrUserDialUseRoutes.
93: 2024-05-06: added support for stateful firewalling.
94: 2024-05-06: Client understands Node.IsJailed.
95: 2024-05-06: Client uses NodeAttrUserDialUseRoutes to change DNS dialing behavior.
96: 2024-05-29: Client understands NodeAttrSSHBehaviorV1
97: 2024-06-06: Client understands NodeAttrDisableSplitDNSWhenNoCustomResolvers
98: 2024-06-13: iOS/tvOS clients may provide serial number as part of posture information
99: 2024-06-14: Client understands NodeAttrDisableLocalDNSOverrideViaNRPT
100: 2024-06-18: Initial support for filtertype.Match.SrcCaps - actually usable in capver 109 (issue #12542)
101: 2024-07-01: Client supports SSH agent forwarding when handling connections with /bin/su
102: 2024-07-12: NodeAttrDisableMagicSockCryptoRouting support
103: 2024-07-24: Client supports NodeAttrDisableCaptivePortalDetection
104: 2024-08-03: SelfNodeV6MasqAddrForThisPeer now works
105: 2024-08-05: Fixed SSH behavior on systems that use busybox (issue #12849)
106: 2024-09-03: fix panic regression from cryptokey routing change (65fe0ba7b5)
107: 2024-10-30: add App Connector to conffile (PR #13942)
108: 2024-11-08: Client sends ServicesHash in Hostinfo, understands c2n GET /vip-services.
109: 2024-11-18: Client supports filtertype.Match.SrcCaps (issue #12542)
110: 2024-12-12: removed never-before-used Tailscale SSH public key support (#14373)
111: 2025-01-14: Client supports a peer having Node.HomeDERP (issue #14636)
112: 2025-01-14: Client interprets AllowedIPs of nil as meaning same as Addresses
113: 2025-01-20: Client communicates to control whether funnel is enabled by sending Hostinfo.IngressEnabled (#14688)
114: 2025-01-30: NodeAttrMaxKeyDuration CapMap defined, clients might use it (no tailscaled code change) (#14829)
115: 2025-03-07: Client understands DERPRegion.NoMeasureNoHome.
116: 2025-05-05: Client serves MagicDNS "AAAA" if NodeAttrMagicDNSPeerAAAA set on self node
117: 2025-05-28: Client understands DisplayMessages (structured health messages), but not necessarily PrimaryAction.
118: 2025-07-01: Client sends Hostinfo.StateEncrypted to report whether the state file is encrypted at rest (#15830)
119: 2025-07-10: Client uses Hostinfo.Location.Priority to prioritize one route over another.
120: 2025-07-15: Client understands peer relay disco messages, and implements peer client and relay server functions
121: 2025-07-19: Client understands peer relay endpoint alloc with [disco.AllocateUDPRelayEndpointRequest] & [disco.AllocateUDPRelayEndpointResponse]
122: 2025-07-21: Client sends Hostinfo.ExitNodeID to report which exit node it has selected, if any.
123: 2025-07-28: fix deadlock regression from cryptokey routing change (issue #16651)
124: 2025-08-08: removed NodeAttrDisableMagicSockCryptoRouting support, crypto routing is now mandatory
125: 2025-08-11: dnstype.Resolver adds UseWithExitNode field.
126: 2025-09-17: Client uses seamless key renewal unless disabled by control (tailscale/corp#31479)
127: 2025-09-19: can handle C2N /debug/netmap.
128: 2025-10-02: can handle C2N /debug/health.
129: 2025-10-04: Fixed sleep/wake deadlock in magicsock when using peer relay (PR #17449)
130: 2025-10-06: client can send key.HardwareAttestationPublic and key.HardwareAttestationKeySignature in MapRequest
131: 2025-11-25: client respectsNodeAttrDefaultAutoUpdate

typeClientAuditAction ¶added inv1.82.0

type ClientAuditActionstring

ClientAuditAction represents an auditable action that a client can report to thecontrol plane. These actions must correspond to the supported actionsin the control plane.

typeClientVersion ¶added inv1.34.0

type ClientVersion struct {// RunningLatest is true if the client is running the latest build.RunningLatestbool `json:",omitempty"`// LatestVersion is the latest version.Short ("1.34.2") version available// for download for the client's platform and packaging type.// It won't be populated if RunningLatest is true.LatestVersionstring `json:",omitempty"`// UrgentSecurityUpdate is set when the client is missing an important// security update. That update may be in LatestVersion or earlier.// UrgentSecurityUpdate should not be set if RunningLatest is false.UrgentSecurityUpdatebool `json:",omitempty"`// Notify is whether the client should do an OS-specific notification about// a new version being available. This should not be populated if// RunningLatest is true. The client should not notify multiple times for// the same LatestVersion value.Notifybool `json:",omitempty"`// NotifyURL is a URL to open in the browser when the user clicks on the// notification, when Notify is true.NotifyURLstring `json:",omitempty"`// NotifyText is the text to show in the notification, when Notify is true.NotifyTextstring `json:",omitempty"`}

ClientVersion is information about the latest client version that's availablefor the client (and whether they're already running it).

It does not include a URL to download the client, as that varies by platform.

typeControlDialPlan ¶added inv1.32.0

type ControlDialPlan struct {// An empty list means the default: use DNS (unspecified which DNS).Candidates []ControlIPCandidate}

ControlDialPlan is instructions from the control server to the client on howto connect to the control server; this is useful for maintaining connectionif the client's network state changes after the initial connection, or dueto the configuration that the control server pushes.

func (*ControlDialPlan)Clone ¶added inv1.32.0

func (src *ControlDialPlan) Clone() *ControlDialPlan

Clone makes a deep copy of ControlDialPlan.The result aliases no memory with the original.

func (*ControlDialPlan)View ¶added inv1.32.0

func (p *ControlDialPlan) View()ControlDialPlanView

View returns a read-only view of ControlDialPlan.

typeControlDialPlanView ¶added inv1.32.0

type ControlDialPlanView struct {// contains filtered or unexported fields}

ControlDialPlanView provides a read-only view over ControlDialPlan.

Its methods should only be called if `Valid()` returns true.

func (ControlDialPlanView)AsStruct ¶added inv1.32.0

func (vControlDialPlanView) AsStruct() *ControlDialPlan

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (ControlDialPlanView)Candidates ¶added inv1.32.0

func (vControlDialPlanView) Candidates()views.Slice[ControlIPCandidate]

An empty list means the default: use DNS (unspecified which DNS).

func (ControlDialPlanView)MarshalJSON ¶added inv1.32.0

func (vControlDialPlanView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (ControlDialPlanView)MarshalJSONTo ¶added inv1.88.0

func (vControlDialPlanView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (*ControlDialPlanView)UnmarshalJSON ¶added inv1.32.0

func (v *ControlDialPlanView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*ControlDialPlanView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *ControlDialPlanView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (ControlDialPlanView)Valid ¶added inv1.32.0

func (vControlDialPlanView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeControlIPCandidate ¶added inv1.32.0

type ControlIPCandidate struct {// IP is the address to attempt connecting to.IPnetip.Addr `json:",omitzero"`// ACEHost, if non-empty, means that the client should connect to the// control plane using an HTTPS CONNECT request to the provided hostname. If// the IP field is also set, then the IP is the IP address of the ACEHost// (and not the control plane) and DNS should not be used. The target (the// argument to CONNECT) is always the control plane's hostname, not an IP.ACEHoststring `json:",omitempty"`// DialStartSec is the number of seconds after the beginning of the// connection process to wait before trying this candidate.DialStartDelaySecfloat64 `json:",omitempty"`// DialTimeoutSec is the timeout for a connection to this candidate,// starting after DialStartDelaySec.DialTimeoutSecfloat64 `json:",omitempty"`// Priority is the relative priority of this candidate; candidates with// a higher priority are preferred over candidates with a lower// priority.Priorityint `json:",omitempty"`}

ControlIPCandidate represents a single candidate address to use whenconnecting to the control server.

typeDERPAdmitClientRequest ¶added inv1.62.0

type DERPAdmitClientRequest struct {NodePublickey.NodePublic// key to query for admissionSourcenetip.Addr// derp client's IP address}

DERPAdmitClientRequest is the JSON request body of a POST to derper's--verify-client-url admission controller URL.

typeDERPAdmitClientResponse ¶added inv1.62.0

type DERPAdmitClientResponse struct {Allowbool// whether to permit client}

DERPAdmitClientResponse is the response to a DERPAdmitClientRequest.

typeDERPHomeParams ¶added inv1.46.0

type DERPHomeParams struct {// RegionScore scales latencies of DERP regions by a given scaling// factor when determining which region to use as the home// ("preferred") DERP. Scores in the range (0, 1) will cause this// region to be proportionally more preferred, and scores in the range// (1, ∞) will penalize a region.//// If a region is not present in this map, it is treated as having a// score of 1.0.//// Scores should not be 0 or negative; such scores will be ignored.//// A nil map means no change from the previous value (if any); an empty// non-nil map can be sent to reset all scores back to 1.0.RegionScore map[int]float64 `json:",omitempty"`}

DERPHomeParams contains parameters from the server related to selecting aDERP home region (sometimes referred to as the "preferred DERP").

func (*DERPHomeParams)Clone ¶added inv1.46.0

func (src *DERPHomeParams) Clone() *DERPHomeParams

Clone makes a deep copy of DERPHomeParams.The result aliases no memory with the original.

func (*DERPHomeParams)View ¶added inv1.46.0

func (p *DERPHomeParams) View()DERPHomeParamsView

View returns a read-only view of DERPHomeParams.

typeDERPHomeParamsView ¶added inv1.46.0

type DERPHomeParamsView struct {// contains filtered or unexported fields}

DERPHomeParamsView provides a read-only view over DERPHomeParams.

Its methods should only be called if `Valid()` returns true.

func (DERPHomeParamsView)AsStruct ¶added inv1.46.0

func (vDERPHomeParamsView) AsStruct() *DERPHomeParams

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (DERPHomeParamsView)MarshalJSON ¶added inv1.46.0

func (vDERPHomeParamsView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (DERPHomeParamsView)MarshalJSONTo ¶added inv1.88.0

func (vDERPHomeParamsView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (DERPHomeParamsView)RegionScore ¶added inv1.46.0

func (vDERPHomeParamsView) RegionScore()views.Map[int,float64]

RegionScore scales latencies of DERP regions by a given scalingfactor when determining which region to use as the home("preferred") DERP. Scores in the range (0, 1) will cause thisregion to be proportionally more preferred, and scores in the range(1, ∞) will penalize a region.

If a region is not present in this map, it is treated as having ascore of 1.0.

Scores should not be 0 or negative; such scores will be ignored.

A nil map means no change from the previous value (if any); an emptynon-nil map can be sent to reset all scores back to 1.0.

func (*DERPHomeParamsView)UnmarshalJSON ¶added inv1.46.0

func (v *DERPHomeParamsView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*DERPHomeParamsView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *DERPHomeParamsView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (DERPHomeParamsView)Valid ¶added inv1.46.0

func (vDERPHomeParamsView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeDERPMap ¶added inv0.98.1

type DERPMap struct {// HomeParams, if non-nil, is a change in home parameters.//// The rest of the DEPRMap fields, if zero, means unchanged.HomeParams *DERPHomeParams `json:",omitempty"`// Regions is the set of geographic regions running DERP node(s).//// It's keyed by the DERPRegion.RegionID.//// The numbers are not necessarily contiguous.Regions map[int]*DERPRegion// OmitDefaultRegions specifies to not use Tailscale's DERP servers, and only use those// specified in this DERPMap. If there are none set outside of the defaults, this is a noop.//// This field is only meaningful if the Regions map is non-nil (indicating a change).OmitDefaultRegionsbool `json:"omitDefaultRegions,omitempty"`}

DERPMap describes the set of DERP packet relay servers that are available.

func (*DERPMap)Clone ¶added inv1.10.0

func (src *DERPMap) Clone() *DERPMap

Clone makes a deep copy of DERPMap.The result aliases no memory with the original.

func (*DERPMap)RegionIDs ¶added inv0.98.1

func (m *DERPMap) RegionIDs() []int

/ RegionIDs returns the sorted region IDs.

func (*DERPMap)View ¶added inv1.26.0

func (p *DERPMap) View()DERPMapView

View returns a read-only view of DERPMap.

typeDERPMapView ¶added inv1.26.0

type DERPMapView struct {// contains filtered or unexported fields}

DERPMapView provides a read-only view over DERPMap.

Its methods should only be called if `Valid()` returns true.

func (DERPMapView)AsStruct ¶added inv1.26.0

func (vDERPMapView) AsStruct() *DERPMap

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (DERPMapView)HomeParams ¶added inv1.46.0

func (vDERPMapView) HomeParams()DERPHomeParamsView

HomeParams, if non-nil, is a change in home parameters.

The rest of the DEPRMap fields, if zero, means unchanged.

func (DERPMapView)MarshalJSON ¶added inv1.26.0

func (vDERPMapView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (DERPMapView)MarshalJSONTo ¶added inv1.88.0

func (vDERPMapView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (DERPMapView)OmitDefaultRegions ¶added inv1.26.0

func (vDERPMapView) OmitDefaultRegions()bool

OmitDefaultRegions specifies to not use Tailscale's DERP servers, and only use thosespecified in this DERPMap. If there are none set outside of the defaults, this is a noop.

This field is only meaningful if the Regions map is non-nil (indicating a change).

func (DERPMapView)Regions ¶added inv1.26.0

func (vDERPMapView) Regions()views.MapFn[int, *DERPRegion,DERPRegionView]

Regions is the set of geographic regions running DERP node(s).

It's keyed by the DERPRegion.RegionID.

The numbers are not necessarily contiguous.

func (*DERPMapView)UnmarshalJSON ¶added inv1.26.0

func (v *DERPMapView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*DERPMapView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *DERPMapView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (DERPMapView)Valid ¶added inv1.26.0

func (vDERPMapView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeDERPNode ¶added inv0.98.1

type DERPNode struct {// Name is a unique node name (across all regions).// It is not a host name.// It's typically of the form "1b", "2a", "3b", etc. (region// ID + suffix within that region)Namestring// RegionID is the RegionID of the DERPRegion that this node// is running in.RegionIDint// HostName is the DERP node's hostname.//// It is required but need not be unique; multiple nodes may// have the same HostName but vary in configuration otherwise.HostNamestring// CertName optionally specifies the expected TLS cert common// name. If empty, HostName is used. If CertName is non-empty,// HostName is only used for the TCP dial (if IPv4/IPv6 are// not present) + TLS ClientHello.//// As a special case, if CertName starts with "sha256-raw:",// then the rest of the string is a hex-encoded SHA256 of the// cert to expect. This is used for self-signed certs.// In this case, the HostName field will typically be an IP// address literal.CertNamestring `json:",omitempty"`// IPv4 optionally forces an IPv4 address to use, instead of using DNS.// If empty, A record(s) from DNS lookups of HostName are used.// If the string is not an IPv4 address, IPv4 is not used; the// conventional string to disable IPv4 (and not use DNS) is// "none".IPv4string `json:",omitempty"`// IPv6 optionally forces an IPv6 address to use, instead of using DNS.// If empty, AAAA record(s) from DNS lookups of HostName are used.// If the string is not an IPv6 address, IPv6 is not used; the// conventional string to disable IPv6 (and not use DNS) is// "none".IPv6string `json:",omitempty"`// Port optionally specifies a STUN port to use.// Zero means 3478.// To disable STUN on this node, use -1.STUNPortint `json:",omitempty"`// STUNOnly marks a node as only a STUN server and not a DERP// server.STUNOnlybool `json:",omitempty"`// DERPPort optionally provides an alternate TLS port number// for the DERP HTTPS server.//// If zero, 443 is used.DERPPortint `json:",omitempty"`// InsecureForTests is used by unit tests to disable TLS verification.// It should not be set by users.InsecureForTestsbool `json:",omitempty"`// STUNTestIP is used in tests to override the STUN server's IP.// If empty, it's assumed to be the same as the DERP server.STUNTestIPstring `json:",omitempty"`// CanPort80 specifies whether this DERP node is accessible over HTTP// on port 80 specifically. This is used for captive portal checks.CanPort80bool `json:",omitempty"`}

DERPNode describes a DERP packet relay node running within a DERPRegion.

func (*DERPNode)Clone ¶added inv1.10.0

func (src *DERPNode) Clone() *DERPNode

Clone makes a deep copy of DERPNode.The result aliases no memory with the original.

func (*DERPNode)IsTestNode ¶added inv1.66.0

func (n *DERPNode) IsTestNode()bool

func (*DERPNode)View ¶added inv1.26.0

func (p *DERPNode) View()DERPNodeView

View returns a read-only view of DERPNode.

typeDERPNodeView ¶added inv1.26.0

type DERPNodeView struct {// contains filtered or unexported fields}

DERPNodeView provides a read-only view over DERPNode.

Its methods should only be called if `Valid()` returns true.

func (DERPNodeView)AsStruct ¶added inv1.26.0

func (vDERPNodeView) AsStruct() *DERPNode

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (DERPNodeView)CanPort80 ¶added inv1.40.0

func (vDERPNodeView) CanPort80()bool

CanPort80 specifies whether this DERP node is accessible over HTTPon port 80 specifically. This is used for captive portal checks.

func (DERPNodeView)CertName ¶added inv1.26.0

func (vDERPNodeView) CertName()string

CertName optionally specifies the expected TLS cert commonname. If empty, HostName is used. If CertName is non-empty,HostName is only used for the TCP dial (if IPv4/IPv6 arenot present) + TLS ClientHello.

As a special case, if CertName starts with "sha256-raw:",then the rest of the string is a hex-encoded SHA256 of thecert to expect. This is used for self-signed certs.In this case, the HostName field will typically be an IPaddress literal.

func (DERPNodeView)DERPPort ¶added inv1.26.0

func (vDERPNodeView) DERPPort()int

DERPPort optionally provides an alternate TLS port numberfor the DERP HTTPS server.

If zero, 443 is used.

func (DERPNodeView)HostName ¶added inv1.26.0

func (vDERPNodeView) HostName()string

HostName is the DERP node's hostname.

It is required but need not be unique; multiple nodes mayhave the same HostName but vary in configuration otherwise.

func (DERPNodeView)IPv4 ¶added inv1.26.0

func (vDERPNodeView) IPv4()string

IPv4 optionally forces an IPv4 address to use, instead of using DNS.If empty, A record(s) from DNS lookups of HostName are used.If the string is not an IPv4 address, IPv4 is not used; theconventional string to disable IPv4 (and not use DNS) is"none".

func (DERPNodeView)IPv6 ¶added inv1.26.0

func (vDERPNodeView) IPv6()string

IPv6 optionally forces an IPv6 address to use, instead of using DNS.If empty, AAAA record(s) from DNS lookups of HostName are used.If the string is not an IPv6 address, IPv6 is not used; theconventional string to disable IPv6 (and not use DNS) is"none".

func (DERPNodeView)InsecureForTests ¶added inv1.26.0

func (vDERPNodeView) InsecureForTests()bool

InsecureForTests is used by unit tests to disable TLS verification.It should not be set by users.

func (DERPNodeView)MarshalJSON ¶added inv1.26.0

func (vDERPNodeView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (DERPNodeView)MarshalJSONTo ¶added inv1.88.0

func (vDERPNodeView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (DERPNodeView)Name ¶added inv1.26.0

func (vDERPNodeView) Name()string

Name is a unique node name (across all regions).It is not a host name.It's typically of the form "1b", "2a", "3b", etc. (regionID + suffix within that region)

func (DERPNodeView)RegionID ¶added inv1.26.0

func (vDERPNodeView) RegionID()int

RegionID is the RegionID of the DERPRegion that this nodeis running in.

func (DERPNodeView)STUNOnly ¶added inv1.26.0

func (vDERPNodeView) STUNOnly()bool

STUNOnly marks a node as only a STUN server and not a DERPserver.

func (DERPNodeView)STUNPort ¶added inv1.26.0

func (vDERPNodeView) STUNPort()int

Port optionally specifies a STUN port to use.Zero means 3478.To disable STUN on this node, use -1.

func (DERPNodeView)STUNTestIP ¶added inv1.26.0

func (vDERPNodeView) STUNTestIP()string

STUNTestIP is used in tests to override the STUN server's IP.If empty, it's assumed to be the same as the DERP server.

func (*DERPNodeView)UnmarshalJSON ¶added inv1.26.0

func (v *DERPNodeView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*DERPNodeView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *DERPNodeView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (DERPNodeView)Valid ¶added inv1.26.0

func (vDERPNodeView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeDERPRegion ¶added inv0.98.1

type DERPRegion struct {// RegionID is a unique integer for a geographic region.//// It corresponds to the legacy derpN.tailscale.com hostnames// used by older clients. (Older clients will continue to resolve// derpN.tailscale.com when contacting peers, rather than use// the server-provided DERPMap)//// RegionIDs must be non-zero, positive, and guaranteed to fit// in a JavaScript number.//// RegionIDs in range 900-999 are reserved for end users to run their// own DERP nodes.RegionIDint// RegionCode is a short name for the region. It's usually a popular// city or airport code in the region: "nyc", "sf", "sin",// "fra", etc.RegionCodestring// RegionName is a long English name for the region: "New York City",// "San Francisco", "Singapore", "Frankfurt", etc.RegionNamestring// Latitude, Longitude are optional geographical coordinates of the DERP region's city, in degrees.Latitudefloat64 `json:",omitempty"`Longitudefloat64 `json:",omitempty"`// Avoid is whether the client should avoid picking this as its home region.// The region should only be used if a peer is there. Clients already using// this region as their home should migrate away to a new region without// Avoid set.//// Deprecated: because of bugs in past implementations combined with unclear// docs that caused people to think the bugs were intentional, this field is// deprecated. It was never supposed to cause STUN/DERP measurement probes,// but due to bugs, it sometimes did. And then some parts of the code began// to rely on that property. But then we were unable to use this field for// its original purpose, nor its later imagined purpose, because various// parts of the codebase thought it meant one thing and others thought it// meant another. But it did something in the middle instead. So we're retiring// it. Use NoMeasureNoHome instead.Avoidbool `json:",omitempty"`// NoMeasureNoHome says that this regions should not be measured for its// latency distance (STUN, HTTPS, etc) or availability (e.g. captive portal// checks) and should never be selected as the node's home region. However,// if a peer declares this region as its home, then this client is allowed// to connect to it for the purpose of communicating with that peer.//// This is what the now deprecated Avoid bool was supposed to mean// originally but had implementation bugs and documentation omissions.NoMeasureNoHomebool `json:",omitempty"`// Nodes are the DERP nodes running in this region, in// priority order for the current client. Client TLS// connections should ideally only go to the first entry// (falling back to the second if necessary). STUN packets// should go to the first 1 or 2.//// If nodes within a region route packets amongst themselves,// but not to other regions. That said, each user/domain// should get a the same preferred node order, so if all nodes// for a user/network pick the first one (as they should, when// things are healthy), the inter-cluster routing is minimal// to zero.Nodes []*DERPNode}

DERPRegion is a geographic region running DERP relay node(s).

Client nodes discover which region they're closest to, advertisethat "home" DERP region (previously called "home node", when therewas only 1 node per region) and maintain a persistent connectionthat region as long as it's the closest. Client nodes will furtherconnect to other regions as necessary to communicate with peersadvertising other regions as their homes.

func (*DERPRegion)Clone ¶added inv1.10.0

func (src *DERPRegion) Clone() *DERPRegion

Clone makes a deep copy of DERPRegion.The result aliases no memory with the original.

func (*DERPRegion)View ¶added inv1.26.0

func (p *DERPRegion) View()DERPRegionView

View returns a read-only view of DERPRegion.

typeDERPRegionView ¶added inv1.26.0

type DERPRegionView struct {// contains filtered or unexported fields}

DERPRegionView provides a read-only view over DERPRegion.

Its methods should only be called if `Valid()` returns true.

func (DERPRegionView)AsStruct ¶added inv1.26.0

func (vDERPRegionView) AsStruct() *DERPRegion

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (DERPRegionView)Avoiddeprecatedadded inv1.26.0

func (vDERPRegionView) Avoid()bool

Avoid is whether the client should avoid picking this as its home region.The region should only be used if a peer is there. Clients already usingthis region as their home should migrate away to a new region withoutAvoid set.

Deprecated: because of bugs in past implementations combined with uncleardocs that caused people to think the bugs were intentional, this field isdeprecated. It was never supposed to cause STUN/DERP measurement probes,but due to bugs, it sometimes did. And then some parts of the code beganto rely on that property. But then we were unable to use this field forits original purpose, nor its later imagined purpose, because variousparts of the codebase thought it meant one thing and others thought itmeant another. But it did something in the middle instead. So we're retiringit. Use NoMeasureNoHome instead.

func (DERPRegionView)Latitude ¶added inv1.62.0

func (vDERPRegionView) Latitude()float64

Latitude, Longitude are optional geographical coordinates of the DERP region's city, in degrees.

func (DERPRegionView)Longitude ¶added inv1.62.0

func (vDERPRegionView) Longitude()float64

func (DERPRegionView)MarshalJSON ¶added inv1.26.0

func (vDERPRegionView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (DERPRegionView)MarshalJSONTo ¶added inv1.88.0

func (vDERPRegionView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (DERPRegionView)NoMeasureNoHome ¶added inv1.82.0

func (vDERPRegionView) NoMeasureNoHome()bool

NoMeasureNoHome says that this regions should not be measured for itslatency distance (STUN, HTTPS, etc) or availability (e.g. captive portalchecks) and should never be selected as the node's home region. However,if a peer declares this region as its home, then this client is allowedto connect to it for the purpose of communicating with that peer.

This is what the now deprecated Avoid bool was supposed to meanoriginally but had implementation bugs and documentation omissions.

func (DERPRegionView)Nodes ¶added inv1.26.0

func (vDERPRegionView) Nodes()views.SliceView[*DERPNode,DERPNodeView]

Nodes are the DERP nodes running in this region, inpriority order for the current client. Client TLSconnections should ideally only go to the first entry(falling back to the second if necessary). STUN packetsshould go to the first 1 or 2.

If nodes within a region route packets amongst themselves,but not to other regions. That said, each user/domainshould get a the same preferred node order, so if all nodesfor a user/network pick the first one (as they should, whenthings are healthy), the inter-cluster routing is minimalto zero.

func (DERPRegionView)RegionCode ¶added inv1.26.0

func (vDERPRegionView) RegionCode()string

RegionCode is a short name for the region. It's usually a popularcity or airport code in the region: "nyc", "sf", "sin","fra", etc.

func (DERPRegionView)RegionID ¶added inv1.26.0

func (vDERPRegionView) RegionID()int

RegionID is a unique integer for a geographic region.

It corresponds to the legacy derpN.tailscale.com hostnamesused by older clients. (Older clients will continue to resolvederpN.tailscale.com when contacting peers, rather than usethe server-provided DERPMap)

RegionIDs must be non-zero, positive, and guaranteed to fitin a JavaScript number.

RegionIDs in range 900-999 are reserved for end users to run theirown DERP nodes.

func (DERPRegionView)RegionName ¶added inv1.26.0

func (vDERPRegionView) RegionName()string

RegionName is a long English name for the region: "New York City","San Francisco", "Singapore", "Frankfurt", etc.

func (*DERPRegionView)UnmarshalJSON ¶added inv1.26.0

func (v *DERPRegionView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*DERPRegionView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *DERPRegionView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (DERPRegionView)Valid ¶added inv1.26.0

func (vDERPRegionView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeDNSConfig ¶added inv1.0.1

type DNSConfig struct {// Resolvers are the DNS resolvers to use, in order of preference.Resolvers []*dnstype.Resolver `json:",omitempty"`// Routes maps DNS name suffixes to a set of DNS resolvers to// use. It is used to implement "split DNS" and other advanced DNS// routing overlays.//// Map keys are fully-qualified DNS name suffixes; they may// optionally contain a trailing dot but no leading dot.//// If the value is an empty slice, that means the suffix should still// be handled by Tailscale's built-in resolver (100.100.100.100), such// as for the purpose of handling ExtraRecords.Routes map[string][]*dnstype.Resolver `json:",omitempty"`// FallbackResolvers is like Resolvers, but is only used if a// split DNS configuration is requested in a configuration that// doesn't work yet without explicit default resolvers.//https://github.com/tailscale/tailscale/issues/1743FallbackResolvers []*dnstype.Resolver `json:",omitempty"`// Domains are the search domains to use.// Search domains must be FQDNs, but *without* the trailing dot.Domains []string `json:",omitempty"`// Proxied turns on automatic resolution of hostnames for devices// in the network map, aka MagicDNS.// Despite the (legacy) name, does not necessarily cause request// proxying to be enabled.Proxiedbool `json:",omitzero"`// Nameservers are the IP addresses of the global nameservers to use.//// Deprecated: this is only set and used by MapRequest.Version >=9 and <14. Use Resolvers instead.Nameservers []netip.Addr `json:",omitempty"`// CertDomains are the set of DNS names for which the control// plane server will assist with provisioning TLS// certificates. See SetDNSRequest, which can be used to// answer dns-01 ACME challenges for e.g. LetsEncrypt.// These names are FQDNs without trailing periods, and without// any "_acme-challenge." prefix.CertDomains []string `json:",omitempty"`// ExtraRecords contains extra DNS records to add to the// MagicDNS config.ExtraRecords []DNSRecord `json:",omitempty"`// ExitNodeFilteredSuffixes are the DNS suffixes that the// node, when being an exit node DNS proxy, should not answer.//// The entries do not contain trailing periods and are always// all lowercase.//// If an entry starts with a period, it's a suffix match (but// suffix ".a.b" doesn't match "a.b"; a prefix is required).//// If an entry does not start with a period, it's an exact// match.//// Matches are case insensitive.ExitNodeFilteredSet []string `json:",omitempty"`// TempCorpIssue13969 is a temporary (2023-08-16) field for an internal hack day prototype.// It contains a user inputed URL that should have a list of domains to be blocked.// Seehttps://github.com/tailscale/corp/issues/13969.TempCorpIssue13969string `json:",omitzero"`}

DNSConfig is the DNS configuration.

func (*DNSConfig)Clone ¶added inv1.2.0

func (src *DNSConfig) Clone() *DNSConfig

Clone makes a deep copy of DNSConfig.The result aliases no memory with the original.

func (*DNSConfig)View ¶added inv1.26.0

func (p *DNSConfig) View()DNSConfigView

View returns a read-only view of DNSConfig.

typeDNSConfigView ¶added inv1.26.0

type DNSConfigView struct {// contains filtered or unexported fields}

DNSConfigView provides a read-only view over DNSConfig.

Its methods should only be called if `Valid()` returns true.

func (DNSConfigView)AsStruct ¶added inv1.26.0

func (vDNSConfigView) AsStruct() *DNSConfig

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (DNSConfigView)CertDomains ¶added inv1.26.0

func (vDNSConfigView) CertDomains()views.Slice[string]

CertDomains are the set of DNS names for which the controlplane server will assist with provisioning TLScertificates. See SetDNSRequest, which can be used toanswer dns-01 ACME challenges for e.g. LetsEncrypt.These names are FQDNs without trailing periods, and withoutany "_acme-challenge." prefix.

func (DNSConfigView)Domains ¶added inv1.26.0

func (vDNSConfigView) Domains()views.Slice[string]

Domains are the search domains to use.Search domains must be FQDNs, but *without* the trailing dot.

func (DNSConfigView)ExitNodeFilteredSet ¶added inv1.26.0

func (vDNSConfigView) ExitNodeFilteredSet()views.Slice[string]

ExitNodeFilteredSuffixes are the DNS suffixes that thenode, when being an exit node DNS proxy, should not answer.

The entries do not contain trailing periods and are alwaysall lowercase.

If an entry starts with a period, it's a suffix match (butsuffix ".a.b" doesn't match "a.b"; a prefix is required).

If an entry does not start with a period, it's an exactmatch.

Matches are case insensitive.

func (DNSConfigView)ExtraRecords ¶added inv1.26.0

func (vDNSConfigView) ExtraRecords()views.Slice[DNSRecord]

ExtraRecords contains extra DNS records to add to theMagicDNS config.

func (DNSConfigView)FallbackResolvers ¶added inv1.26.0

func (vDNSConfigView) FallbackResolvers()views.SliceView[*dnstype.Resolver,dnstype.ResolverView]

FallbackResolvers is like Resolvers, but is only used if asplit DNS configuration is requested in a configuration thatdoesn't work yet without explicit default resolvers.https://github.com/tailscale/tailscale/issues/1743

func (DNSConfigView)MarshalJSON ¶added inv1.26.0

func (vDNSConfigView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (DNSConfigView)MarshalJSONTo ¶added inv1.88.0

func (vDNSConfigView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (DNSConfigView)Nameserversdeprecatedadded inv1.26.0

func (vDNSConfigView) Nameservers()views.Slice[netip.Addr]

Nameservers are the IP addresses of the global nameservers to use.

Deprecated: this is only set and used by MapRequest.Version >=9 and <14. Use Resolvers instead.

func (DNSConfigView)Proxied ¶added inv1.26.0

func (vDNSConfigView) Proxied()bool

Proxied turns on automatic resolution of hostnames for devicesin the network map, aka MagicDNS.Despite the (legacy) name, does not necessarily cause requestproxying to be enabled.

func (DNSConfigView)Resolvers ¶added inv1.26.0

func (vDNSConfigView) Resolvers()views.SliceView[*dnstype.Resolver,dnstype.ResolverView]

Resolvers are the DNS resolvers to use, in order of preference.

func (DNSConfigView)Routes ¶added inv1.26.0

func (vDNSConfigView) Routes()views.MapFn[string, []*dnstype.Resolver,views.SliceView[*dnstype.Resolver,dnstype.ResolverView]]

Routes maps DNS name suffixes to a set of DNS resolvers touse. It is used to implement "split DNS" and other advanced DNSrouting overlays.

Map keys are fully-qualified DNS name suffixes; they mayoptionally contain a trailing dot but no leading dot.

If the value is an empty slice, that means the suffix should stillbe handled by Tailscale's built-in resolver (100.100.100.100), suchas for the purpose of handling ExtraRecords.

func (DNSConfigView)TempCorpIssue13969 ¶added inv1.50.0

func (vDNSConfigView) TempCorpIssue13969()string

TempCorpIssue13969 is a temporary (2023-08-16) field for an internal hack day prototype.It contains a user inputed URL that should have a list of domains to be blocked.Seehttps://github.com/tailscale/corp/issues/13969.

func (*DNSConfigView)UnmarshalJSON ¶added inv1.26.0

func (v *DNSConfigView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*DNSConfigView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *DNSConfigView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (DNSConfigView)Valid ¶added inv1.26.0

func (vDNSConfigView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeDNSRecord ¶added inv1.10.0

type DNSRecord struct {// Name is the fully qualified domain name of// the record to add. The trailing dot is optional.Namestring// Type is the DNS record type.// Empty means A or AAAA, depending on value.// Other values are currently ignored.Typestring `json:",omitzero"`// Value is the IP address in string form.// TODO(bradfitz): if we ever add support for record types// with non-UTF8 binary data, add ValueBytes []byte that// would take precedence.Valuestring}

DNSRecord is an extra DNS record to add to MagicDNS.

typeDebug ¶added inv0.98.1

type Debug struct {// SleepSeconds requests that the client sleep for the// provided number of seconds.// The client can (and should) limit the value (such as 5// minutes). This exists as a safety measure to slow down// spinning clients, in case we introduce a bug in the// state machine.SleepSecondsfloat64 `json:",omitempty"`// DisableLogTail disables the logtail package. Once disabled it can't be// re-enabled for the lifetime of the process.//// This is primarily used by Headscale.DisableLogTailbool `json:",omitempty"`// Exit optionally specifies that the client should os.Exit// with this code. This is a safety measure in case a client is crash// looping or in an unsafe state and we need to remotely shut it down.Exit *int `json:",omitempty"`}

Debug used to be a miscellaneous set of declarative debug config changes andimperative debug commands. They've since been mostly migrated to nodeattributes (MapResponse.Node.Capabilities) for the declarative things and c2nrequests for the imperative things. Not much remains here. Don't add more.

typeDisplayMessage ¶added inv1.86.0

type DisplayMessage struct {// Title is a string that the GUI uses as title for this message. The title// should be short and fit in a single line. It should not end in a period.//// Example: "Network may be blocking Tailscale".//// See the various instantiations of [health.Warnable] for more examples.Titlestring// Text is an extended string that the GUI will display to the user. This// could be multiple sentences explaining the issue in more detail.//// Example: "macOS Screen Time seems to be blocking Tailscale. Try disabling// Screen Time in System Settings > Screen Time > Content & Privacy > Access// to Web Content."//// See the various instantiations of [health.Warnable] for more examples.Textstring// Severity is the severity of the DisplayMessage, which the GUI can use to// determine how to display it. Maps to [health.Severity].SeverityDisplayMessageSeverity// ImpactsConnectivity is whether the health problem will impact the user's// ability to connect to the Internet or other nodes on the tailnet, which// the GUI can use to determine how to display it.ImpactsConnectivitybool `json:",omitempty"`// Primary action, if present, represents the action to allow the user to// take when interacting with this message. For example, if the// DisplayMessage is shown via a notification, the action label might be a// button on that notification and clicking the button would open the URL.PrimaryAction *DisplayMessageAction `json:",omitempty"`}

DisplayMessage represents a health state of the node from the control plane'sperspective. It is deliberately similar to [health.Warnable] as both getconverted into [health.UnhealthyState] to be sent to the GUI.

func (DisplayMessage)Equal ¶added inv1.86.0

func (mDisplayMessage) Equal(oDisplayMessage)bool

Equal returns true iff all fields are equal.

typeDisplayMessageAction ¶added inv1.86.0

type DisplayMessageAction struct {// URL is the URL to navigate to when the user interacts with this actionURLstring// Label is the call to action for the UI to display on the UI element that// will open the URL (such as a button or link). For example, "Sign in" or// "Learn more".Labelstring}

DisplayMessageAction represents an action (URL and link) to be presented tothe user associated with aDisplayMessage.

typeDisplayMessageID ¶added inv1.86.0

type DisplayMessageIDstring

DisplayMessageID is a string that uniquely identifies the kind of healthissue (e.g. "session-expired").

typeDisplayMessageSeverity ¶added inv1.86.0

type DisplayMessageSeveritystring

DisplayMessageSeverity represents how serious aDisplayMessage is. Analogousto health.Severity.

const (// SeverityHigh is the highest severity level, used for critical errors that need immediate attention.// On platforms where the client GUI can deliver notifications, a SeverityHigh message will trigger// a modal notification.SeverityHighDisplayMessageSeverity = "high"// SeverityMedium is used for errors that are important but not critical. This won't trigger a modal// notification, however it will be displayed in a more visible way than a SeverityLow message.SeverityMediumDisplayMessageSeverity = "medium"// SeverityLow is used for less important notices that don't need immediate attention. The user will// have to go to a Settings window, or another "hidden" GUI location to see these messages.SeverityLowDisplayMessageSeverity = "low")

typeEarlyNoise ¶added inv1.34.0

type EarlyNoise struct {// NodeKeyChallenge is a random per-connection public key to be used by// the client to prove possession of a wireguard private key.NodeKeyChallengekey.ChallengePublic `json:"nodeKeyChallenge"`}

EarlyNoise is the early payload that's sent over Noise but before the HTTP/2handshake when connecting to the coordination server.

This exists to let the server push some early info to client for thatstateful HTTP/2+Noise connection without incurring an extra round trip. (Thiswould've used HTTP/2 server push, had Go's client-side APIs been available)

typeEndpoint ¶added inv1.8.0

type Endpoint struct {Addrnetip.AddrPortTypeEndpointType}

Endpoint is an endpoint IPPort and an associated type.It doesn't currently go over the wire as is but is insteadbroken up into two parallel slices in MapRequest, for compatibilityreasons. But this type is used in the codebase.

typeEndpointType ¶added inv1.8.0

type EndpointTypeint

EndpointType distinguishes different sources of MapRequest.Endpoint values.

func (EndpointType)String ¶added inv1.8.0

func (etEndpointType) String()string

typeFilterRule ¶added inv0.98.1

type FilterRule struct {// SrcIPs are the source IPs/networks to match.//// It may take the following forms://     * an IP address (IPv4 or IPv6)//     * the string "*" to match everything (both IPv4 & IPv6)//     * a CIDR (e.g. "192.168.0.0/16")//     * a range of two IPs, inclusive, separated by hyphen ("2eff::1-2eff::0800")//     * a string "cap:<capability>" with NodeCapMap cap nameSrcIPs []string// SrcBits is deprecated; it was the old way to specify a CIDR// prior to CapabilityVersion 7. Its values correspond to the// SrcIPs above.//// If an entry of SrcBits is present for the same index as a// SrcIPs entry, it changes the SrcIP above to be a network// with /n CIDR bits. If the slice is nil or insufficiently// long, the default value (for an IPv4 address) for a// position is 32, as if the SrcIPs above were a /32 mask. For// a "*" SrcIPs value, the corresponding SrcBits value is// ignored.//// This is still present in this file because the Tailscale control plane// code still uses this type, for 118 clients that are still connected as of// 2024-06-18, 3.5 years after the last release that used this type.SrcBits []int `json:",omitempty"`// DstPorts are the port ranges to allow once a source IP// matches (is in the CIDR described by SrcIPs).//// CapGrant and DstPorts are mutually exclusive: at most one can be non-nil.DstPorts []NetPortRange `json:",omitempty"`// IPProto are the IP protocol numbers to match.//// As a special case, nil or empty means TCP, UDP, and ICMP.//// Numbers outside the uint8 range (below 0 or above 255) are// reserved for Tailscale's use. Unknown ones are ignored.//// Depending on the IPProto values, DstPorts may or may not be// used.IPProto []int `json:",omitempty"`// CapGrant, if non-empty, are the capabilities to// conditionally grant to the source IP in SrcIPs.//// Think of DstPorts as "capabilities for networking" and// CapGrant as arbitrary application-defined capabilities// defined between the admin's ACLs and the application// doing WhoIs lookups, looking up the remote IP address's// application-level capabilities.//// CapGrant and DstPorts are mutually exclusive: at most one can be non-nil.CapGrant []CapGrant `json:",omitempty"`}

FilterRule represents one rule in a packet filter.

A rule is logically a set of source CIDRs to match (described bySrcIPs), and a set of destination targets that are thenallowed if a source IP is matches of those CIDRs.

typeHealthChangeRequest ¶added inv1.32.0

type HealthChangeRequest struct {Subsysstring// a health.Subsystem value in string formErrorstring// or empty if cleared// NodeKey is the client's current node key.// In clients <= 1.62.0 it was always the zero value.NodeKeykey.NodePublic}

HealthChangeRequest is the JSON request body type used to reportnode health changes to:

POST https://<control-plane>/machine/update-health.

As of 2025-10-02, we stopped sending this to the control plane proactively.It was never useful enough with its current design and needs more thought.

typeHostinfo ¶

type Hostinfo struct {IPNVersionstring `json:",omitzero"`// version of this code (in version.Long format)FrontendLogIDstring `json:",omitzero"`// logtail ID of frontend instanceBackendLogIDstring `json:",omitzero"`// logtail ID of backend instanceOSstring `json:",omitzero"`// operating system the client runs on (a version.OS value)// OSVersion is the version of the OS, if available.//// For Android, it's like "10", "11", "12", etc. For iOS and macOS it's like// "15.6.1" or "12.4.0". For Windows it's like "10.0.19044.1889". For// FreeBSD it's like "12.3-STABLE".//// For Linux, prior to Tailscale 1.32, we jammed a bunch of fields into this// string on Linux, like "Debian 10.4; kernel=xxx; container; env=kn" and so// on. As of Tailscale 1.32, this is simply the kernel version on Linux, like// "5.10.0-17-amd64".OSVersionstring `json:",omitzero"`Containeropt.Bool `json:",omitzero"`// best-effort whether the client is running in a containerEnvstring   `json:",omitzero"`// a hostinfo.EnvType in string formDistrostring   `json:",omitzero"`// "debian", "ubuntu", "nixos", ...DistroVersionstring   `json:",omitzero"`// "20.04", ...DistroCodeNamestring   `json:",omitzero"`// "jammy", "bullseye", ...// App is used to disambiguate Tailscale clients that run using tsnet.Appstring `json:",omitzero"`// "k8s-operator", "golinks", ...Desktopopt.Bool `json:",omitzero"`// if a desktop was detected on LinuxPackagestring   `json:",omitzero"`// Tailscale package to disambiguate ("choco", "appstore", etc; "" for unknown)DeviceModelstring   `json:",omitzero"`// mobile phone model ("Pixel 3a", "iPhone12,3")PushDeviceTokenstring   `json:",omitzero"`// macOS/iOS APNs device token for notifications (and Android in the future)Hostnamestring   `json:",omitzero"`// name of the host the client runs onShieldsUpbool     `json:",omitzero"`// indicates whether the host is blocking incoming connectionsShareeNodebool     `json:",omitzero"`// indicates this node exists in netmap because it's owned by a shared-to userNoLogsNoSupportbool     `json:",omitzero"`// indicates that the user has opted out of sending logs and support// WireIngress indicates that the node would like to be wired up server-side// (DNS, etc) to be able to use Tailscale Funnel, even if it's not currently// enabled. For example, the user might only use it for intermittent// foreground CLI serve sessions, for which they'd like it to work right// away, even if it's disabled most of the time. As an optimization, this is// only sent if IngressEnabled is false, as IngressEnabled implies that this// option is true.WireIngressbool           `json:",omitzero"`IngressEnabledbool           `json:",omitzero"`// if the node has any funnel endpoint enabledAllowsUpdatebool           `json:",omitzero"`// indicates that the node has opted-in to admin-console-drive remote updatesMachinestring         `json:",omitzero"`// the current host's machine type (uname -m)GoArchstring         `json:",omitzero"`// GOARCH value (of the built binary)GoArchVarstring         `json:",omitzero"`// GOARM, GOAMD64, etc (of the built binary)GoVersionstring         `json:",omitzero"`// Go version binary was built withRoutableIPs     []netip.Prefix `json:",omitempty"`// set of IP ranges this client can routeRequestTags     []string       `json:",omitempty"`// set of ACL tags this node wants to claimWoLMACs         []string       `json:",omitempty"`// MAC address(es) to send Wake-on-LAN packets to wake this node (lowercase hex w/ colons)Services        []Service      `json:",omitempty"`// services advertised by this machineNetInfo         *NetInfo       `json:",omitzero"`SSH_HostKeys    []string       `json:"sshHostKeys,omitempty"`// if advertisedCloudstring         `json:",omitzero"`Userspaceopt.Bool       `json:",omitzero"`// if the client is running in userspace (netstack) modeUserspaceRouteropt.Bool       `json:",omitzero"`// if the client's subnet router is running in userspace (netstack) modeAppConnectoropt.Bool       `json:",omitzero"`// if the client is running the app-connector serviceServicesHashstring         `json:",omitzero"`// opaque hash of the most recent list of tailnet services, change in hash indicates config should be fetched via c2nExitNodeIDStableNodeID   `json:",omitzero"`// the client’s selected exit node, empty when unselected.// Location represents geographical location data about a// Tailscale host. Location is optional and only set if// explicitly declared by a node.Location *Location `json:",omitzero"`TPM *TPMInfo `json:",omitzero"`// TPM device metadata, if available// StateEncrypted reports whether the node state is stored encrypted on// disk. The actual mechanism is platform-specific://   * Apple nodes use the Keychain//   * Linux and Windows nodes use the TPM//   * Android apps use EncryptedSharedPreferencesStateEncryptedopt.Bool `json:",omitzero"`}

Hostinfo contains a summary of a Tailscale host.

Because it contains pointers (slices), this type should not be usedas a value type.

func (*Hostinfo)CheckRequestTags ¶added inv1.4.0

func (h *Hostinfo) CheckRequestTags()error

CheckRequestTags checks that all of h.RequestTags are valid.

func (*Hostinfo)Clone ¶

func (src *Hostinfo) Clone() *Hostinfo

Clone makes a deep copy of Hostinfo.The result aliases no memory with the original.

func (*Hostinfo)Equal ¶

func (h *Hostinfo) Equal(h2 *Hostinfo)bool

Equal reports whether h and h2 are equal.

func (*Hostinfo)TailscaleSSHEnabled ¶added inv1.28.0

func (hi *Hostinfo) TailscaleSSHEnabled()bool

TailscaleSSHEnabled reports whether or not this node is acting as aTailscale SSH server.

func (*Hostinfo)View ¶added inv1.22.0

func (p *Hostinfo) View()HostinfoView

View returns a read-only view of Hostinfo.

typeHostinfoView ¶added inv1.22.0

type HostinfoView struct {// contains filtered or unexported fields}

HostinfoView provides a read-only view over Hostinfo.

Its methods should only be called if `Valid()` returns true.

func (HostinfoView)AllowsUpdate ¶added inv1.36.0

func (vHostinfoView) AllowsUpdate()bool

indicates that the node has opted-in to admin-console-drive remote updates

func (HostinfoView)App ¶added inv1.38.0

func (vHostinfoView) App()string

App is used to disambiguate Tailscale clients that run using tsnet.

func (HostinfoView)AppConnector ¶added inv1.54.0

func (vHostinfoView) AppConnector()opt.Bool

if the client is running the app-connector service

func (HostinfoView)AsStruct ¶added inv1.22.0

func (vHostinfoView) AsStruct() *Hostinfo

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (HostinfoView)BackendLogID ¶added inv1.22.0

func (vHostinfoView) BackendLogID()string

logtail ID of backend instance

func (HostinfoView)Cloud ¶added inv1.28.0

func (vHostinfoView) Cloud()string

func (HostinfoView)Container ¶added inv1.32.0

func (vHostinfoView) Container()opt.Bool

best-effort whether the client is running in a container

func (HostinfoView)Desktop ¶added inv1.26.0

func (vHostinfoView) Desktop()opt.Bool

if a desktop was detected on Linux

func (HostinfoView)DeviceModel ¶added inv1.22.0

func (vHostinfoView) DeviceModel()string

mobile phone model ("Pixel 3a", "iPhone12,3")

func (HostinfoView)Distro ¶added inv1.32.0

func (vHostinfoView) Distro()string

"debian", "ubuntu", "nixos", ...

func (HostinfoView)DistroCodeName ¶added inv1.32.0

func (vHostinfoView) DistroCodeName()string

"jammy", "bullseye", ...

func (HostinfoView)DistroVersion ¶added inv1.32.0

func (vHostinfoView) DistroVersion()string

"20.04", ...

func (HostinfoView)Env ¶added inv1.32.0

func (vHostinfoView) Env()string

a hostinfo.EnvType in string form

func (HostinfoView)Equal ¶added inv1.22.0

func (vHostinfoView) Equal(v2HostinfoView)bool

func (HostinfoView)ExitNodeID ¶added inv1.86.0

func (vHostinfoView) ExitNodeID()StableNodeID

the client’s selected exit node, empty when unselected.

func (HostinfoView)FrontendLogID ¶added inv1.22.0

func (vHostinfoView) FrontendLogID()string

logtail ID of frontend instance

func (HostinfoView)GoArch ¶added inv1.22.0

func (vHostinfoView) GoArch()string

GOARCH value (of the built binary)

func (HostinfoView)GoArchVar ¶added inv1.36.0

func (vHostinfoView) GoArchVar()string

GOARM, GOAMD64, etc (of the built binary)

func (HostinfoView)GoVersion ¶added inv1.30.0

func (vHostinfoView) GoVersion()string

Go version binary was built with

func (HostinfoView)Hostname ¶added inv1.22.0

func (vHostinfoView) Hostname()string

name of the host the client runs on

func (HostinfoView)IPNVersion ¶added inv1.22.0

func (vHostinfoView) IPNVersion()string

version of this code (in version.Long format)

func (HostinfoView)IngressEnabled ¶added inv1.80.0

func (vHostinfoView) IngressEnabled()bool

if the node has any funnel endpoint enabled

func (HostinfoView)Location ¶added inv1.46.0

func (vHostinfoView) Location()LocationView

Location represents geographical location data about aTailscale host. Location is optional and only set ifexplicitly declared by a node.

func (HostinfoView)Machine ¶added inv1.36.0

func (vHostinfoView) Machine()string

the current host's machine type (uname -m)

func (HostinfoView)MarshalJSON ¶added inv1.22.0

func (vHostinfoView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (HostinfoView)MarshalJSONTo ¶added inv1.88.0

func (vHostinfoView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (HostinfoView)NetInfo ¶added inv1.22.0

func (vHostinfoView) NetInfo()NetInfoView

func (HostinfoView)NoLogsNoSupport ¶added inv1.32.0

func (vHostinfoView) NoLogsNoSupport()bool

indicates that the user has opted out of sending logs and support

func (HostinfoView)OS ¶added inv1.22.0

func (vHostinfoView) OS()string

operating system the client runs on (a version.OS value)

func (HostinfoView)OSVersion ¶added inv1.22.0

func (vHostinfoView) OSVersion()string

OSVersion is the version of the OS, if available.

For Android, it's like "10", "11", "12", etc. For iOS and macOS it's like"15.6.1" or "12.4.0". For Windows it's like "10.0.19044.1889". ForFreeBSD it's like "12.3-STABLE".

For Linux, prior to Tailscale 1.32, we jammed a bunch of fields into thisstring on Linux, like "Debian 10.4; kernel=xxx; container; env=kn" and soon. As of Tailscale 1.32, this is simply the kernel version on Linux, like"5.10.0-17-amd64".

func (HostinfoView)Package ¶added inv1.22.0

func (vHostinfoView) Package()string

Tailscale package to disambiguate ("choco", "appstore", etc; "" for unknown)

func (HostinfoView)PushDeviceToken ¶added inv1.38.0

func (vHostinfoView) PushDeviceToken()string

macOS/iOS APNs device token for notifications (and Android in the future)

func (HostinfoView)RequestTags ¶added inv1.22.0

func (vHostinfoView) RequestTags()views.Slice[string]

set of ACL tags this node wants to claim

func (HostinfoView)RoutableIPs ¶added inv1.22.0

func (vHostinfoView) RoutableIPs()views.Slice[netip.Prefix]

set of IP ranges this client can route

func (HostinfoView)SSH_HostKeys ¶added inv1.22.0

func (vHostinfoView) SSH_HostKeys()views.Slice[string]

if advertised

func (HostinfoView)Services ¶added inv1.22.0

func (vHostinfoView) Services()views.Slice[Service]

services advertised by this machine

func (HostinfoView)ServicesHash ¶added inv1.78.0

func (vHostinfoView) ServicesHash()string

opaque hash of the most recent list of tailnet services, change in hash indicates config should be fetched via c2n

func (HostinfoView)ShareeNode ¶added inv1.22.0

func (vHostinfoView) ShareeNode()bool

indicates this node exists in netmap because it's owned by a shared-to user

func (HostinfoView)ShieldsUp ¶added inv1.22.0

func (vHostinfoView) ShieldsUp()bool

indicates whether the host is blocking incoming connections

func (HostinfoView)StateEncrypted ¶added inv1.86.0

func (vHostinfoView) StateEncrypted()opt.Bool

StateEncrypted reports whether the node state is stored encrypted ondisk. The actual mechanism is platform-specific:

Apple nodes use the Keychain
Linux and Windows nodes use the TPM
Android apps use EncryptedSharedPreferences

func (HostinfoView)TPM ¶added inv1.84.0

func (vHostinfoView) TPM()views.ValuePointer[TPMInfo]

TPM device metadata, if available

func (HostinfoView)TailscaleSSHEnabled ¶added inv1.28.0

func (vHostinfoView) TailscaleSSHEnabled()bool

func (*HostinfoView)UnmarshalJSON ¶added inv1.22.0

func (v *HostinfoView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*HostinfoView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *HostinfoView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (HostinfoView)Userspace ¶added inv1.30.0

func (vHostinfoView) Userspace()opt.Bool

if the client is running in userspace (netstack) mode

func (HostinfoView)UserspaceRouter ¶added inv1.30.0

func (vHostinfoView) UserspaceRouter()opt.Bool

if the client's subnet router is running in userspace (netstack) mode

func (HostinfoView)Valid ¶added inv1.22.0

func (vHostinfoView) Valid()bool

Valid reports whether v's underlying value is non-nil.

func (HostinfoView)WireIngress ¶added inv1.34.0

func (vHostinfoView) WireIngress()bool

WireIngress indicates that the node would like to be wired up server-side(DNS, etc) to be able to use Tailscale Funnel, even if it's not currentlyenabled. For example, the user might only use it for intermittentforeground CLI serve sessions, for which they'd like it to work rightaway, even if it's disabled most of the time. As an optimization, this isonly sent if IngressEnabled is false, as IngressEnabled implies that thisoption is true.

func (HostinfoView)WoLMACs ¶added inv1.52.0

func (vHostinfoView) WoLMACs()views.Slice[string]

MAC address(es) to send Wake-on-LAN packets to wake this node (lowercase hex w/ colons)

typeID ¶

type IDint64

ID is an integer ID for a user, node, or login allocated by thecontrol plane.

To be nice, control plane servers should not use int64s that are too large tofit in a JavaScript number (see JavaScript's Number.MAX_SAFE_INTEGER).The Tailscale-hosted control plane stopped allocating large integers inMarch 2023 but nodes prior to that may have IDs larger thanMAX_SAFE_INTEGER (2^53 – 1).

IDs must not be zero or negative.

func (ID)String ¶

func (idID) String()string

typeLocation ¶added inv1.46.0

type Location struct {Countrystring `json:",omitempty"`// User friendly country name, with proper capitalization ("Canada")CountryCodestring `json:",omitempty"`// ISO 3166-1 alpha-2 in upper case ("CA")Citystring `json:",omitempty"`// User friendly city name, with proper capitalization ("Squamish")// CityCode is a short code representing the city in upper case.// CityCode is used to disambiguate a city from another location// with the same city name. It uniquely identifies a particular// geographical location, within the tailnet.// IATA, ICAO or ISO 3166-2 codes are recommended ("YSE")CityCodestring `json:",omitempty"`// Latitude, Longitude are optional geographical coordinates of the node, in degrees.// No particular accuracy level is promised; the coordinates may simply be the center of the city or country.Latitudefloat64 `json:",omitempty"`Longitudefloat64 `json:",omitempty"`// Priority determines the order of use of an exit node when a// location based preference matches more than one exit node,// the node with the highest priority wins. Nodes of equal// probability may be selected arbitrarily.//// A value of 0 means the exit node does not have a priority// preference. A negative int is not allowed.Priorityint `json:",omitempty"`}

Location represents geographical location data about aTailscale host. Location is optional and only set ifexplicitly declared by a node.

func (*Location)Clone ¶added inv1.46.0

func (src *Location) Clone() *Location

Clone makes a deep copy of Location.The result aliases no memory with the original.

func (*Location)View ¶added inv1.46.0

func (p *Location) View()LocationView

View returns a read-only view of Location.

typeLocationView ¶added inv1.46.0

type LocationView struct {// contains filtered or unexported fields}

LocationView provides a read-only view over Location.

Its methods should only be called if `Valid()` returns true.

func (LocationView)AsStruct ¶added inv1.46.0

func (vLocationView) AsStruct() *Location

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (LocationView)City ¶added inv1.46.0

func (vLocationView) City()string

User friendly city name, with proper capitalization ("Squamish")

func (LocationView)CityCode ¶added inv1.46.0

func (vLocationView) CityCode()string

CityCode is a short code representing the city in upper case.CityCode is used to disambiguate a city from another locationwith the same city name. It uniquely identifies a particulargeographical location, within the tailnet.IATA, ICAO or ISO 3166-2 codes are recommended ("YSE")

func (LocationView)Country ¶added inv1.46.0

func (vLocationView) Country()string

User friendly country name, with proper capitalization ("Canada")

func (LocationView)CountryCode ¶added inv1.46.0

func (vLocationView) CountryCode()string

ISO 3166-1 alpha-2 in upper case ("CA")

func (LocationView)Latitude ¶added inv1.62.0

func (vLocationView) Latitude()float64

Latitude, Longitude are optional geographical coordinates of the node, in degrees.No particular accuracy level is promised; the coordinates may simply be the center of the city or country.

func (LocationView)Longitude ¶added inv1.62.0

func (vLocationView) Longitude()float64

func (LocationView)MarshalJSON ¶added inv1.46.0

func (vLocationView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (LocationView)MarshalJSONTo ¶added inv1.88.0

func (vLocationView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (LocationView)Priority ¶added inv1.46.0

func (vLocationView) Priority()int

Priority determines the order of use of an exit node when alocation based preference matches more than one exit node,the node with the highest priority wins. Nodes of equalprobability may be selected arbitrarily.

A value of 0 means the exit node does not have a prioritypreference. A negative int is not allowed.

func (*LocationView)UnmarshalJSON ¶added inv1.46.0

func (v *LocationView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*LocationView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *LocationView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (LocationView)Valid ¶added inv1.46.0

func (vLocationView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeLogin ¶

type Login struct {IDLoginID// unused in the Tailscale clientProviderstring// "google", "github", "okta_foo", etc.LoginNamestring// an email address or "email-ish" string (like alice@github)DisplayNamestring// from the IdPProfilePicURLstring  `json:",omitzero"`// from the IdP// contains filtered or unexported fields}

func (*Login)Clone ¶added inv1.2.0

func (src *Login) Clone() *Login

Clone makes a deep copy of Login.The result aliases no memory with the original.

func (*Login)View ¶added inv1.26.0

func (p *Login) View()LoginView

View returns a read-only view of Login.

typeLoginID ¶

type LoginIDID

LoginID is anID for aLogin.

It is not used in the Tailscale client, but is used in the control plane.

func (LoginID)IsZero ¶added inv1.2.0

func (uLoginID) IsZero()bool

func (LoginID)String ¶

func (idLoginID) String()string

typeLoginView ¶added inv1.26.0

type LoginView struct {// contains filtered or unexported fields}

LoginView provides a read-only view over Login.

Its methods should only be called if `Valid()` returns true.

func (LoginView)AsStruct ¶added inv1.26.0

func (vLoginView) AsStruct() *Login

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (LoginView)DisplayName ¶added inv1.26.0

func (vLoginView) DisplayName()string

from the IdP

func (LoginView)ID ¶added inv1.26.0

func (vLoginView) ID()LoginID

unused in the Tailscale client

func (LoginView)LoginName ¶added inv1.26.0

func (vLoginView) LoginName()string

an email address or "email-ish" string (like alice@github)

func (LoginView)MarshalJSON ¶added inv1.26.0

func (vLoginView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (LoginView)MarshalJSONTo ¶added inv1.88.0

func (vLoginView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (LoginView)ProfilePicURL ¶added inv1.26.0

func (vLoginView) ProfilePicURL()string

from the IdP

func (LoginView)Provider ¶added inv1.26.0

func (vLoginView) Provider()string

"google", "github", "okta_foo", etc.

func (*LoginView)UnmarshalJSON ¶added inv1.26.0

func (v *LoginView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*LoginView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *LoginView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (LoginView)Valid ¶added inv1.26.0

func (vLoginView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeMachineStatus ¶

type MachineStatusint

MachineStatus is the state of aNode's approval into a tailnet.

A "node" and a "machine" are often 1:1, but technically a Tailscaledaemon has one machine key and can have multiple nodes (e.g. differentusers on Windows) for that one machine key.

func (MachineStatus)AppendText ¶added inv1.50.0

func (mMachineStatus) AppendText(b []byte) ([]byte,error)

func (MachineStatus)MarshalText ¶

func (mMachineStatus) MarshalText() ([]byte,error)

func (MachineStatus)String ¶

func (mMachineStatus) String()string

func (*MachineStatus)UnmarshalText ¶

func (m *MachineStatus) UnmarshalText(b []byte)error

typeMapRequest ¶

type MapRequest struct {// Version is incremented whenever the client code changes enough that// we want to signal to the control server that we're capable of something// different.//// For current values and history, see the CapabilityVersion type's docs.VersionCapabilityVersionCompressstring `json:",omitzero"`// "zstd" or "" (no compression)KeepAlivebool   `json:",omitzero"`// whether server should send keep-alives back to usNodeKeykey.NodePublicDiscoKeykey.DiscoPublic// HardwareAttestationKey is the public key of the node's hardware-backed// identity attestation key, if any.HardwareAttestationKeykey.HardwareAttestationPublic `json:",omitzero"`// HardwareAttestationKeySignature is the signature of// "$UNIX_TIMESTAMP|$NODE_KEY" using its hardware attestation key, if any.HardwareAttestationKeySignature []byte `json:",omitempty"`// HardwareAttestationKeySignatureTimestamp is the time at which the// HardwareAttestationKeySignature was created, if any. This UNIX timestamp// value is prepended to the node key when signing.HardwareAttestationKeySignatureTimestamptime.Time `json:",omitzero"`// Stream is whether the client wants to receive multiple MapResponses over// the same HTTP connection.//// If false, the server will send a single MapResponse and then close the// connection.//// If true and Version >= 68, the server should treat this as a read-only// request and ignore any Hostinfo or other fields that might be set.Streambool `json:",omitzero"`// Hostinfo is the client's current Hostinfo. Although it is always included// in the request, the server may choose to ignore it when Stream is true// and Version >= 68.Hostinfo *Hostinfo// MapSessionHandle, if non-empty, is a request to reattach to a previous// map session after a previous map session was interrupted for whatever// reason. Its value is an opaque string as returned by// MapResponse.MapSessionHandle.//// When set, the client must also send MapSessionSeq to specify the last// processed message in that prior session.//// The server may choose to ignore the request for any reason and start a// new map session. This is only applicable when Stream is true.MapSessionHandlestring `json:",omitzero"`// MapSessionSeq is the sequence number in the map session identified by// MapSesssionHandle that was most recently processed by the client.// It is only applicable when MapSessionHandle is specified.// If the server chooses to honor the MapSessionHandle request, only sequence// numbers greater than this value will be returned.MapSessionSeqint64 `json:",omitzero"`// Endpoints are the client's magicsock UDP ip:port endpoints (IPv4 or IPv6).// These can be ignored if Stream is true and Version >= 68.Endpoints []netip.AddrPort `json:",omitempty"`// EndpointTypes are the types of the corresponding endpoints in Endpoints.EndpointTypes []EndpointType `json:",omitempty"`// TKAHead describes the hash of the latest AUM applied to the local// tailnet key authority, if one is operating.// It is encoded as tka.AUMHash.MarshalText.TKAHeadstring `json:",omitzero"`// ReadOnly was set when client just wanted to fetch the MapResponse,// without updating their Endpoints. The intended use was for clients to// discover the DERP map at start-up before their first real endpoint// update.//// Deprecated: always false as of Version 68.ReadOnlybool `json:",omitzero"`// OmitPeers is whether the client is okay with the Peers list being omitted// in the response.//// The behavior of OmitPeers being true varies based on Stream and ReadOnly://// If OmitPeers is true, Stream is false, and ReadOnly is false,// then the server will let clients update their endpoints without// breaking existing long-polling (Stream == true) connections.// In this case, the server can omit the entire response; the client// only checks the HTTP response status code.//// If OmitPeers is true, Stream is false, but ReadOnly is true,// then all the response fields are included. (This is what the client does// when initially fetching the DERP map.)OmitPeersbool `json:",omitzero"`// DebugFlags is a list of strings specifying debugging and// development features to enable in handling this map// request. The values are deliberately unspecified, as they get// added and removed all the time during development, and offer no// compatibility promise. To roll out semantic changes, bump// Version instead.//// Current DebugFlags values are://     * "warn-ip-forwarding-off": client is trying to be a subnet//       router but their IP forwarding is broken.//     * "warn-router-unhealthy": client's Router implementation is//       having problems.DebugFlags []string `json:",omitempty"`// ConnectionHandleForTest, if non-empty, is an opaque string sent by the client that// identifies this specific connection to the server. The server may choose to// use this handle to identify the connection for debugging or testing// purposes. It has no semantic meaning.ConnectionHandleForTeststring `json:",omitzero"`}

MapRequest is sent by a client to either update the control planeabout its current state, or to start a long-poll of network map updates.

The request includes a copy of the client's current set of WireGuardendpoints and general host information.

This is JSON-encoded and sent over the control plane connection to:

POST https://<control-plane>/machine/map

typeMapResponse ¶

type MapResponse struct {// MapSessionHandle optionally specifies a unique opaque handle for this// stateful MapResponse session. Servers may choose not to send it, and it's// only sent on the first MapResponse in a stream. The client can determine// whether it's reattaching to a prior stream by seeing whether this value// matches the requested MapRequest.MapSessionHandle.MapSessionHandlestring `json:",omitempty"`// Seq is a sequence number within a named map session (a response where the// first message contains a MapSessionHandle). The Seq number may be omitted// on responses that don't change the state of the stream, such as KeepAlive// or certain types of PingRequests. This is the value to be sent in// MapRequest.MapSessionSeq to resume after this message.Seqint64 `json:",omitempty"`// KeepAlive, if set, represents an empty message just to keep// the connection alive. When true, all other fields except// PingRequest, ControlTime, and PopBrowserURL are ignored.KeepAlivebool `json:",omitempty"`// PingRequest, if non-empty, is a request to the client to// prove it's still there by sending an HTTP request to the// provided URL. No auth headers are necessary.// PingRequest may be sent on any MapResponse (ones with// KeepAlive true or false).PingRequest *PingRequest `json:",omitempty"`// PopBrowserURL, if non-empty, is a URL for the client to// open to complete an action. The client should dup suppress// identical URLs and only open it once for the same URL.PopBrowserURLstring `json:",omitempty"`// Node describes the node making the map request.// Starting with MapRequest.Version 18, nil means unchanged.Node *Node `json:",omitempty"`// DERPMap describe the set of DERP servers available.// A nil value means unchanged.DERPMap *DERPMap `json:",omitempty"`// Peers, if non-empty, is the complete list of peers.// It will be set in the first MapResponse for a long-polled request/response.// Subsequent responses will be delta-encoded if MapRequest.Version >= 5 and server// chooses, in which case Peers will be nil or zero length.// If Peers is non-empty, PeersChanged and PeersRemoved should// be ignored (and should be empty).// Peers is always returned sorted by Node.ID.Peers []*Node `json:",omitempty"`// PeersChanged are the Nodes (identified by their ID) that// have changed or been added since the past update on the// HTTP response. It's not used by the server if MapRequest.Version < 5.// PeersChanged is always returned sorted by Node.ID.PeersChanged []*Node `json:",omitempty"`// PeersRemoved are the NodeIDs that are no longer in the peer list.PeersRemoved []NodeID `json:",omitempty"`// PeersChangedPatch, if non-nil, means that node(s) have changed.// This is a lighter version of the older PeersChanged support that// only supports certain types of updates.//// These are applied after Peers* above, but in practice the// control server should only send these on their own, without// the Peers* fields also set.PeersChangedPatch []*PeerChange `json:",omitempty"`// PeerSeenChange contains information on how to update peers' LastSeen// times. If the value is false, the peer is gone. If the value is true,// the LastSeen time is now. Absent means unchanged.PeerSeenChange map[NodeID]bool `json:",omitempty"`// OnlineChange changes the value of a Peer Node.Online value.OnlineChange map[NodeID]bool `json:",omitempty"`// DNSConfig contains the DNS settings for the client to use.// A nil value means no change from an earlier non-nil value.DNSConfig *DNSConfig `json:",omitempty"`// Domain is the name of the network that this node is// in. It's either of the form "example.com" (for user// foo@example.com, for multi-user networks) or// "foo@gmail.com" (for siloed users on shared email// providers). Its exact form should not be depended on; new// forms are coming later.// If empty, the value is unchanged.Domainstring `json:",omitempty"`// CollectServices reports whether this node's Tailnet has// requested that info about services be included in HostInfo.// If unset, the most recent non-empty MapResponse value in// the HTTP response stream is used.CollectServicesopt.Bool `json:",omitempty"`// PacketFilter are the firewall rules.//// For MapRequest.Version >= 6, a nil value means the most// previously streamed non-nil MapResponse.PacketFilter within// the same HTTP response. A non-nil but empty list always means// no PacketFilter (that is, to block everything).//// Note that this package's type, due its use of a slice and omitempty, is// unable to marshal a zero-length non-nil slice. The control server needs// to marshal this type using a separate type. See MapResponse docs.//// See PacketFilters for the newer way to send PacketFilter updates.PacketFilter []FilterRule `json:",omitempty"`// PacketFilters encodes incremental packet filter updates to the client// without having to send the entire packet filter on any changes as// required by the older PacketFilter (singular) field above. The map keys// are server-assigned arbitrary strings. The map values are the new rules// for that key, or nil to delete it. The client then concatenates all the// rules together to generate the final packet filter. Because the// FilterRules can only match or not match, the ordering of filter rules// doesn't matter. (That said, the client generates the file merged packet// filter rules by concananting all the packet filter rules sorted by the// map key name. But it does so for stability and testability, not// correctness. If something needs to rely on that property, something has// gone wrong.)//// If the server sends a non-nil PacketFilter (above), that is equivalent to// a named packet filter with the key "base". It is valid for the server to// send both PacketFilter and PacketFilters in the same MapResponse or// alternate between them within a session. The PacketFilter is applied// first (if set) and then the PacketFilters.//// As a special case, the map key "*" with a value of nil means to clear all// prior named packet filters (including any implicit "base") before// processing the other map entries.PacketFilters map[string][]FilterRule `json:",omitempty"`// UserProfiles are the user profiles of nodes in the network.// As as of 1.1.541 (mapver 5), this contains new or updated// user profiles only.UserProfiles []UserProfile `json:",omitempty"`// Health, if non-nil, sets the health state of the node from the control// plane's perspective. A nil value means no change from the previous// MapResponse. A non-nil 0-length slice restores the health to good (no// known problems). A non-zero length slice are the list of problems that// the control plane sees.//// Either this will be set, or DisplayMessages will be set, but not both.//// Note that this package's type, due its use of a slice and omitempty, is// unable to marshal a zero-length non-nil slice. The control server needs// to marshal this type using a separate type. See MapResponse docs.Health []string `json:",omitempty"`// DisplayMessages sets the health state of the node from the control// plane's perspective.//// Either this will be set, or Health will be set, but not both.//// The map keys are IDs that uniquely identify the type of health issue. The// map values are the messages. If the server sends down a map with entries,// the client treats it as a patch: new entries are added, keys with a value// of nil are deleted, existing entries with new values are updated. A nil// map and an empty map both mean no change has occurred since the last// update.//// As a special case, the map key "*" with a value of nil means to clear all// prior display messages before processing the other map entries.DisplayMessages map[DisplayMessageID]*DisplayMessage `json:",omitempty"`// SSHPolicy, if non-nil, updates the SSH policy for how incoming// SSH connections should be handled.SSHPolicy *SSHPolicy `json:",omitempty"`// ControlTime, if non-zero, is the current timestamp according to the control server.ControlTime *time.Time `json:",omitempty"`// TKAInfo describes the control plane's view of tailnet// key authority (TKA) state.//// An initial nil TKAInfo indicates that the control plane// believes TKA should not be enabled. An initial non-nil TKAInfo// indicates the control plane believes TKA should be enabled.// A nil TKAInfo in a mapresponse stream (i.e. a 'delta' mapresponse)// indicates no change from the value sent earlier.TKAInfo *TKAInfo `json:",omitempty"`// DomainDataPlaneAuditLogID, if non-empty, is the per-tailnet log ID to be// used when writing data plane audit logs.DomainDataPlaneAuditLogIDstring `json:",omitempty"`// Debug is normally nil, except for when the control server// is setting debug settings on a node.Debug *Debug `json:",omitempty"`// ControlDialPlan tells the client how to connect to the control// server. An initial nil is equivalent to new(ControlDialPlan).// A subsequent streamed nil means no change.ControlDialPlan *ControlDialPlan `json:",omitempty"`// ClientVersion describes the latest client version that's available for// download and whether the client is using it. A nil value means no change// or nothing to report.ClientVersion *ClientVersion `json:",omitempty"`// DeprecatedDefaultAutoUpdate is the default node auto-update setting for this// tailnet. The node is free to opt-in or out locally regardless of this// value. Once this value has been set and stored in the client, future// changes from the control plane are ignored.//// Deprecated: use NodeAttrDefaultAutoUpdate instead. See//https://github.com/tailscale/tailscale/issues/11502.DeprecatedDefaultAutoUpdateopt.Bool `json:"DefaultAutoUpdate,omitempty"`}

MapResponse is the response to a MapRequest. It describes the state of thelocal node, the peer nodes, the DNS configuration, the packet filter, andmore. A MapRequest, depending on its parameters, may result in the controlplane coordination server sending 0, 1 or a stream of multiple MapResponsevalues.

When the client sets MapRequest.Stream, the server sends a stream ofMapResponses. That long-lived HTTP transaction is called a "map poll". In amap poll, the first MapResponse will be complete and subsequent MapResponseswill be incremental updates with only changed information.

The zero value for all fields means "unchanged". Unfortunately, severalfields were defined before that convention was established, so they use aslice with omitempty, meaning this type can't be used to marshal JSONcontaining non-nil zero-length slices (meaning explicitly now empty). Thecontrol plane uses a separate type to marshal these fields. This type isprimarily used for unmarshaling responses so the omitempty annotations aremostly useless, except that this type is also used for the integration test'sfake control server. (It's not necessary to marshal a non-nil zero-lengthslice for the things we've needed to test in the integration tests as of2023-09-09).

typeNetInfo ¶

type NetInfo struct {// MappingVariesByDestIP says whether the host's NAT mappings// vary based on the destination IP.MappingVariesByDestIPopt.Bool `json:",omitzero"`// WorkingIPv6 is whether the host has IPv6 internet connectivity.WorkingIPv6opt.Bool `json:",omitzero"`// OSHasIPv6 is whether the OS supports IPv6 at all, regardless of// whether IPv6 internet connectivity is available.OSHasIPv6opt.Bool `json:",omitzero"`// WorkingUDP is whether the host has UDP internet connectivity.WorkingUDPopt.Bool `json:",omitzero"`// WorkingICMPv4 is whether ICMPv4 works.// Empty means not checked.WorkingICMPv4opt.Bool `json:",omitzero"`// HavePortMap is whether we have an existing portmap open// (UPnP, PMP, or PCP).HavePortMapbool `json:",omitzero"`// UPnP is whether UPnP appears present on the LAN.// Empty means not checked.UPnPopt.Bool `json:",omitzero"`// PMP is whether NAT-PMP appears present on the LAN.// Empty means not checked.PMPopt.Bool `json:",omitzero"`// PCP is whether PCP appears present on the LAN.// Empty means not checked.PCPopt.Bool `json:",omitzero"`// PreferredDERP is this node's preferred (home) DERP region ID.// This is where the node expects to be contacted to begin a// peer-to-peer connection. The node might be be temporarily// connected to multiple DERP servers (to speak to other nodes// that are located elsewhere) but PreferredDERP is the region ID// that the node subscribes to traffic at.// Zero means disconnected or unknown.PreferredDERPint `json:",omitzero"`// LinkType is the current link type, if known.LinkTypestring `json:",omitzero"`// "wired", "wifi", "mobile" (LTE, 4G, 3G, etc)// DERPLatency is the fastest recent time to reach various// DERP STUN servers, in seconds. The map key is the// "regionID-v4" or "-v6"; it was previously the DERP server's// STUN host:port.//// This should only be updated rarely, or when there's a// material change, as any change here also gets uploaded to// the control plane.DERPLatency map[string]float64 `json:",omitempty"`// FirewallMode encodes both which firewall mode was selected and why.// It is Linux-specific (at least as of 2023-08-19) and is meant to help// debug iptables-vs-nftables issues. The string is of the form// "{nft,ift}-REASON", like "nft-forced" or "ipt-default". Empty means// either not Linux or a configuration in which the host firewall rules// are not managed by tailscaled.FirewallModestring `json:",omitzero"`}

NetInfo contains information about the host's network state.

func (*NetInfo)BasicallyEqual ¶

func (ni *NetInfo) BasicallyEqual(ni2 *NetInfo)bool

BasicallyEqual reports whether ni and ni2 are basically equal, ignoringchanges in DERP ServerLatency & RegionLatency.

func (*NetInfo)Clone ¶

func (src *NetInfo) Clone() *NetInfo

Clone makes a deep copy of NetInfo.The result aliases no memory with the original.

func (*NetInfo)String ¶

func (ni *NetInfo) String()string

func (*NetInfo)View ¶added inv1.22.0

func (p *NetInfo) View()NetInfoView

View returns a read-only view of NetInfo.

typeNetInfoView ¶added inv1.22.0

type NetInfoView struct {// contains filtered or unexported fields}

NetInfoView provides a read-only view over NetInfo.

Its methods should only be called if `Valid()` returns true.

func (NetInfoView)AsStruct ¶added inv1.22.0

func (vNetInfoView) AsStruct() *NetInfo

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (NetInfoView)DERPLatency ¶added inv1.26.0

func (vNetInfoView) DERPLatency()views.Map[string,float64]

DERPLatency is the fastest recent time to reach variousDERP STUN servers, in seconds. The map key is the"regionID-v4" or "-v6"; it was previously the DERP server'sSTUN host:port.

This should only be updated rarely, or when there's amaterial change, as any change here also gets uploaded tothe control plane.

func (NetInfoView)FirewallMode ¶added inv1.48.0

func (vNetInfoView) FirewallMode()string

FirewallMode encodes both which firewall mode was selected and why.It is Linux-specific (at least as of 2023-08-19) and is meant to helpdebug iptables-vs-nftables issues. The string is of the form"{nft,ift}-REASON", like "nft-forced" or "ipt-default". Empty meanseither not Linux or a configuration in which the host firewall rulesare not managed by tailscaled.

func (NetInfoView)HavePortMap ¶added inv1.22.0

func (vNetInfoView) HavePortMap()bool

HavePortMap is whether we have an existing portmap open(UPnP, PMP, or PCP).

func (NetInfoView)LinkType ¶added inv1.22.0

func (vNetInfoView) LinkType()string

LinkType is the current link type, if known.

func (NetInfoView)MappingVariesByDestIP ¶added inv1.22.0

func (vNetInfoView) MappingVariesByDestIP()opt.Bool

MappingVariesByDestIP says whether the host's NAT mappingsvary based on the destination IP.

func (NetInfoView)MarshalJSON ¶added inv1.26.0

func (vNetInfoView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (NetInfoView)MarshalJSONTo ¶added inv1.88.0

func (vNetInfoView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (NetInfoView)OSHasIPv6 ¶added inv1.30.0

func (vNetInfoView) OSHasIPv6()opt.Bool

OSHasIPv6 is whether the OS supports IPv6 at all, regardless ofwhether IPv6 internet connectivity is available.

func (NetInfoView)PCP ¶added inv1.22.0

func (vNetInfoView) PCP()opt.Bool

PCP is whether PCP appears present on the LAN.Empty means not checked.

func (NetInfoView)PMP ¶added inv1.22.0

func (vNetInfoView) PMP()opt.Bool

PMP is whether NAT-PMP appears present on the LAN.Empty means not checked.

func (NetInfoView)PreferredDERP ¶added inv1.22.0

func (vNetInfoView) PreferredDERP()int

PreferredDERP is this node's preferred (home) DERP region ID.This is where the node expects to be contacted to begin apeer-to-peer connection. The node might be be temporarilyconnected to multiple DERP servers (to speak to other nodesthat are located elsewhere) but PreferredDERP is the region IDthat the node subscribes to traffic at.Zero means disconnected or unknown.

func (NetInfoView)String ¶added inv1.22.0

func (vNetInfoView) String()string

func (NetInfoView)UPnP ¶added inv1.22.0

func (vNetInfoView) UPnP()opt.Bool

UPnP is whether UPnP appears present on the LAN.Empty means not checked.

func (*NetInfoView)UnmarshalJSON ¶added inv1.26.0

func (v *NetInfoView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*NetInfoView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *NetInfoView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (NetInfoView)Valid ¶added inv1.22.0

func (vNetInfoView) Valid()bool

Valid reports whether v's underlying value is non-nil.

func (NetInfoView)WorkingICMPv4 ¶added inv1.30.0

func (vNetInfoView) WorkingICMPv4()opt.Bool

WorkingICMPv4 is whether ICMPv4 works.Empty means not checked.

func (NetInfoView)WorkingIPv6 ¶added inv1.22.0

func (vNetInfoView) WorkingIPv6()opt.Bool

WorkingIPv6 is whether the host has IPv6 internet connectivity.

func (NetInfoView)WorkingUDP ¶added inv1.22.0

func (vNetInfoView) WorkingUDP()opt.Bool

WorkingUDP is whether the host has UDP internet connectivity.

typeNetPortRange ¶added inv0.98.1

type NetPortRange struct {IPstring// IP, CIDR, Range, or "*" (same formats as FilterRule.SrcIPs)Bits  *int   `json:",omitempty"`// deprecated; the 2020 way to turn IP into a CIDR. See FilterRule.SrcBits.PortsPortRange// contains filtered or unexported fields}

NetPortRange represents a range of ports that's allowed for one or more IPs.

typeNode ¶

type Node struct {IDNodeIDStableIDStableNodeID// Name is the FQDN of the node.// It is also the MagicDNS name for the node.// It has a trailing dot.// e.g. "host.tail-scale.ts.net."Namestring// User is the user who created the node. If ACL tags are in use for the// node then it doesn't reflect the ACL identity that the node is running// as.UserUserID// Sharer, if non-zero, is the user who shared this node, if different than User.SharerUserID `json:",omitzero"`Keykey.NodePublicKeyExpirytime.Time                  `json:",omitzero"`// the zero value if this node does not expireKeySignaturetkatype.MarshaledSignature `json:",omitempty"`Machinekey.MachinePublic          `json:",omitzero"`DiscoKeykey.DiscoPublic            `json:",omitzero"`// Addresses are the IP addresses of this Node directly.Addresses []netip.Prefix// AllowedIPs are the IP ranges to route to this node.//// As of CapabilityVersion 112, this may be nil (null or undefined) on the wire// to mean the same as Addresses. Internally, it is always filled in with// its possibly-implicit value.AllowedIPs []netip.Prefix `json:",omitzero"`// _not_ omitempty; only nil is specialEndpoints []netip.AddrPort `json:",omitempty"`// IP+port (public via STUN, and local LANs)// LegacyDERPString is this node's home LegacyDERPString region ID integer, but shoved into an// IP:port string for legacy reasons. The IP address is always "127.3.3.40"// (a loopback address (127) followed by the digits over the letters DERP on// a QWERTY keyboard (3.3.40)). The "port number" is the home LegacyDERPString region ID// integer.//// Deprecated: HomeDERP has replaced this, but old servers might still send// this field. See tailscale/tailscale#14636. Do not use this field in code// other than in the upgradeNode func, which canonicalizes it to HomeDERP// if it arrives as a LegacyDERPString string on the wire.LegacyDERPStringstring `json:"DERP,omitzero"`// DERP-in-IP:port ("127.3.3.40:N") endpoint// HomeDERP is the modern version of the DERP string field, with just an// integer. The client advertises support for this as of capver 111.//// HomeDERP may be zero if not (yet) known, but ideally always be non-zero// for magicsock connectivity to function normally.HomeDERPint `json:",omitzero"`// DERP region ID of the node's home DERPHostinfoHostinfoView      `json:",omitzero"`Createdtime.Time         `json:",omitzero"`CapCapabilityVersion `json:",omitzero"`// if non-zero, the node's capability version; old servers might not send// Tags are the list of ACL tags applied to this node.// Tags take the form of `tag:<value>` where value starts// with a letter and only contains alphanumerics and dashes `-`.// Some valid tag examples://   `tag:prod`//   `tag:database`//   `tag:lab-1`Tags []string `json:",omitempty"`// PrimaryRoutes are the routes from AllowedIPs that this node// is currently the primary subnet router for, as determined// by the control plane. It does not include the self address// values from Addresses that are in AllowedIPs.PrimaryRoutes []netip.Prefix `json:",omitempty"`// LastSeen is when the node was last online. It is not// updated when Online is true. It is nil if the current// node doesn't have permission to know, or the node// has never been online.LastSeen *time.Time `json:",omitempty"`// Online is whether the node is currently connected to the// coordination server.  A value of nil means unknown, or the// current node doesn't have permission to know.Online *bool `json:",omitempty"`MachineAuthorizedbool `json:",omitempty"`// TODO(crawshaw): replace with MachineStatus// Capabilities are capabilities that the node has.// They're free-form strings, but should be in the form of URLs/URIs// such as://    "https://tailscale.com/cap/is-admin"//    "https://tailscale.com/cap/file-sharing"//// Deprecated: use CapMap instead. Seehttps://github.com/tailscale/tailscale/issues/11508Capabilities []NodeCapability `json:",omitempty"`// CapMap is a map of capabilities to their optional argument/data values.//// It is valid for a capability to not have any argument/data values; such// capabilities can be tested for using the HasCap method. These type of// capabilities are used to indicate that a node has a capability, but there// is no additional data associated with it. These were previously// represented by the Capabilities field, but can now be represented by// CapMap with an empty value.//// See NodeCapability for more information on keys.//// Metadata about nodes can be transmitted in 3 ways:// 1. MapResponse.Node.CapMap describes attributes that affect behavior for//    this node, such as which features have been enabled through the admin//    panel and any associated configuration details.// 2. MapResponse.PacketFilter(s) describes access (both IP and application//    based) that should be granted to peers.// 3. MapResponse.Peers[].CapMap describes attributes regarding a peer node,//    such as which features the peer supports or if that peer is preferred//    for a particular task vs other peers that could also be chosen.CapMapNodeCapMap `json:",omitempty"`// UnsignedPeerAPIOnly means that this node is not signed nor subject to TKA// restrictions. However, in exchange for that privilege, it does not get// network access. It can only access this node's peerapi, which may not let// it do anything. It is the tailscaled client's job to double-check the// MapResponse's PacketFilter to verify that its AllowedIPs will not be// accepted by the packet filter.UnsignedPeerAPIOnlybool `json:",omitzero"`ComputedNamestring `json:",omitzero"`// MagicDNS base name (for normal non-shared-in nodes), FQDN (without trailing dot, for shared-in nodes), or Hostname (if no MagicDNS)ComputedNameWithHoststring `json:",omitzero"`// either "ComputedName" or "ComputedName (computedHostIfDifferent)", if computedHostIfDifferent is set// DataPlaneAuditLogID is the per-node logtail ID used for data plane audit logging.DataPlaneAuditLogIDstring `json:",omitzero"`// Expired is whether this node's key has expired. Control may send// this; clients are only allowed to set this from false to true. On// the client, this is calculated client-side based on a timestamp sent// from control, to avoid clock skew issues.Expiredbool `json:",omitzero"`// SelfNodeV4MasqAddrForThisPeer is the IPv4 that this peer knows the current node as.// It may be empty if the peer knows the current node by its native// IPv4 address.// This field is only populated in a MapResponse for peers and not// for the current node.//// If set, it should be used to masquerade traffic originating from the// current node to this peer. The masquerade address is only relevant// for this peer and not for other peers.//// This only applies to traffic originating from the current node to the// peer or any of its subnets. Traffic originating from subnet routes will// not be masqueraded (e.g. in case of --snat-subnet-routes).SelfNodeV4MasqAddrForThisPeer *netip.Addr `json:",omitzero"`// TODO: de-pointer: tailscale/tailscale#17978// SelfNodeV6MasqAddrForThisPeer is the IPv6 that this peer knows the current node as.// It may be empty if the peer knows the current node by its native// IPv6 address.// This field is only populated in a MapResponse for peers and not// for the current node.//// If set, it should be used to masquerade traffic originating from the// current node to this peer. The masquerade address is only relevant// for this peer and not for other peers.//// This only applies to traffic originating from the current node to the// peer or any of its subnets. Traffic originating from subnet routes will// not be masqueraded (e.g. in case of --snat-subnet-routes).SelfNodeV6MasqAddrForThisPeer *netip.Addr `json:",omitzero"`// TODO: de-pointer: tailscale/tailscale#17978// IsWireGuardOnly indicates that this is a non-Tailscale WireGuard peer, it// is not expected to speak Disco or DERP, and it must have Endpoints in// order to be reachable.IsWireGuardOnlybool `json:",omitzero"`// IsJailed indicates that this node is jailed and should not be allowed// initiate connections, however outbound connections to it should still be// allowed.IsJailedbool `json:",omitzero"`// ExitNodeDNSResolvers is the list of DNS servers that should be used when this// node is marked IsWireGuardOnly and being used as an exit node.ExitNodeDNSResolvers []*dnstype.Resolver `json:",omitempty"`// contains filtered or unexported fields}

Node is a Tailscale device in a tailnet.

func (*Node)Clone ¶

func (src *Node) Clone() *Node

Clone makes a deep copy of Node.The result aliases no memory with the original.

func (*Node)DisplayName ¶added inv1.4.0

func (n *Node) DisplayName(forOwnerbool)string

DisplayName returns the user-facing name for a node which shouldbe shown in client UIs.

Parameter forOwner specifies whether the name is requested bythe owner of the node. When forOwner is false, the hostname isnever included in the return value.

Return value is either "Name" or "Name (Hostname)", whereName is the node's MagicDNS base name (for normal non-shared-innodes), FQDN (without trailing dot, for shared-in nodes), orHostname (if no MagicDNS). Hostname is only included in thereturn value if it varies from Name and forOwner is provided true.

DisplayName is only valid if InitDisplayNames has been called.

func (*Node)DisplayNames ¶added inv1.4.0

func (n *Node) DisplayNames(forOwnerbool) (name, hostIfDifferentstring)

DisplayName returns the decomposed user-facing name for a node.

Parameter forOwner specifies whether the name is requested bythe owner of the node. When forOwner is false, hostIfDifferentis always returned empty.

Return value name is the node's primary name, populated with thenode's MagicDNS base name (for normal non-shared-in nodes), FQDN(without trailing dot, for shared-in nodes), or Hostname (if noMagicDNS).

Return value hostIfDifferent, when non-empty, is the node'shostname. hostIfDifferent is only populated when the hostnamevaries from name and forOwner is provided as true.

DisplayNames is only valid if InitDisplayNames has been called.

func (*Node)Equal ¶

func (n *Node) Equal(n2 *Node)bool

Equal reports whether n and n2 are equal.

func (*Node)HasCap ¶added inv1.50.0

func (v *Node) HasCap(capNodeCapability)bool

HasCap reports whether the node has the given capability.It is safe to call on a nil Node.

func (*Node)InitDisplayNames ¶added inv1.4.0

func (n *Node) InitDisplayNames(networkMagicDNSSuffixstring)

InitDisplayNames computes and populates n's display namefields: n.ComputedName, n.computedHostIfDifferent, andn.ComputedNameWithHost.

func (*Node)IsTagged ¶added inv1.38.0

func (n *Node) IsTagged()bool

IsTagged reports whether the node has any tags.

func (*Node)SharerOrUser ¶added inv1.50.0

func (n *Node) SharerOrUser()UserID

SharerOrUser Sharer if set, else User.

func (*Node)View ¶added inv1.26.0

func (p *Node) View()NodeView

View returns a read-only view of Node.

typeNodeCapMap ¶added inv1.50.0

type NodeCapMap map[NodeCapability][]RawMessage

NodeCapMap is a map of capabilities to their optional values. It is valid fora capability to have no values (nil slice); such capabilities can be testedfor by using theNodeCapMap.Contains method.

SeeNodeCapability for more information on keys.

func (NodeCapMap)Contains ¶added inv1.50.0

func (cNodeCapMap) Contains(capNodeCapability)bool

Contains reports whether c has the capability cap. This is used to test forthe existence of a capability, especially when the capability has noassociated argument/data values.

func (NodeCapMap)Equal ¶added inv1.50.0

func (cNodeCapMap) Equal(c2NodeCapMap)bool

Equal reports whether c and c2 are equal.

typeNodeCapability ¶added inv1.50.0

type NodeCapabilitystring

NodeCapability represents a capability granted to the self node as listed inMapResponse.Node.Capabilities.

It must be a URL like "https://tailscale.com/cap/file-sharing", or awell-known capability name like "funnel". The latter is only allowed forTailscale-defined capabilities.

Unlike PeerCapability, NodeCapability is not in context of a peer and isgranted to the node itself.

These are also referred to as "Node Attributes" in the ACL policy file.

const (CapabilityFileSharingNodeCapability = "https://tailscale.com/cap/file-sharing"CapabilityAdminNodeCapability = "https://tailscale.com/cap/is-admin"CapabilityOwnerNodeCapability = "https://tailscale.com/cap/is-owner"CapabilitySSHNodeCapability = "https://tailscale.com/cap/ssh"// feature enabled/availableCapabilitySSHRuleInNodeCapability = "https://tailscale.com/cap/ssh-rule-in"// some SSH rule reach this nodeCapabilityDataPlaneAuditLogsNodeCapability = "https://tailscale.com/cap/data-plane-audit-logs"// feature enabledCapabilityDebugNodeCapability = "https://tailscale.com/cap/debug"// exposes debug endpoints over the PeerAPICapabilityHTTPSNodeCapability = "https"// CapabilityMacUIV2 makes the macOS GUI enable its v2 mode.CapabilityMacUIV2NodeCapability = "https://tailscale.com/cap/mac-ui-v2"// CapabilityBindToInterfaceByRoute changes how Darwin nodes create// sockets (in the net/netns package). See that package for more// details on the behaviour of this capability.CapabilityBindToInterfaceByRouteNodeCapability = "https://tailscale.com/cap/bind-to-interface-by-route"// CapabilityDebugDisableAlternateDefaultRouteInterface changes how Darwin// nodes get the default interface. There is an optional hook (used by the// macOS and iOS clients) to override the default interface, this capability// disables that and uses the default behavior (of parsing the routing// table).CapabilityDebugDisableAlternateDefaultRouteInterfaceNodeCapability = "https://tailscale.com/cap/debug-disable-alternate-default-route-interface"// CapabilityDebugDisableBindConnToInterface disables the automatic binding// of connections to the default network interface on Darwin nodes.CapabilityDebugDisableBindConnToInterfaceNodeCapability = "https://tailscale.com/cap/debug-disable-bind-conn-to-interface"// CapabilityDebugDisableBindConnToInterface disables the automatic binding// of connections to the default network interface on Darwin nodes using network extensionsCapabilityDebugDisableBindConnToInterfaceAppleExtNodeCapability = "https://tailscale.com/cap/debug-disable-bind-conn-to-interface-apple-ext"// CapabilityTailnetLock indicates the node may initialize tailnet lock.CapabilityTailnetLockNodeCapability = "https://tailscale.com/cap/tailnet-lock"// CapabilityWarnFunnelNoInvite indicates whether Funnel is enabled for the tailnet.// This cap is no longer used 2023-08-09 onwards.CapabilityWarnFunnelNoInviteNodeCapability = "https://tailscale.com/cap/warn-funnel-no-invite"// CapabilityWarnFunnelNoHTTPS indicates HTTPS has not been enabled for the tailnet.// This cap is no longer used 2023-08-09 onwards.CapabilityWarnFunnelNoHTTPSNodeCapability = "https://tailscale.com/cap/warn-funnel-no-https"// CapabilityDebugTSDNSResolution enables verbose debug logging for DNS// resolution for Tailscale-controlled domains (the control server, log// server, DERP servers, etc.)CapabilityDebugTSDNSResolutionNodeCapability = "https://tailscale.com/cap/debug-ts-dns-resolution"// CapabilityFunnelPorts specifies the ports that the Funnel is available on.// The ports are specified as a comma-separated list of port numbers or port// ranges (e.g. "80,443,8080-8090") in the ports query parameter.// e.g.https://tailscale.com/cap/funnel-ports?ports=80,443,8080-8090CapabilityFunnelPortsNodeCapability = "https://tailscale.com/cap/funnel-ports"// NodeAttrOnlyTCP443 specifies that the client should not attempt to generate// any outbound traffic that isn't TCP on port 443 (HTTPS). This is used for// clients in restricted environments where only HTTPS traffic is allowed// other types of traffic trips outbound firewall alarms. This thus implies// all traffic is over DERP.NodeAttrOnlyTCP443NodeCapability = "only-tcp-443"// NodeAttrFunnel grants the ability for a node to host ingress traffic.NodeAttrFunnelNodeCapability = "funnel"// NodeAttrSSHAggregator grants the ability for a node to collect SSH sessions.NodeAttrSSHAggregatorNodeCapability = "ssh-aggregator"// NodeAttrDebugForceBackgroundSTUN forces a node to always do background// STUN queries regardless of inactivity.NodeAttrDebugForceBackgroundSTUNNodeCapability = "debug-always-stun"// NodeAttrDebugDisableWGTrim disables the lazy WireGuard configuration,// always giving WireGuard the full netmap, even for idle peers.NodeAttrDebugDisableWGTrimNodeCapability = "debug-no-wg-trim"// NodeAttrDisableSubnetsIfPAC controls whether subnet routers should be// disabled if WPAD is present on the network.NodeAttrDisableSubnetsIfPACNodeCapability = "debug-disable-subnets-if-pac"// NodeAttrDisableUPnP makes the client not perform a UPnP portmapping.// By default, we want to enable it to see if it works on more clients.//// If UPnP catastrophically fails for people, this should be set kill// new attempts at UPnP connections.NodeAttrDisableUPnPNodeCapability = "debug-disable-upnp"// NodeAttrDisableDeltaUpdates makes the client not process updates via the// delta update mechanism and should instead treat all netmap changes as// "full" ones as tailscaled did in 1.48.x and earlier.NodeAttrDisableDeltaUpdatesNodeCapability = "disable-delta-updates"// NodeAttrRandomizeClientPort makes magicsock UDP bind to// :0 to get a random local port, ignoring any configured// fixed port.NodeAttrRandomizeClientPortNodeCapability = "randomize-client-port"// NodeAttrSilentDisco makes the client suppress disco heartbeats to its// peers.NodeAttrSilentDiscoNodeCapability = "silent-disco"// NodeAttrOneCGNATEnable makes the client prefer one big CGNAT /10 route// rather than a /32 per peer. At most one of this or// NodeAttrOneCGNATDisable may be set; if neither are, it's automatic.NodeAttrOneCGNATEnableNodeCapability = "one-cgnat?v=true"// NodeAttrOneCGNATDisable makes the client prefer a /32 route per peer// rather than one big /10 CGNAT route. At most one of this or// NodeAttrOneCGNATEnable may be set; if neither are, it's automatic.NodeAttrOneCGNATDisableNodeCapability = "one-cgnat?v=false"// NodeAttrPeerMTUEnable makes the client do path MTU discovery to its// peers. If it isn't set, it defaults to the client default.NodeAttrPeerMTUEnableNodeCapability = "peer-mtu-enable"// NodeAttrDNSForwarderDisableTCPRetries disables retrying truncated// DNS queries over TCP if the response is truncated.NodeAttrDNSForwarderDisableTCPRetriesNodeCapability = "dns-forwarder-disable-tcp-retries"// NodeAttrLinuxMustUseIPTables forces Linux clients to use iptables for// netfilter management.// This cannot be set simultaneously with NodeAttrLinuxMustUseNfTables.NodeAttrLinuxMustUseIPTablesNodeCapability = "linux-netfilter?v=iptables"// NodeAttrLinuxMustUseNfTables forces Linux clients to use nftables for// netfilter management.// This cannot be set simultaneously with NodeAttrLinuxMustUseIPTables.NodeAttrLinuxMustUseNfTablesNodeCapability = "linux-netfilter?v=nftables"// NodeAttrDisableSeamlessKeyRenewal disables seamless key renewal, which is// enabled by default in clients as of 2025-09-17 (1.90 and later).//// We will use this attribute to manage the rollout, and disable seamless in// clients with known bugs.//http://go/seamless-key-renewalNodeAttrDisableSeamlessKeyRenewalNodeCapability = "disable-seamless-key-renewal"// NodeAttrSeamlessKeyRenewal was used to opt-in to seamless key renewal// during its private alpha.//// Deprecated: NodeAttrSeamlessKeyRenewal is deprecated as of CapabilityVersion 126,// because seamless key renewal is now enabled by default.NodeAttrSeamlessKeyRenewalNodeCapability = "seamless-key-renewal"// NodeAttrProbeUDPLifetime makes the client probe UDP path lifetime at the// tail end of an active direct connection in magicsock.NodeAttrProbeUDPLifetimeNodeCapability = "probe-udp-lifetime"// NodeAttrsTaildriveShare enables sharing via Taildrive.NodeAttrsTaildriveShareNodeCapability = "drive:share"// NodeAttrsTaildriveAccess enables accessing shares via Taildrive.NodeAttrsTaildriveAccessNodeCapability = "drive:access"// NodeAttrSuggestExitNode is applied to each exit node which the control plane has determined// is a recommended exit node.NodeAttrSuggestExitNodeNodeCapability = "suggest-exit-node"// NodeAttrDisableWebClient disables using the web client.NodeAttrDisableWebClientNodeCapability = "disable-web-client"// NodeAttrLogExitFlows enables exit node destinations in network flow logs.NodeAttrLogExitFlowsNodeCapability = "log-exit-flows"// NodeAttrAutoExitNode permits the automatic exit nodes feature.NodeAttrAutoExitNodeNodeCapability = "auto-exit-node"// NodeAttrStoreAppCRoutes configures the node to store app connector routes persistently.NodeAttrStoreAppCRoutesNodeCapability = "store-appc-routes"// NodeAttrSuggestExitNodeUI allows the currently suggested exit node to appear in the client GUI.NodeAttrSuggestExitNodeUINodeCapability = "suggest-exit-node-ui"// NodeAttrUserDialUseRoutes makes UserDial use either the peer dialer or the system dialer,// depending on the destination address and the configured routes. When present, it also makes// the DNS forwarder use UserDial instead of SystemDial when dialing resolvers.NodeAttrUserDialUseRoutesNodeCapability = "user-dial-routes"// NodeAttrSSHBehaviorV1 forces SSH to use the V1 behavior (no su, run SFTP in-process)// Added 2024-05-29 in Tailscale version 1.68.NodeAttrSSHBehaviorV1NodeCapability = "ssh-behavior-v1"// NodeAttrSSHBehaviorV2 forces SSH to use the V2 behavior (use su, run SFTP in child process).// This overrides NodeAttrSSHBehaviorV1 if set.// See forceV1Behavior in ssh/tailssh/incubator.go for distinction between// V1 and V2 behavior.// Added 2024-08-06 in Tailscale version 1.72.NodeAttrSSHBehaviorV2NodeCapability = "ssh-behavior-v2"// NodeAttrDisableSplitDNSWhenNoCustomResolvers indicates that the node's// DNS manager should not adopt a split DNS configuration even though the// Config of the resolver only contains routes that do not specify custom// resolver(s), hence all DNS queries can be safely sent to the upstream// DNS resolver and the node's DNS forwarder doesn't need to handle all// DNS traffic.// This is for now (2024-06-06) an iOS-specific battery life optimization,// and this node attribute allows us to disable the optimization remotely// if needed.NodeAttrDisableSplitDNSWhenNoCustomResolversNodeCapability = "disable-split-dns-when-no-custom-resolvers"// NodeAttrDisableLocalDNSOverrideViaNRPT indicates that the node's DNS manager should not// create a default (catch-all) Windows NRPT rule when "Override local DNS" is enabled.// Without this rule, Windows 8.1 and newer devices issue parallel DNS requests to DNS servers// associated with all network adapters, even when "Override local DNS" is enabled and/or// a Mullvad exit node is being used, resulting in DNS leaks.// We began creating this rule on 2024-06-14, and this node attribute// allows us to disable the new behavior remotely if needed.NodeAttrDisableLocalDNSOverrideViaNRPTNodeCapability = "disable-local-dns-override-via-nrpt"// NodeAttrDisableMagicSockCryptoRouting disables the use of the// magicsock cryptorouting hook. See tailscale/corp#20732.//// Deprecated: NodeAttrDisableMagicSockCryptoRouting is deprecated as of// CapabilityVersion 124, CryptoRouting is now mandatory. See tailscale/corp#31083.NodeAttrDisableMagicSockCryptoRoutingNodeCapability = "disable-magicsock-crypto-routing"// NodeAttrDisableCaptivePortalDetection instructs the client to not perform captive portal detection// automatically when the network state changes.NodeAttrDisableCaptivePortalDetectionNodeCapability = "disable-captive-portal-detection"// NodeAttrDisableSkipStatusQueue is set when the node should disable skipping// of queued netmap.NetworkMap between the controlclient and LocalBackend.// See tailscale/tailscale#14768.NodeAttrDisableSkipStatusQueueNodeCapability = "disable-skip-status-queue"// NodeAttrSSHEnvironmentVariables enables logic for handling environment variables sent// via SendEnv in the SSH server and applying them to the SSH session.NodeAttrSSHEnvironmentVariablesNodeCapability = "ssh-env-vars"// NodeAttrServiceHost indicates the VIP Services for which the client is// approved to act as a service host, and which IP addresses are assigned// to those VIP Services. Any VIP Services that the client is not// advertising can be ignored.// Each value of this key in [NodeCapMap] is of type [ServiceIPMappings].// If multiple values of this key exist, they should be merged in sequence// (replace conflicting keys).NodeAttrServiceHostNodeCapability = "service-host"// NodeAttrMaxKeyDuration represents the MaxKeyDuration setting on the// tailnet. The value of this key in [NodeCapMap] will be only one entry of// type float64 representing the duration in seconds. This cap will be// omitted if the tailnet's MaxKeyDuration is the default.NodeAttrMaxKeyDurationNodeCapability = "tailnet.maxKeyDuration"// NodeAttrNativeIPV4 contains the IPV4 address of the node in its// native tailnet. This is currently only sent to Hello, in its// peer node list.NodeAttrNativeIPV4NodeCapability = "native-ipv4"// NodeAttrDisableRelayServer prevents the node from acting as an underlay// UDP relay server. There are no expected values for this key; the key// only needs to be present in [NodeCapMap] to take effect.NodeAttrDisableRelayServerNodeCapability = "disable-relay-server"// NodeAttrDisableRelayClient prevents the node from both allocating UDP// relay server endpoints itself, and from using endpoints allocated by// its peers. This attribute can be added to the node dynamically; if added// while the node is already running, the node will be unable to allocate// endpoints after it next updates its network map, and will be immediately// unable to use new paths via a UDP relay server. Setting this attribute// dynamically does not remove any existing paths, including paths that// traverse a UDP relay server. There are no expected values for this key// in [NodeCapMap]; the key only needs to be present in [NodeCapMap] to// take effect.NodeAttrDisableRelayClientNodeCapability = "disable-relay-client"// NodeAttrMagicDNSPeerAAAA is a capability that tells the node's MagicDNS// server to answer AAAA queries about its peers. See tailscale/tailscale#1152.NodeAttrMagicDNSPeerAAAANodeCapability = "magicdns-aaaa"// NodeAttrTrafficSteering configures the node to use the traffic// steering subsystem for via routes. See tailscale/corp#29966.NodeAttrTrafficSteeringNodeCapability = "traffic-steering"// NodeAttrTailnetDisplayName is an optional alternate name for the tailnet// to be displayed to the user.// If empty or absent, a default is used.// If this value is present and set by a user this will only include letters,// numbers, apostrophe, spaces, and hyphens. This may not be true for the default.// Values can look like "foo.com" or "Foo's Test Tailnet - Staging".NodeAttrTailnetDisplayNameNodeCapability = "tailnet-display-name"// NodeAttrClientSideReachability configures the node to determine// reachability itself when choosing connectors. When absent, the// default behavior is to trust the control plane when it claims that a// node is no longer online, but that is not a reliable signal.NodeAttrClientSideReachability = "client-side-reachability"// NodeAttrDefaultAutoUpdate advertises the default node auto-update setting// for this tailnet. The node is free to opt-in or out locally regardless of// this value. Once this has been set and stored in the client, future// changes from the control plane are ignored.//// The value of the key in [NodeCapMap] is a JSON boolean.NodeAttrDefaultAutoUpdateNodeCapability = "default-auto-update")

typeNodeID ¶

type NodeIDID

NodeID is a unique integer ID for a node.

It's global within a control plane URL ("tailscale up --login-server") and is(as of 2025-01-06) never re-used even after a node is deleted.

NodeIDs are not stable across control plane URLs. For more stable URLs,seeStableNodeID.

func (NodeID)IsZero ¶added inv1.2.0

func (uNodeID) IsZero()bool

func (NodeID)String ¶

func (idNodeID) String()string

typeNodeView ¶added inv1.26.0

type NodeView struct {// contains filtered or unexported fields}

NodeView provides a read-only view over Node.

Its methods should only be called if `Valid()` returns true.

func (NodeView)Addresses ¶added inv1.26.0

func (vNodeView) Addresses()views.Slice[netip.Prefix]

Addresses are the IP addresses of this Node directly.

func (NodeView)AllowedIPs ¶added inv1.26.0

func (vNodeView) AllowedIPs()views.Slice[netip.Prefix]

AllowedIPs are the IP ranges to route to this node.

As of CapabilityVersion 112, this may be nil (null or undefined) on the wireto mean the same as Addresses. Internally, it is always filled in withits possibly-implicit value.

func (NodeView)AsStruct ¶added inv1.26.0

func (vNodeView) AsStruct() *Node

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (NodeView)Cap ¶added inv1.36.0

func (vNodeView) Cap()CapabilityVersion

if non-zero, the node's capability version; old servers might not send

func (NodeView)CapMap ¶added inv1.50.0

func (vNodeView) CapMap()views.MapSlice[NodeCapability,RawMessage]

CapMap is a map of capabilities to their optional argument/data values.

It is valid for a capability to not have any argument/data values; suchcapabilities can be tested for using the HasCap method. These type ofcapabilities are used to indicate that a node has a capability, but thereis no additional data associated with it. These were previouslyrepresented by the Capabilities field, but can now be represented byCapMap with an empty value.

See NodeCapability for more information on keys.

Metadata about nodes can be transmitted in 3 ways:

MapResponse.Node.CapMap describes attributes that affect behavior forthis node, such as which features have been enabled through the adminpanel and any associated configuration details.
MapResponse.PacketFilter(s) describes access (both IP and applicationbased) that should be granted to peers.
MapResponse.Peers[].CapMap describes attributes regarding a peer node,such as which features the peer supports or if that peer is preferredfor a particular task vs other peers that could also be chosen.

func (NodeView)Capabilitiesdeprecatedadded inv1.26.0

func (vNodeView) Capabilities()views.Slice[NodeCapability]

Capabilities are capabilities that the node has.They're free-form strings, but should be in the form of URLs/URIssuch as:

"https://tailscale.com/cap/is-admin""https://tailscale.com/cap/file-sharing"

Deprecated: use CapMap instead. Seehttps://github.com/tailscale/tailscale/issues/11508

func (NodeView)ComputedName ¶added inv1.26.0

func (vNodeView) ComputedName()string

MagicDNS base name (for normal non-shared-in nodes), FQDN (without trailing dot, for shared-in nodes), or Hostname (if no MagicDNS)

func (NodeView)ComputedNameWithHost ¶added inv1.26.0

func (vNodeView) ComputedNameWithHost()string

either "ComputedName" or "ComputedName (computedHostIfDifferent)", if computedHostIfDifferent is set

func (NodeView)Created ¶added inv1.26.0

func (vNodeView) Created()time.Time

func (NodeView)DataPlaneAuditLogID ¶added inv1.32.0

func (vNodeView) DataPlaneAuditLogID()string

DataPlaneAuditLogID is the per-node logtail ID used for data plane audit logging.

func (NodeView)DiscoKey ¶added inv1.26.0

func (vNodeView) DiscoKey()key.DiscoPublic

func (NodeView)DisplayName ¶added inv1.50.0

func (nNodeView) DisplayName(forOwnerbool)string

DisplayName wraps Node.DisplayName.

func (NodeView)Endpoints ¶added inv1.26.0

func (vNodeView) Endpoints()views.Slice[netip.AddrPort]

IP+port (public via STUN, and local LANs)

func (NodeView)Equal ¶added inv1.26.0

func (vNodeView) Equal(v2NodeView)bool

func (NodeView)ExitNodeDNSResolvers ¶added inv1.50.0

func (vNodeView) ExitNodeDNSResolvers()views.SliceView[*dnstype.Resolver,dnstype.ResolverView]

ExitNodeDNSResolvers is the list of DNS servers that should be used when thisnode is marked IsWireGuardOnly and being used as an exit node.

func (NodeView)Expired ¶added inv1.36.0

func (vNodeView) Expired()bool

Expired is whether this node's key has expired. Control may sendthis; clients are only allowed to set this from false to true. Onthe client, this is calculated client-side based on a timestamp sentfrom control, to avoid clock skew issues.

func (NodeView)HasCap ¶added inv1.50.0

func (vNodeView) HasCap(capNodeCapability)bool

HasCap reports whether the node has the given capability.It is safe to call on an invalid NodeView.

func (NodeView)HomeDERP ¶added inv1.80.0

func (vNodeView) HomeDERP()int

HomeDERP is the modern version of the DERP string field, with just aninteger. The client advertises support for this as of capver 111.

HomeDERP may be zero if not (yet) known, but ideally always be non-zerofor magicsock connectivity to function normally.

func (NodeView)Hostinfo ¶added inv1.26.0

func (vNodeView) Hostinfo()HostinfoView

func (NodeView)ID ¶added inv1.26.0

func (vNodeView) ID()NodeID

func (NodeView)IsJailed ¶added inv1.66.0

func (vNodeView) IsJailed()bool

IsJailed indicates that this node is jailed and should not be allowedinitiate connections, however outbound connections to it should still beallowed.

func (NodeView)IsTagged ¶added inv1.50.0

func (nNodeView) IsTagged()bool

IsTagged reports whether the node has any tags.

func (NodeView)IsWireGuardOnly ¶added inv1.40.0

func (vNodeView) IsWireGuardOnly()bool

IsWireGuardOnly indicates that this is a non-Tailscale WireGuard peer, itis not expected to speak Disco or DERP, and it must have Endpoints inorder to be reachable.

func (NodeView)Key ¶added inv1.26.0

func (vNodeView) Key()key.NodePublic

func (NodeView)KeyExpiry ¶added inv1.26.0

func (vNodeView) KeyExpiry()time.Time

the zero value if this node does not expire

func (NodeView)KeySignature ¶added inv1.30.0

func (vNodeView) KeySignature()views.ByteSlice[tkatype.MarshaledSignature]

func (NodeView)LastSeen ¶added inv1.26.0

func (vNodeView) LastSeen()views.ValuePointer[time.Time]

LastSeen is when the node was last online. It is notupdated when Online is true. It is nil if the currentnode doesn't have permission to know, or the nodehas never been online.

func (NodeView)LegacyDERPStringdeprecatedadded inv1.80.0

func (vNodeView) LegacyDERPString()string

LegacyDERPString is this node's home LegacyDERPString region ID integer, but shoved into anIP:port string for legacy reasons. The IP address is always "127.3.3.40"(a loopback address (127) followed by the digits over the letters DERP ona QWERTY keyboard (3.3.40)). The "port number" is the home LegacyDERPString region IDinteger.

Deprecated: HomeDERP has replaced this, but old servers might still sendthis field. See tailscale/tailscale#14636. Do not use this field in codeother than in the upgradeNode func, which canonicalizes it to HomeDERPif it arrives as a LegacyDERPString string on the wire.

func (NodeView)Machine ¶added inv1.26.0

func (vNodeView) Machine()key.MachinePublic

func (NodeView)MachineAuthorized ¶added inv1.26.0

func (vNodeView) MachineAuthorized()bool

TODO(crawshaw): replace with MachineStatus

func (NodeView)MarshalJSON ¶added inv1.26.0

func (vNodeView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (NodeView)MarshalJSONTo ¶added inv1.88.0

func (vNodeView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (NodeView)Name ¶added inv1.26.0

func (vNodeView) Name()string

Name is the FQDN of the node.It is also the MagicDNS name for the node.It has a trailing dot.e.g. "host.tail-scale.ts.net."

func (NodeView)Online ¶added inv1.26.0

func (vNodeView) Online()views.ValuePointer[bool]

Online is whether the node is currently connected to thecoordination server. A value of nil means unknown, or thecurrent node doesn't have permission to know.

func (NodeView)PrimaryRoutes ¶added inv1.26.0

func (vNodeView) PrimaryRoutes()views.Slice[netip.Prefix]

PrimaryRoutes are the routes from AllowedIPs that this nodeis currently the primary subnet router for, as determinedby the control plane. It does not include the self addressvalues from Addresses that are in AllowedIPs.

func (NodeView)SelfNodeV4MasqAddrForThisPeer ¶added inv1.40.0

func (vNodeView) SelfNodeV4MasqAddrForThisPeer()views.ValuePointer[netip.Addr]

SelfNodeV4MasqAddrForThisPeer is the IPv4 that this peer knows the current node as.It may be empty if the peer knows the current node by its nativeIPv4 address.This field is only populated in a MapResponse for peers and notfor the current node.

If set, it should be used to masquerade traffic originating from thecurrent node to this peer. The masquerade address is only relevantfor this peer and not for other peers.

This only applies to traffic originating from the current node to thepeer or any of its subnets. Traffic originating from subnet routes willnot be masqueraded (e.g. in case of --snat-subnet-routes).

func (NodeView)SelfNodeV6MasqAddrForThisPeer ¶added inv1.50.0

func (vNodeView) SelfNodeV6MasqAddrForThisPeer()views.ValuePointer[netip.Addr]

SelfNodeV6MasqAddrForThisPeer is the IPv6 that this peer knows the current node as.It may be empty if the peer knows the current node by its nativeIPv6 address.This field is only populated in a MapResponse for peers and notfor the current node.

If set, it should be used to masquerade traffic originating from thecurrent node to this peer. The masquerade address is only relevantfor this peer and not for other peers.

This only applies to traffic originating from the current node to thepeer or any of its subnets. Traffic originating from subnet routes willnot be masqueraded (e.g. in case of --snat-subnet-routes).

func (NodeView)Sharer ¶added inv1.26.0

func (vNodeView) Sharer()UserID

Sharer, if non-zero, is the user who shared this node, if different than User.

func (NodeView)SharerOrUser ¶added inv1.50.0

func (nNodeView) SharerOrUser()UserID

SharerOrUser wraps Node.SharerOrUser.

func (NodeView)StableID ¶added inv1.26.0

func (vNodeView) StableID()StableNodeID

func (NodeView)Tags ¶added inv1.26.0

func (vNodeView) Tags()views.Slice[string]

Tags are the list of ACL tags applied to this node.Tags take the form of `tag:<value>` where value startswith a letter and only contains alphanumerics and dashes `-`.Some valid tag examples:

`tag:prod``tag:database``tag:lab-1`

func (*NodeView)UnmarshalJSON ¶added inv1.26.0

func (v *NodeView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*NodeView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *NodeView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (NodeView)UnsignedPeerAPIOnly ¶added inv1.34.0

func (vNodeView) UnsignedPeerAPIOnly()bool

UnsignedPeerAPIOnly means that this node is not signed nor subject to TKArestrictions. However, in exchange for that privilege, it does not getnetwork access. It can only access this node's peerapi, which may not letit do anything. It is the tailscaled client's job to double-check theMapResponse's PacketFilter to verify that its AllowedIPs will not beaccepted by the packet filter.

func (NodeView)User ¶added inv1.26.0

func (vNodeView) User()UserID

User is the user who created the node. If ACL tags are in use for thenode then it doesn't reflect the ACL identity that the node is runningas.

func (NodeView)Valid ¶added inv1.26.0

func (vNodeView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeOauth2Token ¶added inv1.8.0

type Oauth2Token struct {// AccessToken is the token that authorizes and authenticates// the requests.AccessTokenstring `json:"access_token"`// TokenType is the type of token.// The Type method returns either this or "Bearer", the default.TokenTypestring `json:"token_type,omitempty"`// RefreshToken is a token that's used by the application// (as opposed to the user) to refresh the access token// if it expires.RefreshTokenstring `json:"refresh_token,omitempty"`// Expiry is the optional expiration time of the access token.//// If zero, TokenSource implementations will reuse the same// token forever and RefreshToken or equivalent// mechanisms for that TokenSource will not be used.Expirytime.Time `json:"expiry,omitempty"`}

Oauth2Token is a copy of golang.org/x/oauth2.Token, to avoid thego.mod dependency on App Engine and grpc, which was causing problems.All we actually needed was this struct on the client side.

typeOverTLSPublicKeyResponse ¶added inv1.24.0

type OverTLSPublicKeyResponse struct {// LegacyPublic specifies the control plane server's original// NaCl crypto_box machine key.// It will be zero for sufficiently new clients, based on their// advertised "v" parameter (the CurrentMapRequestVersion).// In that case, only the newer Noise-based transport may be used// using the PublicKey field.LegacyPublicKeykey.MachinePublic `json:"legacyPublicKey"`// PublicKey specifies the server's public key for the// Noise-based control plane protocol. (see packages// control/controlbase and control/controlhttp)PublicKeykey.MachinePublic `json:"publicKey"`}

OverTLSPublicKeyResponse is the JSON response to /key?v=<n>over HTTPS (regular TLS) to the Tailscale control plane server,where the 'v' argument is the client's current capability version(previously known as the "MapRequest version").

The "OverTLS" prefix is to loudly declare that this exchangedoesn't happen over Noise and can be intercepted/MITM'ed byenterprise/corp proxies where the organization can put TLS rootson devices.

typePeerCapMap ¶added inv1.48.0

type PeerCapMap map[PeerCapability][]RawMessage

PeerCapMap is a map of capabilities to their optional values. It is valid fora capability to have no values (nil slice); such capabilities can be testedfor by using the HasCapability method.

The values are opaque to Tailscale, but are passed through from the ACLs tothe application via the WhoIs API.

func (PeerCapMap)HasCapability ¶added inv1.48.0

func (cPeerCapMap) HasCapability(capPeerCapability)bool

HasCapability reports whether c has the capability cap. This is used to testfor the existence of a capability, especially when the capability has noassociated argument/data values.

typePeerCapability ¶added inv1.48.0

type PeerCapabilitystring

PeerCapability represents a capability granted to a peer by a FilterRule whenthe peer communicates with the node that has this rule. Its meaning isapplication-defined.

It must be a URL like "https://tailscale.com/cap/file-send".

const (// PeerCapabilityFileSharingTarget grants the current node the ability to send// files to the peer which has this capability.PeerCapabilityFileSharingTargetPeerCapability = "https://tailscale.com/cap/file-sharing-target"// PeerCapabilityFileSharingSend grants the ability to receive files from a// node that's owned by a different user.PeerCapabilityFileSharingSendPeerCapability = "https://tailscale.com/cap/file-send"// PeerCapabilityDebugPeer grants the ability for a peer to read this node's// goroutines, metrics, magicsock internal state, etc.PeerCapabilityDebugPeerPeerCapability = "https://tailscale.com/cap/debug-peer"// PeerCapabilityWakeOnLAN grants the ability to send a Wake-On-LAN packet.PeerCapabilityWakeOnLANPeerCapability = "https://tailscale.com/cap/wake-on-lan"// PeerCapabilityIngress grants the ability for a peer to send ingress traffic.PeerCapabilityIngressPeerCapability = "https://tailscale.com/cap/ingress"// PeerCapabilityWebUI grants the ability for a peer to edit features from the// device Web UI.PeerCapabilityWebUIPeerCapability = "tailscale.com/cap/webui"// PeerCapabilityTaildrive grants the ability for a peer to access Taildrive// shares.PeerCapabilityTaildrivePeerCapability = "tailscale.com/cap/drive"// PeerCapabilityTaildriveSharer indicates that a peer has the ability to// share folders with us.PeerCapabilityTaildriveSharerPeerCapability = "tailscale.com/cap/drive-sharer"// PeerCapabilityKubernetes grants a peer Kubernetes-specific// capabilities, such as the ability to impersonate specific Tailscale// user groups as Kubernetes user groups. This capability is read by// peers that are Tailscale Kubernetes operator instances.PeerCapabilityKubernetesPeerCapability = "tailscale.com/cap/kubernetes"// PeerCapabilityRelay grants the ability for a peer to allocate relay// endpoints.PeerCapabilityRelayPeerCapability = "tailscale.com/cap/relay"// PeerCapabilityRelayTarget grants the current node the ability to allocate// relay endpoints to the peer which has this capability.PeerCapabilityRelayTargetPeerCapability = "tailscale.com/cap/relay-target"// PeerCapabilityTsIDP grants a peer tsidp-specific// capabilities, such as the ability to add user groups to the OIDC// claimPeerCapabilityTsIDPPeerCapability = "tailscale.com/cap/tsidp")

typePeerChange ¶added inv1.30.0

type PeerChange struct {// NodeID is the node ID being mutated. If the NodeID is not// known in the current netmap, this update should be// ignored. (But the server will try not to send such useless// updates.)NodeIDNodeID// DERPRegion, if non-zero, means that NodeID's home DERP// region ID is now this number.DERPRegionint `json:",omitzero"`// Cap, if non-zero, means that NodeID's capability version has changed.CapCapabilityVersion `json:",omitzero"`// CapMap, if non-nil, means that NodeID's capability map has changed.CapMapNodeCapMap `json:",omitempty"`// Endpoints, if non-empty, means that NodeID's UDP Endpoints// have changed to these.Endpoints []netip.AddrPort `json:",omitempty"`// Key, if non-nil, means that the NodeID's wireguard public key changed.Key *key.NodePublic `json:",omitzero"`// TODO: de-pointer: tailscale/tailscale#17978// KeySignature, if non-nil, means that the signature of the wireguard// public key has changed.KeySignaturetkatype.MarshaledSignature `json:",omitempty"`// DiscoKey, if non-nil, means that the NodeID's discokey changed.DiscoKey *key.DiscoPublic `json:",omitzero"`// TODO: de-pointer: tailscale/tailscale#17978// Online, if non-nil, means that the NodeID's online status changed.Online *bool `json:",omitzero"`// LastSeen, if non-nil, means that the NodeID's online status changed.LastSeen *time.Time `json:",omitzero"`// TODO: de-pointer: tailscale/tailscale#17978// KeyExpiry, if non-nil, changes the NodeID's key expiry.KeyExpiry *time.Time `json:",omitzero"`// TODO: de-pointer: tailscale/tailscale#17978}

PeerChange is an update to a node.

typePingRequest ¶added inv1.6.0

type PingRequest struct {// URL is the URL to reply to the PingRequest to.// It will be a unique URL each time. No auth headers are necessary.// If the client sees multiple PingRequests with the same URL,// subsequent ones should be ignored.//// The HTTP method that the node should make back to URL depends on the other// fields of the PingRequest. If Types is defined, then URL is the URL to// send a POST request to. Otherwise, the node should just make a HEAD// request to URL.URLstring// URLIsNoise, if true, means that the client should hit URL over the Noise// transport instead of TLS.URLIsNoisebool `json:",omitzero"`// Log is whether to log about this ping in the success case.// For failure cases, the client will log regardless.Logbool `json:",omitzero"`// Types is the types of ping that are initiated. Can be any PingType, comma// separated, e.g. "disco,TSMP"//// As a special case, if Types is "c2n", then this PingRequest is a// client-to-node HTTP request. The HTTP request should be handled by this// node's c2n handler and the HTTP response sent in a POST to URL. For c2n,// the value of URLIsNoise is ignored and only the Noise transport (back to// the control plane) will be used, as if URLIsNoise were true.Typesstring `json:",omitzero"`// IP is the ping target, when needed by the PingType(s) given in Types.IPnetip.Addr `json:",omitzero"`// Payload is the ping payload.//// It is only used for c2n requests, in which case it's an HTTP/1.0 or// HTTP/1.1-formatted HTTP request as parsable with http.ReadRequest.Payload []byte `json:",omitempty"`}

PingRequest is a request from the control plane to the local node to probesomething.

A PingRequest with no IP and Types is a request from the control plane to thelocal node to send an HTTP request to a URL to prove the long-polling clientis still connected.

A PingRequest with Types and IP, will send a ping to the IP and send a POSTrequest containing a PingResponse to the URL containing results.

typePingResponse ¶added inv1.24.0

type PingResponse struct {TypePingType// ping type, such as TSMP or disco.IPstring `json:",omitempty"`// ping destinationNodeIPstring `json:",omitempty"`// Tailscale IP of node handling IP (different for subnet routers)NodeNamestring `json:",omitempty"`// DNS name base or (possibly not unique) hostname// Err contains a short description of error conditions if the PingRequest// could not be fulfilled for some reason.// e.g. "100.1.2.3 is local Tailscale IP"Errstring `json:",omitempty"`// LatencySeconds reports measurement of the round-trip time of a message to// the requested target, if it could be determined. If LatencySeconds is// omitted, Err should contain information as to the cause.LatencySecondsfloat64 `json:",omitempty"`// Endpoint is a string of the form "{ip}:{port}" if direct UDP was used. It// is not currently set for TSMP.Endpointstring `json:",omitempty"`// PeerRelay is a string of the form "{ip}:{port}:vni:{vni}" if a peer// relay was used. It is not currently set for TSMP.PeerRelaystring `json:",omitempty"`// DERPRegionID is non-zero DERP region ID if DERP was used.// It is not currently set for TSMP pings.DERPRegionIDint `json:",omitempty"`// DERPRegionCode is the three-letter region code// corresponding to DERPRegionID.// It is not currently set for TSMP pings.DERPRegionCodestring `json:",omitempty"`// PeerAPIPort is set by TSMP ping responses for peers that// are running a peerapi server. This is the port they're// running the server on.PeerAPIPortuint16 `json:",omitempty"`// IsLocalIP is whether the ping request error is due to it being// a ping to the local node.IsLocalIPbool `json:",omitempty"`}

PingResponse provides result information for a TSMP or Disco PingRequest.Typically populated from an ipnstate.PingResult used in `tailscale ping`.

typePingType ¶added inv1.26.0

type PingTypestring

PingType is a string representing the kind of ping to perform.

const (// PingDisco performs a ping, without involving IP at either end.PingDiscoPingType = "disco"// PingTSMP performs a ping, using the IP layer, but avoiding the OS IP stack.PingTSMPPingType = "TSMP"// PingICMP performs a ping between two tailscale nodes using ICMP that is// received by the target systems IP stack.PingICMPPingType = "ICMP"// PingPeerAPI performs a ping between two tailscale nodes using ICMP that is// received by the target systems IP stack.PingPeerAPIPingType = "peerapi")

typePortRange ¶added inv0.98.1

type PortRange struct {Firstuint16Lastuint16}

PortRange represents a range of UDP or TCP port numbers.

funcParseHostPortRange ¶added inv1.90.0

func ParseHostPortRange(hostportstring) (hoststring, portsPortRange, errerror)

ParseHostPortRange parses hostport as HOST:PORTS where HOST isreturned unchanged and PORTS is is either "*" or PORTLOW-PORTHIGH ranges.

func (PortRange)Contains ¶added inv1.38.0

func (prPortRange) Contains(portuint16)bool

Contains reports whether port is in pr.

func (PortRange)String ¶added inv1.90.0

func (prPortRange) String()string

typeProtoPortRange ¶added inv1.52.0

type ProtoPortRange struct {// Proto is the IP protocol number.// If Proto is 0, it means TCP+UDP+ICMP(4+6).ProtointPortsPortRange}

ProtoPortRange is used to encode "proto:port" format.The following formats are supported:

"*" allows all TCP, UDP and ICMP traffic on all ports."<ports>" allows all TCP, UDP and ICMP traffic on the specified ports."proto:*" allows traffic of the specified proto on all ports."proto:<port>" allows traffic of the specified proto on the specified port.

Ports are either a single port number or a range of ports (e.g. "80-90").String named protocols support names that ipproto.Proto accepts.

funcParseProtoPortRanges ¶added inv1.52.0

func ParseProtoPortRanges(ips []string) ([]ProtoPortRange,error)

ParseProtoPortRanges parses a slice of IP port range fields.

func (*ProtoPortRange)MarshalText ¶added inv1.52.0

func (ppr *ProtoPortRange) MarshalText() ([]byte,error)

MarshalText implements the encoding.TextMarshaler interface. SeeProtoPortRange for the format.

func (ProtoPortRange)String ¶added inv1.52.0

func (pprProtoPortRange) String()string

String implements the stringer interface. See ProtoPortRange for theformat.

func (*ProtoPortRange)UnmarshalText ¶added inv1.52.0

func (ppr *ProtoPortRange) UnmarshalText(text []byte)error

UnmarshalText implements the encoding.TextUnmarshaler interface. SeeProtoPortRange for the format.

typeQueryFeatureRequest ¶added inv1.48.0

type QueryFeatureRequest struct {// Feature is the string identifier for a feature.Featurestring `json:",omitzero"`// NodeKey is the client's current node key.NodeKeykey.NodePublic `json:",omitzero"`}

QueryFeatureRequest is a request sent to "POST /machine/feature/query" to getinstructions on how to enable a feature, such as Funnel, for the node'stailnet.

See QueryFeatureResponse for response structure.

typeQueryFeatureResponse ¶added inv1.48.0

type QueryFeatureResponse struct {// Complete is true when the feature is already enabled.Completebool `json:",omitzero"`// Text holds lines to display in the CLI with information// about the feature and how to enable it.//// Lines are separated by newline characters. The final// newline may be omitted.Textstring `json:",omitzero"`// URL is the link for the user to visit to take action on// enabling the feature.//// When empty, there is no action for this user to take.URLstring `json:",omitzero"`// ShouldWait specifies whether the CLI should block and// wait for the user to enable the feature.//// If this is true, the enablement from the control server// is expected to be a quick and uninterrupted process for// the user, and blocking allows them to immediately start// using the feature once enabled without rerunning the// command (e.g. no need to re-run "funnel on").//// The CLI can watch the IPN notification bus for changes in// required node capabilities to know when to continue.ShouldWaitbool `json:",omitzero"`}

QueryFeatureResponse is the response to an QueryFeatureRequest.See cli.enableFeatureInteractive for usage.

typeRawMessage ¶added inv1.50.0

type RawMessagestring

RawMessage is a raw encoded JSON value. It implements Marshaler andUnmarshaler and can be used to delay JSON decoding or precompute a JSONencoding.

It is like json.RawMessage but is a string instead of a []byte to betterportray immutable data.

funcMarshalCapJSON ¶added inv1.68.0

func MarshalCapJSON[Tany](capRule T) (RawMessage,error)

MarshalCapJSON returns a capability rule in RawMessage string format.

func (RawMessage)MarshalJSON ¶added inv1.50.0

func (mRawMessage) MarshalJSON() ([]byte,error)

MarshalJSON returns m as the JSON encoding of m.

func (*RawMessage)UnmarshalJSON ¶added inv1.50.0

func (m *RawMessage) UnmarshalJSON(data []byte)error

UnmarshalJSON sets *m to a copy of data.

typeRegisterRequest ¶

type RegisterRequest struct {// Version is the client's capabilities when using the Noise// transport.//// When using the original nacl crypto_box transport, the// value must be 1.VersionCapabilityVersionNodeKeykey.NodePublicOldNodeKeykey.NodePublicNLKeykey.NLPublicAuth       *RegisterResponseAuth `json:",omitempty"`// Expiry optionally specifies the requested key expiry.// The server policy may override.// As a special case, if Expiry is in the past and NodeKey is// the node's current key, the key is expired.Expirytime.TimeFollowupstring// response waits until AuthURL is visitedHostinfo *Hostinfo// Ephemeral is whether the client is requesting that this// node be considered ephemeral and be automatically deleted// when it stops being active.Ephemeralbool `json:",omitempty"`// NodeKeySignature is the node's own node-key signature, re-signed// for its new node key using its network-lock key.//// This field is set when the client retries registration after learning// its NodeKeySignature (which is in need of rotation).NodeKeySignaturetkatype.MarshaledSignature// The following fields are not used for SignatureNone and are required for// SignatureV1:SignatureTypeSignatureType `json:",omitempty"`Timestamp     *time.Time    `json:",omitempty"`// creation time of request to prevent replayDeviceCert    []byte        `json:",omitempty"`// X.509 certificate for client deviceSignature     []byte        `json:",omitempty"`// as described by SignatureType// Tailnet is an optional identifier specifying the name of the recommended or required// network that the node should join. Its exact form should not be depended on; new// forms are coming later. The identifier is generally a domain name (for an organization)// or e-mail address (for a personal account on a shared e-mail provider). It is the same name// used by the API, as described in /api.md#tailnet.// If Tailnet begins with the prefix "required:" then the server should prevent logging in to a different// network than the one specified. Otherwise, the server should recommend the specified network// but still permit logging in to other networks.// If empty, no recommendation is offered to the server and the login page should show all options.Tailnetstring `json:",omitempty"`// contains filtered or unexported fields}

RegisterRequest is a request to register a key for a node.

This is JSON-encoded and sent over the control plane connection to:

POST https://<control-plane>/machine/register.

func (*RegisterRequest)Clone ¶

func (src *RegisterRequest) Clone() *RegisterRequest

Clone makes a deep copy of RegisterRequest.The result aliases no memory with the original.

func (*RegisterRequest)View ¶added inv1.50.0

func (p *RegisterRequest) View()RegisterRequestView

View returns a read-only view of RegisterRequest.

typeRegisterRequestView ¶added inv1.50.0

type RegisterRequestView struct {// contains filtered or unexported fields}

RegisterRequestView provides a read-only view over RegisterRequest.

Its methods should only be called if `Valid()` returns true.

func (RegisterRequestView)AsStruct ¶added inv1.50.0

func (vRegisterRequestView) AsStruct() *RegisterRequest

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (RegisterRequestView)Auth ¶added inv1.50.0

func (vRegisterRequestView) Auth()RegisterResponseAuthView

func (RegisterRequestView)DeviceCert ¶added inv1.50.0

func (vRegisterRequestView) DeviceCert()views.ByteSlice[[]byte]

X.509 certificate for client device

func (RegisterRequestView)Ephemeral ¶added inv1.50.0

func (vRegisterRequestView) Ephemeral()bool

Ephemeral is whether the client is requesting that thisnode be considered ephemeral and be automatically deletedwhen it stops being active.

func (RegisterRequestView)Expiry ¶added inv1.50.0

func (vRegisterRequestView) Expiry()time.Time

Expiry optionally specifies the requested key expiry.The server policy may override.As a special case, if Expiry is in the past and NodeKey isthe node's current key, the key is expired.

func (RegisterRequestView)Followup ¶added inv1.50.0

func (vRegisterRequestView) Followup()string

response waits until AuthURL is visited

func (RegisterRequestView)Hostinfo ¶added inv1.50.0

func (vRegisterRequestView) Hostinfo()HostinfoView

func (RegisterRequestView)MarshalJSON ¶added inv1.50.0

func (vRegisterRequestView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (RegisterRequestView)MarshalJSONTo ¶added inv1.88.0

func (vRegisterRequestView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (RegisterRequestView)NLKey ¶added inv1.50.0

func (vRegisterRequestView) NLKey()key.NLPublic

func (RegisterRequestView)NodeKey ¶added inv1.50.0

func (vRegisterRequestView) NodeKey()key.NodePublic

func (RegisterRequestView)NodeKeySignature ¶added inv1.50.0

func (vRegisterRequestView) NodeKeySignature()views.ByteSlice[tkatype.MarshaledSignature]

NodeKeySignature is the node's own node-key signature, re-signedfor its new node key using its network-lock key.

This field is set when the client retries registration after learningits NodeKeySignature (which is in need of rotation).

func (RegisterRequestView)OldNodeKey ¶added inv1.50.0

func (vRegisterRequestView) OldNodeKey()key.NodePublic

func (RegisterRequestView)Signature ¶added inv1.50.0

func (vRegisterRequestView) Signature()views.ByteSlice[[]byte]

as described by SignatureType

func (RegisterRequestView)SignatureType ¶added inv1.50.0

func (vRegisterRequestView) SignatureType()SignatureType

The following fields are not used for SignatureNone and are required forSignatureV1:

func (RegisterRequestView)Tailnet ¶added inv1.52.0

func (vRegisterRequestView) Tailnet()string

Tailnet is an optional identifier specifying the name of the recommended or requirednetwork that the node should join. Its exact form should not be depended on; newforms are coming later. The identifier is generally a domain name (for an organization)or e-mail address (for a personal account on a shared e-mail provider). It is the same nameused by the API, as described in /api.md#tailnet.If Tailnet begins with the prefix "required:" then the server should prevent logging in to a differentnetwork than the one specified. Otherwise, the server should recommend the specified networkbut still permit logging in to other networks.If empty, no recommendation is offered to the server and the login page should show all options.

func (RegisterRequestView)Timestamp ¶added inv1.50.0

func (vRegisterRequestView) Timestamp()views.ValuePointer[time.Time]

creation time of request to prevent replay

func (*RegisterRequestView)UnmarshalJSON ¶added inv1.50.0

func (v *RegisterRequestView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*RegisterRequestView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *RegisterRequestView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (RegisterRequestView)Valid ¶added inv1.50.0

func (vRegisterRequestView) Valid()bool

Valid reports whether v's underlying value is non-nil.

func (RegisterRequestView)Version ¶added inv1.50.0

func (vRegisterRequestView) Version()CapabilityVersion

Version is the client's capabilities when using the Noisetransport.

When using the original nacl crypto_box transport, thevalue must be 1.

typeRegisterResponse ¶

type RegisterResponse struct {UserUserLoginLoginNodeKeyExpiredbool// if true, the NodeKey needs to be replacedMachineAuthorizedbool// TODO(crawshaw): move to using MachineStatusAuthURLstring// if set, authorization pending// If set, this is the current node-key signature that needs to be// re-signed for the node's new node-key.NodeKeySignaturetkatype.MarshaledSignature// Error indicates that authorization failed. If this is non-empty,// other status fields should be ignored.Errorstring}

RegisterResponse is returned by the server in response to a RegisterRequest.

func (*RegisterResponse)Clone ¶added inv1.2.0

func (src *RegisterResponse) Clone() *RegisterResponse

Clone makes a deep copy of RegisterResponse.The result aliases no memory with the original.

func (*RegisterResponse)View ¶added inv1.26.0

func (p *RegisterResponse) View()RegisterResponseView

View returns a read-only view of RegisterResponse.

typeRegisterResponseAuth ¶added inv1.50.0

type RegisterResponseAuth struct {Oauth2Token *Oauth2Token `json:",omitempty"`// used by pre-1.66 Android onlyAuthKeystring       `json:",omitempty"`// contains filtered or unexported fields}

RegisterResponseAuth is the authentication information returned by the serverin response to a RegisterRequest.

func (*RegisterResponseAuth)Clone ¶added inv1.50.0

func (src *RegisterResponseAuth) Clone() *RegisterResponseAuth

Clone makes a deep copy of RegisterResponseAuth.The result aliases no memory with the original.

func (*RegisterResponseAuth)View ¶added inv1.50.0

func (p *RegisterResponseAuth) View()RegisterResponseAuthView

View returns a read-only view of RegisterResponseAuth.

typeRegisterResponseAuthView ¶added inv1.50.0

type RegisterResponseAuthView struct {// contains filtered or unexported fields}

RegisterResponseAuthView provides a read-only view over RegisterResponseAuth.

Its methods should only be called if `Valid()` returns true.

func (RegisterResponseAuthView)AsStruct ¶added inv1.50.0

func (vRegisterResponseAuthView) AsStruct() *RegisterResponseAuth

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (RegisterResponseAuthView)AuthKey ¶added inv1.50.0

func (vRegisterResponseAuthView) AuthKey()string

func (RegisterResponseAuthView)MarshalJSON ¶added inv1.50.0

func (vRegisterResponseAuthView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (RegisterResponseAuthView)MarshalJSONTo ¶added inv1.88.0

func (vRegisterResponseAuthView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (RegisterResponseAuthView)Oauth2Token ¶added inv1.50.0

func (vRegisterResponseAuthView) Oauth2Token()views.ValuePointer[Oauth2Token]

used by pre-1.66 Android only

func (*RegisterResponseAuthView)UnmarshalJSON ¶added inv1.50.0

func (v *RegisterResponseAuthView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*RegisterResponseAuthView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *RegisterResponseAuthView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (RegisterResponseAuthView)Valid ¶added inv1.50.0

func (vRegisterResponseAuthView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeRegisterResponseView ¶added inv1.26.0

type RegisterResponseView struct {// contains filtered or unexported fields}

RegisterResponseView provides a read-only view over RegisterResponse.

Its methods should only be called if `Valid()` returns true.

func (RegisterResponseView)AsStruct ¶added inv1.26.0

func (vRegisterResponseView) AsStruct() *RegisterResponse

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (RegisterResponseView)AuthURL ¶added inv1.26.0

func (vRegisterResponseView) AuthURL()string

if set, authorization pending

func (RegisterResponseView)Error ¶added inv1.26.0

func (vRegisterResponseView) Error()string

Error indicates that authorization failed. If this is non-empty,other status fields should be ignored.

func (RegisterResponseView)Login ¶added inv1.26.0

func (vRegisterResponseView) Login()Login

func (RegisterResponseView)MachineAuthorized ¶added inv1.26.0

func (vRegisterResponseView) MachineAuthorized()bool

TODO(crawshaw): move to using MachineStatus

func (RegisterResponseView)MarshalJSON ¶added inv1.26.0

func (vRegisterResponseView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (RegisterResponseView)MarshalJSONTo ¶added inv1.88.0

func (vRegisterResponseView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (RegisterResponseView)NodeKeyExpired ¶added inv1.26.0

func (vRegisterResponseView) NodeKeyExpired()bool

if true, the NodeKey needs to be replaced

func (RegisterResponseView)NodeKeySignature ¶added inv1.34.0

func (vRegisterResponseView) NodeKeySignature()views.ByteSlice[tkatype.MarshaledSignature]

If set, this is the current node-key signature that needs to bere-signed for the node's new node-key.

func (*RegisterResponseView)UnmarshalJSON ¶added inv1.26.0

func (v *RegisterResponseView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*RegisterResponseView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *RegisterResponseView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (RegisterResponseView)User ¶added inv1.26.0

func (vRegisterResponseView) User()User

func (RegisterResponseView)Valid ¶added inv1.26.0

func (vRegisterResponseView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeSSHAction ¶added inv1.22.0

type SSHAction struct {// Message, if non-empty, is shown to the user before the// action occurs.Messagestring `json:"message,omitempty"`// Reject, if true, terminates the connection. This action// has higher priority that Accept, if given.// The reason this is exists is primarily so a response// from HoldAndDelegate has a way to stop the poll.Rejectbool `json:"reject,omitempty"`// Accept, if true, accepts the connection immediately// without further prompts.Acceptbool `json:"accept,omitempty"`// SessionDuration, if non-zero, is how long the session can stay open// before being forcefully terminated.SessionDurationtime.Duration `json:"sessionDuration,omitempty,format:nano"`// AllowAgentForwarding, if true, allows accepted connections to forward// the ssh agent if requested.AllowAgentForwardingbool `json:"allowAgentForwarding,omitempty"`// HoldAndDelegate, if non-empty, is a URL that serves an// outcome verdict.  The connection will be accepted and will// block until the provided long-polling URL serves a new// SSHAction JSON value. The URL must be fetched using the// Noise transport (in package control/control{base,http}).// If the long poll breaks before returning a complete HTTP// response, it should be re-fetched as long as the SSH// session is open.//// The following variables in the URL are expanded by tailscaled:////   * $SRC_NODE_IP (URL escaped)//   * $SRC_NODE_ID (Node.ID as int64 string)//   * $DST_NODE_IP (URL escaped)//   * $DST_NODE_ID (Node.ID as int64 string)//   * $SSH_USER (URL escaped, ssh user requested)//   * $LOCAL_USER (URL escaped, local user mapped)HoldAndDelegatestring `json:"holdAndDelegate,omitempty"`// AllowLocalPortForwarding, if true, allows accepted connections// to use local port forwarding if requested.AllowLocalPortForwardingbool `json:"allowLocalPortForwarding,omitempty"`// AllowRemotePortForwarding, if true, allows accepted connections// to use remote port forwarding if requested.AllowRemotePortForwardingbool `json:"allowRemotePortForwarding,omitempty"`// Recorders defines the destinations of the SSH session recorders.// The recording will be uploaded tohttp://addr:port/record.Recorders []netip.AddrPort `json:"recorders,omitempty"`// OnRecorderFailure is the action to take if recording fails.// If nil, the default action is to fail open.OnRecordingFailure *SSHRecorderFailureAction `json:"onRecordingFailure,omitempty"`}

SSHAction is how to handle an incoming connection.At most one field should be non-zero.

func (*SSHAction)Clone ¶added inv1.38.4

func (src *SSHAction) Clone() *SSHAction

Clone makes a deep copy of SSHAction.The result aliases no memory with the original.

func (*SSHAction)View ¶added inv1.38.4

func (p *SSHAction) View()SSHActionView

View returns a read-only view of SSHAction.

typeSSHActionView ¶added inv1.38.4

type SSHActionView struct {// contains filtered or unexported fields}

SSHActionView provides a read-only view over SSHAction.

Its methods should only be called if `Valid()` returns true.

func (SSHActionView)Accept ¶added inv1.38.4

func (vSSHActionView) Accept()bool

Accept, if true, accepts the connection immediatelywithout further prompts.

func (SSHActionView)AllowAgentForwarding ¶added inv1.38.4

func (vSSHActionView) AllowAgentForwarding()bool

AllowAgentForwarding, if true, allows accepted connections to forwardthe ssh agent if requested.

func (SSHActionView)AllowLocalPortForwarding ¶added inv1.38.4

func (vSSHActionView) AllowLocalPortForwarding()bool

AllowLocalPortForwarding, if true, allows accepted connectionsto use local port forwarding if requested.

func (SSHActionView)AllowRemotePortForwarding ¶added inv1.44.0

func (vSSHActionView) AllowRemotePortForwarding()bool

AllowRemotePortForwarding, if true, allows accepted connectionsto use remote port forwarding if requested.

func (SSHActionView)AsStruct ¶added inv1.38.4

func (vSSHActionView) AsStruct() *SSHAction

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (SSHActionView)HoldAndDelegate ¶added inv1.38.4

func (vSSHActionView) HoldAndDelegate()string

HoldAndDelegate, if non-empty, is a URL that serves anoutcome verdict. The connection will be accepted and willblock until the provided long-polling URL serves a newSSHAction JSON value. The URL must be fetched using theNoise transport (in package control/control{base,http}).If the long poll breaks before returning a complete HTTPresponse, it should be re-fetched as long as the SSHsession is open.

The following variables in the URL are expanded by tailscaled:

$SRC_NODE_IP (URL escaped)
$SRC_NODE_ID (Node.ID as int64 string)
$DST_NODE_IP (URL escaped)
$DST_NODE_ID (Node.ID as int64 string)
$SSH_USER (URL escaped, ssh user requested)
$LOCAL_USER (URL escaped, local user mapped)

func (SSHActionView)MarshalJSON ¶added inv1.38.4

func (vSSHActionView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (SSHActionView)MarshalJSONTo ¶added inv1.88.0

func (vSSHActionView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (SSHActionView)Message ¶added inv1.38.4

func (vSSHActionView) Message()string

Message, if non-empty, is shown to the user before theaction occurs.

func (SSHActionView)OnRecordingFailure ¶added inv1.40.0

func (vSSHActionView) OnRecordingFailure()views.ValuePointer[SSHRecorderFailureAction]

OnRecorderFailure is the action to take if recording fails.If nil, the default action is to fail open.

func (SSHActionView)Recorders ¶added inv1.38.4

func (vSSHActionView) Recorders()views.Slice[netip.AddrPort]

Recorders defines the destinations of the SSH session recorders.The recording will be uploaded tohttp://addr:port/record.

func (SSHActionView)Reject ¶added inv1.38.4

func (vSSHActionView) Reject()bool

Reject, if true, terminates the connection. This actionhas higher priority that Accept, if given.The reason this is exists is primarily so a responsefrom HoldAndDelegate has a way to stop the poll.

func (SSHActionView)SessionDuration ¶added inv1.38.4

func (vSSHActionView) SessionDuration()time.Duration

SessionDuration, if non-zero, is how long the session can stay openbefore being forcefully terminated.

func (*SSHActionView)UnmarshalJSON ¶added inv1.38.4

func (v *SSHActionView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*SSHActionView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *SSHActionView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (SSHActionView)Valid ¶added inv1.38.4

func (vSSHActionView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeSSHEventNotifyRequest ¶added inv1.42.0

type SSHEventNotifyRequest struct {// EventType is the type of notify request being sent.EventTypeSSHEventType// ConnectionID uniquely identifies a connection made to the SSH server.// It may be shared across multiple sessions over the same connection in// case a single connection creates multiple sessions.ConnectionIDstring// CapVersion is the client's current CapabilityVersion.CapVersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// SrcNode is the ID of the node that initiated the SSH session.SrcNodeNodeID// SSHUser is the user that was presented to the SSH server.SSHUserstring// LocalUser is the user that was resolved from the SSHUser for the local machine.LocalUserstring// RecordingAttempts is the list of recorders that were attempted, in order.RecordingAttempts []*SSHRecordingAttempt}

SSHEventNotifyRequest is the JSON payload sent to the NotifyURLfor an SSH event.

POST https://<control-plane>/[...varies, sent in SSH policy...]

typeSSHEventType ¶added inv1.42.0

type SSHEventTypeint

SSHEventType defines the event type linked to a SSH action or state.

const (UnspecifiedSSHEventTypeSSHEventType = 0// SSHSessionRecordingRejected is the event that// defines when a SSH session cannot be started// because no recorder is available for session// recording, and the SSHRecorderFailureAction// RejectSessionWithMessage is not empty.SSHSessionRecordingRejectedSSHEventType = 1// SSHSessionRecordingTerminated is the event that// defines when session recording has failed// during the session and the SSHRecorderFailureAction// TerminateSessionWithMessage is not empty.SSHSessionRecordingTerminatedSSHEventType = 2// SSHSessionRecordingFailed is the event that// defines when session recording is unavailable and// the SSHRecorderFailureAction RejectSessionWithMessage// or TerminateSessionWithMessage is empty.SSHSessionRecordingFailedSSHEventType = 3)

typeSSHPolicy ¶added inv1.22.0

type SSHPolicy struct {// Rules are the rules to process for an incoming SSH connection. The first// matching rule takes its action and stops processing further rules.//// When an incoming connection first starts, all rules are evaluated in// "none" auth mode, where the client hasn't even been asked to send a// public key. All SSHRule.Principals requiring a public key won't match. If// a rule matches on the first pass and its Action is reject, the// authentication fails with that action's rejection message, if any.//// If the first pass rule evaluation matches nothing without matching an// Action with Reject set, the rules are considered to see whether public// keys might still result in a match. If not, "none" auth is terminated// before proceeding to public key mode. If so, the client is asked to try// public key authentication and the rules are evaluated again for each of// the client's present keys.Rules []*SSHRule `json:"rules"`}

SSHPolicy is the policy for how to handle incoming SSH connectionsover Tailscale.

func (*SSHPolicy)Clone ¶added inv1.90.0

func (src *SSHPolicy) Clone() *SSHPolicy

Clone makes a deep copy of SSHPolicy.The result aliases no memory with the original.

func (*SSHPolicy)View ¶added inv1.90.0

func (p *SSHPolicy) View()SSHPolicyView

View returns a read-only view of SSHPolicy.

typeSSHPolicyView ¶added inv1.90.0

type SSHPolicyView struct {// contains filtered or unexported fields}

SSHPolicyView provides a read-only view over SSHPolicy.

Its methods should only be called if `Valid()` returns true.

func (SSHPolicyView)AsStruct ¶added inv1.90.0

func (vSSHPolicyView) AsStruct() *SSHPolicy

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (SSHPolicyView)MarshalJSON ¶added inv1.90.0

func (vSSHPolicyView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (SSHPolicyView)MarshalJSONTo ¶added inv1.90.0

func (vSSHPolicyView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (SSHPolicyView)Rules ¶added inv1.90.0

func (vSSHPolicyView) Rules()views.SliceView[*SSHRule,SSHRuleView]

Rules are the rules to process for an incoming SSH connection. The firstmatching rule takes its action and stops processing further rules.

When an incoming connection first starts, all rules are evaluated in"none" auth mode, where the client hasn't even been asked to send apublic key. All SSHRule.Principals requiring a public key won't match. Ifa rule matches on the first pass and its Action is reject, theauthentication fails with that action's rejection message, if any.

If the first pass rule evaluation matches nothing without matching anAction with Reject set, the rules are considered to see whether publickeys might still result in a match. If not, "none" auth is terminatedbefore proceeding to public key mode. If so, the client is asked to trypublic key authentication and the rules are evaluated again for each ofthe client's present keys.

func (*SSHPolicyView)UnmarshalJSON ¶added inv1.90.0

func (v *SSHPolicyView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*SSHPolicyView)UnmarshalJSONFrom ¶added inv1.90.0

func (v *SSHPolicyView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (SSHPolicyView)Valid ¶added inv1.90.0

func (vSSHPolicyView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeSSHPrincipal ¶added inv1.22.0

type SSHPrincipal struct {NodeStableNodeID `json:"node,omitempty"`NodeIPstring       `json:"nodeIP,omitempty"`UserLoginstring       `json:"userLogin,omitempty"`// email-ish: foo@example.com, bar@githubAnybool         `json:"any,omitempty"`// if true, match any connection// UnusedPubKeys was public key support. It never became an official product// feature and so as of 2024-12-12 is being removed.// This stub exists to remind us not to re-use the JSON field name "pubKeys"// in the future if we bring it back with different semantics.//// Deprecated: do not use. It does nothing.UnusedPubKeys []string `json:"pubKeys,omitempty"`}

SSHPrincipal is either a particular node or a user on any node.

func (*SSHPrincipal)Clone ¶added inv1.30.0

func (src *SSHPrincipal) Clone() *SSHPrincipal

Clone makes a deep copy of SSHPrincipal.The result aliases no memory with the original.

func (*SSHPrincipal)View ¶added inv1.30.0

func (p *SSHPrincipal) View()SSHPrincipalView

View returns a read-only view of SSHPrincipal.

typeSSHPrincipalView ¶added inv1.30.0

type SSHPrincipalView struct {// contains filtered or unexported fields}

SSHPrincipalView provides a read-only view over SSHPrincipal.

Its methods should only be called if `Valid()` returns true.

func (SSHPrincipalView)Any ¶added inv1.30.0

func (vSSHPrincipalView) Any()bool

if true, match any connection

func (SSHPrincipalView)AsStruct ¶added inv1.30.0

func (vSSHPrincipalView) AsStruct() *SSHPrincipal

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (SSHPrincipalView)MarshalJSON ¶added inv1.30.0

func (vSSHPrincipalView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (SSHPrincipalView)MarshalJSONTo ¶added inv1.88.0

func (vSSHPrincipalView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (SSHPrincipalView)Node ¶added inv1.30.0

func (vSSHPrincipalView) Node()StableNodeID

func (SSHPrincipalView)NodeIP ¶added inv1.30.0

func (vSSHPrincipalView) NodeIP()string

func (*SSHPrincipalView)UnmarshalJSON ¶added inv1.30.0

func (v *SSHPrincipalView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*SSHPrincipalView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *SSHPrincipalView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (SSHPrincipalView)UnusedPubKeysdeprecatedadded inv1.80.0

func (vSSHPrincipalView) UnusedPubKeys()views.Slice[string]

UnusedPubKeys was public key support. It never became an official productfeature and so as of 2024-12-12 is being removed.This stub exists to remind us not to re-use the JSON field name "pubKeys"in the future if we bring it back with different semantics.

Deprecated: do not use. It does nothing.

func (SSHPrincipalView)UserLogin ¶added inv1.30.0

func (vSSHPrincipalView) UserLogin()string

email-ish: foo@example.com, bar@github

func (SSHPrincipalView)Valid ¶added inv1.30.0

func (vSSHPrincipalView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeSSHRecorderFailureAction ¶added inv1.40.0

type SSHRecorderFailureAction struct {// RejectSessionWithMessage, if not empty, specifies that the session should// be rejected if the recording fails to start.// The message will be shown to the user before the session is rejected.RejectSessionWithMessagestring `json:",omitempty"`// TerminateSessionWithMessage, if not empty, specifies that the session// should be terminated if the recording fails after it has started. The// message will be shown to the user before the session is terminated.TerminateSessionWithMessagestring `json:",omitempty"`// NotifyURL, if non-empty, specifies a HTTP POST URL to notify when the// recording fails. The payload is the JSON encoded// SSHRecordingFailureNotifyRequest struct. The host field in the URL is// ignored, and it will be sent to control over the Noise transport.NotifyURLstring `json:",omitempty"`}

SSHRecorderFailureAction is the action to take if recording fails.

typeSSHRecordingAttempt ¶added inv1.40.0

type SSHRecordingAttempt struct {// Recorder is the address of the recorder that was attempted.Recordernetip.AddrPort// FailureMessage is the error message of the failed attempt.FailureMessagestring}

SSHRecordingAttempt is a single attempt to start a recording.

typeSSHRule ¶added inv1.22.0

type SSHRule struct {// RuleExpires, if non-nil, is when this rule expires.//// For example, a (principal,sshuser) tuple might be granted// prompt-free SSH access for N minutes, so this rule would be// before a expiration-free rule for the same principal that// required an auth prompt.  This permits the control plane to// be out of the path for already-authorized SSH pairs.//// Once a rule matches, the lifetime of any accepting connection// is subject to the SSHAction.SessionExpires time, if any.RuleExpires *time.Time `json:"ruleExpires,omitempty"`// Principals matches an incoming connection. If the connection// matches anything in this list and also matches SSHUsers,// then Action is applied.Principals []*SSHPrincipal `json:"principals"`// SSHUsers are the SSH users that this rule matches. It is a// map from either ssh-user|"*" => local-user.  The map must// contain a key for either ssh-user or, as a fallback, "*" to// match anything. If it does, the map entry's value is the// actual user that's logged in.// If the map value is the empty string (for either the// requested SSH user or "*"), the rule doesn't match.// If the map value is "=", it means the ssh-user should map// directly to the local-user.// It may be nil if the Action is reject.SSHUsers map[string]string `json:"sshUsers"`// Action is the outcome to task.// A nil or invalid action means to deny.Action *SSHAction `json:"action"`// AcceptEnv is a slice of environment variable names that are allowlisted// for the SSH rule in the policy file.//// AcceptEnv values may contain * and ? wildcard characters which match against// an arbitrary number of characters or a single character respectively.AcceptEnv []string `json:"acceptEnv,omitempty"`}

An SSH rule is a match predicate and associated action for an incoming SSH connection.

func (*SSHRule)Clone ¶added inv1.30.0

func (src *SSHRule) Clone() *SSHRule

Clone makes a deep copy of SSHRule.The result aliases no memory with the original.

func (*SSHRule)View ¶added inv1.30.0

func (p *SSHRule) View()SSHRuleView

View returns a read-only view of SSHRule.

typeSSHRuleView ¶added inv1.30.0

type SSHRuleView struct {// contains filtered or unexported fields}

SSHRuleView provides a read-only view over SSHRule.

Its methods should only be called if `Valid()` returns true.

func (SSHRuleView)AcceptEnv ¶added inv1.76.0

func (vSSHRuleView) AcceptEnv()views.Slice[string]

AcceptEnv is a slice of environment variable names that are allowlistedfor the SSH rule in the policy file.

AcceptEnv values may contain * and ? wildcard characters which match againstan arbitrary number of characters or a single character respectively.

func (SSHRuleView)Action ¶added inv1.30.0

func (vSSHRuleView) Action()SSHActionView

Action is the outcome to task.A nil or invalid action means to deny.

func (SSHRuleView)AsStruct ¶added inv1.30.0

func (vSSHRuleView) AsStruct() *SSHRule

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (SSHRuleView)MarshalJSON ¶added inv1.30.0

func (vSSHRuleView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (SSHRuleView)MarshalJSONTo ¶added inv1.88.0

func (vSSHRuleView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (SSHRuleView)Principals ¶added inv1.30.0

func (vSSHRuleView) Principals()views.SliceView[*SSHPrincipal,SSHPrincipalView]

Principals matches an incoming connection. If the connectionmatches anything in this list and also matches SSHUsers,then Action is applied.

func (SSHRuleView)RuleExpires ¶added inv1.30.0

func (vSSHRuleView) RuleExpires()views.ValuePointer[time.Time]

RuleExpires, if non-nil, is when this rule expires.

For example, a (principal,sshuser) tuple might be grantedprompt-free SSH access for N minutes, so this rule would bebefore a expiration-free rule for the same principal thatrequired an auth prompt. This permits the control plane tobe out of the path for already-authorized SSH pairs.

Once a rule matches, the lifetime of any accepting connectionis subject to the SSHAction.SessionExpires time, if any.

func (SSHRuleView)SSHUsers ¶added inv1.30.0

func (vSSHRuleView) SSHUsers()views.Map[string,string]

SSHUsers are the SSH users that this rule matches. It is amap from either ssh-user|"*" => local-user. The map mustcontain a key for either ssh-user or, as a fallback, "*" tomatch anything. If it does, the map entry's value is theactual user that's logged in.If the map value is the empty string (for either therequested SSH user or "*"), the rule doesn't match.If the map value is "=", it means the ssh-user should mapdirectly to the local-user.It may be nil if the Action is reject.

func (*SSHRuleView)UnmarshalJSON ¶added inv1.30.0

func (v *SSHRuleView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*SSHRuleView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *SSHRuleView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (SSHRuleView)Valid ¶added inv1.30.0

func (vSSHRuleView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeService ¶

type Service struct {// Proto is the type of service. It's usually the constant TCP// or UDP ("tcp" or "udp"), but it can also be one of the// following meta service values:////     * "peerapi4": peerapi is available on IPv4; Port is the//        port number that the peerapi is running on the//        node's Tailscale IPv4 address.//     * "peerapi6": peerapi is available on IPv6; Port is the//        port number that the peerapi is running on the//        node's Tailscale IPv6 address.//     * "peerapi-dns-proxy": the local peerapi service supports//        being a DNS proxy (when the node is an exit//        node). For this service, the Port number must only be 1.ProtoServiceProto// Port is the port number.//// For Proto "peerapi-dns", it must be 1.Portuint16// Description is the textual description of the service,// usually the process name that's running.Descriptionstring `json:",omitempty"`// contains filtered or unexported fields}

Service represents a service running on a node.

typeServiceIPMappings ¶added inv1.80.0

type ServiceIPMappings map[ServiceName][]netip.Addr

ServiceIPMappings maps ServiceName to lists of IP addresses. This is usedas the value of theNodeAttrServiceHost capability, to inform service hostswhat IP addresses they need to listen on for each service that they areadvertising.

This is of the form:

{  "svc:samba": ["100.65.32.1", "fd7a:115c:a1e0::1234"],  "svc:web": ["100.102.42.3", "fd7a:115c:a1e0::abcd"],}

where the IP addresses are the IPs of the VIP services. These IPs are alsoprovided in AllowedIPs, but this lets the client know which servicescorrespond to those IPs. Any services that don't correspond to a servicethis client is hosting can be ignored.

typeServiceName ¶added inv1.80.0

type ServiceNamestring

ServiceName is the name of a service, of the form `svc:dns-label`. Servicesrepresent some kind of application provided for users of the tailnet with aMagicDNS name and possibly dedicated IP addresses. Currently (2024-01-21),the only type of service isVIPService.This is not related to the olderService used in [Hostinfo.Services].

funcAsServiceName ¶added inv1.86.0

func AsServiceName(sstring)ServiceName

AsServiceName reports whether the given string is a valid service name.If so returns the name as atailcfg.ServiceName, otherwise returns "".

func (ServiceName)String ¶added inv1.80.0

func (snServiceName) String()string

String implementsfmt.Stringer.

func (ServiceName)Validate ¶added inv1.80.0

func (snServiceName) Validate()error

Validate validates if the service name is formatted correctly.We only allow valid DNS labels, since the expectation is that these will beused as parts of domain names. All errors arevizerror.Error.

func (ServiceName)WithoutPrefix ¶added inv1.80.0

func (snServiceName) WithoutPrefix()string

WithoutPrefix is the name of the service without the `svc:` prefix, used forDNS names. If the name does not include the prefix (which meansServiceName.Validate would return an error) then it returns "".

typeServiceProto ¶

type ServiceProtostring

ServiceProto is a service type. It's usuallyTCP ("tcp") or UDP ("udp"), but it can also havemeta service values as defined in Service.Proto.

typeSetDNSRequest ¶added inv1.10.0

type SetDNSRequest struct {// Version is the client's capabilities// (CurrentCapabilityVersion) when using the Noise transport.//// When using the original nacl crypto_box transport, the// value must be 1.VersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// Name is the domain name for which to create a record.// For ACME DNS-01 challenges, it should be one of the domains// in MapResponse.DNSConfig.CertDomains with the prefix// "_acme-challenge.".Namestring// Type is the DNS record type. For ACME DNS-01 challenges, it// should be "TXT".Typestring// Value is the value to add.Valuestring}

SetDNSRequest is a request to add a DNS record.

This is used to let tailscaled clients complete their ACME DNS-01 challenges(so people can use LetsEncrypt, etc) to get TLS certificates fortheir foo.bar.ts.net MagicDNS names.

This is JSON-encoded and sent over the control plane connection to:

POST https://<control-plane>/machine/set-dns

typeSetDNSResponse ¶added inv1.24.0

type SetDNSResponse struct{}

SetDNSResponse is the response to a SetDNSRequest.

typeSetDeviceAttributesRequest ¶added inv1.80.0

type SetDeviceAttributesRequest struct {// Version is the current binary's [CurrentCapabilityVersion].VersionCapabilityVersion// NodeKey identifies the node to modify. It should be the currently active// node and is an error if not.NodeKeykey.NodePublic// Update is a map of device posture attributes to update.// Attributes not in the map are left unchanged.UpdateAttrUpdate}

SetDeviceAttributesRequest is a request to update thecurrent node's device posture attributes.

As of 2024-12-30, this is an experimental dev featurefor internal testing. See tailscale/corp#24690.

This is JSON-encoded and sent over the control plane connection to:

PATCH https://<control-plane>/machine/set-device-attr

typeSignatureType ¶added inv1.8.0

type SignatureTypeint

SignatureType specifies a scheme for signing RegisterRequest messages. Itspecifies the crypto algorithms to use, the contents of what is signed, andany other relevant details. Historically, requests were unsigned so the zerovalue is SignatureNone.

func (SignatureType)AppendText ¶added inv1.50.0

func (stSignatureType) AppendText(b []byte) ([]byte,error)

func (SignatureType)MarshalText ¶added inv1.8.0

func (stSignatureType) MarshalText() ([]byte,error)

func (SignatureType)String ¶added inv1.8.0

func (stSignatureType) String()string

func (*SignatureType)UnmarshalText ¶added inv1.8.0

func (st *SignatureType) UnmarshalText(b []byte)error

typeStableNodeID ¶added inv1.4.0

type StableNodeIDstring

StableNodeID is a string form ofNodeID.

Different control plane servers should ideally have different StableNodeIDsuffixes for different sites or regions.

Being a string, it's safer to use in JavaScript without worrying about thesize of the integer, as documented onNodeID.

But in general, Tailscale APIs can accept either aNodeID integer or aStableNodeID string when referring to a node.

func (StableNodeID)IsZero ¶added inv1.4.0

func (uStableNodeID) IsZero()bool

typeTKABootstrapRequest ¶added inv1.32.0

type TKABootstrapRequest struct {// Version is the client's capabilities.VersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// Head represents the node's head AUMHash (tka.Authority.Head), if// network lock is enabled.Headstring}

TKABootstrapRequest is sent by a node to get information necessary forenabling or disabling the tailnet key authority.

typeTKABootstrapResponse ¶added inv1.32.0

type TKABootstrapResponse struct {// GenesisAUM returns the initial AUM necessary to initialize TKA.GenesisAUMtkatype.MarshaledAUM `json:",omitempty"`// DisablementSecret encodes a secret necessary to disable TKA.DisablementSecret []byte `json:",omitempty"`}

TKABootstrapResponse encodes values necessary to enable or disablethe tailnet key authority (TKA).

typeTKADisableRequest ¶added inv1.34.0

type TKADisableRequest struct {// Version is the client's capabilities.VersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// Head represents the node's head AUMHash (tka.Authority.Head).// It is encoded as tka.AUMHash.MarshalText.Headstring// DisablementSecret encodes the secret necessary to disable TKA.DisablementSecret []byte}

TKADisableRequest disables network-lock across the tailnet using theprovided disablement secret.

This is the request schema for a /tka/disable noise RPC.

typeTKADisableResponse ¶added inv1.34.0

type TKADisableResponse struct {}

TKADisableResponse is the JSON response from a /tka/disable RPC.This schema describes the successful disablement of the tailnet'skey authority.

typeTKAInfo ¶added inv1.32.0

type TKAInfo struct {// Head describes the hash of the latest AUM applied to the authority.// Head is encoded as tka.AUMHash.MarshalText.//// If the Head state differs to that known locally, the node should perform// synchronization via a separate RPC.Headstring `json:",omitempty"`// Disabled indicates the control plane believes TKA should be disabled,// and the node should reach out to fetch a disablement// secret. If the disablement secret verifies, then the node should then// disable TKA locally.// This field exists to disambiguate a nil TKAInfo in a delta mapresponse// from a nil TKAInfo indicating TKA should be disabled.Disabledbool `json:",omitempty"`}

TKAInfo encodes the control plane's view of tailnet key authority (TKA)state. This information is transmitted as part of the MapResponse.

typeTKAInitBeginRequest ¶added inv1.30.0

type TKAInitBeginRequest struct {// Version is the client's capabilities.VersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// GenesisAUM is the initial (genesis) AUM that the node generated// to bootstrap tailnet key authority state.GenesisAUMtkatype.MarshaledAUM}

TKAInitBeginRequest submits a genesis AUM to seed the creation of thetailnet's key authority.

typeTKAInitBeginResponse ¶added inv1.30.0

type TKAInitBeginResponse struct {// NeedSignatures specify information about the nodes in your tailnet// which need initial signatures to function once the tailnet key// authority is in use. The generated signatures should then be// submitted in a /tka/init/finish RPC.NeedSignatures []TKASignInfo}

TKAInitBeginResponse is the JSON response from a /tka/init/begin RPC.This structure describes node information which must be signed tocomplete initialization of the tailnets' key authority.

typeTKAInitFinishRequest ¶added inv1.30.0

type TKAInitFinishRequest struct {// Version is the client's capabilities.VersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// Signatures are serialized tka.NodeKeySignatures for all nodes// in the tailnet.Signatures map[NodeID]tkatype.MarshaledSignature// SupportDisablement is a disablement secret for Tailscale support.// This is only generated if --gen-disablement-for-support is specified// in an invocation to 'tailscale lock init'.SupportDisablement []byte `json:",omitempty"`}

TKAInitFinishRequest is the JSON request of a /tka/init/finish RPC.This RPC finalizes initialization of the tailnet key authorityby submitting node-key signatures for all existing nodes.

typeTKAInitFinishResponse ¶added inv1.30.0

type TKAInitFinishResponse struct {}

TKAInitFinishResponse is the JSON response from a /tka/init/finish RPC.This schema describes the successful enablement of the tailnet'skey authority.

typeTKASignInfo ¶added inv1.30.0

type TKASignInfo struct {// NodeID is the ID of the node which needs a signature. It must// correspond to NodePublic.NodeIDNodeID// NodePublic is the node (Wireguard) public key which is being// signed.NodePublickey.NodePublic// RotationPubkey specifies the public key which may sign// a NodeKeySignature (NKS), which rotates the node key.//// This is necessary so the node can rotate its node-key without// talking to a node which holds a trusted network-lock key.// It does this by nesting the original NKS in a 'rotation' NKS,// which it then signs with the key corresponding to RotationPubkey.//// This field expects a raw ed25519 public key.RotationPubkey []byte}

TKASignInfo describes information about an existing node that needsto be signed into a node-key signature.

typeTKASignaturesUsingKeyRequest ¶added inv1.38.0

type TKASignaturesUsingKeyRequest struct {// Version is the client's capabilities.VersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// KeyID is the key we are querying using.KeyIDtkatype.KeyID}

TKASignaturesUsingKeyRequest asks the control plane forall signatures which are signed by the provided keyID.

This is the request schema for a /tka/affected-sigs RPC.

typeTKASignaturesUsingKeyResponse ¶added inv1.38.0

type TKASignaturesUsingKeyResponse struct {Signatures []tkatype.MarshaledSignature}

TKASignaturesUsingKeyResponse is the JSON response toa /tka/affected-sigs RPC.

It enumerates all signatures which are signed by thequeried keyID.

typeTKASubmitSignatureRequest ¶added inv1.34.0

type TKASubmitSignatureRequest struct {// Version is the client's capabilities.VersionCapabilityVersion// NodeKey is the client's current node key. The node-key which// is being signed is embedded in Signature.NodeKeykey.NodePublic// Signature encodes the node-key signature being submitted.Signaturetkatype.MarshaledSignature}

TKASubmitSignatureRequest transmits a node-key signature to the control plane.

This is the request schema for a /tka/sign noise RPC.

typeTKASubmitSignatureResponse ¶added inv1.34.0

type TKASubmitSignatureResponse struct {}

TKASubmitSignatureResponse is the JSON response from a /tka/sign RPC.

typeTKASyncOfferRequest ¶added inv1.32.0

type TKASyncOfferRequest struct {// Version is the client's capabilities.VersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// Head represents the node's head AUMHash (tka.Authority.Head). This// corresponds to tka.SyncOffer.Head.Headstring// Ancestors represents a selection of ancestor AUMHash values ascending// from the current head. This corresponds to tka.SyncOffer.Ancestors.Ancestors []string}

TKASyncOfferRequest encodes a request to synchronize tailnet key authoritystate (TKA). Values of type tka.AUMHash are encoded as strings in theirMarshalText form.

typeTKASyncOfferResponse ¶added inv1.32.0

type TKASyncOfferResponse struct {// Head represents the control plane's head AUMHash (tka.Authority.Head).// This corresponds to tka.SyncOffer.Head.Headstring// Ancestors represents a selection of ancestor AUMHash values ascending// from the control plane's head. This corresponds to// tka.SyncOffer.Ancestors.Ancestors []string// MissingAUMs encodes AUMs that the control plane believes the node// is missing.MissingAUMs []tkatype.MarshaledAUM}

TKASyncOfferResponse encodes a response in synchronizing a node'stailnet key authority state. Values of type tka.AUMHash are encoded asstrings in their MarshalText form.

typeTKASyncSendRequest ¶added inv1.32.0

type TKASyncSendRequest struct {// Version is the client's capabilities.VersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// Head represents the node's head AUMHash (tka.Authority.Head) after// applying any AUMs from the sync-offer response.// It is encoded as tka.AUMHash.MarshalText.Headstring// MissingAUMs encodes AUMs that the node believes the control plane// is missing.MissingAUMs []tkatype.MarshaledAUM// Interactive is true if additional error checking should be performed as// the request is on behalf of an interactive operation (e.g., an// administrator publishing new changes) as opposed to an automatic// synchronization that may be reporting lost data.Interactivebool}

TKASyncSendRequest encodes AUMs that a node believes the control planeis missing, and notifies control of its local TKA state (specificallythe head hash).

typeTKASyncSendResponse ¶added inv1.32.0

type TKASyncSendResponse struct {// Head represents the control plane's head AUMHash (tka.Authority.Head),// after applying the missing AUMs.Headstring}

TKASyncSendResponse encodes the control plane's response to a nodesubmitting AUMs during AUM synchronization.

typeTPMInfo ¶added inv1.84.0

type TPMInfo struct {// Manufacturer is a 4-letter code from section 4.1 of//https://trustedcomputinggroup.org/resource/vendor-id-registry/,// for example "MSFT" for Microsoft.// Read from TPM_PT_MANUFACTURER.Manufacturerstring `json:",omitzero"`// Vendor is a vendor ID string, up to 16 characters.// Read from TPM_PT_VENDOR_STRING_*.Vendorstring `json:",omitzero"`// Model is a vendor-defined TPM model.// Read from TPM_PT_VENDOR_TPM_TYPE.Modelint `json:",omitzero"`// FirmwareVersion is the version number of the firmware.// Read from TPM_PT_FIRMWARE_VERSION_*.FirmwareVersionuint64 `json:",omitzero"`// SpecRevision is the TPM 2.0 spec revision encoded as a single number. All// revisions can be found at//https://trustedcomputinggroup.org/resource/tpm-library-specification/.// Before revision 184, TCG used the "01.83" format for revision 183.SpecRevisionint `json:",omitzero"`// FamilyIndicator is the TPM spec family, like "2.0".// Read from TPM_PT_FAMILY_INDICATOR.FamilyIndicatorstring `json:",omitzero"`}

TPMInfo contains information about a TPM 2.0 device present on a node.All fields are read from TPM_CAP_TPM_PROPERTIES, see Part 2, section 6.13 ofhttps://trustedcomputinggroup.org/resource/tpm-library-specification/.

func (*TPMInfo)Present ¶added inv1.86.0

func (t *TPMInfo) Present()bool

Present reports whether a TPM device is present on this machine.

typeTokenRequest ¶added inv1.24.0

type TokenRequest struct {// CapVersion is the client's current CapabilityVersion.CapVersionCapabilityVersion// NodeKey is the client's current node key.NodeKeykey.NodePublic// Audience the token is being requested for.Audiencestring}

TokenRequest is a request to get an OIDC ID token for an audience.The token can be presented to any resource provider which offers OIDCFederation.

It is JSON-encoded and sent over Noise to "POST /machine/id-token".

typeTokenResponse ¶added inv1.24.0

type TokenResponse struct {// IDToken is a JWT encoding the following standard claims:////   `sub` | the MagicDNS name of the node//   `aud` | Audience from the request//   `exp` | Token expiry//   `iat` | Token issuance time//   `iss` | Issuer//   `jti` | Random token identifier//   `nbf` | Not before time//// It also encodes the following Tailscale specific claims:////   `key`       | the node public key//   `addresses` | the Tailscale IPs of the node//   `nid`       | the node ID//   `node`      | the name of the node//   `domain`    | the domain of the node, it has the same format as MapResponse.Domain.//   `tags`      | an array of <domain:tag> on the node (like alice.github:tag:foo or example.com:tag:foo)//   `user`      | user emailish (like alice.github:alice@github or example.com:bob@example.com), if not tagged//   `uid`       | user ID, if not taggedIDTokenstring `json:"id_token"`}

TokenResponse is the response to a TokenRequest.

typeUser ¶

type User struct {IDUserIDDisplayNamestring// if non-empty overrides Login fieldProfilePicURLstring    `json:",omitzero"`// if non-empty overrides Login fieldCreatedtime.Time `json:",omitzero"`}

User is a Tailscale user.

A user can have multiple logins associated with it (e.g. gmail and github oauth).(Note: none of our UIs support this yet.)

Some properties are inherited from the logins and can be overridden, such asdisplay name and profile picture.

Other properties must be the same for all logins associated with a user.In particular: domain. If a user has a "tailscale.io" domain login, they cannothave a general gmail address login associated with the user.

func (*User)Clone ¶

func (src *User) Clone() *User

Clone makes a deep copy of User.The result aliases no memory with the original.

func (*User)View ¶added inv1.26.0

func (p *User) View()UserView

View returns a read-only view of User.

typeUserID ¶

type UserIDID

UserID is anID for aUser.

func (UserID)IsZero ¶added inv1.2.0

func (uUserID) IsZero()bool

func (UserID)String ¶

func (idUserID) String()string

typeUserProfile ¶

type UserProfile struct {IDUserIDLoginNamestring// "alice@smith.com"; for display purposes only (provider is not listed)DisplayNamestring// "Alice Smith"ProfilePicURLstring `json:",omitzero"`}

A UserProfile is display-friendly data for aUser.It includes the LoginName for display purposes but *not* the Provider.It also includes derived data from one of the user's logins.

func (*UserProfile)Clone ¶added inv1.48.0

func (src *UserProfile) Clone() *UserProfile

Clone makes a deep copy of UserProfile.The result aliases no memory with the original.

func (*UserProfile)Equal ¶added inv1.48.0

func (p *UserProfile) Equal(p2 *UserProfile)bool

func (*UserProfile)View ¶added inv1.48.0

func (p *UserProfile) View()UserProfileView

View returns a read-only view of UserProfile.

typeUserProfileView ¶added inv1.48.0

type UserProfileView struct {// contains filtered or unexported fields}

UserProfileView provides a read-only view over UserProfile.

Its methods should only be called if `Valid()` returns true.

func (UserProfileView)AsStruct ¶added inv1.48.0

func (vUserProfileView) AsStruct() *UserProfile

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (UserProfileView)DisplayName ¶added inv1.48.0

func (vUserProfileView) DisplayName()string

"Alice Smith"

func (UserProfileView)Equal ¶added inv1.48.0

func (vUserProfileView) Equal(v2UserProfileView)bool

func (UserProfileView)ID ¶added inv1.48.0

func (vUserProfileView) ID()UserID

func (UserProfileView)LoginName ¶added inv1.48.0

func (vUserProfileView) LoginName()string

"alice@smith.com"; for display purposes only (provider is not listed)

func (UserProfileView)MarshalJSON ¶added inv1.48.0

func (vUserProfileView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (UserProfileView)MarshalJSONTo ¶added inv1.88.0

func (vUserProfileView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (UserProfileView)ProfilePicURL ¶added inv1.48.0

func (vUserProfileView) ProfilePicURL()string

func (*UserProfileView)UnmarshalJSON ¶added inv1.48.0

func (v *UserProfileView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*UserProfileView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *UserProfileView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (UserProfileView)Valid ¶added inv1.48.0

func (vUserProfileView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeUserView ¶added inv1.26.0

type UserView struct {// contains filtered or unexported fields}

UserView provides a read-only view over User.

Its methods should only be called if `Valid()` returns true.

func (UserView)AsStruct ¶added inv1.26.0

func (vUserView) AsStruct() *User

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (UserView)Created ¶added inv1.26.0

func (vUserView) Created()time.Time

func (UserView)DisplayName ¶added inv1.26.0

func (vUserView) DisplayName()string

if non-empty overrides Login field

func (UserView)ID ¶added inv1.26.0

func (vUserView) ID()UserID

func (UserView)MarshalJSON ¶added inv1.26.0

func (vUserView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (UserView)MarshalJSONTo ¶added inv1.88.0

func (vUserView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (UserView)ProfilePicURL ¶added inv1.26.0

func (vUserView) ProfilePicURL()string

if non-empty overrides Login field

func (*UserView)UnmarshalJSON ¶added inv1.26.0

func (v *UserView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*UserView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *UserView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (UserView)Valid ¶added inv1.26.0

func (vUserView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeVIPService ¶added inv1.78.0

type VIPService struct {// Name is the name of the service. The Name uniquely identifies a service// on a particular tailnet, and so also corresponds uniquely to the pair of// IP addresses belonging to the VIP service.NameServiceName// Ports specify which ProtoPorts are made available by this node// on the service's IPs.Ports []ProtoPortRange// Active specifies whether new requests for the service should be// sent to this node by control.Activebool}

VIPService represents a service created on a tailnet from theperspective of a node providing that service. These serviceshave an virtual IP (VIP) address pair distinct from the node's IPs.

func (*VIPService)Clone ¶added inv1.84.0

func (src *VIPService) Clone() *VIPService

Clone makes a deep copy of VIPService.The result aliases no memory with the original.

func (*VIPService)View ¶added inv1.84.0

func (p *VIPService) View()VIPServiceView

View returns a read-only view of VIPService.

typeVIPServiceView ¶added inv1.84.0

type VIPServiceView struct {// contains filtered or unexported fields}

VIPServiceView provides a read-only view over VIPService.

Its methods should only be called if `Valid()` returns true.

func (VIPServiceView)Active ¶added inv1.84.0

func (vVIPServiceView) Active()bool

Active specifies whether new requests for the service should besent to this node by control.

func (VIPServiceView)AsStruct ¶added inv1.84.0

func (vVIPServiceView) AsStruct() *VIPService

AsStruct returns a clone of the underlying value which aliases no memory withthe original.

func (VIPServiceView)MarshalJSON ¶added inv1.84.0

func (vVIPServiceView) MarshalJSON() ([]byte,error)

MarshalJSON implementsjsonv1.Marshaler.

func (VIPServiceView)MarshalJSONTo ¶added inv1.88.0

func (vVIPServiceView) MarshalJSONTo(enc *jsontext.Encoder)error

MarshalJSONTo implementsjsonv2.MarshalerTo.

func (VIPServiceView)Name ¶added inv1.84.0

func (vVIPServiceView) Name()ServiceName

Name is the name of the service. The Name uniquely identifies a serviceon a particular tailnet, and so also corresponds uniquely to the pair ofIP addresses belonging to the VIP service.

func (VIPServiceView)Ports ¶added inv1.84.0

func (vVIPServiceView) Ports()views.Slice[ProtoPortRange]

Ports specify which ProtoPorts are made available by this nodeon the service's IPs.

func (*VIPServiceView)UnmarshalJSON ¶added inv1.84.0

func (v *VIPServiceView) UnmarshalJSON(b []byte)error

UnmarshalJSON implementsjsonv1.Unmarshaler.

func (*VIPServiceView)UnmarshalJSONFrom ¶added inv1.88.0

func (v *VIPServiceView) UnmarshalJSONFrom(dec *jsontext.Decoder)error

UnmarshalJSONFrom implementsjsonv2.UnmarshalerFrom.

func (VIPServiceView)Valid ¶added inv1.84.0

func (vVIPServiceView) Valid()bool

Valid reports whether v's underlying value is non-nil.

typeWebClientAuthResponse ¶added inv1.52.0

type WebClientAuthResponse struct {// ID is a unique identifier for the session auth request.// It can be supplied to "/machine/webclient/wait" to pause until// the session authentication has been completed.IDstring `json:",omitzero"`// URL is the link for the user to visit to authenticate the session.//// When empty, there is no action for the user to take.URLstring `json:",omitzero"`// Complete is true when the session authentication has been completed.Completebool `json:",omitzero"`}

WebClientAuthResponse is the response to a web client authentication requestsent to "/machine/webclient/action" or "/machine/webclient/wait".See client/web for usage.

Source Files¶

View all Source files

?	: This menu
/	: Search site
f orF	: Jump to
y orY	: Canonical URL

Movatterモバイル変換

Details

Repository

Links

Documentation¶

Overview¶

Index¶

Constants¶

Variables¶

Functions¶

funcCheckTag¶added inv0.98.1

funcClone¶added inv1.2.0

funcIsKnownServiceProto¶added inv1.76.0

funcUnmarshalCapJSON¶added inv1.48.0

funcUnmarshalCapViewJSON¶added inv1.82.0

funcUnmarshalNodeCapJSON¶added inv1.50.0

funcUnmarshalNodeCapViewJSON¶added inv1.82.0

Types¶

typeAttrUpdate¶added inv1.80.0

typeAuditLogRequest¶added inv1.82.0

typeC2NAppConnectorDomainRoutesResponse¶added inv1.54.0

typeC2NDebugNetmapRequest¶added inv1.90.0

typeC2NDebugNetmapResponse¶added inv1.90.0

typeC2NPostureIdentityResponse¶added inv1.52.0

typeC2NSSHUsernamesRequest¶added inv1.32.0

typeC2NSSHUsernamesResponse¶added inv1.32.0

typeC2NTLSCertInfo¶added inv1.56.0

typeC2NUpdateResponse¶added inv1.50.0

typeC2NVIPServicesResponse¶added inv1.80.0

typeCapGrant¶added inv1.24.0

typeCapabilityVersion¶added inv1.24.0

typeClientAuditAction¶added inv1.82.0

typeClientVersion¶added inv1.34.0

typeControlDialPlan¶added inv1.32.0

func (*ControlDialPlan)Clone¶added inv1.32.0

func (*ControlDialPlan)View¶added inv1.32.0

typeControlDialPlanView¶added inv1.32.0

func (ControlDialPlanView)AsStruct¶added inv1.32.0

func (ControlDialPlanView)Candidates¶added inv1.32.0

func (ControlDialPlanView)MarshalJSON¶added inv1.32.0

func (ControlDialPlanView)MarshalJSONTo¶added inv1.88.0

func (*ControlDialPlanView)UnmarshalJSON¶added inv1.32.0

func (*ControlDialPlanView)UnmarshalJSONFrom¶added inv1.88.0

func (ControlDialPlanView)Valid¶added inv1.32.0

typeControlIPCandidate¶added inv1.32.0

typeDERPAdmitClientRequest¶added inv1.62.0

typeDERPAdmitClientResponse¶added inv1.62.0

typeDERPHomeParams¶added inv1.46.0

func (*DERPHomeParams)Clone¶added inv1.46.0

func (*DERPHomeParams)View¶added inv1.46.0

typeDERPHomeParamsView¶added inv1.46.0

func (DERPHomeParamsView)AsStruct¶added inv1.46.0

func (DERPHomeParamsView)MarshalJSON¶added inv1.46.0

func (DERPHomeParamsView)MarshalJSONTo¶added inv1.88.0

func (DERPHomeParamsView)RegionScore¶added inv1.46.0

func (*DERPHomeParamsView)UnmarshalJSON¶added inv1.46.0

func (*DERPHomeParamsView)UnmarshalJSONFrom¶added inv1.88.0

func (DERPHomeParamsView)Valid¶added inv1.46.0

typeDERPMap¶added inv0.98.1

func (*DERPMap)Clone¶added inv1.10.0

func (*DERPMap)RegionIDs¶added inv0.98.1

func (*DERPMap)View¶added inv1.26.0

typeDERPMapView¶added inv1.26.0

func (DERPMapView)AsStruct¶added inv1.26.0

func (DERPMapView)HomeParams¶added inv1.46.0

func (DERPMapView)MarshalJSON¶added inv1.26.0

func (DERPMapView)MarshalJSONTo¶added inv1.88.0

func (DERPMapView)OmitDefaultRegions¶added inv1.26.0

func (DERPMapView)Regions¶added inv1.26.0

func (*DERPMapView)UnmarshalJSON¶added inv1.26.0

func (*DERPMapView)UnmarshalJSONFrom¶added inv1.88.0

func (DERPMapView)Valid¶added inv1.26.0

typeDERPNode¶added inv0.98.1

func (*DERPNode)Clone¶added inv1.10.0

func (*DERPNode)IsTestNode¶added inv1.66.0

func (*DERPNode)View¶added inv1.26.0

typeDERPNodeView¶added inv1.26.0

func (DERPNodeView)AsStruct¶added inv1.26.0

func (DERPNodeView)CanPort80¶added inv1.40.0

func (DERPNodeView)CertName¶added inv1.26.0

Documentation ¶

funcCheckTag ¶added inv0.98.1

funcClone ¶added inv1.2.0

funcIsKnownServiceProto ¶added inv1.76.0

funcUnmarshalCapJSON ¶added inv1.48.0

funcUnmarshalCapViewJSON ¶added inv1.82.0

funcUnmarshalNodeCapJSON ¶added inv1.50.0

funcUnmarshalNodeCapViewJSON ¶added inv1.82.0

typeAttrUpdate ¶added inv1.80.0

typeAuditLogRequest ¶added inv1.82.0

typeC2NAppConnectorDomainRoutesResponse ¶added inv1.54.0

typeC2NDebugNetmapRequest ¶added inv1.90.0

typeC2NDebugNetmapResponse ¶added inv1.90.0

typeC2NPostureIdentityResponse ¶added inv1.52.0

typeC2NSSHUsernamesRequest ¶added inv1.32.0

typeC2NSSHUsernamesResponse ¶added inv1.32.0

typeC2NTLSCertInfo ¶added inv1.56.0

typeC2NUpdateResponse ¶added inv1.50.0

typeC2NVIPServicesResponse ¶added inv1.80.0

typeCapGrant ¶added inv1.24.0

typeCapabilityVersion ¶added inv1.24.0

typeClientAuditAction ¶added inv1.82.0

typeClientVersion ¶added inv1.34.0

typeControlDialPlan ¶added inv1.32.0

func (*ControlDialPlan)Clone ¶added inv1.32.0

func (*ControlDialPlan)View ¶added inv1.32.0

typeControlDialPlanView ¶added inv1.32.0

func (ControlDialPlanView)AsStruct ¶added inv1.32.0

func (ControlDialPlanView)Candidates ¶added inv1.32.0

func (ControlDialPlanView)MarshalJSON ¶added inv1.32.0

func (ControlDialPlanView)MarshalJSONTo ¶added inv1.88.0

func (*ControlDialPlanView)UnmarshalJSON ¶added inv1.32.0

func (*ControlDialPlanView)UnmarshalJSONFrom ¶added inv1.88.0

func (ControlDialPlanView)Valid ¶added inv1.32.0

typeControlIPCandidate ¶added inv1.32.0

typeDERPAdmitClientRequest ¶added inv1.62.0

typeDERPAdmitClientResponse ¶added inv1.62.0

typeDERPHomeParams ¶added inv1.46.0

func (*DERPHomeParams)Clone ¶added inv1.46.0

func (*DERPHomeParams)View ¶added inv1.46.0

typeDERPHomeParamsView ¶added inv1.46.0

func (DERPHomeParamsView)AsStruct ¶added inv1.46.0

func (DERPHomeParamsView)MarshalJSON ¶added inv1.46.0

func (DERPHomeParamsView)MarshalJSONTo ¶added inv1.88.0

func (DERPHomeParamsView)RegionScore ¶added inv1.46.0

func (*DERPHomeParamsView)UnmarshalJSON ¶added inv1.46.0

func (*DERPHomeParamsView)UnmarshalJSONFrom ¶added inv1.88.0

func (DERPHomeParamsView)Valid ¶added inv1.46.0

typeDERPMap ¶added inv0.98.1

func (*DERPMap)Clone ¶added inv1.10.0

func (*DERPMap)RegionIDs ¶added inv0.98.1

func (*DERPMap)View ¶added inv1.26.0

typeDERPMapView ¶added inv1.26.0

func (DERPMapView)AsStruct ¶added inv1.26.0

func (DERPMapView)HomeParams ¶added inv1.46.0

func (DERPMapView)MarshalJSON ¶added inv1.26.0

func (DERPMapView)MarshalJSONTo ¶added inv1.88.0

func (DERPMapView)OmitDefaultRegions ¶added inv1.26.0

func (DERPMapView)Regions ¶added inv1.26.0

func (*DERPMapView)UnmarshalJSON ¶added inv1.26.0

func (*DERPMapView)UnmarshalJSONFrom ¶added inv1.88.0

func (DERPMapView)Valid ¶added inv1.26.0

typeDERPNode ¶added inv0.98.1

func (*DERPNode)Clone ¶added inv1.10.0

func (*DERPNode)IsTestNode ¶added inv1.66.0

func (*DERPNode)View ¶added inv1.26.0

typeDERPNodeView ¶added inv1.26.0

func (DERPNodeView)AsStruct ¶added inv1.26.0

func (DERPNodeView)CanPort80 ¶added inv1.40.0

func (DERPNodeView)CertName ¶added inv1.26.0

func (DERPNodeView)DERPPort ¶added inv1.26.0

func (DERPNodeView)HostName ¶added inv1.26.0

func (DERPNodeView)IPv4 ¶added inv1.26.0

func (DERPNodeView)IPv6 ¶added inv1.26.0

func (DERPNodeView)InsecureForTests ¶added inv1.26.0

func (DERPNodeView)MarshalJSON ¶added inv1.26.0

func (DERPNodeView)MarshalJSONTo ¶added inv1.88.0

func (DERPNodeView)Name ¶added inv1.26.0

func (DERPNodeView)RegionID ¶added inv1.26.0

func (DERPNodeView)STUNOnly ¶added inv1.26.0