Repository navigation
Conversation
tailcat turned netns off on every platform, so its sockets followed the system route table. On a Mac running the Tailscale app with an exit node selected, that table sends tailcat's own WireGuard UDP and DERP connections into the app's tunnel, and tailcat's direct path then runs inside it. On macOS netns binds sockets to the default physical interface, as tailscaled does, and loopback UDP still works from sockets bound that way, so leave it on there. Other platforms keep it off, as configureNetNS explains. Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Fixes tailscale#165 Signed-off-by: Hyunwoo Jung <chaosphch@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #165
tailcat turned netns off on every platform, so its sockets followed the system route table. On a Mac running the Tailscale app with an exit node selected, that table sends tailcat's own WireGuard UDP and DERP connections into the app's tunnel, and large responses over the resulting tunnel-in-tunnel path stalled for minutes to hours. #165 has the details and measurements.
This leaves netns on for macOS, where it binds sockets to the default physical interface as tailscaled does. Loopback UDP still works from sockets bound that way on macOS, so the loopback DERP map concern that
PickBestRegiondocumented applies to Linux only. Other platforms keep netns off.Testing:
TestNetNSPolicystarts aServerand checks the netns policy. On macOS it fails on main (netns binds sockets = false; want true) and passes with this change.go test ./...passes on macOS 27.2 (arm64) and Ubuntu 22.04 (amd64). On macOS the root package takes the same time as on main, about 4.6 s.go vetfor linux, darwin and windows; release builds for windows/amd64 and darwin/arm64; aGOOS=jsbuild of the root package.tailcat socksclient built from main kept its UDP socket and DERP connection on utun5 and stayed on DERP. Built from this branch, it put them on en0 and got a direct path, and the server saw the client's own public IP. 3 MB downloads took 3.6–8.0 s with main and 0.5–1.8 s with this branch.🤖 Generated with Claude Code