Close shuts down the server, closing the WireGuard engine and DERP connections.

Get returns the previously stored DERP map response for url: its raw JSON, the server's ETag (or ""), and when it was stored. It returns ok == false i

Start connects to the DERP relay and begins accepting clients, first picking defaults for any unset configuration fields: a new ephemeral key, log.Pri

ConnBlob returns the token that clients use to connect to this server. It embeds the full DERP region, so clients don't need to fetch the DERP map fro

DialTCPPort opens a TCP connection to the given port on the server. See [Client.Dial] for the lazy startup behavior.

Ping starts the client if needed (see [Client.Dial] for the lazy startup behavior), sends a meow ping to the server via DERP, and waits for the meowed

Addr returns the server's IPv6 address derived from its public key. It must only be called after [Server.Start].

Close shuts down the client, closing the WireGuard engine and DERP connections.

Expand populates ci.Region from a DERP map if only ci.RegionID was set. If ci.Region is already populated, Expand is a no-op. When RegionID is -1, the

ParseConnBlob decodes a [ConnBlob] back into a [ConnInfo], restoring fields that were stripped during encoding (RegionID, RegionCode, node names).

Handler returns an HTTP handler serving the web app from dist, a filesystem containing the files built by wasmbuild.Dist: index.html at "/", app.js, w

PingForTest waits for the client's DERP connection and performs the meow/meowed handshake.

addrBlobArg interprets a CLI destination argument as either a "tc"-prefixed address blob or a DNS name whose "tailcat=" TXT record holds one. A dot ca

launchChrome boots a headless Chrome under chromedp and returns a context whose cancellation tears down the browser.

bytes sent in each direction's test

newWebServer serves the web app's freshly built dist directory via webdemo.Handler (the same handler production servers use), plus a same-origin /derp

preflight skips the test unless --run-headless-browser-tests is set, and returns the path to a Chromium-family binary, failing the test if none is fou

up ensures the client is started and the server has acknowledged us as a peer, performing the meow handshake on first use. Dial methods call it so tha

DialTCP opens a TCP connection to an arbitrary IP:port through the server, which must be configured as an exit node (see [Server.OnTCPForward]). IPv4

Dist builds the complete set of static files a server needs to serve the web app: main.wasm (compiled from the Go package in webDir, with precompresse

advertiseEndpoints sends our current UDP endpoints to every known peer in a disco CallMeMaybe message over DERP, the same message the control plane fl

makePromise runs f on a new goroutine and returns a JavaScript Promise of its result, rejected with a JavaScript Error if f returns an error.

newClient returns a [tailcat.Client] configured with the global --derpmap-url flag and the disk DERP map cache.

nodePrivateAsDiscoPrivate converts a NodePrivate to a DiscoPrivate by reusing the same raw key bytes. This is used in tailcat where the server uses it

AddAllowedClient adds k as an allowed client. Until a key is allowed (here or via [Server.AllowedClients]), all clients are allowed.

ConnBlob serializes the ConnInfo into a compact [ConnBlob] string. It is encoded via the wire types (see wire.go), which drop the DERP region fields t

Dial opens a connection to the given network/address through the server's WireGuard tunnel. The address is resolved relative to the server. On a Clie

FetchDERPMap fetches and decodes the JSON DERP map. The opts may contain any of the following types: - [DERPMapURL]: fetch from an alternate URL inste

IsMeowPacket reports whether pkt starts with the meow magic prefix.

IsMeowedPacket reports whether pkt is a meowed (acknowledgment) packet.

NewPrivateKey returns a new PrivateKey, but without the DERP region populated. It's up to the caller to populate that.

PickBestRegion runs a netcheck over the DERP regions in dm and returns the region ID with the lowest latency. It returns 0 (and a nil error) if the ne

ProxyConns copies data between a and b in both directions until both sides have finished, then closes both connections. When one direction's copy fin

Status returns the current WireGuard and DERP connection status.

WaitForDERPForTest waits for the server's and client's DERP connections. Integration tests should use this instead of guessing how long startup takes.

classifySOCKSAddr decides where the SOCKS5 destination addr should be dialed. The magic hostname "server.tailcat" (or an empty host) means the tailcat

createEngine creates the wgengine.Engine with userspace networking.

derpRegion converts w back to a [tailcfg.DERPRegion].

ensureStarted brings up the client's network stack on first use: it resolves the server's DERP region if the ConnBlob didn't embed it (possibly fetchi

exitCode extracts the exit code from an exec error.

fetchDERPMap fetches and decodes the JSON DERP map from fetchURL, sending mode ("client" or "server") as the Tailcat-Mode hint header. If cache is nil

makeJSConn wraps a tunneled TCP connection as a JavaScript object: { port: number, read: () => Promise<Uint8Array|null>, // null on EOF; no co

nodeKeyLocked returns the client's effective node private key, resolving it from the Key field (or generating a fresh one) on first use. c.startMu mus

normalizeListenAddrPort fills in the missing parts of the --listen flag value s so it's a valid net.Listen address. A bare port means localhost on tha

parseWire decodes cb into its wire form, without restoring the fields that [ConnInfo.ConnBlob] elides.

peerByIP returns the public key of the peer that outbound packets addressed to dst should be sent to (see [wgengine.Engine.SetPeerByIPPacketFunc]).

sshDestHost returns the hostname to give the system ssh client as the connection destination for a tailcat ConnBlob. It is a short, deterministic func

sshProxyCommand returns the command passed to OpenSSH to connect the SSH client to a tailcat server. The command is run by OpenSSH, so values that can

wireRegionOf converts a [tailcfg.DERPRegion] (such as one from the control plane's DERP map) to its wire form. Fields tailcat doesn't use (Latitude, L

Build compiles the Go package in pkgDir for js/wasm and writes the binary to outPath.

DiscoPing sends a disco ping to the server and reports how the pong came back: the result's Endpoint field is set if it arrived over a direct path, el

DrainTCP waits until every TCP connection in the server's netstack has fully closed, meaning the peer has acknowledged all sent data and the final FIN

EncodeMeowPing encodes a meow ping packet containing the sender's node public key and disco public key.

EncodeMeowed encodes a meowed (acknowledgment) packet.

Equal reports whether a and b represent the same public key.

GoRoot returns the GOROOT of the go command in $PATH.

ParseConnBlobRaw decodes cb into its wire form, without restoring the implicit fields that [ParseConnBlob] synthesizes (region and node IDs, region co

ParseMeowPing parses a meow ping packet, returning the sender's node public key and disco public key. The pkt must have already been verified with IsM

PublicKey returns the client's node public key, generating the key first if the Key field is zero and the client hasn't yet been used.

Put stores the DERP map response for url, replacing any prior entry and marking it stored as of now. An empty etag means the server sent none.

Resolve returns a self-contained equivalent of b with the DERP relay's details embedded, so that later use of the blob requires no network access to f

SupportsSSHServer reports whether the platform supports running the built-in auth-free SSH server.

Tags returns the comma-joined -tags value for the wasm build, sorted so the same source tree always produces the same wasm bytes.

WasmExecJS returns the path to the Go toolchain's wasm_exec.js, the JavaScript support file needed to run Go wasm binaries.

acceptEnvPair reports whether the environment variable key=value pair should be accepted from the client (same default as OpenSSH AcceptEnv).

buildFilter returns the packet filter enforcing what the server is configured to serve: new inbound TCP connections are admitted only to the server's

compressWasm writes path.zst and path.gz next to path.

decodeDERPMap decodes a JSON DERP map, returning nil if data is empty or invalid.

defaultPath returns the default PATH for the given user.