or returns 0 on no match

getHostKeys returns the SSH host key signers, generating an ed25519 key in ~/.config/tailcat/ssh/ if one doesn't exist.

initLocked builds the client's network stack (WireGuard engine and netstack) on first use, with defaults for unset config fields. It does no network a

loginShell returns the user's login shell.

nodeHasAddr reports whether ip is one of n's tailcat addresses.

nodePublicAsDiscoPublic converts a NodePublic to a DiscoPublic by reusing the same raw key bytes. This is used in tailcat where the server's node publ

onMeow handles a MeowPing from the client with node key src and disco key discoPub, adding it as a WireGuard peer. It reports whether the client is al

ping sends a single meow ping and waits for the meowed ack. The client must be started.

pingUntil retries the meow/meowed handshake until it succeeds or ctx expires. The first pings can be lost while either side's DERP connection is still

portRanges coalesces the ascending-sorted ports into contiguous port ranges.

renumberRegion returns a copy of dm with its single region 1 renumbered to newID. Tests pass an arbitrary ID (at most the DERP maximum of 999) so that

runWithPTY runs cmd attached to a pseudo-terminal.

runWithPipes runs cmd with stdin/stdout/stderr pipes (no PTY).

sshClient dials the server's SSH port and returns a connected gossh.Client.

tailcatDial connects to a tailcat server and dials one TCP stream over the tunnel. It takes one options object argument: { addr: string, /

tailcatListen starts a tailcat server in the browser. It takes one options object argument: { derpMapURL: string, // absolute URL of the JS

tcpipStackOf returns ns's unexported gVisor *stack.Stack. TODO(bradfitz): add an exported accessor to wgengine/netstack.Impl upstream and delete this

versionString returns the version set at release build time, falling back to the module version from the Go build info.

HandleTailscaleSSHConn handles an incoming TCP connection as an SSH session. Authentication is not required — the WireGuard tunnel provides identity.

MarshalBinary implements encoding.BinaryMarshaler for CBOR serialization, encoding the raw 32-byte key without the "nodekey:" text prefix.

NewClient returns a client that will connect to the server identified by the given token. It is shorthand for &Client{Server: server}; see [Client] fo

PickBestRegion is a stub for js/wasm, where netcheck's STUN probes are unavailable (browsers can't send raw UDP). It always returns 0, which makes [Co

SupportsSSHServer reports whether the platform supports running the built-in auth-free SSH server.

TestBrowserReceives has the browser listen and a Go tailcat client send it random bytes, netcat style, verifying the browser received exactly what was

TestBrowserReceivesTextUI has the browser listen with the regular interface (not the test-mode hash sink), sends it text from a Go tailcat client, cli

TestBrowserSends has a Go tailcat server listen and the browser dial it and send random bytes, verifying the server received exactly what the browser

TestBrowserSendsTextUI drives the send form like a user: it types an address and a message into the page, clicks "Send text", and verifies a Go tailca

TestFetchDERPMapMemoryCache verifies the default in-memory DERP map cache: a second fetch of the same URL within the freshness window makes no network

TestHalfClose tests that a client's write shutdown (CloseWrite) propagates through the server's TCP proxying as a half-close rather than tearing down

TestPipeMode runs the built tailcat binary in its two stdin/stdout pipe modes against a local DERP server, emulating a pipeline like "tailcat | tar -z

TestSOCKSClientKey verifies that "tailcat socks" presents the --key client identity rather than a fresh ephemeral node key, by connecting to a server

TestWireFieldNames verifies that every field of every wire type has a CBOR field name matching wireFieldNames, so that the same Go field name always g

TestWireRegionRoundTrip tests the mapping between the upstream tailcfg DERP types (as fetched from the control plane's DERP map) and tailcat's wire ty

UnmarshalBinary implements encoding.BinaryUnmarshaler for CBOR deserialization.

lookupNetIP resolves host using the local resolver, for [classifySOCKSAddr].

onEngineStatus is the wgengine status callback. It watches for changes to our magicsock UDP endpoints (learned via STUN and from local interfaces) and

peerAllowedIPs returns the prefixes that the peer with public key k is allowed to originate traffic from. It is the engine's per-peer WireGuard config

peerForIP is the [wgengine.Engine.SetPeerForIPFunc] callback, mapping a tailcat IPv6 address to its node in the network map. The engine uses it to fin

sessionHandler handles a single SSH session (shell or exec).