Fix with_tailscale/with_cloudflared/with_masque builds, register legacy WireGuard outbound#32
Open
hiddifydeveloper wants to merge 4 commits into
Open
Fix with_tailscale/with_cloudflared/with_masque builds, register legacy WireGuard outbound#32hiddifydeveloper wants to merge 4 commits into
hiddifydeveloper wants to merge 4 commits into
Conversation
sing-cloudflared's ICMPHandler interface changed from a session-based RouteICMPConnection(ctx, session, routeContext, timeout) to RouteICMPFlow(source, destination) (tun.Port, error), matching upstream's PreMatch/JudgeFlow flow-routing model. Rewrites icmpRouterHandler accordingly, extracting a tun.Port from the router's PreMatchResult instead of a tun.DirectRouteDestination.
Several APIs the tailscale endpoint depended on were removed or reshaped upstream since hiddify's fork diverged: - adapter.DirectRouteOutbound (session-based PrepareConnection/ NewDirectRouteConnection) is gone, replaced by adapter.FlowOutbound (tun.Port + PreMatchFlow). Endpoint now backs its ICMP flow routing with sing-tun's ping.Port instead of the removed ping.ConnectDestination/ConnectGVisor helpers. - port.go's JudgeFlow/WritePackets implementation depended on wgEngine.InputPackets/SetReturnPath, which were never actually implemented anywhere in this tailscale fork (dead code). Replaced with a JudgeFlow that delegates to adapter.JudgeFlow after checking Tailscale's ACL filter, for the gVisor ICMPForwarder's traffic-from-peers path; the never-functional whole-packet TCP/UDP forwarding via wgEngine is dropped. - OutboundWithPreferredRoutes.PreferredAddress/PreferredDomain gained a *adapter.InboundContext parameter. - adapter.TailscaleEndpoint gained a Logout method, implemented via the fork's client/local.Client.Logout. - netns.SetControlFunc was removed; only the Android protect-func path has a replacement (netns.SetAndroidProtectFunc, split into netns_android.go/netns_stub.go since it's Android-build-tagged in the fork). The non-Android auto-redirect-mark control path has no replacement and is dropped (documented inline). - tsnet.Server.PeerDNSQueryHandler was removed with no replacement hook; peer DNS queries no longer route through dnsRouter (dead code left in place, documented, pending a new hook upstream). - LocalBackend.SetExternalSSHHostKeys (tailssh) was removed; peer status no longer reports the custom SSH server's host key.
tun.NewICMPForwarder dropped its context/timeout parameters in favor of (stack, handler, logger), matching the cloudflare and tailscale ICMP forwarder fixes.
…ed up) protocol/wireguard.RegisterOutbound existed but had no call site in include/registry.go, so configs using it always hit upstream's deliberate "WireGuard outbound is deprecated... use WireGuard endpoint instead" stub registered under the same "wireguard" type name. Registers it under a new "wireguard_legacy" type instead of overriding upstream's stub, so existing deprecation messaging for "wireguard" stays intact and adopting the legacy outbound is an explicit opt-in.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #31 (merged before these 4 commits were pushed). Fixes build breaks in tag-gated packages that plain
go build ./...doesn't cover, plus a real registration bug found during protocol testing.What's fixed
sing-cloudflared'sICMPHandlerinterface changed from session-basedRouteICMPConnectiontoRouteICMPFlow(source, destination) (tun.Port, error). Rewired to extract atun.Portfrom the router'sPreMatchResult.adapter.DirectRouteOutboundis gone, replaced byadapter.FlowOutbound(tun.Port+PreMatchFlow). ICMP flow routing now backs ontosing-tun'sping.Port. Also fixedPreferredAddress/PreferredDomainsignatures, added the requiredLogoutmethod, and stubbed three hooks with no current upstream replacement —netns.SetControlFunc(only Android protect-func has one now),tsnet.Server.PeerDNSQueryHandler,LocalBackend.SetExternalSSHHostKeys— each documented inline.tun.NewICMPForwardersignature drift as cloudflare/tailscale."wireguard"name. Registered under a newwireguard_legacytype instead of overriding the stub.Note: full-tag builds need the
badlinknametag dropped on Go 1.25.6 — pre-existing upstreamcrypto/tlslinkname fragility, unrelated to this PR (confirmedcommon/badtlsuntouched by any commit here).Test plan
go buildwith fullrelease/DEFAULT_BUILD_TAGS(minusbadlinkname) succeedsgo vetclean under the same tag set (aside from pre-existing upstream-only issues in untouched files)sing-box checkagainst configs for every ported protocol (WireGuard+Noise, AmneziaWG, WARP, VLESS+XHTTP, VLESS+Vision, mieru, snell, psiphon, balancer, hinvalid, dnstt, gooserelay, tunnel_client, SSH in/outbound, legacy WireGuard outbound, MASQUE, monitoring, proxyproto, cloudflared inbound, smart_dns_pool) — all construct/start/stop cleanly