Question 1

How do I fix tailcat perf returning "no reply to pings" with a whole-second --timeout for a relayed DERP path?

Accepted Answer

This is a timeout-boundary bug in `waitForDirectPath`: with whole-second timeouts such as `--timeout=5s` or the default `10s`, the last ping can leave about 1 second until the deadline, so the code waits another second and starts the next probe after the deadline, discarding the relayed path that already replied.

Temporary workaround: use a fractional timeout, for example:

```bash
tailcat --json perf --via-derp --timeout=5.5s <tc-addr>
```

Permanent fix: update `tailcat` to a build containing the fix on the `perf-relayed-path` branch. The fix retains the last measured path and returns it when the deadline expires after at least one pong; `no reply to pings` is reported only when no pong was received. Without `--via-derp`, tailcat should then report the intended refusal instead of a ping timeout.

Question 2

How to fix the Nix tailcat build error: "go.mod requires go >= 1.27.1 (running go 1.27.0; GOTOOLCHAIN=local)"?

Accepted Answer

The build fails because tailcat commit `9148b22` requires Go 1.27.1, while the flake's nixpkgs revision provides `go_1_27` 1.27.0. With `GOTOOLCHAIN=local`, Nix cannot automatically download another Go toolchain. Update to the tailcat revision containing the "Fix, test nix flake" PR; it builds Go 1.27.1 from source, refreshes the stale vendor hash, and skips a test that is flaky in the Nix sandbox. Rebuild with `nix build github:tailscale/tailcat --refresh`. If tailcat is an input in your own flake, run `nix flake lock --update-input tailcat`, then rebuild. For the old revision, temporarily point the flake at a nixpkgs revision where `pkgs.go_1_27` is 1.27.1, or override `pkgs.go_1_27` to 1.27.1.

Question 3

How can a Tailcat `no-auth-ssh` process identify the authenticated peer node key?

Accepted Answer

Upgrade to a Tailcat release containing PR #89. For connections accepted by `--allow`, Tailcat sets `TAILCAT_PEER_KEY` in the environment of the served subprocess. Read it directly, for example in Go with `os.Getenv("TAILCAT_PEER_KEY")`. This removes the need to run a separate SSH daemon or require a second SSH key just to identify the peer. Embedded Go programs can also use `Server.PeerKey`; PR #88 adds separate SSH public key support when user-level SSH keys are required.

Question 4

How can I detect whether a tailcat client connection is direct or relayed through DERP when Server.Status() returns an empty Peer map?

Accepted Answer

This is fixed by making `locoBackend.Status()` request peer data. The zero-value `ipnstate.StatusBuilder` leaves `WantPeers` false, so both magicsock and wgengine skip their peer loops. Update to a tailcat build containing the fix for #116, or apply the one-line patch:

```go
func (b *locoBackend) Status() *ipnstate.Status {
	mc := b.sys.MagicSock.Get()
	eng := b.sys.Engine.Get()

var sb ipnstate.StatusBuilder
	sb.WantPeers = true // required to populate Status.Peer

mc.UpdateStatus(&sb)
	eng.UpdateStatus(&sb)
	return sb.Status()
}
```

Then inspect the peer status for the connected node:

```go
st := s.Status()
p := st.Peer[peerKey]

switch {
case p.CurAddr != "":
	// Direct UDP path; p.CurAddr is the active endpoint address.
case p.Relay != "":
	// Relayed through DERP; p.Relay identifies the relay.
default:
	// No active path information yet.
}
```

To map an accepted connection to its `key.NodePublic`, use the added `Server.PeerKey` accessor rather than relying on `RemoteAddr()`. Tracking only `RemoteAddr()` cannot distinguish a direct path from a DERP relay.

Question 5

How do I secure a tailcat SSH server whose address is published in a public DNS TXT record?

Accepted Answer

Treat a tailcat address published in public DNS as compromised: it contains the tunnel's pre-shared key, so anyone who queries the TXT record can connect. Do not use `tailcat serve no-auth-ssh` with a public DNS record. Require client authentication by starting the server with `--allow ` to restrict tunnel access, or use `tailcat serve ssh --ssh-authorized-keys ` to enforce SSH key authentication. If an unauthenticated address was already published, remove or replace the DNS TXT record, rotate/reissue the tailcat address or pre-shared key, and verify that connections from unapproved node or SSH keys are rejected.

tailcat

Core Features

What It Can't Do

Use Cases

Tags

Getting Started

Similar Projects