From b232b6fa10ad50f98db8aa37485f0e5b983f6c26 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 7 Mar 2025 11:21:13 -0800
Subject: [PATCH] tailscale: fix darwin build

Fixes #387340
---
 pkgs/by-name/ta/tailscale/package.nix | 78 +++++++++++++++++----------
 1 file changed, 50 insertions(+), 28 deletions(-)

diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index 8598867513ec..66802c248405 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -16,6 +16,8 @@
   procps,
   # runtime tooling - darwin
   lsof,
+  # check phase tooling - darwin
+  unixtools,
 
   nixosTests,
   tailscale-nginx-auth,
@@ -56,6 +58,10 @@ buildGoModule {
     installShellFiles
   ];
 
+  nativeCheckInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    unixtools.netstat
+  ];
+
   env.CGO_ENABLED = 0;
 
   subPackages = [
@@ -88,6 +94,10 @@ buildGoModule {
     rm -rf ./tool
   '';
 
+  # Tests start http servers which need to bind to local addresses:
+  # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted
+  __darwinAllowLocalNetworking = true;
+
   preCheck = ''
     # feed in all tests for testing
     # subPackages above limits what is built to just what we
@@ -100,39 +110,51 @@ buildGoModule {
 
   checkFlags =
     let
-      skippedTests = [
-        # dislikes vendoring
-        "TestPackageDocs" # .
-        # tries to start tailscaled
-        "TestContainerBoot" # cmd/containerboot
+      skippedTests =
+        [
+          # dislikes vendoring
+          "TestPackageDocs" # .
+          # tries to start tailscaled
+          "TestContainerBoot" # cmd/containerboot
 
-        # just part of a tool which generates yaml for k8s CRDs
-        # requires helm
-        "Test_generate" # cmd/k8s-operator/generate
-        # self reported potentially flakey test
-        "TestConnMemoryOverhead" # control/controlbase
+          # just part of a tool which generates yaml for k8s CRDs
+          # requires helm
+          "Test_generate" # cmd/k8s-operator/generate
+          # self reported potentially flakey test
+          "TestConnMemoryOverhead" # control/controlbase
 
-        # interacts with `/proc/net/route` and need a default route
-        "TestDefaultRouteInterface" # net/netmon
-        "TestRouteLinuxNetlink" # net/netmon
-        "TestGetRouteTable" # net/routetable
+          # interacts with `/proc/net/route` and need a default route
+          "TestDefaultRouteInterface" # net/netmon
+          "TestRouteLinuxNetlink" # net/netmon
+          "TestGetRouteTable" # net/routetable
 
-        # remote udp call to 8.8.8.8
-        "TestDefaultInterfacePortable" # net/netutil
+          # remote udp call to 8.8.8.8
+          "TestDefaultInterfacePortable" # net/netutil
 
-        # launches an ssh server which works when provided openssh
-        # also requires executing commands but nixbld user has /noshell
-        "TestSSH" # ssh/tailssh
-        # wants users alice & ubuntu
-        "TestMultipleRecorders" # ssh/tailssh
-        "TestSSHAuthFlow" # ssh/tailssh
-        "TestSSHRecordingCancelsSessionsOnUploadFailure" # ssh/tailssh
-        "TestSSHRecordingNonInteractive" # ssh/tailssh
+          # launches an ssh server which works when provided openssh
+          # also requires executing commands but nixbld user has /noshell
+          "TestSSH" # ssh/tailssh
+          # wants users alice & ubuntu
+          "TestMultipleRecorders" # ssh/tailssh
+          "TestSSHAuthFlow" # ssh/tailssh
+          "TestSSHRecordingCancelsSessionsOnUploadFailure" # ssh/tailssh
+          "TestSSHRecordingNonInteractive" # ssh/tailssh
 
-        # test for a dev util which helps to fork golang.org/x/crypto/acme
-        # not necessary and fails to match
-        "TestSyncedToUpstream" # tempfork/acme
-      ];
+          # test for a dev util which helps to fork golang.org/x/crypto/acme
+          # not necessary and fails to match
+          "TestSyncedToUpstream" # tempfork/acme
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # syscall default route interface en0 differs from netstat
+          "TestLikelyHomeRouterIPSyscallExec" # net/netmon
+
+          # Even with __darwinAllowLocalNetworking this doesn't work.
+          # panic: write udp [::]:59507->127.0.0.1:50830: sendto: operation not permitted
+          "TestUDP" # net/socks5
+
+          # portlist_test.go:81: didn't find ephemeral port in p2 53643
+          "TestPoller" # portlist
+        ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];