Stamp the git tag or short commit into the binary (closes #10 )

rtnetmon had no version. main.Version is now set at link time and logged in the first startup line. The Dockerfile takes it from the VERSION build argument when one is given, otherwise from `git describe --tags --always` of the .git the build context now carries, and fails the build if the context carries .git and no version comes out. .dockerignore follows the canonical copy: .git is sent, .git/config, which can hold a credential, is not. Model: opus-5-5
2026-10-02 06:24:22 +00:00
6 changed files with 69 additions and 257 deletions
@@ -5,8 +5,6 @@
 # below are thin shims that call them.
 .DEFAULT_GOAL := check

-VERSION ?= $(shell git describe --tags --always)
-
 bootstrap:
 	@script/bootstrap

@@ -38,14 +36,13 @@ hooks:
 	@script/install-precommit

 build:
-	CGO_ENABLED=0 go build -trimpath -ldflags "-X main.Version=$(VERSION)" \
-		-o bin/rtnetmon ./cmd/rtnetmon
+	CGO_ENABLED=0 go build -trimpath -o bin/rtnetmon ./cmd/rtnetmon

 run: build
 	./bin/rtnetmon

 dev:
-	go run -ldflags "-X main.Version=$(VERSION)" ./cmd/rtnetmon
+	go run ./cmd/rtnetmon

 deps:
 	go mod download
@@ -46,27 +46,22 @@ single pane.
 setup, unchanged. When neither exists, the single default-route interface is
 monitored instead.

-**macOS.** The physical internet interface is found from the default route. The
-VPN pane appears only while a VPN is connected, meaning its `utun` tunnel
-carries the IPv4 default route: in `netstat -rn -f inet` that is a `default` row
-on the tunnel, or both a `0/1` and a `128.0/1` row on it, which some VPN clients
-install instead of replacing the default. That tunnel is then monitored as the
-primary pane alongside the physical interface. A tunnel that is up without the
-default route is ignored, whatever its address: Tailscale without an exit node,
-or a tunnel a disconnected client left behind. A default route scoped to the
-tunnel alone (flag `I`) does not count either. With no VPN connected, only the
-physical interface is monitored. Interface names are detected on macOS; the
+**macOS.** The physical internet interface is found from the default route. When
+a VPN client is running (Mullvad and similar clients create a `utun` tunnel that
+carries a default route or holds a routable address), that tunnel is monitored
+as the primary pane alongside the physical interface. With no VPN running, only
+the physical interface is monitored. Interface names are detected on macOS; the
 `--ifaceA`/`--ifaceB` flags are not used there, but `--labelA`/`--labelB` still
 set the pane labels.

 ### Supported matrix

-| OS    | Interfaces monitored                                                  |
-| ----- | --------------------------------------------------------------------- |
-| Linux | `gu0` + `backhaul0` when both exist (two panes)                       |
-| Linux | the single default-route interface otherwise (one pane)               |
-| macOS | connected VPN tunnel + physical default-route interface (two panes)   |
-| macOS | the physical default-route interface with no VPN connected (one pane) |
+| OS    | Interfaces monitored                                        |
+| ----- | ----------------------------------------------------------- |
+| Linux | `gu0` + `backhaul0` when both exist (two panes)             |
+| Linux | the single default-route interface otherwise (one pane)     |
+| macOS | VPN tunnel + physical default-route interface (two panes)   |
+| macOS | the physical default-route interface with no VPN (one pane) |

 Anything outside this matrix — on Linux, only one of the named pair present, or
 no/multiple default routes when neither is present; on macOS, no default route
@@ -9,7 +9,7 @@ import (
 )

 // Version is the git tag or short commit, set at link time with -X by the
-// Makefile and the Dockerfile. Builds that do not set it report dev.
+// Dockerfile. Builds that do not set it report dev.
 var Version = "dev" //nolint:gochecknoglobals // set at link time with -X

 func main() {
@@ -41,14 +41,11 @@ type Interface struct {
 	IPv4 []string
 }

-// Route is one routing-table entry reduced to what detection needs. Scoped
-// marks a macOS interface-scoped route (flag I), which only traffic bound to
-// that interface uses.
+// Route is one routing-table entry reduced to what detection needs.
 type Route struct {
 	Iface   string
 	Gateway string
 	Default bool
-	Scoped  bool
 }

 // Pane names one interface to display, with its label.
@@ -136,7 +133,7 @@ func selectLinux(ifaces []Interface, routes []Route, f Flags) ([]Pane, error) {
 }

 // selectDarwin monitors the physical default-route interface, plus a VPN
-// tunnel as the primary pane while one is connected.
+// tunnel as the primary pane when one is running.
 func selectDarwin(ifaces []Interface, routes []Route, f Flags) ([]Pane, error) {
 	vpn := findVPN(ifaces, routes)

@@ -155,16 +152,15 @@ func selectDarwin(ifaces []Interface, routes []Route, f Flags) ([]Pane, error) {
 	}, nil
 }

-// findVPN returns the name of the connected VPN tunnel, or "" if there is
-// none. A tunnel is the VPN only while it carries the default route; one that
-// is merely up, even with a routable address (Tailscale without an exit node,
-// or a tunnel a disconnected client left behind), is not. A default route
-// scoped to the tunnel does not count: only traffic bound there uses it.
+// findVPN returns the name of a VPN tunnel interface, or "" if none is
+// running. A tunnel counts as a running VPN when it carries a default route,
+// or when it is up with a routable (non-link-local) IPv4 address. Idle system
+// tunnels have only a link-local IPv6 address and are skipped.
 func findVPN(ifaces []Interface, routes []Route) string {
 	routeIfaces := map[string]bool{}

 	for _, r := range routes {
-		if r.Default && !r.Scoped {
+		if r.Default {
 			routeIfaces[r.Iface] = true
 		}
 	}
@@ -180,6 +176,10 @@ func findVPN(ifaces []Interface, routes []Route) string {
 		if routeIfaces[ifi.Name] {
 			return ifi.Name
 		}
+
+		if ifi.Up && hasRoutableIPv4(ifi) {
+			return ifi.Name
+		}
 	}

 	return ""
@@ -219,8 +219,6 @@ func onlyPhysicalDefaultRoute(routes []Route, vpn string) (string, error) {

 // defaultRouteIfaces returns the sorted, unique interface names that carry a
 // default route, excluding the named VPN interface and any other tunnel.
-// Scoped routes count: while a VPN holds the default route, the physical
-// interface keeps only a default route scoped to itself.
 func defaultRouteIfaces(routes []Route, vpn string) []string {
 	seen := map[string]bool{}

@@ -257,6 +255,21 @@ func isTunnel(name string) bool {
 	return strings.HasPrefix(name, "utun")
 }

+// hasRoutableIPv4 reports whether the interface has an IPv4 address that is
+// neither loopback nor link-local.
+func hasRoutableIPv4(ifi Interface) bool {
+	for _, s := range ifi.IPv4 {
+		ip := net.ParseIP(s)
+		if ip == nil || ip.IsLoopback() || ip.IsLinkLocalUnicast() {
+			continue
+		}
+
+		return true
+	}
+
+	return false
+}
+
 // singleLabel is the label for a lone pane: the explicit --labelA if given,
 // otherwise a plain description.
 func singleLabel(f Flags) string {
@@ -327,47 +340,23 @@ func parseProcNetRoute(out string) []Route {
 	return routes
 }

-// parseNetstat reads `netstat -rn -f inet` output (macOS); the Netif column
-// (field 4) names the interface. A row whose destination is "default" is a
-// default route, scoped when its flags include I. A "0/1" row and a "128.0/1"
-// row on one interface together also make a default route there: VPN clients
-// that leave the physical default in place send all traffic through them.
+// parseNetstat reads `netstat -rn -f inet` output (macOS). Rows whose
+// destination is "default" are default routes; the Netif column (field 4)
+// names the interface.
 func parseNetstat(out string) []Route {
-	const columns = 4 // Destination, Gateway, Flags, Netif; Expire is optional
-
 	var routes []Route

-	var lowHalf []string // interfaces with a 0/1 row
-
-	highHalf := map[string]bool{} // interfaces with a 128.0/1 row
-
 	for _, line := range strings.Split(out, "\n") {
 		fields := strings.Fields(line)
-		if len(fields) < columns {
+		if len(fields) < 4 || fields[0] != "default" {
 			continue
 		}

-		dest, gateway, flags, iface := fields[0], fields[1], fields[2], fields[3]
-
-		switch dest {
-		case "default":
-			routes = append(routes, Route{
-				Iface:   iface,
-				Gateway: gateway,
-				Default: true,
-				Scoped:  strings.Contains(flags, "I"),
-			})
-		case "0/1":
-			lowHalf = append(lowHalf, iface)
-		case "128.0/1":
-			highHalf[iface] = true
-		}
-	}
-
-	for _, iface := range lowHalf {
-		if highHalf[iface] {
-			routes = append(routes, Route{Iface: iface, Default: true})
-		}
+		routes = append(routes, Route{
+			Iface:   fields[3],
+			Gateway: fields[1],
+			Default: true,
+		})
 	}

 	return routes
@@ -17,96 +17,13 @@ const (
 	ifaceEth0     = "eth0"
 	ifaceWlan0    = "wlan0"
 	ifaceEn0      = "en0"
-	ifaceUtun0    = "utun0"
-	ifaceUtun3    = "utun3"
 	ifaceUtun4    = "utun4"

 	labelGu      = "gu LAN - VPN outbound"
 	labelCox     = "Cox cable direct"
 	labelDefault = "default route"
-	labelVPN     = "VPN"

-	addrEn0       = "192.168.1.20"
-	addrVPN       = "10.64.0.2"
-	addrTailscale = "100.101.102.103"
-)
-
-// netstatHeader starts `netstat -rn -f inet` output on macOS. Each output
-// below adds the rows of one routing state: en0 is the physical interface,
-// utun3 is Tailscale's tunnel and utun4 a VPN client's.
-const netstatHeader = `Routing tables
-
-Internet:
-Destination        Gateway            Flags        Netif Expire`
-
-const (
-	netstatNoTunnel = netstatHeader + `
-default            192.168.1.1        UGScg          en0
-127                127.0.0.1          UCS            lo0
-127.0.0.1          127.0.0.1          UH             lo0
-192.168.1          link#6             UCS            en0      !
-192.168.1.1        a4:2b:b0:12:34:56  UHLWIir        en0   1187
-`
-
-	// Tailscale on without an exit node: routes for its own range only.
-	netstatTailscaleIdle = netstatHeader + `
-default            192.168.1.1        UGScg          en0
-100.64/10          link#22            UCS          utun3
-100.100.100.100/32 link#22            UCS          utun3
-100.101.102.103/32 link#22            UCS          utun3
-127.0.0.1          127.0.0.1          UH             lo0
-`
-
-	// A tunnel a disconnected client left behind, still holding its address.
-	netstatTunnelLeftBehind = netstatHeader + `
-default            192.168.1.1        UGScg          en0
-10.64.0.2          10.64.0.2          UH           utun4
-127.0.0.1          127.0.0.1          UH             lo0
-`
-
-	// A tunnel whose only default route is scoped to it.
-	netstatTunnelScopedDefault = netstatHeader + `
-default            192.168.1.1        UGScg          en0
-default            link#22            UCSIg        utun3
-100.64/10          link#22            UCS          utun3
-127.0.0.1          127.0.0.1          UH             lo0
-`
-
-	// A tunnel with the lower half of the address space but not the upper.
-	netstatVPNOneHalf = netstatHeader + `
-0/1                utun4              USc          utun4
-default            192.168.1.1        UGScg          en0
-127.0.0.1          127.0.0.1          UH             lo0
-`
-
-	// A VPN holding the default route; the physical default is now scoped.
-	netstatVPNDefault = netstatHeader + `
-default            link#15            UCSg         utun4
-default            192.168.1.1        UGScIg         en0
-10.64.0.2          10.64.0.2          UH           utun4
-127.0.0.1          127.0.0.1          UH             lo0
-`
-
-	// A VPN on both halves, leaving the physical default in place.
-	netstatVPNHalves = netstatHeader + `
-0/1                utun4              USc          utun4
-default            192.168.1.1        UGScg          en0
-default            192.168.1.1        UGScIg         en0
-10.64.0.2          10.64.0.2          UH           utun4
-127.0.0.1          127.0.0.1          UH             lo0
-128.0/1            utun4              USc          utun4
-`
-
-	// Idle Tailscale next to a VPN on both halves.
-	netstatTailscaleAndVPN = netstatHeader + `
-0/1                utun4              USc          utun4
-default            192.168.1.1        UGScg          en0
-10.64.0.2          10.64.0.2          UH           utun4
-100.64/10          link#22            UCS          utun3
-100.101.102.103/32 link#22            UCS          utun3
-127.0.0.1          127.0.0.1          UH             lo0
-128.0/1            utun4              USc          utun4
-`
+	addrEn0 = "192.168.1.20"
 )

 // linuxFlags describes the Linux bridge interfaces rtnetmon was built for.
@@ -117,17 +34,6 @@ func linuxFlags() netdetect.Flags {
 	}
 }

-// macIfaces returns the interfaces every Mac in these tests has (en0,
-// loopback, and an idle system tunnel with no IPv4 address) plus the given
-// tunnels.
-func macIfaces(tunnels ...netdetect.Interface) []netdetect.Interface {
-	return append([]netdetect.Interface{
-		{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
-		{Name: "lo0", Up: true, IPv4: []string{"127.0.0.1"}},
-		{Name: ifaceUtun0, Up: true},
-	}, tunnels...)
-}
-
 // selectCase is one Select scenario with fake interfaces and routes.
 type selectCase struct {
 	name    string
@@ -260,8 +166,8 @@ func TestSelectDarwinPanes(t *testing.T) {
 			goos: osDarwin,
 			ifaces: []netdetect.Interface{
 				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
-				{Name: ifaceUtun4, Up: true, IPv4: []string{addrVPN}},
-				{Name: ifaceUtun0, Up: true, IPv4: nil},
+				{Name: ifaceUtun4, Up: true, IPv4: []string{"10.64.0.2"}},
+				{Name: "utun0", Up: true, IPv4: nil},
 			},
 			routes: []netdetect.Route{
 				{Iface: ifaceUtun4, Default: true},
@@ -269,7 +175,21 @@ func TestSelectDarwinPanes(t *testing.T) {
 			},
 			flags: linuxFlags(),
 			want: []netdetect.Pane{
-				{Name: ifaceUtun4, Label: labelVPN},
+				{Name: ifaceUtun4, Label: "VPN"},
+				{Name: ifaceEn0, Label: labelDefault},
+			},
+		},
+		{
+			name: "vpn detected by routable address without its own route",
+			goos: osDarwin,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
+				{Name: "utun6", Up: true, IPv4: []string{"10.2.0.2"}},
+			},
+			routes: []netdetect.Route{{Iface: ifaceEn0, Default: true}},
+			flags:  linuxFlags(),
+			want: []netdetect.Pane{
+				{Name: "utun6", Label: "VPN"},
 				{Name: ifaceEn0, Label: labelDefault},
 			},
 		},
@@ -278,7 +198,7 @@ func TestSelectDarwinPanes(t *testing.T) {
 			goos: osDarwin,
 			ifaces: []netdetect.Interface{
 				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
-				{Name: ifaceUtun4, Up: true, IPv4: []string{addrVPN}},
+				{Name: ifaceUtun4, Up: true, IPv4: []string{"10.64.0.2"}},
 			},
 			routes: []netdetect.Route{
 				{Iface: ifaceUtun4, Default: true},
@@ -305,24 +225,13 @@ func TestSelectDarwinSingleAndErrors(t *testing.T) {
 			goos: osDarwin,
 			ifaces: []netdetect.Interface{
 				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
-				{Name: ifaceUtun0, Up: true, IPv4: nil},
+				{Name: "utun0", Up: true, IPv4: nil},
 				{Name: "utun1", Up: true, IPv4: []string{"169.254.1.1"}},
 			},
 			routes: []netdetect.Route{{Iface: ifaceEn0, Default: true}},
 			flags:  linuxFlags(),
 			want:   []netdetect.Pane{{Name: ifaceEn0, Label: labelDefault}},
 		},
-		{
-			name: "tunnel with a routable address but no default route",
-			goos: osDarwin,
-			ifaces: []netdetect.Interface{
-				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
-				{Name: "utun6", Up: true, IPv4: []string{"10.2.0.2"}},
-			},
-			routes: []netdetect.Route{{Iface: ifaceEn0, Default: true}},
-			flags:  linuxFlags(),
-			want:   []netdetect.Pane{{Name: ifaceEn0, Label: labelDefault}},
-		},
 		{
 			name: "no default route",
 			goos: osDarwin,
@@ -355,81 +264,6 @@ func TestSelectDarwinSingleAndErrors(t *testing.T) {
 	})
 }

-// TestSelectDarwinFromNetstat runs macOS routing tables through the netstat
-// parser into Select: only a tunnel carrying the default route is the VPN.
-func TestSelectDarwinFromNetstat(t *testing.T) {
-	t.Parallel()
-
-	tailscale := netdetect.Interface{
-		Name: ifaceUtun3, Up: true, IPv4: []string{addrTailscale},
-	}
-	vpn := netdetect.Interface{Name: ifaceUtun4, Up: true, IPv4: []string{addrVPN}}
-	physicalOnly := []netdetect.Pane{{Name: ifaceEn0, Label: labelDefault}}
-	vpnAndPhysical := []netdetect.Pane{
-		{Name: ifaceUtun4, Label: labelVPN},
-		{Name: ifaceEn0, Label: labelDefault},
-	}
-
-	runSelectCases(t, []selectCase{
-		{
-			name:   "no tunnel",
-			goos:   osDarwin,
-			ifaces: macIfaces(),
-			routes: netdetect.ParseNetstat(netstatNoTunnel),
-			want:   physicalOnly,
-		},
-		{
-			name:   "tailscale without an exit node",
-			goos:   osDarwin,
-			ifaces: macIfaces(tailscale),
-			routes: netdetect.ParseNetstat(netstatTailscaleIdle),
-			want:   physicalOnly,
-		},
-		{
-			name:   "tunnel left behind by a disconnected client",
-			goos:   osDarwin,
-			ifaces: macIfaces(vpn),
-			routes: netdetect.ParseNetstat(netstatTunnelLeftBehind),
-			want:   physicalOnly,
-		},
-		{
-			name:   "tunnel with only a scoped default route",
-			goos:   osDarwin,
-			ifaces: macIfaces(tailscale),
-			routes: netdetect.ParseNetstat(netstatTunnelScopedDefault),
-			want:   physicalOnly,
-		},
-		{
-			name:   "tunnel with only one half of the address space",
-			goos:   osDarwin,
-			ifaces: macIfaces(vpn),
-			routes: netdetect.ParseNetstat(netstatVPNOneHalf),
-			want:   physicalOnly,
-		},
-		{
-			name:   "vpn on the default route",
-			goos:   osDarwin,
-			ifaces: macIfaces(vpn),
-			routes: netdetect.ParseNetstat(netstatVPNDefault),
-			want:   vpnAndPhysical,
-		},
-		{
-			name:   "vpn on both halves",
-			goos:   osDarwin,
-			ifaces: macIfaces(vpn),
-			routes: netdetect.ParseNetstat(netstatVPNHalves),
-			want:   vpnAndPhysical,
-		},
-		{
-			name:   "idle tailscale next to a connected vpn",
-			goos:   osDarwin,
-			ifaces: macIfaces(tailscale, vpn),
-			routes: netdetect.ParseNetstat(netstatTailscaleAndVPN),
-			want:   vpnAndPhysical,
-		},
-	})
-}
-
 func TestParseIPRoute(t *testing.T) {
 	t.Parallel()

@@ -31,9 +31,6 @@ detect_pkgmgr() {
 		if [ "$(id -u)" != "0" ]; then
 			SUDO="sudo"
 		fi
-		# Fresh images, the CI runner's among them, ship with empty
-		# package lists. This runs once, on the first install.
-		$SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
 	fi
 }