wgengine,wgcfg,feature/netlog: move network flow logging behind a feature hook

wgcfg.Config.NetworkLogging carried the network flow logging identity
inside the WireGuard config, where it was unrelated to WireGuard; it
lived there mainly so that identity changes would defeat Reconfig's
ErrNoChanges check and reach the netlog startup/shutdown logic.

Remove the field and move the whole netlog lifecycle into a new
feature/netlog package, installed on the engine via the new
wgengine.HookNewNetLogger hook, like other feature/* packages. The
logging identity now comes from LocalBackend's current netmap via the
widened NetLogSource interface (replacing Engine.SetNetLogNodeSource),
so nmcfg no longer parses audit log IDs into the config. The engine
still calls the hook before its ErrNoChanges return and before
router.Set (to capture initial packets), and again after router.Set
(to capture final packets), preserving the previous ordering.

Core wgengine no longer imports wgengine/netlog, so minimal builds
drop it entirely. tailscaled keeps netlog via feature/condregister,
and tsnet imports feature/condregister/netlog explicitly to keep
netlog enabled by default in tsnet-based binaries (tsidp,
k8s-operator).

This is pulled out of a future change that removes wgcfg.Config.Peers,
to make that PR smaller.

Updates #12542
Updates #12614

Change-Id: I41ca7dfe43c51e977c41b5f8e934bd1f0e6e6e24
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

ipn/ipnlocal/local.go

@@ -103,7 +103,6 @@ import (
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/magicsock"
-	"tailscale.com/wgengine/netlog"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg"
 	"tailscale.com/wgengine/wgcfg/nmcfg"
@@ -636,7 +635,7 @@ func NewLocalBackend(logf logger.Logf, logID logid.PublicID, sys *tsd.System, lo
 	e.SetPeerByIPPacketFunc(b.lookupPeerByIP)
 	e.SetPeerForIPFunc(b.peerForIP)
 	e.SetPeerSessionStateFunc(b.onPeerWireGuardState)
-	e.SetNetLogNodeSource(netLogNodeSource{b})
+	e.SetNetLogSource(netLogNodeSource{b})
 	e.SetWGPeerLookup(b.lookupPeerWireGuardString)
 	b.dialer.SetResolveMagicDNS(b.resolveMagicDNS)
 
@@ -8017,9 +8016,10 @@ func (n noiseRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 	return n.lb.DoNoiseRequest(req)
 }
 
-// netLogNodeSource adapts LocalBackend's nodeBackend to [netlog.NodeSource].
-// Each method consults [LocalBackend.currentNode] so that profile rotations
-// are picked up automatically without re-installing the source.
+// netLogNodeSource adapts LocalBackend to [wgengine.NetLogSource].
+// Each method consults [LocalBackend.currentNode] or the current netmap
+// so that profile rotations are picked up automatically without
+// re-installing the source.
 type netLogNodeSource struct {
 	b *LocalBackend
 }
@@ -8048,8 +8048,37 @@ func (s netLogNodeSource) NodeByAddr(addr netip.Addr) (_ tailcfg.NodeView, _ tai
 	return nv, up, true
 }
 
-// Compile-time assertion that netLogNodeSource implements [netlog.NodeSource].
-var _ netlog.NodeSource = netLogNodeSource{}
+// NetLogIDs implements [wgengine.NetLogSource], returning the network
+// flow logging identity from the current netmap. ok is false if the
+// netmap does not enable network flow logging for this node.
+func (s netLogNodeSource) NetLogIDs() (nodeID, domainID logid.PrivateID, logExitFlows bool, ok bool) {
+	nm := s.b.NetMap()
+	if nm == nil || !nm.SelfNode.Valid() {
+		return
+	}
+	if !nm.SelfNode.HasCap(tailcfg.CapabilityDataPlaneAuditLogs) {
+		return
+	}
+	if nm.SelfNode.DataPlaneAuditLogID() == "" || nm.DomainAuditLogID == "" {
+		return
+	}
+	nodeID, errNode := logid.ParsePrivateID(nm.SelfNode.DataPlaneAuditLogID())
+	if errNode != nil {
+		s.b.logf("[v1] netlog: unable to parse node audit log ID: %v", errNode)
+	}
+	domainID, errDomain := logid.ParsePrivateID(nm.DomainAuditLogID)
+	if errDomain != nil {
+		s.b.logf("[v1] netlog: unable to parse domain audit log ID: %v", errDomain)
+	}
+	if errNode != nil || errDomain != nil {
+		return logid.PrivateID{}, logid.PrivateID{}, false, false
+	}
+	return nodeID, domainID, nm.SelfNode.HasCap(tailcfg.NodeAttrLogExitFlows), true
+}
+
+// Compile-time assertion that netLogNodeSource implements
+// [wgengine.NetLogSource].
+var _ wgengine.NetLogSource = netLogNodeSource{}
 
 // lookupPeerWireGuardString returns the Tailscale-conventional short string
 // (e.g. "[IMTBr]") for the peer whose wireguard-go-formatted public key

ipn/ipnlocal/state_test.go

@@ -47,7 +47,6 @@ import (
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/magicsock"
-	"tailscale.com/wgengine/netlog"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg"
 	"tailscale.com/wgengine/wgint"
@@ -1989,7 +1988,7 @@ func (e *mockEngine) PeerKeyForIP(netip.Addr) (_ key.NodePublic, _ netip.Prefix,
 }
 func (e *mockEngine) SetPeerSessionStateFunc(func(key.NodePublic, wgengine.PeerWireGuardState)) {
 }
-func (e *mockEngine) SetNetLogNodeSource(netlog.NodeSource)                            {}
+func (e *mockEngine) SetNetLogSource(wgengine.NetLogSource)                            {}
 func (e *mockEngine) SetWGPeerLookup(func(wgString string) (tsString string, ok bool)) {}
 func (e *mockEngine) ProbeLocks()                                                      {}