chore: Remove WebRTC networking (#3881)

* chore: Remove WebRTC networking

* Fix race condition

* Fix WebSocket not closing

agent/agent.go

@@ -11,7 +11,6 @@ import (
 	"io"
 	"net"
 	"net/netip"
-	"net/url"
 	"os"
 	"os/exec"
 	"os/user"
@@ -34,8 +33,6 @@ import (
 
 	"cdr.dev/slog"
 	"github.com/coder/coder/agent/usershell"
-	"github.com/coder/coder/peer"
-	"github.com/coder/coder/peerbroker"
 	"github.com/coder/coder/pty"
 	"github.com/coder/coder/tailnet"
 	"github.com/coder/retry"
@@ -64,7 +61,6 @@ var (
 
 type Options struct {
 	CoordinatorDialer CoordinatorDialer
-	WebRTCDialer      WebRTCDialer
 	FetchMetadata     FetchMetadata
 
 	StatsReporter          StatsReporter
@@ -80,8 +76,6 @@ type Metadata struct {
 	Directory            string            `json:"directory"`
 }
 
-type WebRTCDialer func(ctx context.Context, logger slog.Logger) (*peerbroker.Listener, error)
-
 // CoordinatorDialer is a function that constructs a new broker.
 // A dialer must be passed in to allow for reconnects.
 type CoordinatorDialer func(ctx context.Context) (net.Conn, error)
@@ -95,7 +89,6 @@ func New(options Options) io.Closer {
 	}
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	server := &agent{
-		webrtcDialer:           options.WebRTCDialer,
 		reconnectingPTYTimeout: options.ReconnectingPTYTimeout,
 		logger:                 options.Logger,
 		closeCancel:            cancelFunc,
@@ -111,8 +104,7 @@ func New(options Options) io.Closer {
 }
 
 type agent struct {
-	webrtcDialer WebRTCDialer
-	logger       slog.Logger
+	logger slog.Logger
 
 	reconnectingPTYs       sync.Map
 	reconnectingPTYTimeout time.Duration
@@ -173,9 +165,6 @@ func (a *agent) run(ctx context.Context) {
 		}
 	}()
 
-	if a.webrtcDialer != nil {
-		go a.runWebRTCNetworking(ctx)
-	}
 	if metadata.DERPMap != nil {
 		go a.runTailnet(ctx, metadata.DERPMap)
 	}
@@ -326,49 +315,6 @@ func (a *agent) runCoordinator(ctx context.Context) {
 	}
 }
 
-func (a *agent) runWebRTCNetworking(ctx context.Context) {
-	var peerListener *peerbroker.Listener
-	var err error
-	// An exponential back-off occurs when the connection is failing to dial.
-	// This is to prevent server spam in case of a coderd outage.
-	for retrier := retry.New(50*time.Millisecond, 10*time.Second); retrier.Wait(ctx); {
-		peerListener, err = a.webrtcDialer(ctx, a.logger)
-		if err != nil {
-			if errors.Is(err, context.Canceled) {
-				return
-			}
-			if a.isClosed() {
-				return
-			}
-			a.logger.Warn(context.Background(), "failed to dial", slog.Error(err))
-			continue
-		}
-		a.logger.Info(context.Background(), "connected to webrtc broker")
-		break
-	}
-	select {
-	case <-ctx.Done():
-		return
-	default:
-	}
-
-	for {
-		conn, err := peerListener.Accept()
-		if err != nil {
-			if a.isClosed() {
-				return
-			}
-			a.logger.Debug(ctx, "peer listener accept exited; restarting connection", slog.Error(err))
-			a.runWebRTCNetworking(ctx)
-			return
-		}
-		a.closeMutex.Lock()
-		a.connCloseWait.Add(1)
-		a.closeMutex.Unlock()
-		go a.handlePeerConn(ctx, conn)
-	}
-}
-
 func (a *agent) runStartupScript(ctx context.Context, script string) error {
 	if script == "" {
 		return nil
@@ -401,74 +347,6 @@ func (a *agent) runStartupScript(ctx context.Context, script string) error {
 	return nil
 }
 
-func (a *agent) handlePeerConn(ctx context.Context, peerConn *peer.Conn) {
-	go func() {
-		select {
-		case <-a.closed:
-		case <-peerConn.Closed():
-		}
-		_ = peerConn.Close()
-		a.connCloseWait.Done()
-	}()
-	for {
-		channel, err := peerConn.Accept(ctx)
-		if err != nil {
-			if errors.Is(err, peer.ErrClosed) || a.isClosed() {
-				return
-			}
-			a.logger.Debug(ctx, "accept channel from peer connection", slog.Error(err))
-			return
-		}
-
-		conn := channel.NetConn()
-
-		switch channel.Protocol() {
-		case ProtocolSSH:
-			go a.sshServer.HandleConn(a.stats.wrapConn(conn))
-		case ProtocolReconnectingPTY:
-			rawID := channel.Label()
-			// The ID format is referenced in conn.go.
-			// <uuid>:<height>:<width>
-			idParts := strings.SplitN(rawID, ":", 4)
-			if len(idParts) != 4 {
-				a.logger.Warn(ctx, "client sent invalid id format", slog.F("raw-id", rawID))
-				continue
-			}
-			id := idParts[0]
-			// Enforce a consistent format for IDs.
-			_, err := uuid.Parse(id)
-			if err != nil {
-				a.logger.Warn(ctx, "client sent reconnection token that isn't a uuid", slog.F("id", id), slog.Error(err))
-				continue
-			}
-			// Parse the initial terminal dimensions.
-			height, err := strconv.Atoi(idParts[1])
-			if err != nil {
-				a.logger.Warn(ctx, "client sent invalid height", slog.F("id", id), slog.F("height", idParts[1]))
-				continue
-			}
-			width, err := strconv.Atoi(idParts[2])
-			if err != nil {
-				a.logger.Warn(ctx, "client sent invalid width", slog.F("id", id), slog.F("width", idParts[2]))
-				continue
-			}
-			go a.handleReconnectingPTY(ctx, reconnectingPTYInit{
-				ID:      id,
-				Height:  uint16(height),
-				Width:   uint16(width),
-				Command: idParts[3],
-			}, a.stats.wrapConn(conn))
-		case ProtocolDial:
-			go a.handleDial(ctx, channel.Label(), a.stats.wrapConn(conn))
-		default:
-			a.logger.Warn(ctx, "unhandled protocol from channel",
-				slog.F("protocol", channel.Protocol()),
-				slog.F("label", channel.Label()),
-			)
-		}
-	}
-}
-
 func (a *agent) init(ctx context.Context) {
 	a.logger.Info(ctx, "generating host key")
 	// Clients' should ignore the host key when connecting.
@@ -915,70 +793,6 @@ func (a *agent) handleReconnectingPTY(ctx context.Context, msg reconnectingPTYIn
 	}
 }
 
-// dialResponse is written to datachannels with protocol "dial" by the agent as
-// the first packet to signify whether the dial succeeded or failed.
-type dialResponse struct {
-	Error string `json:"error,omitempty"`
-}
-
-func (a *agent) handleDial(ctx context.Context, label string, conn net.Conn) {
-	defer conn.Close()
-
-	writeError := func(responseError error) error {
-		msg := ""
-		if responseError != nil {
-			msg = responseError.Error()
-			if !xerrors.Is(responseError, io.EOF) {
-				a.logger.Warn(ctx, "handle dial", slog.F("label", label), slog.Error(responseError))
-			}
-		}
-		b, err := json.Marshal(dialResponse{
-			Error: msg,
-		})
-		if err != nil {
-			a.logger.Warn(ctx, "write dial response", slog.F("label", label), slog.Error(err))
-			return xerrors.Errorf("marshal agent webrtc dial response: %w", err)
-		}
-
-		_, err = conn.Write(b)
-		return err
-	}
-
-	u, err := url.Parse(label)
-	if err != nil {
-		_ = writeError(xerrors.Errorf("parse URL %q: %w", label, err))
-		return
-	}
-
-	network := u.Scheme
-	addr := u.Host + u.Path
-	if strings.HasPrefix(network, "unix") {
-		if runtime.GOOS == "windows" {
-			_ = writeError(xerrors.New("Unix forwarding is not supported from Windows workspaces"))
-			return
-		}
-		addr, err = ExpandRelativeHomePath(addr)
-		if err != nil {
-			_ = writeError(xerrors.Errorf("expand path %q: %w", addr, err))
-			return
-		}
-	}
-
-	d := net.Dialer{Timeout: 3 * time.Second}
-	nconn, err := d.DialContext(ctx, network, addr)
-	if err != nil {
-		_ = writeError(xerrors.Errorf("dial '%v://%v': %w", network, addr, err))
-		return
-	}
-
-	err = writeError(nil)
-	if err != nil {
-		return
-	}
-
-	Bicopy(ctx, conn, nconn)
-}
-
 // isClosed returns whether the API is closed or not.
 func (a *agent) isClosed() bool {
 	select {

agent/agent_test.go

@@ -20,12 +20,10 @@ import (
 
 	"golang.org/x/xerrors"
 	"tailscale.com/net/speedtest"
-	"tailscale.com/tailcfg"
 
 	scp "github.com/bramvdbogaerde/go-scp"
 	"github.com/google/uuid"
 	"github.com/pion/udp"
-	"github.com/pion/webrtc/v3"
 	"github.com/pkg/sftp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -37,10 +35,6 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 	"github.com/coder/coder/agent"
-	"github.com/coder/coder/peer"
-	"github.com/coder/coder/peerbroker"
-	"github.com/coder/coder/peerbroker/proto"
-	"github.com/coder/coder/provisionersdk"
 	"github.com/coder/coder/pty/ptytest"
 	"github.com/coder/coder/tailnet"
 	"github.com/coder/coder/tailnet/tailnettest"
@@ -54,64 +48,49 @@ func TestMain(m *testing.M) {
 func TestAgent(t *testing.T) {
 	t.Parallel()
 	t.Run("Stats", func(t *testing.T) {
-		for _, tailscale := range []bool{true, false} {
-			t.Run(fmt.Sprintf("tailscale=%v", tailscale), func(t *testing.T) {
-				t.Parallel()
+		t.Parallel()
 
-				setupAgent := func(t *testing.T) (agent.Conn, <-chan *agent.Stats) {
-					var derpMap *tailcfg.DERPMap
-					if tailscale {
-						derpMap = tailnettest.RunDERPAndSTUN(t)
-					}
-					conn, stats := setupAgent(t, agent.Metadata{
-						DERPMap: derpMap,
-					}, 0)
-					assert.Empty(t, <-stats)
-					return conn, stats
-				}
+		t.Run("SSH", func(t *testing.T) {
+			t.Parallel()
+			conn, stats := setupAgent(t, agent.Metadata{}, 0)
 
-				t.Run("SSH", func(t *testing.T) {
-					t.Parallel()
-					conn, stats := setupAgent(t)
+			sshClient, err := conn.SSHClient()
+			require.NoError(t, err)
+			defer sshClient.Close()
+			session, err := sshClient.NewSession()
+			require.NoError(t, err)
+			defer session.Close()
 
-					sshClient, err := conn.SSHClient()
-					require.NoError(t, err)
-					session, err := sshClient.NewSession()
-					require.NoError(t, err)
-					defer session.Close()
+			assert.EqualValues(t, 1, (<-stats).NumConns)
+			assert.Greater(t, (<-stats).RxBytes, int64(0))
+			assert.Greater(t, (<-stats).TxBytes, int64(0))
+		})
 
-					assert.EqualValues(t, 1, (<-stats).NumConns)
-					assert.Greater(t, (<-stats).RxBytes, int64(0))
-					assert.Greater(t, (<-stats).TxBytes, int64(0))
-				})
+		t.Run("ReconnectingPTY", func(t *testing.T) {
+			t.Parallel()
 
-				t.Run("ReconnectingPTY", func(t *testing.T) {
-					t.Parallel()
+			conn, stats := setupAgent(t, agent.Metadata{}, 0)
 
-					conn, stats := setupAgent(t)
+			ptyConn, err := conn.ReconnectingPTY(uuid.NewString(), 128, 128, "/bin/bash")
+			require.NoError(t, err)
+			defer ptyConn.Close()
 
-					ptyConn, err := conn.ReconnectingPTY(uuid.NewString(), 128, 128, "/bin/bash")
-					require.NoError(t, err)
-					defer ptyConn.Close()
-
-					data, err := json.Marshal(agent.ReconnectingPTYRequest{
-						Data: "echo test\r\n",
-					})
-					require.NoError(t, err)
-					_, err = ptyConn.Write(data)
-					require.NoError(t, err)
-
-					var s *agent.Stats
-					require.Eventuallyf(t, func() bool {
-						var ok bool
-						s, ok = (<-stats)
-						return ok && s.NumConns > 0 && s.RxBytes > 0 && s.TxBytes > 0
-					}, testutil.WaitLong, testutil.IntervalFast,
-						"never saw stats: %+v", s,
-					)
-				})
+			data, err := json.Marshal(agent.ReconnectingPTYRequest{
+				Data: "echo test\r\n",
 			})
-		}
+			require.NoError(t, err)
+			_, err = ptyConn.Write(data)
+			require.NoError(t, err)
+
+			var s *agent.Stats
+			require.Eventuallyf(t, func() bool {
+				var ok bool
+				s, ok = (<-stats)
+				return ok && s.NumConns > 0 && s.RxBytes > 0 && s.TxBytes > 0
+			}, testutil.WaitLong, testutil.IntervalFast,
+				"never saw stats: %+v", s,
+			)
+		})
 	})
 
 	t.Run("SessionExec", func(t *testing.T) {
@@ -235,6 +214,7 @@ func TestAgent(t *testing.T) {
 		conn, _ := setupAgent(t, agent.Metadata{}, 0)
 		sshClient, err := conn.SSHClient()
 		require.NoError(t, err)
+		defer sshClient.Close()
 		client, err := sftp.NewClient(sshClient)
 		require.NoError(t, err)
 		tempFile := filepath.Join(t.TempDir(), "sftp")
@@ -252,6 +232,7 @@ func TestAgent(t *testing.T) {
 		conn, _ := setupAgent(t, agent.Metadata{}, 0)
 		sshClient, err := conn.SSHClient()
 		require.NoError(t, err)
+		defer sshClient.Close()
 		scpClient, err := scp.NewClientBySSH(sshClient)
 		require.NoError(t, err)
 		tempFile := filepath.Join(t.TempDir(), "scp")
@@ -384,9 +365,7 @@ func TestAgent(t *testing.T) {
 			t.Skip("ConPTY appears to be inconsistent on Windows.")
 		}
 
-		conn, _ := setupAgent(t, agent.Metadata{
-			DERPMap: tailnettest.RunDERPAndSTUN(t),
-		}, 0)
+		conn, _ := setupAgent(t, agent.Metadata{}, 0)
 		id := uuid.NewString()
 		netConn, err := conn.ReconnectingPTY(id, 100, 100, "/bin/bash")
 		require.NoError(t, err)
@@ -462,19 +441,6 @@ func TestAgent(t *testing.T) {
 					return l
 				},
 			},
-			{
-				name: "Unix",
-				setup: func(t *testing.T) net.Listener {
-					if runtime.GOOS == "windows" {
-						t.Skip("Unix socket forwarding isn't supported on Windows")
-					}
-
-					tmpDir := t.TempDir()
-					l, err := net.Listen("unix", filepath.Join(tmpDir, "test.sock"))
-					require.NoError(t, err, "create UDP listener")
-					return l
-				},
-			},
 		}
 
 		for _, c := range cases {
@@ -496,8 +462,11 @@ func TestAgent(t *testing.T) {
 					}
 				}()
 
-				// Dial the listener over WebRTC twice and test out of order
 				conn, _ := setupAgent(t, agent.Metadata{}, 0)
+				require.Eventually(t, func() bool {
+					_, err := conn.Ping()
+					return err == nil
+				}, testutil.WaitMedium, testutil.IntervalFast)
 				conn1, err := conn.DialContext(context.Background(), l.Addr().Network(), l.Addr().String())
 				require.NoError(t, err)
 				defer conn1.Close()
@@ -506,36 +475,11 @@ func TestAgent(t *testing.T) {
 				defer conn2.Close()
 				testDial(t, conn2)
 				testDial(t, conn1)
+				time.Sleep(150 * time.Millisecond)
 			})
 		}
 	})
 
-	t.Run("DialError", func(t *testing.T) {
-		t.Parallel()
-
-		if runtime.GOOS == "windows" {
-			// This test uses Unix listeners so we can very easily ensure that
-			// no other tests decide to listen on the same random port we
-			// picked.
-			t.Skip("this test is unsupported on Windows")
-			return
-		}
-
-		tmpDir, err := os.MkdirTemp("", "coderd_agent_test_")
-		require.NoError(t, err, "create temp dir")
-		t.Cleanup(func() {
-			_ = os.RemoveAll(tmpDir)
-		})
-
-		// Try to dial the non-existent Unix socket over WebRTC
-		conn, _ := setupAgent(t, agent.Metadata{}, 0)
-		netConn, err := conn.DialContext(context.Background(), "unix", filepath.Join(tmpDir, "test.sock"))
-		require.Error(t, err)
-		require.ErrorContains(t, err, "remote dial error")
-		require.ErrorContains(t, err, "no such file")
-		require.Nil(t, netConn)
-	})
-
 	t.Run("Tailnet", func(t *testing.T) {
 		t.Parallel()
 		derpMap := tailnettest.RunDERPAndSTUN(t)
@@ -578,7 +522,7 @@ func setupSSHCommand(t *testing.T, beforeArgs []string, afterArgs []string) *exe
 				return
 			}
 			ssh, err := agentConn.SSH()
-			if !assert.NoError(t, err) {
+			if err != nil {
 				_ = conn.Close()
 				return
 			}
@@ -622,11 +566,12 @@ func (c closeFunc) Close() error {
 }
 
 func setupAgent(t *testing.T, metadata agent.Metadata, ptyTimeout time.Duration) (
-	agent.Conn,
+	*agent.Conn,
 	<-chan *agent.Stats,
 ) {
-	client, server := provisionersdk.TransportPipe()
-	tailscale := metadata.DERPMap != nil
+	if metadata.DERPMap == nil {
+		metadata.DERPMap = tailnettest.RunDERPAndSTUN(t)
+	}
 	coordinator := tailnet.NewCoordinator()
 	agentID := uuid.New()
 	statsCh := make(chan *agent.Stats)
@@ -634,17 +579,18 @@ func setupAgent(t *testing.T, metadata agent.Metadata, ptyTimeout time.Duration)
 		FetchMetadata: func(ctx context.Context) (agent.Metadata, error) {
 			return metadata, nil
 		},
-		WebRTCDialer: func(ctx context.Context, logger slog.Logger) (*peerbroker.Listener, error) {
-			listener, err := peerbroker.Listen(server, nil)
-			return listener, err
-		},
 		CoordinatorDialer: func(ctx context.Context) (net.Conn, error) {
 			clientConn, serverConn := net.Pipe()
+			closed := make(chan struct{})
 			t.Cleanup(func() {
 				_ = serverConn.Close()
 				_ = clientConn.Close()
+				<-closed
 			})
-			go coordinator.ServeAgent(serverConn, agentID)
+			go func() {
+				_ = coordinator.ServeAgent(serverConn, agentID)
+				close(closed)
+			}()
 			return clientConn, nil
 		},
 		Logger:                 slogtest.Make(t, nil).Leveled(slog.LevelDebug),
@@ -683,46 +629,27 @@ func setupAgent(t *testing.T, metadata agent.Metadata, ptyTimeout time.Duration)
 		},
 	})
 	t.Cleanup(func() {
-		_ = client.Close()
-		_ = server.Close()
 		_ = closer.Close()
 	})
-	api := proto.NewDRPCPeerBrokerClient(provisionersdk.Conn(client))
-	stream, err := api.NegotiateConnection(context.Background())
-	assert.NoError(t, err)
-	if tailscale {
-		conn, err := tailnet.NewConn(&tailnet.Options{
-			Addresses: []netip.Prefix{netip.PrefixFrom(tailnet.IP(), 128)},
-			DERPMap:   metadata.DERPMap,
-			Logger:    slogtest.Make(t, nil).Named("client").Leveled(slog.LevelDebug),
-		})
-		require.NoError(t, err)
-		clientConn, serverConn := net.Pipe()
-		t.Cleanup(func() {
-			_ = clientConn.Close()
-			_ = serverConn.Close()
-			_ = conn.Close()
-		})
-		go coordinator.ServeClient(serverConn, uuid.New(), agentID)
-		sendNode, _ := tailnet.ServeCoordinator(clientConn, func(node []*tailnet.Node) error {
-			return conn.UpdateNodes(node)
-		})
-		conn.SetNodeCallback(sendNode)
-		return &agent.TailnetConn{
-			Conn: conn,
-		}, statsCh
-	}
-	conn, err := peerbroker.Dial(stream, []webrtc.ICEServer{}, &peer.ConnOptions{
-		Logger: slogtest.Make(t, nil),
+	conn, err := tailnet.NewConn(&tailnet.Options{
+		Addresses: []netip.Prefix{netip.PrefixFrom(tailnet.IP(), 128)},
+		DERPMap:   metadata.DERPMap,
+		Logger:    slogtest.Make(t, nil).Named("client").Leveled(slog.LevelDebug),
 	})
 	require.NoError(t, err)
+	clientConn, serverConn := net.Pipe()
 	t.Cleanup(func() {
+		_ = clientConn.Close()
+		_ = serverConn.Close()
 		_ = conn.Close()
 	})
-
-	return &agent.WebRTCConn{
-		Negotiator: api,
-		Conn:       conn,
+	go coordinator.ServeClient(serverConn, uuid.New(), agentID)
+	sendNode, _ := tailnet.ServeCoordinator(clientConn, func(node []*tailnet.Node) error {
+		return conn.UpdateNodes(node)
+	})
+	conn.SetNodeCallback(sendNode)
+	return &agent.Conn{
+		Conn: conn,
 	}, statsCh
 }
 

agent/conn.go

@@ -4,13 +4,9 @@ import (
 	"context"
 	"encoding/binary"
 	"encoding/json"
-	"fmt"
-	"io"
 	"net"
 	"net/netip"
-	"net/url"
 	"strconv"
-	"strings"
 	"time"
 
 	"golang.org/x/crypto/ssh"
@@ -19,8 +15,6 @@ import (
 	"tailscale.com/net/speedtest"
 	"tailscale.com/tailcfg"
 
-	"github.com/coder/coder/peer"
-	"github.com/coder/coder/peerbroker/proto"
 	"github.com/coder/coder/tailnet"
 )
 
@@ -32,123 +26,12 @@ type ReconnectingPTYRequest struct {
 	Width  uint16 `json:"width"`
 }
 
-// Conn is a temporary interface while we switch from WebRTC to Wireguard networking.
-type Conn interface {
-	io.Closer
-	Closed() <-chan struct{}
-	Ping() (time.Duration, error)
-	CloseWithError(err error) error
-	ReconnectingPTY(id string, height, width uint16, command string) (net.Conn, error)
-	SSH() (net.Conn, error)
-	Speedtest(direction speedtest.Direction, duration time.Duration) ([]speedtest.Result, error)
-	SSHClient() (*ssh.Client, error)
-	DialContext(ctx context.Context, network string, addr string) (net.Conn, error)
-}
-
-// Conn wraps a peer connection with helper functions to
-// communicate with the agent.
-type WebRTCConn struct {
-	// Negotiator is responsible for exchanging messages.
-	Negotiator proto.DRPCPeerBrokerClient
-
-	*peer.Conn
-}
-
-// ReconnectingPTY returns a connection serving a TTY that can
-// be reconnected to via ID.
-//
-// The command is optional and defaults to start a shell.
-func (c *WebRTCConn) ReconnectingPTY(id string, height, width uint16, command string) (net.Conn, error) {
-	channel, err := c.CreateChannel(context.Background(), fmt.Sprintf("%s:%d:%d:%s", id, height, width, command), &peer.ChannelOptions{
-		Protocol: ProtocolReconnectingPTY,
-	})
-	if err != nil {
-		return nil, xerrors.Errorf("pty: %w", err)
-	}
-	return channel.NetConn(), nil
-}
-
-// SSH dials the built-in SSH server.
-func (c *WebRTCConn) SSH() (net.Conn, error) {
-	channel, err := c.CreateChannel(context.Background(), "ssh", &peer.ChannelOptions{
-		Protocol: ProtocolSSH,
-	})
-	if err != nil {
-		return nil, xerrors.Errorf("dial: %w", err)
-	}
-	return channel.NetConn(), nil
-}
-
-func (*WebRTCConn) Speedtest(_ speedtest.Direction, _ time.Duration) ([]speedtest.Result, error) {
-	return nil, xerrors.New("not implemented")
-}
-
-// SSHClient calls SSH to create a client that uses a weak cipher
-// for high throughput.
-func (c *WebRTCConn) SSHClient() (*ssh.Client, error) {
-	netConn, err := c.SSH()
-	if err != nil {
-		return nil, xerrors.Errorf("ssh: %w", err)
-	}
-	sshConn, channels, requests, err := ssh.NewClientConn(netConn, "localhost:22", &ssh.ClientConfig{
-		// SSH host validation isn't helpful, because obtaining a peer
-		// connection already signifies user-intent to dial a workspace.
-		// #nosec
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-	})
-	if err != nil {
-		return nil, xerrors.Errorf("ssh conn: %w", err)
-	}
-	return ssh.NewClient(sshConn, channels, requests), nil
-}
-
-// DialContext dials an arbitrary protocol+address from inside the workspace and
-// proxies it through the provided net.Conn.
-func (c *WebRTCConn) DialContext(ctx context.Context, network string, addr string) (net.Conn, error) {
-	u := &url.URL{
-		Scheme: network,
-	}
-	if strings.HasPrefix(network, "unix") {
-		u.Path = addr
-	} else {
-		u.Host = addr
-	}
-
-	channel, err := c.CreateChannel(ctx, u.String(), &peer.ChannelOptions{
-		Protocol:  ProtocolDial,
-		Unordered: strings.HasPrefix(network, "udp"),
-	})
-	if err != nil {
-		return nil, xerrors.Errorf("create datachannel: %w", err)
-	}
-
-	// The first message written from the other side is a JSON payload
-	// containing the dial error.
-	dec := json.NewDecoder(channel)
-	var res dialResponse
-	err = dec.Decode(&res)
-	if err != nil {
-		return nil, xerrors.Errorf("decode agent dial response: %w", err)
-	}
-	if res.Error != "" {
-		_ = channel.Close()
-		return nil, xerrors.Errorf("remote dial error: %v", res.Error)
-	}
-
-	return channel.NetConn(), nil
-}
-
-func (c *WebRTCConn) Close() error {
-	_ = c.Negotiator.DRPCConn().Close()
-	return c.Conn.Close()
-}
-
-type TailnetConn struct {
+type Conn struct {
 	*tailnet.Conn
 	CloseFunc func()
 }
 
-func (c *TailnetConn) Ping() (time.Duration, error) {
+func (c *Conn) Ping() (time.Duration, error) {
 	errCh := make(chan error, 1)
 	durCh := make(chan time.Duration, 1)
 	c.Conn.Ping(tailnetIP, tailcfg.PingICMP, func(pr *ipnstate.PingResult) {
@@ -166,11 +49,11 @@ func (c *TailnetConn) Ping() (time.Duration, error) {
 	}
 }
 
-func (c *TailnetConn) CloseWithError(_ error) error {
+func (c *Conn) CloseWithError(_ error) error {
 	return c.Close()
 }
 
-func (c *TailnetConn) Close() error {
+func (c *Conn) Close() error {
 	if c.CloseFunc != nil {
 		c.CloseFunc()
 	}
@@ -184,7 +67,7 @@ type reconnectingPTYInit struct {
 	Command string
 }
 
-func (c *TailnetConn) ReconnectingPTY(id string, height, width uint16, command string) (net.Conn, error) {
+func (c *Conn) ReconnectingPTY(id string, height, width uint16, command string) (net.Conn, error) {
 	conn, err := c.DialContextTCP(context.Background(), netip.AddrPortFrom(tailnetIP, uint16(tailnetReconnectingPTYPort)))
 	if err != nil {
 		return nil, err
@@ -210,13 +93,13 @@ func (c *TailnetConn) ReconnectingPTY(id string, height, width uint16, command s
 	return conn, nil
 }
 
-func (c *TailnetConn) SSH() (net.Conn, error) {
+func (c *Conn) SSH() (net.Conn, error) {
 	return c.DialContextTCP(context.Background(), netip.AddrPortFrom(tailnetIP, uint16(tailnetSSHPort)))
 }
 
 // SSHClient calls SSH to create a client that uses a weak cipher
 // for high throughput.
-func (c *TailnetConn) SSHClient() (*ssh.Client, error) {
+func (c *Conn) SSHClient() (*ssh.Client, error) {
 	netConn, err := c.SSH()
 	if err != nil {
 		return nil, xerrors.Errorf("ssh: %w", err)
@@ -233,7 +116,7 @@ func (c *TailnetConn) SSHClient() (*ssh.Client, error) {
 	return ssh.NewClient(sshConn, channels, requests), nil
 }
 
-func (c *TailnetConn) Speedtest(direction speedtest.Direction, duration time.Duration) ([]speedtest.Result, error) {
+func (c *Conn) Speedtest(direction speedtest.Direction, duration time.Duration) ([]speedtest.Result, error) {
 	speedConn, err := c.DialContextTCP(context.Background(), netip.AddrPortFrom(tailnetIP, uint16(tailnetSpeedtestPort)))
 	if err != nil {
 		return nil, xerrors.Errorf("dial speedtest: %w", err)
@@ -245,7 +128,10 @@ func (c *TailnetConn) Speedtest(direction speedtest.Direction, duration time.Dur
 	return results, err
 }
 
-func (c *TailnetConn) DialContext(ctx context.Context, network string, addr string) (net.Conn, error) {
+func (c *Conn) DialContext(ctx context.Context, network string, addr string) (net.Conn, error) {
+	if network == "unix" {
+		return nil, xerrors.New("network must be tcp or udp")
+	}
 	_, rawPort, _ := net.SplitHostPort(addr)
 	port, _ := strconv.Atoi(rawPort)
 	ipp := netip.AddrPortFrom(tailnetIP, uint16(port))