From c8b1a30f34b829f39668241f80361e7e8f1f74f7 Mon Sep 17 00:00:00 2001
From: Aarnav Tale <git@tale.me>
Date: Wed, 17 Jun 2026 11:30:34 -0400
Subject: [PATCH] fix(wasm): account for custom DERP ports when checking the
 probe

Closes HP-540
---
 build.sh                          |  4 ++--
 patches/tailscale-derp-port.patch | 26 +++++++++++++++++++++-----
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/build.sh b/build.sh
index 5f67f18..d96c9ad 100755
--- a/build.sh
+++ b/build.sh
@@ -138,8 +138,8 @@ build_wasm() {
 		"$(dirname "$WASM_OUTPUT")/wasm_exec.js"
 
 	# Vendor dependencies and apply the DERP port patch.
-	# Tailscale's derphttp WebSocket URL builder ignores DERPPort,
-	# which breaks WASM connections to non-443 DERP servers.
+	# Tailscale's browser WebSocket and netcheck URL builders ignore
+	# DERPPort, which breaks WASM connections to non-443 DERP servers.
 	echo "==> Vendoring Go dependencies for WASM patch"
 	go mod vendor
 
diff --git a/patches/tailscale-derp-port.patch b/patches/tailscale-derp-port.patch
index 46d262c..5c23f9d 100644
--- a/patches/tailscale-derp-port.patch
+++ b/patches/tailscale-derp-port.patch
@@ -1,9 +1,9 @@
-Fix DERP WebSocket URL to include non-standard ports.
+Fix DERP browser URLs to include non-standard ports.
 
-Tailscale's derphttp client ignores DERPPort when building WebSocket
-URLs, causing connections to fail when DERP servers run on non-443
-ports (e.g. :8443). The TCP dial path correctly handles DERPPort
-but the WebSocket path (used in WASM/browser builds) does not.
+Tailscale's browser DERP paths ignore DERPPort when building WebSocket
+and HTTP-only netcheck probe URLs, causing connections to fail when DERP
+servers run on non-443 ports (e.g. :8443). The TCP dial path correctly
+handles DERPPort but the browser paths used by WASM builds do not.
 
 --- a/derp/derphttp/derphttp_client.go
 +++ b/derp/derphttp/derphttp_client.go
@@ -28,3 +28,19 @@ but the WebSocket path (used in WASM/browser builds) does not.
  }
  
  // AddressFamilySelector decides whether IPv6 is preferred for
+
+--- a/net/netcheck/netcheck.go
++++ b/net/netcheck/netcheck.go
+@@ -1103,7 +1103,11 @@
+ 		go func() {
+ 			defer wg.Done()
+ 			node := rg.Nodes[0]
+-			req, _ := http.NewRequestWithContext(ctx, "HEAD", "https://"+node.HostName+"/derp/probe", nil)
++			host := node.HostName
++			if node.DERPPort != 0 {
++				host = net.JoinHostPort(node.HostName, fmt.Sprint(node.DERPPort))
++			}
++			req, _ := http.NewRequestWithContext(ctx, "HEAD", "https://"+host+"/derp/probe", nil)
+ 			// One warm-up one to get HTTP connection set
+ 			// up and get a connection from the browser's
+ 			// pool.