cmd/tailscaled: disable netns in userspace-networking mode

Updates #2827
Updates #2822

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

net/netns/netns.go

@@ -19,12 +19,23 @@ import (
 	"net"
 
 	"inet.af/netaddr"
+	"tailscale.com/syncs"
 )
 
+var disabled syncs.AtomicBool
+
+// Disable disables netns for the process.
+func Disable() {
+	disabled.Set(true)
+}
+
 // Listener returns a new net.Listener with its Control hook func
 // initialized as necessary to run in logical network namespace that
 // doesn't route back into Tailscale.
 func Listener() *net.ListenConfig {
+	if disabled.Get() {
+		return new(net.ListenConfig)
+	}
 	return &net.ListenConfig{Control: control}
 }
 
@@ -41,6 +52,9 @@ func NewDialer() Dialer {
 // handles using a SOCKS if configured in the environment with
 // ALL_PROXY.
 func FromDialer(d *net.Dialer) Dialer {
+	if disabled.Get() {
+		return d
+	}
 	d.Control = control
 	if wrapDialer != nil {
 		return wrapDialer(d)