net/tshttpproxy: fix WDAP/PAC proxy detection on Win10 1607 and earlier

[nickkhyl]

Using WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG on Windows versions older than Windows 10 1703 (build 15063) is not supported and causes WinHttpGetProxyForUrl to fail with ERROR_INVALID_PARAMETER. This results in failures reaching the control on environments where a proxy is required.

We use wingoes version detection to conditionally set the WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG flag
on Windows builds greater than 15063.

While there, we also update proxy detection to use WINHTTP_AUTO_DETECT_TYPE_DNS_A, as DNS-based proxy discovery might be required with Active Directory and in certain other environments.

Updates tailscale/corp#29168
Fixes #879

[review-ai-agent]

Pull Request Revisions

Revision	Description
r5	Reduced proxy error retry duration Modified Windows proxy error handling to set a shorter 10-second retry interval instead of one hour
r4	Dependency tracking file updated Minor dependency tracking update in derper's depaware.txt, specifically for wingoes package from tailscale.com/util/winutil
r3	Migrated Windows build version check Replaced local Windows build version checking with external wingoes library functionality, removing duplicated version constants
r2	Windows build number constant renamed Renamed Windows12_24H2 constant to Windows11_24H2 and updated WindowsServer2025 build number accordingly
r1	Windows proxy detection version check Added Windows build version check for proxy auto-configuration flag compatibility and introduced build number constants

---

✅ AI review completed for r5

Help

React with emojis to give feedback on AI-generated reviews:

• 👍 means the feedback was helpful and actionable
• 👎 means the feedback was incorrect or unhelpful

💬 Replying to feedback with a comment helps us improve the system. Your input also contributes to shaping future interactions with the AI reviewer.

We'd love to hear from you—reach out anytime at team@review.ai.

[dblohm7]

Can we just use wingoes for the version detection?

[nickkhyl]

Thanks for pointing out that we have something similar in wingoes.

But its implementation is based on RtlGetVersion, which returns the actual OS version info and doesn’t work well with compat shims. It's perfectly fine to use RtlGetVersion when we need version info for reporting purposes, but I'd rather keep using VerifyVersionInfo for checking API availability and alike. It's also what Microsoft seems to use in similar scenarios.

[bradfitz]

Nice find.

LGTM for the tshttpproxy bit at least.

You can Aaron can work out where the version checking goes.

I like the sync.OnceValue to only do the system call once.

[bradfitz]

hah, using archive.org because Microsoft can't keep breaking their URLs every few years. lolsob.

[nickkhyl]

Updated this PR to use wingoes, as we already use it in other places; filed tailscale/corp#29174 to update its implementation to avoid using RtlGetVersion due to potential compat shim issues.

[dblohm7]

Thanks!