调整与受管司南之间通知可信节点变化的为控制器向司南发请求推送差值；需要考虑的问题是控制器下线后重新上线如何通知受管司南拉拉取最新信息?（是否有必要？）

Signed-off-by: Chenyang Gao <gps949@outlook.com>

controller/app.go

@@ -24,6 +24,7 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/sync/errgroup"
 	"gorm.io/gorm"
+	"tailscale.com/control/controlclient"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 )
@@ -63,6 +64,8 @@ type Mirage struct {
 
 	noisePrivateKey *key.MachinePrivate
 	DERPMap         *tailcfg.DERPMap
+	DERPNCs         map[string]*controlclient.NoiseClient
+	DERPseqnum      map[string]int
 
 	aclPolicy *ACLPolicy
 	aclRules  []tailcfg.FilterRule
@@ -120,6 +123,8 @@ func NewMirage(cfg *Config, db *gorm.DB) (*Mirage, error) {
 		cancel: cancel,
 
 		noisePrivateKey: noisePrivateKey,
+		DERPNCs:         make(map[string]*controlclient.NoiseClient),
+		DERPseqnum:      make(map[string]int),
 		aclRules:        tailcfg.FilterAllowAll, // default allowall
 
 		aCodeCache:              aCodeCache,
@@ -134,6 +139,21 @@ func NewMirage(cfg *Config, db *gorm.DB) (*Mirage, error) {
 		lastStateChange:         xsync.NewMapOf[time.Time](),
 	}
 
+	nrs := app.ListNaviRegions()
+	for _, nr := range nrs {
+		nns := app.ListNaviNodes(nr.ID)
+		for _, nn := range nns {
+			nckey := key.MachinePublic{}
+			nckey.UnmarshalText([]byte(MachinePublicKeyEnsurePrefix(nn.NaviKey)))
+			nc, err := app.GetNaviNoiseClient(nckey, nn.HostName, nn.DERPPort)
+			if err != nil {
+				log.Error().Err(err).Msg("GetNaviNoiseClient Error: " + err.Error())
+			}
+			app.DERPNCs[nn.ID] = nc
+			app.DERPseqnum[nn.ID] = 0
+		}
+	}
+
 	/* 由于可能我们会使用内建的dex，所以这里可能并不能正确初始化OIDC
 	if cfg.OIDC.Issuer != "" {
 		err = app.initOIDC()
@@ -210,6 +230,9 @@ func (h *Mirage) expireEphemeralNodesWorker() {
 						Str("machine", machine.Hostname).
 						Msg("🤮 Cannot delete ephemeral machine from the database")
 				}
+
+				// TODO: 并不好的处理
+				h.NotifyNaviOrgNodesChange(machine.User.OrganizationID, "", machine.NodeKey)
 			}
 		}
 
@@ -257,6 +280,8 @@ func (h *Mirage) expireExpiredMachinesWorker() {
 						Str("name", machine.GivenName).
 						Msg("Machine successfully expired")
 				}
+
+				h.NotifyNaviOrgNodesChange(machine.User.OrganizationID, "", machine.NodeKey)
 			}
 		}
 

controller/cockpit.go

@@ -25,6 +25,7 @@ import (
 )
 
 type Cockpit struct {
+	App  *Mirage
 	db   *gorm.DB
 	Addr string
 

controller/cockpit_api_tenants.go

@@ -245,6 +245,7 @@ func (c *Cockpit) DestroyTenant(tenant *Organization) error {
 		if err != nil {
 			return err
 		}
+		c.App.NotifyNaviOrgNodesChange(machine.User.OrganizationID, "", machine.NodeKey)
 	}
 
 	users, err := c.ListTenantUsers(tenant.ID)

controller/console_api_machine.go

@@ -533,6 +533,8 @@ func (h *Mirage) ConsoleRemoveMachineAPI(
 				}
 				return
 			}
+			h.NotifyNaviOrgNodesChange(user.OrganizationID, "", machine.NodeKey)
+
 			resData.Status = "OK"
 			resData.ErrMsg = "用户设备成功删除"
 			writer.Header().Set("Content-Type", "application/json; charset=utf-8")

controller/console_api_users.go

@@ -169,6 +169,7 @@ func (h *Mirage) CAPIPostUsers(
 				h.doAPIResponse(w, "目标用户设备删除失败:"+err.Error(), nil)
 				return
 			}
+			h.NotifyNaviOrgNodesChange(user.OrganizationID, "", m.NodeKey)
 		}
 		err = h.DestroyUser(targetUser.Name, targetUser.Organization.Name, targetUser.Organization.Provider)
 		if err != nil {

controller/console_auth.go

@@ -865,10 +865,16 @@ func (h *Mirage) registerMachineFromConsole(
 				Msg("Failed to restruct machine")
 			return nil, ErrCouldNotConvertMachineInterface
 		}
+
+		h.NotifyNaviOrgNodesChange(user.OrganizationID, newmachine.NodeKey, oldmachine.NodeKey)
+
 		machine, err := h.GetMachineByID(newmachine.ID)
 		return machine, nil
 	} else {
 		machine, err := h.RegisterMachine(newmachine)
+
+		h.NotifyNaviOrgNodesChange(user.OrganizationID, newmachine.NodeKey, "")
+
 		return machine, err
 	}
 }

controller/noise.go

@@ -67,7 +67,7 @@ func (h *Mirage) NoiseUpgradeHandler(
 		Methods(http.MethodPost)
 	router.HandleFunc("/machine/map", ts2021App.NoisePollNetMapHandler)
 
-	router.HandleFunc("/navi/map", ts2021App.NoiseNaviPollNodesListHandler).Methods(http.MethodPost)
+	router.HandleFunc("/navi/nodes", ts2021App.NoiseNaviPollNodesListHandler).Methods(http.MethodPost)
 
 	server := http.Server{
 		ReadTimeout: HTTPReadTimeout,

controller/protocol_common.go

@@ -360,6 +360,8 @@ func (h *Mirage) handleAuthKeyCommon(
 			Str("machine", machine.Hostname).
 			Msg("machine was already registered before, refreshing with new auth key")
 
+		h.NotifyNaviOrgNodesChange(machine.User.OrganizationID, nodeKey, machine.NodeKey)
+
 		machine.NodeKey = nodeKey
 		machine.AuthKeyID = uint(pak.ID)
 		machine.AuthKey = pak
@@ -429,6 +431,7 @@ func (h *Mirage) handleAuthKeyCommon(
 
 			return
 		}
+		h.NotifyNaviOrgNodesChange(machine.User.OrganizationID, nodeKey, "")
 	}
 
 	err = h.UsePreAuthKey(pak)
@@ -539,6 +542,8 @@ func (h *Mirage) handleMachineLogOutCommon(
 		return
 	}
 
+	h.NotifyNaviOrgNodesChange(machine.User.OrganizationID, "", machine.NodeKey)
+
 	log.Info().
 		Caller().
 		Str("machine", machine.Hostname).

controller/protocol_noise.go

@@ -43,7 +43,8 @@ func (t *ts2021App) NoiseRegistrationHandler(
 }
 
 type NaviRegisterResponse struct {
-	NodeInfo  NaviNode
+	NaviInfo   NaviNode
+	TrustNodes []string
 	Timestamp  *time.Time
 }
 
@@ -71,9 +72,17 @@ func (m *Mirage) handleRegisterNavi(
 			return
 		}
 		log.Trace().Caller().Msgf("Navi node %s registered", node.ID)
+
+		trustNodesKeys, err := m.getOrgNodesKey(node.NaviRegion.OrgID)
+		if err != nil {
+			log.Error().Caller().Err(err).Msg("Failed to get trust nodes key")
+			http.Error(writer, "Internal error", http.StatusInternalServerError)
+			return
+		}
 		now := time.Now().Round(time.Second)
 		resp := NaviRegisterResponse{
-			NodeInfo:  *node,
+			NaviInfo:   *node,
+			TrustNodes: trustNodesKeys,
 			Timestamp:  &now,
 		}
 		respBody, err := m.marshalResponse(resp, naviKey)
@@ -88,6 +97,18 @@ func (m *Mirage) handleRegisterNavi(
 		}
 		writer.Header().Set("Content-Type", "application/json; charset=utf-8")
 		writer.WriteHeader(http.StatusOK)
+
+		nc, err := m.GetNaviNoiseClient(naviKey, node.HostName, node.DERPPort)
+		if err != nil {
+			log.Error().
+				Caller().
+				Err(err).
+				Msg("Failed to get Navi Noise client")
+			return
+		}
+		m.DERPNCs[node.ID] = nc
+		m.DERPseqnum[node.ID] = 0 //初始化Noise client及序列号
+
 		_, err = writer.Write(respBody)
 		if err != nil {
 			log.Error().
@@ -112,7 +133,7 @@ func (m *Mirage) handleRegisterNavi(
 }
 
 type PullNodesListResponse struct {
-	TrustNodesList map[string]string `json:"TrustNodesList"`
+	TrustNodes []string   `json:"TrustNodes"`
 	Timestamp  *time.Time `json:"Timestamp"`
 }
 
@@ -145,30 +166,15 @@ func (t *ts2021App) NoiseNaviPollNodesListHandler(
 		return
 	}
 	if node.NaviKey == MachinePublicKeyStripPrefix(t.conn.Peer()) {
-		var machines []Machine
+		trustNodesKeys, err := t.mirage.getOrgNodesKey(node.NaviRegion.OrgID)
-		var err error
-		if node.NaviRegion.OrgID == 0 {
-			machines, err = t.mirage.ListMachines()
-		} else {
-			machines, err = t.mirage.ListMachinesByOrgID(node.NaviRegion.OrgID)
-		}
 		if err != nil {
-			log.Error().
+			log.Error().Caller().Err(err).Msg("Failed to get trust nodes key")
-				Caller().
-				Err(err).
-				Msg("Cannot list machines")
 			http.Error(writer, "Internal error", http.StatusInternalServerError)
 			return
 		}
-		log.Trace().Caller().Msgf("Navi node list for  %s prepared", node.ID)
-
-		nodeList := make(map[string]string)
-		for _, machine := range machines {
-			nodeList[NodePublicKeyEnsurePrefix(machine.NodeKey)] = ""
-		}
 		now := time.Now().Round(time.Second)
 		resp := PullNodesListResponse{
-			TrustNodesList: nodeList,
+			TrustNodes: trustNodesKeys,
 			Timestamp:  &now,
 		}
 
@@ -184,6 +190,9 @@ func (t *ts2021App) NoiseNaviPollNodesListHandler(
 		}
 		writer.Header().Set("Content-Type", "application/json; charset=utf-8")
 		writer.WriteHeader(http.StatusOK)
+
+		t.mirage.DERPseqnum[node.ID] = 0 //序列号置零
+
 		_, err = writer.Write(respBody)
 		if err != nil {
 			log.Error().

controller/protocol_noise_navictrl.go

@@ -0,0 +1,130 @@
+package controller
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+	"tailscale.com/control/controlclient"
+	"tailscale.com/net/tsdial"
+	"tailscale.com/types/key"
+	"tailscale.com/util/singleflight"
+)
+
+// 生成连接司南的Noise客户端
+func (m *Mirage) GetNaviNoiseClient(naviPub key.MachinePublic, naviHostname string, naviDERPPort int) (*controlclient.NoiseClient, error) {
+	dialer := &tsdial.Dialer{Logf: log.Logger.Printf}
+	var sfGroup singleflight.Group[struct{}, *controlclient.NoiseClient]
+	nc, err, _ := sfGroup.Do(struct{}{}, func() (*controlclient.NoiseClient, error) {
+		log.Trace().Caller().Msg("creating new noise client")
+		var nc *controlclient.NoiseClient
+		var err error
+		if naviDERPPort == 0 {
+			nc, err = controlclient.NewNoiseClient(*m.noisePrivateKey, naviPub, "https://"+naviHostname, dialer, nil)
+		} else {
+			nc, err = controlclient.NewNoiseClient(*m.noisePrivateKey, naviPub, "https://"+naviHostname+":"+strconv.Itoa(naviDERPPort), dialer, nil)
+		}
+		if err != nil {
+			return nil, err
+		}
+		return nc, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return nc, nil
+}
+
+func decodeNoiseResponse(res *http.Response, v any) error {
+	defer res.Body.Close()
+	msg, err := io.ReadAll(io.LimitReader(res.Body, 1<<20))
+	if err != nil {
+		return err
+	}
+	if res.StatusCode != 200 {
+		return fmt.Errorf("%d: %v", res.StatusCode, string(msg))
+	}
+	return json.Unmarshal(msg, v)
+}
+
+type NodesChange struct {
+	SeqNum     int
+	AddNode    string
+	RemoveNode string
+}
+
+func (m *Mirage) sendNodesChange(navi *NaviNode, addNode, removeNode string) error {
+	m.DERPseqnum[navi.ID]++
+	request := NodesChange{
+		SeqNum:     m.DERPseqnum[navi.ID],
+		AddNode:    addNode,
+		RemoveNode: removeNode,
+	}
+	url := fmt.Sprintf("https://%s/ctrl/nodes", navi.HostName)
+	bodyData, err := json.Marshal(request)
+	if err != nil {
+		return fmt.Errorf("node change request: %w", err)
+	}
+	req, err := http.NewRequestWithContext(m.ctx, "POST", url, bytes.NewReader(bodyData))
+	if err != nil {
+		return fmt.Errorf("node change request: %w", err)
+	}
+	res, err := m.DERPNCs[navi.ID].Do(req)
+	if err != nil {
+		return fmt.Errorf("node change request: %w", err)
+	}
+	if res.StatusCode != 200 {
+		msg, _ := io.ReadAll(res.Body)
+		res.Body.Close()
+		return fmt.Errorf("node change request: http %d: %.200s",
+			res.StatusCode, strings.TrimSpace(string(msg)))
+	}
+	return nil
+}
+
+func (m *Mirage) NotifyNaviOrgNodesChange(orgID int64, addNode, removeNode string) {
+	//TODO
+	nrs := m.ListNaviRegions()
+	for _, nr := range nrs {
+		if nr.OrgID == orgID || nr.OrgID == 0 {
+			nns := m.ListNaviNodes(nr.ID)
+			for _, nn := range nns {
+				err := m.sendNodesChange(&nn, addNode, removeNode)
+				if err != nil {
+					log.Error().
+						Caller().
+						Err(err).
+						Msg("Cannot send nodes change")
+				}
+			}
+		}
+	}
+}
+
+func (m *Mirage) getOrgNodesKey(orgID int64) ([]string, error) {
+	var machines []Machine
+	var err error
+	if orgID == 0 {
+		machines, err = m.ListMachines()
+	} else {
+		machines, err = m.ListMachinesByOrgID(orgID)
+	}
+	if err != nil {
+		log.Error().
+			Caller().
+			Err(err).
+			Msg("Cannot list machines")
+		return nil, err
+	}
+
+	nodeList := make([]string, 0)
+	for _, machine := range machines {
+		nodeList = append(nodeList, NodePublicKeyEnsurePrefix(machine.NodeKey))
+	}
+	return nodeList, nil
+}

controller/users.go

@@ -209,6 +209,7 @@ func (h *Mirage) ForceDestroyUserByID(userId int64) error {
 		if err := h.HardDeleteMachine(&machine); err != nil {
 			return nil
 		}
+		h.NotifyNaviOrgNodesChange(machine.User.OrganizationID, "", machine.NodeKey)
 	}
 
 	keys, err := h.ListPreAuthKeys(userId)

go.mod

@@ -116,7 +116,7 @@ require (
 	golang.org/x/mod v0.9.0 // indirect
 	google.golang.org/api v0.114.0 // indirect
 	google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect
-	google.golang.org/grpc v1.53.0 // indirect
+	google.golang.org/grpc v1.54.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -154,6 +154,7 @@ require (
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/subosito/gotenv v1.4.2 // indirect
+	go4.org v0.0.0-20230225012048-214862532bf5
 	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
 	golang.org/x/exp v0.0.0-20230315142452-642cacee5cc0 // indirect
 	golang.org/x/sys v0.6.0 // indirect

go.sum

@@ -518,6 +518,7 @@ github.com/russellhaering/goxmldsig v1.3.0 h1:DllIWUgMy0cRUMfGiASiYEa35nsieyD3ci
 github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
 github.com/samber/lo v1.37.0 h1:XjVcB8g6tgUp8rsPsJ2CvhClfImrpL04YpQHXeHPhRw=
 github.com/samber/lo v1.37.0/go.mod h1:9vaz2O4o8oOnK23pd2TrXufcbdbJIa3b6cstBWKpopA=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
@@ -629,6 +630,8 @@ go.uber.org/multierr v1.8.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95a
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8=
 go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
+go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=
+go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU=
 go4.org/mem v0.0.0-20220726221520-4f986261bf13 h1:CbZeCBZ0aZj8EfVgnqQcYZgf0lpZ3H9rmp5nkDTAst8=
 go4.org/mem v0.0.0-20220726221520-4f986261bf13/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
 go4.org/netipx v0.0.0-20230303233057-f1b76eb4bb35 h1:nJAwRlGWZZDOD+6wni9KVUNHMpHko/OnRwsrCYeAzPo=
@@ -740,6 +743,7 @@ golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1007,6 +1011,7 @@ google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA5
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc=
 google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
+google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=

go.work.sum

@@ -157,6 +157,7 @@ github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFb
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
+github.com/mdlayher/sdnotify v1.0.0 h1:Ma9XeLVN/l0qpyx1tNeMSeTjCPH6NtuD6/N9XdTlQ3c=
 github.com/pelletier/go-toml v1.9.4 h1:tjENF6MfZAg8e4ZmZTeWaWiT2vXtsoO6+iuOjFhECwM=
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=

server.go

@@ -98,7 +98,7 @@ func main() {
 					break
 				}
 
-				app, err := controller.NewMirage(cockpitMsg.SysCfg, datapool.DB())
+				cockpit.App, err = controller.NewMirage(cockpitMsg.SysCfg, datapool.DB())
 				if err != nil {
 					log.Error().Caller().Err(err).Msg("Error initializing Mirage")
 					msgChn <- controller.CtrlMsg{
@@ -108,7 +108,7 @@ func main() {
 					break
 				}
 
-				err = app.Serve(ctrlChn)
+				err = cockpit.App.Serve(ctrlChn)
 				if err != nil {
 					log.Error().Caller().Err(err).Msg("Error starting server")
 					msgChn <- controller.CtrlMsg{