TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-08-13 14:43:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

control/controlknobs,tailcfg,wgengine/magicsock: deprecate NodeAttrDisableMagicSockCryptoRouting (#16818)

Browse Source 
Peer Relay is dependent on crypto routing, therefore crypto routing is
now mandatory.

Updates tailscale/corp#20732
Updates tailscale/corp#31083

Signed-off-by: Jordan Whited <jordan@tailscale.com>
This commit is contained in:
Jordan Whited
2025-08-11 09:04:03 -07:00
committed by GitHub
parent 71d51eb8db
commit d122f0350e
3 changed files with 5 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
control/controlknobs/controlknobs.go
View File

@@ -98,10 +98,6 @@ type Knobs struct {
// allows us to disable the new behavior remotely if needed. // allows us to disable the new behavior remotely if needed.
DisableLocalDNSOverrideViaNRPT atomic.Bool DisableLocalDNSOverrideViaNRPT atomic.Bool
// DisableCryptorouting indicates that the node should not use the
// magicsock crypto routing feature.
DisableCryptorouting atomic.Bool
// DisableCaptivePortalDetection is whether the node should not perform captive portal detection // DisableCaptivePortalDetection is whether the node should not perform captive portal detection
// automatically when the network state changes. // automatically when the network state changes.
DisableCaptivePortalDetection atomic.Bool DisableCaptivePortalDetection atomic.Bool
@@ -137,7 +133,6 @@ func (k *Knobs) UpdateFromNodeAttributes(capMap tailcfg.NodeCapMap) {
userDialUseRoutes = has(tailcfg.NodeAttrUserDialUseRoutes) userDialUseRoutes = has(tailcfg.NodeAttrUserDialUseRoutes)
disableSplitDNSWhenNoCustomResolvers = has(tailcfg.NodeAttrDisableSplitDNSWhenNoCustomResolvers) disableSplitDNSWhenNoCustomResolvers = has(tailcfg.NodeAttrDisableSplitDNSWhenNoCustomResolvers)
disableLocalDNSOverrideViaNRPT = has(tailcfg.NodeAttrDisableLocalDNSOverrideViaNRPT) disableLocalDNSOverrideViaNRPT = has(tailcfg.NodeAttrDisableLocalDNSOverrideViaNRPT)
disableCryptorouting = has(tailcfg.NodeAttrDisableMagicSockCryptoRouting)
disableCaptivePortalDetection = has(tailcfg.NodeAttrDisableCaptivePortalDetection) disableCaptivePortalDetection = has(tailcfg.NodeAttrDisableCaptivePortalDetection)
disableSkipStatusQueue = has(tailcfg.NodeAttrDisableSkipStatusQueue) disableSkipStatusQueue = has(tailcfg.NodeAttrDisableSkipStatusQueue)
) )
@@ -165,7 +160,6 @@ func (k *Knobs) UpdateFromNodeAttributes(capMap tailcfg.NodeCapMap) {
k.UserDialUseRoutes.Store(userDialUseRoutes) k.UserDialUseRoutes.Store(userDialUseRoutes)
k.DisableSplitDNSWhenNoCustomResolvers.Store(disableSplitDNSWhenNoCustomResolvers) k.DisableSplitDNSWhenNoCustomResolvers.Store(disableSplitDNSWhenNoCustomResolvers)
k.DisableLocalDNSOverrideViaNRPT.Store(disableLocalDNSOverrideViaNRPT) k.DisableLocalDNSOverrideViaNRPT.Store(disableLocalDNSOverrideViaNRPT)
k.DisableCryptorouting.Store(disableCryptorouting)
k.DisableCaptivePortalDetection.Store(disableCaptivePortalDetection) k.DisableCaptivePortalDetection.Store(disableCaptivePortalDetection)
k.DisableSkipStatusQueue.Store(disableSkipStatusQueue) k.DisableSkipStatusQueue.Store(disableSkipStatusQueue)
} }

6
tailcfg/tailcfg.go
View File

@@ -168,7 +168,8 @@ type CapabilityVersion int
// - 121: 2025-07-19: Client understands peer relay endpoint alloc with [disco.AllocateUDPRelayEndpointRequest] & [disco.AllocateUDPRelayEndpointResponse] // - 121: 2025-07-19: Client understands peer relay endpoint alloc with [disco.AllocateUDPRelayEndpointRequest] & [disco.AllocateUDPRelayEndpointResponse]
// - 122: 2025-07-21: Client sends Hostinfo.ExitNodeID to report which exit node it has selected, if any. // - 122: 2025-07-21: Client sends Hostinfo.ExitNodeID to report which exit node it has selected, if any.
// - 123: 2025-07-28: fix deadlock regression from cryptokey routing change (issue #16651) // - 123: 2025-07-28: fix deadlock regression from cryptokey routing change (issue #16651)
const CurrentCapabilityVersion CapabilityVersion = 123 // - 124: 2025-08-08: removed NodeAttrDisableMagicSockCryptoRouting support, crypto routing is now mandatory
const CurrentCapabilityVersion CapabilityVersion = 124
// ID is an integer ID for a user, node, or login allocated by the // ID is an integer ID for a user, node, or login allocated by the
// control plane. // control plane.
@@ -2590,6 +2591,9 @@ const (
// NodeAttrDisableMagicSockCryptoRouting disables the use of the // NodeAttrDisableMagicSockCryptoRouting disables the use of the
// magicsock cryptorouting hook. See tailscale/corp#20732. // magicsock cryptorouting hook. See tailscale/corp#20732.
//
// Deprecated: NodeAttrDisableMagicSockCryptoRouting is deprecated as of
// CapabilityVersion 124, CryptoRouting is now mandatory. See tailscale/corp#31083.
NodeAttrDisableMagicSockCryptoRouting NodeCapability = "disable-magicsock-crypto-routing" NodeAttrDisableMagicSockCryptoRouting NodeCapability = "disable-magicsock-crypto-routing"
// NodeAttrDisableCaptivePortalDetection instructs the client to not perform captive portal detection // NodeAttrDisableCaptivePortalDetection instructs the client to not perform captive portal detection

6
wgengine/magicsock/magicsock.go
View File

@@ -1842,12 +1842,6 @@ func (c *Conn) receiveIP(b []byte, ipp netip.AddrPort, cache *epAddrEndpointCach
de, ok := c.peerMap.endpointForEpAddr(src) de, ok := c.peerMap.endpointForEpAddr(src)
c.mu.Unlock() c.mu.Unlock()
if !ok { if !ok {
if c.controlKnobs != nil && c.controlKnobs.DisableCryptorouting.Load() {
// Note: UDP relay is dependent on cryptorouting enablement. We
// only update Geneve-encapsulated [epAddr]s in the [peerMap]
// via [lazyEndpoint].
return nil, 0, false, false
}
// TODO(jwhited): reuse [lazyEndpoint] across calls to receiveIP() // TODO(jwhited): reuse [lazyEndpoint] across calls to receiveIP()
// for the same batch & [epAddr] src. // for the same batch & [epAddr] src.
return &lazyEndpoint{c: c, src: src}, size, isGeneveEncap, true return &lazyEndpoint{c: c, src: src}, size, isGeneveEncap, true