webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

tailcfg: add a node attribute to explicitly disable netmap caching (#19947)

Browse Source 
Add a new tailcfg.NodeCapability (NodeAttrDisableCacheNetworkMaps) to allow the
policy document to override whether a node will receive the cache-network-maps
attribute by default. The client does not interpret this attribute directly, it
is used to influence decisions by the control plane.

As of 2026-06-01, cache-network-maps is only sent when explicitly requested by
the policy. In a future version, we will send it by default for clients with a
sufficient capability version (to be added in a future commit), except to
ephemeral nodes, unless the policy sets disable-cached-network-maps.

Updates #12639
Updates tailscale/projects#28

Change-Id: I6376376d7898f7da8db977e457dcd45df9deef41
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
This commit is contained in:
M. J. Fromberger
2026-06-01 15:16:45 -07:00
committed by GitHub
parent d64aaffc06
commit 8a63c023f0
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tailcfg/tailcfg.go
+6
View File
@@ -2786,6 +2786,12 @@ const (
// discard existing cached maps, and will not store any. // discard existing cached maps, and will not store any.
NodeAttrCacheNetworkMaps NodeCapability = "cache-network-maps" NodeAttrCacheNetworkMaps NodeCapability = "cache-network-maps"
// NodeAttrDisableCacheNetworkMaps indicates that the node should not cache
// network maps (as per [NodeAttrCacheNetworkMaps]) when it normally would.
// This attribute exists to allow the policy document to override the default.
// When set, it takes precedence over [NodeAttrCacheNetworkMaps].
NodeAttrDisableCacheNetworkMaps NodeCapability = "disable-cache-network-maps"
// NodeAttrDisableLinuxCGNATDropRule tells Linux clients to not insert a // NodeAttrDisableLinuxCGNATDropRule tells Linux clients to not insert a
// blanket firewall DROP rule for inbound traffic from the CGNAT IP range // blanket firewall DROP rule for inbound traffic from the CGNAT IP range
// that does not originate from the Tailscale network interface. // that does not originate from the Tailscale network interface.