Repository navigation
fix(state): skip an app on every connector for machines at one connector's site - #64
Merged
Merged
Conversation
trancong12102
added a commit
that referenced
this pull request
Oct 14, 2026
…#65) Tailscale 1.104 was released at capability version 148. Until the capver tables include it, the `generated` check fails on every branch, including #62 and #64. **Changes** - `go generate ./hscontrol/capver/` only, not the full `make generate`. It adds `v1.104 → 148`, and `MinSupportedCapabilityVersion` moves from 115 to 116, so the supported window is now 1.84–1.104. The oldest client in production is 1.98.5, so nobody is refused. - `docs/content/ref/policy.mdx` claimed netmap caching was expected with 1.104. It needs capver 149, which is a later release. **What 1.104 adds over 1.102 (capvers 143–148), reviewed for drop, change or adopt** - 143 conn25 attrs ignored when not enabled, and 144 TSMP disco advertisement: client-side only, nothing to do. - 145 `scope-quad100-macos` and 146 `debug-conn-reject`: policy `nodeAttrs` already pass any attribute through, so operators can set both today. - 147 the client honours 429/503 with `Retry-After` on `/machine/`: will be adopted in a follow-up for load shedding, motivated by the 2026-10-14 incident. - 148 `Node.StableTailnetID`: already sent (`mapper/builder.go`). `CanOldCodeBeCleanedUp` is not tripped, since the threshold is 148 and the minimum is now 116. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…tor's site A machine behind the same NAT address as a connector skipped only that connector. With a second connector abroad for failover, an office machine sent the app's names to the abroad connector, which learned the answers and carried the traffic, so office AWS calls went through Frankfurt. The machine now skips the app itself: no split DNS for its domains toward any connector, and no connector carries its static routes in the machine's view. The connector behind the machine's address still drops its learned routes too; another connector keeps them, since they cannot be told apart from those of the apps it serves alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
trancong12102
force-pushed
the
fix/app-bypass-every-connector
branch
from
October 14, 2026 09:13
9a9ded5 to
2dd4ca7
Compare
Merged
trancong12102
added a commit
that referenced
this pull request
Oct 14, 2026
A release is ready. Read the notes below as an operator would, fix a wrong line by editing the commit's PR body with a BEGIN_COMMIT_OVERRIDE block, and merge to tag and publish. --- ## [0.58.2](v0.58.1...v0.58.2) (2026-10-14) ### Fixes * **capver:** track Tailscale 1.104 and refuse clients older than 1.84 ([#65](#65)) ([53a652f](53a652f)) * **mapper:** stop a slow control plane from piling up abandoned sessions ([#66](#66)) ([f4f8b87](f4f8b87)) * **state:** skip an app on every connector for machines at one connector's site ([#64](#64)) ([03bfc35](03bfc35)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the 2026-10-14 incident (#62).
Problem. The AWS app needs
tag:eu-gatewayas a failover connector next to office-1, and both egress addresses are on the AWS IAM allowlist.bypassedAppsanddnsConnectorsskipped connectors one at a time, so an office machine (same NAT as office-1) skipped office-1 but still used eu. Its app DNS went to eu, eu learned the answers, and office AWS API calls detoured through Frankfurt. In productionsts.amazonaws.comrouted via eu from mac-studio until eu was taken off the app.Change.
State.skippedApps(node)returns the apps that have any connector behind the node's public address.AppDNSRoutesgives those apps no split DNS.RoutesForPeerdrops the static routes of those apps from every connector. Learned host routes are still dropped only from the same-address connector: another connector may serve other apps that need its own egress (G-STAR, the Cloudflare zone), and a learned /32 cannot be attributed to an app.docs/content/ref/apps.mdxdescribes the new behaviour.Tests.
TestAppConnectorBypassEveryConnectorcovers two connectors and two apps (one shared, one abroad-only) for an office machine, a home machine, and the office machine moving away. It fails on main at the office-machine condition and passes here.go test -short ./hscontrol/{state,mapper,servertest}/...and golangci-lint pass, andmake docsis clean.🤖 Generated with Claude Code