tailscale

mirror of https://github.com/tailscale/tailscale.git synced 2026-05-29 11:11:31 -04:00

Files

dragondscv 4b8115bb2c cmd/containerboot: clamp MSS to PMTU for proxy group pods (#19686 )

Single-pod ingress/egress proxies already called ClampMSSToPMTU when
setting up forwarding rules, but the proxy group (HA) code paths in
egressservices.go and ingressservices.go did not. This caused TCP
connections through proxy group pods to suffer from MSS/MTU mismatch
issues in environments where path MTU discovery is not working.

Add ClampMSSToPMTU calls in the egress sync loop (alongside the existing
EnsureSNATForDst call) and in addDNATRuleForSvc (alongside the existing
EnsureDNATRuleForSvc call), mirroring what the single-pod forwarding
rules already do.

Also add MSS clamping assertions to TestSyncIngressConfigs and track
ClampMSSToPMTU calls in FakeNetfilterRunner.

Fixes issue #19812 https://github.com/tailscale/tailscale/issues/19812.
Tracking internal ticket TSS-86326.

Signed-off-by: Jay Tung <ltung@crusoeenergy.com>
Co-authored-by: Jay Tung <ltung@crusoeenergy.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-28 12:57:38 +01:00

egressservices_test.go

cmd/{containerboot,k8s-operator}: don't return pointers to maps (#19593 )

2026-04-30 16:11:00 +01:00

egressservices.go

cmd/containerboot: clamp MSS to PMTU for proxy group pods (#19686 )

2026-05-28 12:57:38 +01:00

forwarding.go

all: use Go 1.26 things, run most gofix modernizers

2026-03-06 13:32:03 -08:00

ingressservices_test.go

cmd/containerboot: clamp MSS to PMTU for proxy group pods (#19686 )