Struct CapabilityVersion

Source

pub struct CapabilityVersion(/* private fields */);

Expand description

Indicates the capability level of a Tailscale node. This must be kept in-sync with the CapabilityVersion constants in the Golang codebase (tailcfg/tailcfg.go).

It can be thought of as a node’s simple version number; a single monotonically increasing integer, rather than the complex x.y.z-cccccc semver+hash(es) versioning scheme. Whenever a node gains a capability or wants to negotiate a change in semantics with the control plane, peers, or an official frontend (such as LocalAPI in the Golang codebase), bump this number and document what’s changed.

The capability versions 0, 1, 2, and 35 are undefined; you cannot create a CapabilityVersion with these values.

Note: Prior to 2022-03-06, this value was known as the “MapRequest version”, mapVer, or “map cap”; you’ll still see that name used in comments throughout the Golang codebase.

Implementations§

Source §

impl CapabilityVersion

Source

pub const V3: Self

2020-??-??: implicit compression, keep-alives

Source

pub const V4: Self

2020-??-??: opt-in keep-alives via KeepAlive field, opt-in compression via Compress

Source

pub const V5: Self

2020-10-19: implies IncludeIPv6; delta Peers/UserProfiles, supports MagicDNS

Source

pub const V6: Self

2020-12-07: means MapResponse.PacketFilter nil means unchanged

Source

pub const V7: Self

2020-12-15: FilterRule.SrcIPs accepts CIDRs+ranges, doesn’t warn about 0.0.0.0/::

Source

pub const V8: Self

2020-12-19: client can buggily receive IPv6 addresses and routes if beta enabled server-side

Source

pub const V9: Self

2020-12-30: client doesn’t auto-add implicit search domains from peers; only DNSConfig.Domains

Source

pub const V10: Self

2021-01-17: client understands MapResponse.PeerSeenChange

Source

pub const V11: Self

2021-03-03: client understands IPv6; multiple default routes, and goroutine dumping

Source

pub const V12: Self

2021-03-04: client understands PingRequest

Source

pub const V13: Self

2021-03-19: client understands FilterRule.IPProto

Source

pub const V14: Self

2021-04-07: client understands DNSConfig.Routes and DNSConfig.Resolvers

Source

pub const V15: Self

2021-04-12: client treats nil MapResponse.DNSConfig as meaning unchanged

Source

pub const V16: Self

2021-04-15: client understands Node.Online, MapResponse.OnlineChange

Source

pub const V17: Self

2021-04-18: MapResponse.Domain empty means unchanged

Source

pub const V18: Self

2021-04-19: MapResponse.Node nil means unchanged (all fields now omitempty)

Source

pub const V19: Self

2021-04-21: MapResponse.Debug.SleepSeconds

Source

pub const V20: Self

2021-06-11: MapResponse.LastSeen used even less (https://github.com/tailscale/tailscale/issues/2107)

Source

pub const V21: Self

2021-06-15: added MapResponse.DNSConfig.CertDomains

Source

pub const V22: Self

2021-06-16: added MapResponse.DNSConfig.ExtraRecords

Source

pub const V23: Self

2021-08-25: DNSConfig.Routes values may be empty (for ExtraRecords support in 1.14.1+)

Source

pub const V24: Self

2021-09-18: MapResponse.Health from control to node; node shows in “tailscale status”

Source

pub const V25: Self

2021-11-01: MapResponse.Debug.Exit

Source

pub const V26: Self

2022-01-12: (nothing, just bumping for 1.20.0)

Source

pub const V27: Self

2022-02-18: start of SSHPolicy being respected

Source

pub const V28: Self

2022-03-09: client can communicate over Noise.

Source

pub const V29: Self

2022-03-21: MapResponse.PopBrowserURL

Source

pub const V30: Self

2022-03-22: client can request id tokens.

Source

pub const V31: Self

2022-04-15: PingRequest & PingResponse TSMP & disco support

Source

pub const V32: Self

2022-04-17: client knows FilterRule.CapMatch

Source

pub const V33: Self

2022-07-20: added MapResponse.PeersChangedPatch (DERPRegion + Endpoints)

Source

pub const V34: Self

2022-08-02: client understands CapabilityFileSharingTarget

Source

pub const V36: Self

2022-08-02: added PeersChangedPatch.{Key,DiscoKey,Online,LastSeen,KeyExpiry,Capabilities}

Source

pub const V37: Self

2022-08-09: added Debug.{SetForceBackgroundSTUN,SetRandomizeClientPort}; Debug are sticky

Source

pub const V38: Self

2022-08-11: added PingRequest.URLIsNoise

Source

pub const V39: Self

2022-08-15: clients can talk Noise over arbitrary HTTPS port

Source

pub const V40: Self

2022-08-22: added Node.KeySignature, PeersChangedPatch.KeySignature

Source

pub const V41: Self

2022-08-30: uses 100.100.100.100 for route-less ExtraRecords if global nameservers is set

Source

pub const V42: Self

2022-09-06: NextDNS DoH support; see https://github.com/tailscale/tailscale/pull/5556

Source

pub const V43: Self

2022-09-21: clients can return usernames for SSH

Source

pub const V44: Self

2022-09-22: MapResponse.ControlDialPlan

Source

pub const V45: Self

2022-09-26: c2n /debug/{goroutines,prefs,metrics}

Source

pub const V46: Self

2022-10-04: c2n /debug/component-logging

Source

pub const V47: Self

2022-10-11: Register{Request,Response}.NodeKeySignature

Source

pub const V48: Self

2022-11-02: Node.UnsignedPeerAPIOnly

Source

pub const V49: Self

2022-11-03: Client understands EarlyNoise

Source

pub const V50: Self

2022-11-14: Client understands CapabilityIngress

Source

pub const V51: Self

2022-11-30: Client understands CapabilityTailnetLockAlpha

Source

pub const V52: Self

2023-01-05: client can handle c2n POST /logtail/flush

Source

pub const V53: Self

2023-01-18: client respects explicit Node.Expired + auto-sets based on Node.KeyExpiry

Source

pub const V54: Self

2023-01-19: Node.Cap added, PeersChangedPatch.Cap, uses Node.Cap for ExitDNS before Hostinfo.Services fallback

Source

pub const V55: Self

2023-01-23: start of c2n GET+POST /update handler

Source

pub const V56: Self

2023-01-24: Client understands CapabilityDebugTSDNSResolution

Source

pub const V57: Self

2023-01-25: Client understands CapabilityBindToInterfaceByRoute

Source

pub const V58: Self

2023-03-10: Client retries lite map updates before restarting map poll.

Source

pub const V59: Self

2023-03-16: Client understands Peers[].SelfNodeV4MasqAddrForThisPeer

Source

pub const V60: Self

2023-04-06: Client understands IsWireGuardOnly

Source

pub const V61: Self

2023-04-18: Client understand SSHAction.SSHRecorderFailureAction

Source

pub const V62: Self

2023-05-05: Client can notify control over noise for SSHEventNotificationRequest recording failure events

Source

pub const V63: Self

2023-06-08: Client understands SSHAction.AllowRemotePortForwarding.

Source

pub const V64: Self

2023-07-11: Client understands s/CapabilityTailnetLockAlpha/CapabilityTailnetLock

Source

pub const V65: Self

2023-07-12: Client understands DERPMap.HomeParams + incremental DERPMap updates with params

Source

pub const V66: Self

2023-07-23: UserProfile.Groups added (available via WhoIs) (removed in 87)

Source

pub const V67: Self

2023-07-25: Client understands PeerCapMap

Source

pub const V68: Self

2023-08-09: Client has dedicated updateRoutine; MapRequest.Stream true means ignore Hostinfo+Endpoints

Source

pub const V69: Self

2023-08-16: removed Debug.LogHeap* + GoroutineDumpURL; added c2n /debug/logheap

Source

pub const V70: Self

2023-08-16: removed most Debug fields; added NodeAttrDisable*, NodeAttrDebug* instead

Source

pub const V71: Self

2023-08-17: added NodeAttrOneCGNATEnable, NodeAttrOneCGNATDisable

Source

pub const V72: Self

2023-08-23: TS-2023-006 UPnP issue fixed; UPnP can now be used again

Source

pub const V73: Self

2023-09-01: Non-Windows clients expect to receive ClientVersion

Source

pub const V74: Self

2023-09-18: Client understands NodeCapMap

Source

pub const V75: Self

2023-09-12: Client understands NodeAttrDNSForwarderDisableTCPRetries

Source

pub const V76: Self

2023-09-20: Client understands ExitNodeDNSResolvers for IsWireGuardOnly nodes

Source

pub const V77: Self

2023-10-03: Client understands Peers[].SelfNodeV6MasqAddrForThisPeer

Source

pub const V78: Self

2023-10-05: can handle c2n Wake-on-LAN sending

Source

pub const V79: Self

2023-10-05: Client understands UrgentSecurityUpdate in ClientVersion

Source

pub const V80: Self

2023-11-16: can handle c2n GET /tls-cert-status

Source

pub const V81: Self

2023-11-17: MapResponse.PacketFilters (incremental packet filter updates)

Source

pub const V82: Self

2023-12-01: Client understands NodeAttrLinuxMustUseIPTables, NodeAttrLinuxMustUseNfTables, c2n /netfilter-kind

Source

pub const V83: Self

2023-12-18: Client understands DefaultAutoUpdate

Source

pub const V84: Self

2024-01-04: Client understands SeamlessKeyRenewal

Source

pub const V85: Self

2024-01-05: Client understands MaxKeyDuration

Source

pub const V86: Self

2024-01-23: Client understands NodeAttrProbeUDPLifetime

Source

pub const V87: Self

2024-02-11: UserProfile.Groups removed (added in 66)

Source

pub const V88: Self

2024-03-05: Client understands NodeAttrSuggestExitNode

Source

pub const V89: Self

2024-03-23: Client no longer respects deleted PeerChange.Capabilities (use CapMap)

Source

pub const V90: Self

2024-04-03: Client understands PeerCapabilityTaildrive.

Source

pub const V91: Self

2024-04-24: Client understands PeerCapabilityTaildriveSharer.

Source

pub const V92: Self

2024-05-06: Client understands NodeAttrUserDialUseRoutes.

Source

pub const V93: Self

2024-05-06: added support for stateful firewalling.

Source

pub const V94: Self

2024-05-06: Client understands Node.IsJailed.

Source

pub const V95: Self

2024-05-06: Client uses NodeAttrUserDialUseRoutes to change DNS dialing behavior.

Source

pub const V96: Self

2024-05-29: Client understands NodeAttrSSHBehaviorV1

Source

pub const V97: Self

2024-06-06: Client understands NodeAttrDisableSplitDNSWhenNoCustomResolvers

Source

pub const V98: Self

2024-06-13: iOS/tvOS clients may provide serial number as part of posture information

Source

pub const V99: Self

2024-06-14: Client understands NodeAttrDisableLocalDNSOverrideViaNRPT

Source

pub const V100: Self

2024-06-18: Initial support for filtertype.Match.SrcCaps - actually usable in capver 109 (issue #12542)

Source

pub const V101: Self

2024-07-01: Client supports SSH agent forwarding when handling connections with /bin/su

Source

pub const V102: Self

2024-07-12: NodeAttrDisableMagicSockCryptoRouting support

Source

pub const V103: Self

2024-07-24: Client supports NodeAttrDisableCaptivePortalDetection

Source

pub const V104: Self

2024-08-03: SelfNodeV6MasqAddrForThisPeer now works

Source

pub const V105: Self

2024-08-05: Fixed SSH behavior on systems that use busybox (issue #12849)

Source

pub const V106: Self

2024-09-03: fix panic regression from cryptokey routing change (65fe0ba7b5)

Source

pub const V107: Self

2024-10-30: add App Connector to conffile (PR #13942)

Source

pub const V108: Self

2024-11-08: Client sends ServicesHash in Hostinfo, understands c2n GET /vip-services.

Source

pub const V109: Self

2024-11-18: Client supports filtertype.Match.SrcCaps (issue #12542)

Source

pub const V110: Self

2024-12-12: removed never-before-used Tailscale SSH public key support (#14373)

Source

pub const V111: Self

2025-01-14: Client supports a peer having Node.HomeDERP (issue #14636)

Source

pub const V112: Self

2025-01-14: Client interprets AllowedIPs of nil as meaning same as Addresses

Source

pub const V113: Self

2025-01-20: Client communicates to control whether funnel is enabled by sending Hostinfo.IngressEnabled (#14688)

Source

pub const V114: Self

2025-01-30: NodeAttrMaxKeyDuration CapMap defined, clients might use it (no tailscaled code change) (#14829)

Source

pub const V115: Self

2025-03-07: Client understands DERPRegion.NoMeasureNoHome.

Source

pub const V116: Self

2025-05-05: Client serves MagicDNS “AAAA” if NodeAttrMagicDNSPeerAAAA set on self node

Source

pub const V117: Self

2025-05-28: Client understands DisplayMessages (structured health messages), but not necessarily PrimaryAction.

Source

pub const V118: Self

2025-07-01: Client sends Hostinfo.StateEncrypted to report whether the state file is encrypted at rest (#15830)

Source

pub const V119: Self

2025-07-10: Client uses Hostinfo.Location.Priority to prioritize one route over another.

Source

pub const V120: Self

2025-07-15: Client understands peer relay disco messages, and implements peer client and relay server functions

Source

pub const V121: Self

2025-07-19: Client understands peer relay endpoint alloc with disco.AllocateUDPRelayEndpointRequest & disco.AllocateUDPRelayEndpointResponse

Source

pub const V122: Self

2025-07-21: Client sends Hostinfo.ExitNodeID to report which exit node it has selected, if any.

Source

pub const V123: Self

2025-07-28: fix deadlock regression from cryptokey routing change (issue #16651)

Source

pub const V124: Self

2025-08-08: removed NodeAttrDisableMagicSockCryptoRouting support, crypto routing is now mandatory

Source

pub const V125: Self

2025-08-11: dnstype.Resolver adds UseWithExitNode field.

Source

pub const V126: Self

2025-09-17: Client uses seamless key renewal unless disabled by control (tailscale/corp#31479)

Source

pub const V127: Self

2025-09-19: can handle C2N /debug/netmap.

Source

pub const V128: Self

2025-10-02: can handle C2N /debug/health.

Source

pub const V129: Self

2025-10-04: Fixed sleep/wake deadlock in magicsock when using peer relay (PR #17449)

Source

pub const V130: Self

2025-10-06: client can send key.HardwareAttestationPublic and key.HardwareAttestationKeySignature in MapRequest

Source

pub const V131: Self

2025-11-25: client respects NodeAttrDefaultAutoUpdate

Source

pub const V132: Self

2026-02-13: client respects NodeAttrDisableHostsFileUpdates

Source

pub const V133: Self

2026-02-17: client understands NodeAttrForceRegisterMagicDNSIPv4Only; MagicDNS IPv6 registered w/ OS by default

Source

pub const CURRENT: Self = Self::V125

The capability version this node declares to control.

This is a claim control and peers act on, so it is pinned to what this tree actually implements — not to the newest constant defined above. The constants above are a transcription of upstream’s list (they document what each version means); this one is a promise. Declaring a version whose behaviour is missing does not gain a feature, it just tells control to stop sending the compatibility path for it.

The value is bracketed from both sides, and both bounds are load-bearing. See Self::is_relay_capable for the lower one.

§Upper bound: below 126

The declaration is held at 125 because the next three versions each name a behaviour this tree does not have:

126 — seamless key renewal. Go renews the node key ahead of expiry without breaking connections (controlknobs.Knobs.SeamlessKeyRenewal). This tree’s expiry recovery is a node-key rotation plus a full re-register with the stored auth key (ts_control::Config::reauth_on_expiry, Go doLogin) — that is upstream’s non-seamless path, so connections do break across a renewal.
127 — c2n GET|POST /debug/netmap (Go handleC2NDebugNetMap, ipn/ipnlocal/c2n.go). Needs a netmap.NetworkMap aggregate to marshal; this tree has none — the netmap arrives as a stream of deltas accumulated by the runtime’s peer tracker.
128 — c2n /debug/health (Go handleC2NDebugHealth, ipn/ipnlocal/c2n.go). Needs a health.Tracker; this fork has no health subsystem.

and 138 (c2n /debug/tka/log, Go handleC2NDebugTKALog in feature/tailnetlock/tailnetlock.go) is unimplemented for the same reason: the AUM chain lives in ts_runtime, and the c2n responder in ts_control cannot reach it. All three paths take the responder’s 400 Bad Request / unknown c2n path fallthrough, which is exactly what Go’s handleC2N writes for an unregistered path.

125 is also a version a real client shipped (Tailscale v1.88.0 declares it), which keeps this coherent with the IPNVersion advertised in ts_control::hostinfo.

§Lower bound: at or above 121 — and the one exception it leaves standing

A capability version is a single integer, so declaring 125 also asserts 120 (“Client understands peer relay disco messages, and implements peer client and relay server functions”) and 121 (“Client understands peer relay endpoint alloc with disco.AllocateUDPRelayEndpointRequest & disco.AllocateUDPRelayEndpointResponse”). Neither is fully implemented here: this tree ports the peer-relay client half only — it answers an inbound CallMeMaybeVia and brings the relayed path up (ts_magicsock’s relay module) — but it never serves as a relay (Go net/udprelay.Server, feature/relayserver) and never originates an allocation request of its own.

That is a real overclaim, and it is deliberately not resolved the way 126, 127, 128 and 138 were, because here the two directions are not symmetric:

Lowering would be unconditionally destructive. An upstream peer decides whether we may be offered a relay path from our declared version alone, with magicsock.capVerIsRelayCapable(n.Cap()) — ported here as Self::is_relay_capable. It gates both endpoint.wantUDPRelayPathDiscoveryLocked (no discovery is started toward a peer below the floor) and the inbound CallMeMaybeVia handler (the message is ignored outright). Declaring 119 would mean no Go peer ever sends us a CallMeMaybeVia, making the ported client half unreachable in production. 122–125 would go with it, including 125’s dnstype.Resolver.UseWithExitNode, which ts_runtime::magic_dns does implement.
The overclaim is inert unless an operator opts in. The half we do not implement — serving as a relay — is additionally gated on tailnet policy: a peer treats us as a relay-server candidate only if it also holds peercap.RelayTarget (tailscale.com/cap/relay-target) on us (Conn.updateRelayServersSet), a grant an operator writes into the policy file. Absent it no peer ever asks us to allocate, and an AllocateUDPRelayEndpointRequest that does arrive is decoded and dropped. Contrast 127/128/138, which control acts on unilaterally the moment the version is declared — which is why those were resolved by lowering and this one is not.

Closing it for real means porting the relay server, which was ruled out of scope for an embedded client when the peer-relay client half landed. Until then it is a recorded, bounded exception rather than an oversight.

Before raising this, check that every version between the old value and the new one is implemented here, not just the topmost one — capability versions are monotone, so declaring N asserts everything at or below N. Before lowering it, check it against Self::is_relay_capable first.

Source

pub const fn is_relay_capable(self) -> bool

The capability version at and above which an upstream Go peer will treat a node as peer-relay capable: 121.

Faithful port of Go magicsock.capVerIsRelayCapable (wgengine/magicsock/magicsock.go, pinned at 49e148c4a30b4f8098f69468fd27a7021d85ea02), which is exactly version >= 121. Go evaluates it over a peer’s netmap tailcfg.Node.Cap and stores the result as endpoint.relayCapable, which gates two things:

endpoint.wantUDPRelayPathDiscoveryLocked — a peer below the floor never has UDP relay path discovery started toward it, so it is never sent a CallMeMaybeVia.
the inbound CallMeMaybeVia path in Conn.handleDiscoMessage — a CallMeMaybeVia from a peer below the floor is ignored (“is not known to be relay capable”).

So this is the floor Self::CURRENT must stay at or above for this tree’s ported peer-relay client half to be reachable at all by a real Tailscale peer; see that constant for why the tree sits above the floor despite not implementing all of 120/121.

Source