From 47a99768a4e1a704ae8045a1abf6327d22d0d97d Mon Sep 17 00:00:00 2001 From: Dmitri Dolguikh Date: Tue, 14 Jul 2026 12:44:01 +0200 Subject: [PATCH] propagate client-side DisableComponentNetworkMap flag Signed-off-by: Dmitri Dolguikh --- client/internal/auth/auth.go | 1 + client/internal/connect.go | 16 +++++++++------- client/internal/engine.go | 17 ++++++++++------- client/internal/profilemanager/config.go | 15 ++++++++------- client/system/info.go | 18 ++++++++++-------- shared/management/client/grpc.go | 10 ++++++---- 6 files changed, 44 insertions(+), 33 deletions(-) diff --git a/client/internal/auth/auth.go b/client/internal/auth/auth.go index 51f56b644..c0d9d348b 100644 --- a/client/internal/auth/auth.go +++ b/client/internal/auth/auth.go @@ -351,6 +351,7 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) { a.config.BlockLANAccess, a.config.BlockInbound, a.config.DisableIPv6, + a.config.DisableComponentNetworkMap, a.config.EnableSSHRoot, a.config.EnableSSHSFTP, a.config.EnableSSHLocalPortForwarding, diff --git a/client/internal/connect.go b/client/internal/connect.go index c2fc2fd73..0d68e66d9 100644 --- a/client/internal/connect.go +++ b/client/internal/connect.go @@ -611,13 +611,14 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf DisableSSHAuth: config.DisableSSHAuth, DNSRouteInterval: config.DNSRouteInterval, - DisableClientRoutes: config.DisableClientRoutes, - DisableServerRoutes: config.DisableServerRoutes || config.BlockInbound, - DisableDNS: config.DisableDNS, - DisableFirewall: config.DisableFirewall, - BlockLANAccess: config.BlockLANAccess, - BlockInbound: config.BlockInbound, - DisableIPv6: config.DisableIPv6, + DisableClientRoutes: config.DisableClientRoutes, + DisableServerRoutes: config.DisableServerRoutes || config.BlockInbound, + DisableDNS: config.DisableDNS, + DisableFirewall: config.DisableFirewall, + BlockLANAccess: config.BlockLANAccess, + BlockInbound: config.BlockInbound, + DisableIPv6: config.DisableIPv6, + DisableComponentNetworkMap: config.DisableComponentNetworkMap, LazyConnection: lazyconn.ParseState(config.LazyConnection), @@ -693,6 +694,7 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte, config.BlockLANAccess, config.BlockInbound, config.DisableIPv6, + config.DisableComponentNetworkMap, config.EnableSSHRoot, config.EnableSSHSFTP, config.EnableSSHLocalPortForwarding, diff --git a/client/internal/engine.go b/client/internal/engine.go index 7f0b43b39..b9aea8b16 100644 --- a/client/internal/engine.go +++ b/client/internal/engine.go @@ -142,13 +142,14 @@ type EngineConfig struct { DNSRouteInterval time.Duration - DisableClientRoutes bool - DisableServerRoutes bool - DisableDNS bool - DisableFirewall bool - BlockLANAccess bool - BlockInbound bool - DisableIPv6 bool + DisableClientRoutes bool + DisableServerRoutes bool + DisableDNS bool + DisableFirewall bool + BlockLANAccess bool + BlockInbound bool + DisableIPv6 bool + DisableComponentNetworkMap bool // LazyConnection is the MDM-sourced lazy-connection override; StateUnset defers to // the env var and management feature flag. @@ -1228,6 +1229,7 @@ func (e *Engine) applyInfoFlags(info *system.Info) { e.config.BlockLANAccess, e.config.BlockInbound, e.config.DisableIPv6, + e.config.DisableComponentNetworkMap, e.config.EnableSSHRoot, e.config.EnableSSHSFTP, e.config.EnableSSHLocalPortForwarding, @@ -2096,6 +2098,7 @@ func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, err e.config.BlockLANAccess, e.config.BlockInbound, e.config.DisableIPv6, + e.config.DisableComponentNetworkMap, e.config.EnableSSHRoot, e.config.EnableSSHSFTP, e.config.EnableSSHLocalPortForwarding, diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go index ed2f21999..3ee2972bb 100644 --- a/client/internal/profilemanager/config.go +++ b/client/internal/profilemanager/config.go @@ -130,13 +130,14 @@ type Config struct { DisableSSHAuth *bool SSHJWTCacheTTL *int - DisableClientRoutes bool - DisableServerRoutes bool - DisableDNS bool - DisableFirewall bool - BlockLANAccess bool - BlockInbound bool - DisableIPv6 bool + DisableClientRoutes bool + DisableServerRoutes bool + DisableDNS bool + DisableFirewall bool + BlockLANAccess bool + BlockInbound bool + DisableIPv6 bool + DisableComponentNetworkMap bool DisableNotifications *bool diff --git a/client/system/info.go b/client/system/info.go index 1838204b8..47d0433e6 100644 --- a/client/system/info.go +++ b/client/system/info.go @@ -66,13 +66,14 @@ type Info struct { RosenpassPermissive bool ServerSSHAllowed bool - DisableClientRoutes bool - DisableServerRoutes bool - DisableDNS bool - DisableFirewall bool - BlockLANAccess bool - BlockInbound bool - DisableIPv6 bool + DisableClientRoutes bool + DisableServerRoutes bool + DisableDNS bool + DisableFirewall bool + BlockLANAccess bool + BlockInbound bool + DisableIPv6 bool + DisableComponentNetworkMap bool EnableSSHRoot bool EnableSSHSFTP bool @@ -85,7 +86,7 @@ func (i *Info) SetFlags( rosenpassEnabled, rosenpassPermissive bool, serverSSHAllowed *bool, disableClientRoutes, disableServerRoutes, - disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool, + disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6, disableComponentNetworkMap bool, enableSSHRoot, enableSSHSFTP, enableSSHLocalPortForwarding, enableSSHRemotePortForwarding *bool, disableSSHAuth *bool, ) { @@ -102,6 +103,7 @@ func (i *Info) SetFlags( i.BlockLANAccess = blockLANAccess i.BlockInbound = blockInbound i.DisableIPv6 = disableIPv6 + i.DisableComponentNetworkMap = disableComponentNetworkMap if enableSSHRoot != nil { i.EnableSSHRoot = *enableSSHRoot diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go index 489608074..f199db90e 100644 --- a/shared/management/client/grpc.go +++ b/shared/management/client/grpc.go @@ -1033,10 +1033,12 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta { func peerCapabilities(info system.Info) []proto.PeerCapability { caps := []proto.PeerCapability{ proto.PeerCapability_PeerCapabilitySourcePrefixes, - // PeerCapabilityComponentNetworkMap signals that this client can - // decode the components-format SyncResponse.NetworkMapEnvelope and - // run Calculate() locally. - proto.PeerCapability_PeerCapabilityComponentNetworkMap, + } + // PeerCapabilityComponentNetworkMap signals that this client can + // decode the components-format SyncResponse.NetworkMapEnvelope and + // run Calculate() locally. + if !info.DisableComponentNetworkMap { + caps = append(caps, proto.PeerCapability_PeerCapabilityComponentNetworkMap) } if !info.DisableIPv6 { caps = append(caps, proto.PeerCapability_PeerCapabilityIPv6Overlay)