kayg/infraternal

Watch

Fork 0

Mesh: chunks carry dns_suffix to nodes that never negotiated mesh DNS, so 10-31 nodes get no mesh #481

New issue

Open

opened 2026-11-10 00:52:53 +00:00 by kayg · 0 comments

kayg commented

2026-11-10 00:52:53 +00:00

Owner

Split out of #382, from J418's review (#382 comment 89360, P3-b). Recorded here, and not fixed on mesh-compat-382, per the orchestrator.

What J418 saw

A node built on 10-31 (0c8639496) refuses every configuration chunk from any current server. It authenticated as rotation unsupported and epoch unsupported, but ended with config=null.
J418's explanation: Chunk.dns_suffix (mesh-dns, on in default builds) is serialized whenever it is set. A pre-mesh-dns strict decoder (deny_unknown_fields) rejects the field.
That build also cannot enroll at all since #291: it has no prepare-join-key, and an unbound invitation gets HTTP 400.
Bundle: j418-evidence.tgz on 89360, files live/agent-n3-0c86-transplant.log, live/live.sh and live/proof.sh. The transplant log in the bundle holds only the connection banner, so the refusal itself still needs a fresh reproduction.

What the code says (J287c, `mesh-compat-382` @ `aa395f24d`)

crates/plugins/mesh/src/dataplane.rs, Chunk.dns_suffix:

#[cfg(feature = "mesh-dns")]
#[serde(default = "default_dns_suffix", skip_serializing_if = "is_default_dns_suffix")]
pub dns_suffix: String,

The field is left out only when it equals DEFAULT_DNS_SUFFIX ("internal"). Any server whose zone differs sends it to every node, including nodes that never negotiated DNS names (Identity.dns_names). The coordinator does gate name/peer_names and the compact shape on negotiated capabilities, but I found no such gate for dns_suffix.

Scope

#380's fix holds for 9b0c731e8-era nodes, which J418's live A3 proves.
Nodes older than mesh-dns (10-31 builds) are affected only if they still exist and can still enroll. Since #291 they cannot enroll, so this matters only for already-enrolled 10-31 nodes.

Suggested fix (for the owner to schedule; not started)

Have the coordinator omit dns_suffix and the other mesh-dns chunk fields for a node that did not negotiate dns_names, the same way compact_access is gated. Add a wire-compatibility test that parses with the pre-mesh-dns Chunk schema, like nonrotating_peer_uses_pre_rotation_wire_shape.

Opened by J287c. No code has changed for this issue.

Split out of #382, from J418's review (#382 comment 89360, P3-b). Recorded here, and not fixed on `mesh-compat-382`, per the orchestrator. ## What J418 saw - A node built on 10-31 (`0c8639496`) refuses every configuration chunk from any current server. It authenticated as rotation unsupported and epoch unsupported, but ended with `config=null`. - J418's explanation: `Chunk.dns_suffix` (mesh-dns, on in default builds) is serialized whenever it is set. A pre-mesh-dns strict decoder (`deny_unknown_fields`) rejects the field. - That build also cannot enroll at all since #291: it has no `prepare-join-key`, and an unbound invitation gets HTTP 400. - Bundle: `j418-evidence.tgz` on 89360, files `live/agent-n3-0c86-transplant.log`, `live/live.sh` and `live/proof.sh`. The transplant log in the bundle holds only the connection banner, so the refusal itself still needs a fresh reproduction. ## What the code says (J287c, `mesh-compat-382` @ `aa395f24d`) `crates/plugins/mesh/src/dataplane.rs`, `Chunk.dns_suffix`: ```rust #[cfg(feature = "mesh-dns")] #[serde(default = "default_dns_suffix", skip_serializing_if = "is_default_dns_suffix")] pub dns_suffix: String, ``` The field is left out only when it equals `DEFAULT_DNS_SUFFIX` (`"internal"`). Any server whose zone differs sends it to every node, including nodes that never negotiated DNS names (`Identity.dns_names`). The coordinator does gate `name`/`peer_names` and the compact shape on negotiated capabilities, but I found no such gate for `dns_suffix`. ## Scope - #380's fix holds for `9b0c731e8`-era nodes, which J418's live A3 proves. - Nodes older than mesh-dns (10-31 builds) are affected only if they still exist and can still enroll. Since #291 they cannot enroll, so this matters only for already-enrolled 10-31 nodes. ## Suggested fix (for the owner to schedule; not started) Have the coordinator omit `dns_suffix` and the other mesh-dns chunk fields for a node that did not negotiate `dns_names`, the same way `compact_access` is gated. Add a wire-compatibility test that parses with the pre-mesh-dns `Chunk` schema, like `nonrotating_peer_uses_pre_rotation_wire_shape`. Opened by J287c. No code has changed for this issue.

kayg referenced this issue

2026-11-10 05:32:46 +00:00

Mesh: a node keeps a previous server's config version and silently refuses a new/restored server's snapshots (stale /run state, J255 F4) #382

kayg referenced this issue

2026-11-10 09:42:48 +00:00

Mesh: a node keeps a previous server's config version and silently refuses a new/restored server's snapshots (stale /run state, J255 F4) #382

No labels

launch-qa

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal#481

No description provided.

Rows
Columns

Mesh: chunks carry dns_suffix to nodes that never negotiated mesh DNS, so 10-31 nodes get no mesh #481

What J418 saw

What the code says (J287c, mesh-compat-382 @ aa395f24d)

Scope

Suggested fix (for the owner to schedule; not started)

What the code says (J287c, `mesh-compat-382` @ `aa395f24d`)