From 0d5e4f28e9b9779f28bfbd3fba125e2b2f043551 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Fri, 30 Oct 2026 15:56:02 +0000 Subject: [PATCH] types: stop sending machine keys in map entries Stable identity that outlives node key rotation. SaaS sends it on no entry; no client from our minimum version on acts on it. Updates #3626 --- hscontrol/mapper/tail_test.go | 3 --- hscontrol/servertest/mapstream_compat_test.go | 3 --- hscontrol/types/node.go | 1 - integration/helpers.go | 2 -- 4 files changed, 9 deletions(-) diff --git a/hscontrol/mapper/tail_test.go b/hscontrol/mapper/tail_test.go index 21fd6bdf3..3d65ce1e0 100644 --- a/hscontrol/mapper/tail_test.go +++ b/hscontrol/mapper/tail_test.go @@ -133,9 +133,6 @@ func TestTailNode(t *testing.T) { ), KeyExpiry: expire, - Machine: mustMK( - "mkey:f08305b4ee4250b95a70f3b7504d048d75d899993c624a26d422c67af0422507", - ), DiscoKey: mustDK( "discokey:cf7b0fd05da556fdc3bab365787b506fd82d64a70745db70e00e86c1b1c03084", ), diff --git a/hscontrol/servertest/mapstream_compat_test.go b/hscontrol/servertest/mapstream_compat_test.go index ff6cc6156..3e734dc9d 100644 --- a/hscontrol/servertest/mapstream_compat_test.go +++ b/hscontrol/servertest/mapstream_compat_test.go @@ -60,8 +60,6 @@ var mapStreamSkipReasons = map[string]string{ "map-delivery/S3.5-remove/db1/frames": policyResponseToEveryNode, "map-delivery/S3.5-restore/db1/frames": policyResponseToEveryNode, - "map-delivery/S2.0/own-entry/Machine": machineKeySent, - "map-delivery/S2.0/peer-entry/Machine": machineKeySent, "map-delivery/S2.0/peer-entry/MachineAuthorized": peerAuthorizedSent, "map-delivery/S2.0/own-entry/Cap": ownCapSent, "map-delivery/S2.0/own-entry/Online": ownOnlineSent, @@ -105,7 +103,6 @@ var mapStreamSkipReasons = map[string]string{ const ( policyResponseToEveryNode = "POLICY_RESPONSE_TO_EVERY_NODE: headscale sends every connected node a policy response when the policy, a node's tags or approved routes, or the set of nodes change; SaaS sends only the nodes whose peers or filter change" restartEndpointsKept = "RESTART_ENDPOINTS_KEPT: headscale keeps a restarted node's last endpoints at its peers until it reports new ones; SaaS sends peers the node without endpoints until then" - machineKeySent = "MACHINE_KEY_SENT: headscale puts a node's machine key on its own entry and on its peers' copies; SaaS on neither" peerAuthorizedSent = "PEER_AUTHORIZED_SENT: headscale sets MachineAuthorized on peer entries; SaaS only on a node's own" ownCapSent = "OWN_CAP_SENT: headscale sets Cap on a node's own entry; SaaS only on peers" ownOnlineSent = "OWN_ONLINE_SENT: headscale sets Online on a node's own entry; SaaS only on peers" diff --git a/hscontrol/types/node.go b/hscontrol/types/node.go index 6424510a4..a68a1ed15 100644 --- a/hscontrol/types/node.go +++ b/hscontrol/types/node.go @@ -1471,7 +1471,6 @@ func (nv NodeView) TailNode( Key: nv.NodeKey(), KeyExpiry: keyExpiry, - Machine: nv.MachineKey(), DiscoKey: nv.DiscoKey(), Addresses: addresses, PrimaryRoutes: primaryRoutes, diff --git a/integration/helpers.go b/integration/helpers.go index 469451368..4e1e6e640 100644 --- a/integration/helpers.go +++ b/integration/helpers.go @@ -809,7 +809,6 @@ func assertValidNetmap(t *testing.T, client TailscaleClient) { assert.Truef(c, netmap.SelfNode.Online().Get(), "%q is not online", client.Hostname()) assert.Falsef(c, netmap.SelfNode.Key().IsZero(), "%q does not have a valid NodeKey", client.Hostname()) - assert.Falsef(c, netmap.SelfNode.Machine().IsZero(), "%q does not have a valid MachineKey", client.Hostname()) assert.Falsef(c, netmap.SelfNode.DiscoKey().IsZero(), "%q does not have a valid DiscoKey", client.Hostname()) for _, peer := range netmap.Peers { @@ -829,7 +828,6 @@ func assertValidNetmap(t *testing.T, client TailscaleClient) { assert.Truef(c, peer.Online().Get(), "peer (%s) of %q is not online", peer.ComputedName(), client.Hostname()) assert.Falsef(c, peer.Key().IsZero(), "peer (%s) of %q does not have a valid NodeKey", peer.ComputedName(), client.Hostname()) - assert.Falsef(c, peer.Machine().IsZero(), "peer (%s) of %q does not have a valid MachineKey", peer.ComputedName(), client.Hostname()) assert.Falsef(c, peer.DiscoKey().IsZero(), "peer (%s) of %q does not have a valid DiscoKey", peer.ComputedName(), client.Hostname()) } }, 10*time.Second, 200*time.Millisecond, "Waiting for valid netmap for %q", client.Hostname())