Both stages compile a tailscale tree cloned from an unpinned branch. The
golang images set GOTOOLCHAIN=local, so the moment upstream raises its go
directive the build fails outright instead of fetching a toolchain.
(cherry picked from commit e40f47abbf)
Updates #3541, #3531
Adapted: #3525 is not backported, so the inline pre-auth key
re-registration path reports keysOnly, and NodeView.IsExpiredAt comes
along from it.
(cherry picked from commit a8d6f5be81)
ListPeers now filters named peers against the recipient's adjacency, so
a node the policy hides is never delivered.
Updates #3417
(cherry picked from commit 4c6a2dff52)
A write that cannot move visibility carries the previous adjacency
forward; policy and user changes rebuild it explicitly.
Updates #3417
(cherry picked from commit e3c4c81b18)
Adjacency becomes immutable, so a snapshot can resolve peers through its
own fresh views instead of storing them.
Updates #3417
(cherry picked from commit 95ba787417)
Fixes#3408
0.29's BuildPeerMap returns node views, not node IDs, so the peer map
assertion compares IDs read off the views.
(cherry picked from commit e48bc46cc6)
Matches SaaS; Apple clients hide the exit-node list without a suggestion.
Fixes#3415
0.29's tailscale has no tailcfg/nodecap package, so the constant keeps its
tailcfg name here and in the test.
(cherry picked from commit c604874dba)
Line numbers drift on every upstream bump.
0.29's tailscale has no tailcfg/nodecap package, so the constants keep their
tailcfg names here.
(cherry picked from commit 06fa3075da)
acmeLogger drained and closed the body of every ACME error response before
handing the response back to golang.org/x/crypto/acme. The client parses that
body to classify errors, so badNonce was no longer recognised: isBadNonce
returned false, clearNonces was never called and Client.post treated the 400 as
non-retriable.
One badNonce reply therefore stops certificate renewal for good. autocert
retries every 30-60 minutes, each attempt reuses a nonce stored from the
previous failed response, that nonce has already expired, and the loop repeats
until the process is restarted or the certificate expires.
Restore the body with a fresh reader after logging it.
(cherry picked from commit 7472e98f6c)
The filter lived in ACL.UnmarshalJSON, so grants, ssh and nodeAttrs still
hit RejectUnknownMembers. Strip the members in the HuJSON AST instead, at
the single decode entrypoint. Grant "app" payloads are left untouched.
Fixes#3479
(cherry picked from commit 5401edb6a8)
Updates #3470
TestExpireNode is rewritten against 0.29's gRPC node type: GetId, GetName
and GetOnline instead of the HTTP client's string fields.
(cherry picked from commit 932b8174f6)
Online now requires a live session and an unexpired key, derived in one
place by Node.ShouldBeOnline so every writer agrees what online means.
Fixes#3470
Connect keeps 0.29's NodeOnlineFor peer patch; only the not-online branch
is new here. The updateChanges hunk is dropped: 0.29 has no caller for it.
(cherry picked from commit 80c863b15a)
Going offline changes nothing the policy reads, so the row write skips
the policy refresh and peers get only the offline patch.
Updates #3417
(cherry picked from commit dfe0d3f2e5)
Each request is reduced to the narrowest change it justifies, so a
keepalive or endpoint bump no longer resends the whole node to peers.
Updates #3417
0.29 pins an older tailscale where Hostinfo.NetInfo.PreferredDERP is an int,
so the DERPRegionID types are int here.
(cherry picked from commit 59f3ff12a7)
An empty change carries no work for any recipient, so it never becomes
a pending entry. Adds headscale_mapper_changes_dropped_total.
Updates #3417
(cherry picked from commit 286f1d5a12)
Kristoffer Dalby
github-actions[bot]
Kristoffer Dalby
Andrei Korviakov