It walks every testdata folder, so a new folder is covered too. Captures
taken since tscap refuses such builds are listed until taken again.
(cherry picked from commit 729464091e)
The lock is taken before any credential check, so client-chosen machine
keys grew the map forever. Ref-count entries; delete at zero.
Fixes ANT-2026-ZC18AF82
(cherry picked from commit c9e9f72857)
One verdict per session, so one waiter: the newest. A displaced one
returns at once (register error, SSH re-delegate), not at session end.
A waiter keeps only the follow-up URL and the cached registration.
Fixes ANT-2026-NM50ZP4N
(cherry picked from commit b833be283c, adapted: follow-up trimmed in 0.29's RegistrationHandler)
The hijack drops the outer server's deadlines; any machine key gets a
tunnel.
Fixes ANT-2026-K903ZEUA
(cherry picked from commit 28959cb27c, adapted: 0.29 serves via http2.ServeConn, idle timeout set on http2.Server)
The rest arrives with the first MapRequest. A relogin keeps the node's
current Hostinfo, endpoints and disco key; an oversized merge is a 400.
Fixes ANT-2026-RQS7JAPP
(cherry picked from commit 5a4d366ce1, adapted: inline auth path and OIDC error on 0.29)
Rows stored before the bounds are trimmed the same way at load; a
Hostinfo still over budget is dropped until the node reports again.
Fixes ANT-2026-RQS7JAPP
Fixes ANT-2026-5B6KE87K
Fixes ANT-2026-KFCFFM34
(cherry picked from commit 4ce928411e, adapted: dropped main-only expiry UTC load and tests)
Keep the first 256 endpoints and 4096 routes; refuse longer hostnames,
too many tags, zoned endpoints and >64 KiB NetInfo or other Hostinfo.
The body limit counted wire bytes, not what NodeStore and peers keep.
Fixes ANT-2026-RQS7JAPP
Fixes ANT-2026-5B6KE87K
Fixes ANT-2026-KFCFFM34
(cherry picked from commit 2e563635d0, adapted: 0.29 RegistrationHandler closure, serveRegister test helper)
handleRegister, the OIDC auth path and SetNodeExpiry refuse it. Expiries
are stored in UTC, which SQLite can read back, and loaded in UTC, as
PostgreSQL returns the server's zone. The v1 API answers 400.
Fixes ANT-2026-QMCAFJ1Q
(cherry picked from commit 15a8c7584e, adapted: gRPC ExpireNode instead of REST v1)
json.Marshal refuses a year outside [0,9999], so one stored expiry
failed every map with that node. TailNode and key patches send UTC, the
builder drops what fails and the boot scan names the node.
Fixes ANT-2026-QMCAFJ1Q
(cherry picked from commit e3c1bfd68e, adapted: 0.29 imports)
Only a key that speaks for a tagged node re-authenticates it: a tagged
key, or one of the user it was tagged from. Another user's key or login
adds that user's own device, or only wakes the node under its node key.
Fixes ANT-2026-AWGRB7O1
(cherry picked from commit e1de83cbdf, adapted: inline PAK re-register path, no servertest compat table)
Such a route names a node, not a subnet: it stays approved and listed
but no viewer gets it. Via inclusions skip the election, so the rule
sits on everything RoutesForPeer returns.
Fixes ANT-2026-MLP8ZR5T
(cherry picked from commit 47d82023e7, adapted: only TestServesRoute in config_test, CHANGELOG dropped)
TryNewClient returns a refused login; Login covers profile switches and
interactive logins approved through ApproveAuth; RegisterAttempts reads
the client's register log.
(cherry picked from commit 5c2cf6ed6f, adapted: ApproveAuth via State, no v1 REST in servertest)
Relogin builds a new Direct on the same machine key and persisted
node key, as tailscaled does on up --auth-key; force rotates the key.
(cherry picked from commit 1716eece74, adapted: adds main's startPollLoop and resetNetmapState)
Routers announcing tailnet addresses, approved by policy, admin key and
devices:routes token; replayed through policy, map stream and v1/v2
APIs.
Updates ANT-2026-MLP8ZR5T
(cherry picked from commit 286d6ea05d, adapted: no v1/v2 API tests on 0.29)
Replays ten routes captures through the mapper too; SaaS's address
ranges for "*" now resolve. Known gaps are skip entries per node.
(cherry picked from commit 59f7c558a6)
Self and peer profiles, by login and display name. A tagged self gets
its own profile in SaaS; listed as a skip entry until headscale matches.
(cherry picked from commit 32652326b9)
Kristoffer Dalby
arkie
github-actions[bot]