A write that cannot move visibility carries the previous adjacency
forward; policy and user changes rebuild it explicitly.
Updates #3417
(cherry picked from commit e3c4c81b18)
Adjacency becomes immutable, so a snapshot can resolve peers through its
own fresh views instead of storing them.
Updates #3417
(cherry picked from commit 95ba787417)
Fixes#3408
0.29's BuildPeerMap returns node views, not node IDs, so the peer map
assertion compares IDs read off the views.
(cherry picked from commit e48bc46cc6)
Matches SaaS; Apple clients hide the exit-node list without a suggestion.
Fixes#3415
0.29's tailscale has no tailcfg/nodecap package, so the constant keeps its
tailcfg name here and in the test.
(cherry picked from commit c604874dba)
Line numbers drift on every upstream bump.
0.29's tailscale has no tailcfg/nodecap package, so the constants keep their
tailcfg names here.
(cherry picked from commit 06fa3075da)
acmeLogger drained and closed the body of every ACME error response before
handing the response back to golang.org/x/crypto/acme. The client parses that
body to classify errors, so badNonce was no longer recognised: isBadNonce
returned false, clearNonces was never called and Client.post treated the 400 as
non-retriable.
One badNonce reply therefore stops certificate renewal for good. autocert
retries every 30-60 minutes, each attempt reuses a nonce stored from the
previous failed response, that nonce has already expired, and the loop repeats
until the process is restarted or the certificate expires.
Restore the body with a fresh reader after logging it.
(cherry picked from commit 7472e98f6c)
The filter lived in ACL.UnmarshalJSON, so grants, ssh and nodeAttrs still
hit RejectUnknownMembers. Strip the members in the HuJSON AST instead, at
the single decode entrypoint. Grant "app" payloads are left untouched.
Fixes#3479
(cherry picked from commit 5401edb6a8)
Updates #3470
TestExpireNode is rewritten against 0.29's gRPC node type: GetId, GetName
and GetOnline instead of the HTTP client's string fields.
(cherry picked from commit 932b8174f6)
Online now requires a live session and an unexpired key, derived in one
place by Node.ShouldBeOnline so every writer agrees what online means.
Fixes#3470
Connect keeps 0.29's NodeOnlineFor peer patch; only the not-online branch
is new here. The updateChanges hunk is dropped: 0.29 has no caller for it.
(cherry picked from commit 80c863b15a)
Going offline changes nothing the policy reads, so the row write skips
the policy refresh and peers get only the offline patch.
Updates #3417
(cherry picked from commit dfe0d3f2e5)
Each request is reduced to the narrowest change it justifies, so a
keepalive or endpoint bump no longer resends the whole node to peers.
Updates #3417
0.29 pins an older tailscale where Hostinfo.NetInfo.PreferredDERP is an int,
so the DERPRegionID types are int here.
(cherry picked from commit 59f3ff12a7)
An empty change carries no work for any recipient, so it never becomes
a pending entry. Adds headscale_mapper_changes_dropped_total.
Updates #3417
(cherry picked from commit 286f1d5a12)
The interstitial was the body of /oidc/callback, the URL carrying the
single-use code, so any reload re-entered the spent exchange. Redirect to
GET /register/confirm/{auth_id}, also missing from the route table.
0.29 lacks the authPathURL helper from main, so it is added here.
(cherry picked from commit 6d377b5348)
Defence-in-depth fixes to the OIDC login flow.
Set the state/nonce cookie Secure flag from the configured server_url
scheme rather than req.TLS, so the cookies stay Secure behind a
TLS-terminating reverse proxy where the proxy-to-Headscale hop is plain
HTTP. Deriving it from config avoids trusting a spoofable
X-Forwarded-Proto header.
Make the OIDC state single-use: consume it from the cache on the
callback and clear the state/nonce cookies once validated, so a replayed
callback cannot resolve the same session and the cookies do not linger
until expiry.
Bound OIDC discovery to the caller's context so a slow or unreachable
issuer fails startup within the timeout instead of hanging, and validate
the issuer URL and required client_id/client_secret at config load so an
unworkable setup fails fast.
(cherry picked from commit 622e08f5e6)
A deleted node is served a self node with no StableID, so Status().Self.ID
goes empty; TestACLPolicyPropagationOverTime must match on hostname instead.
Updates #3410
(cherry picked from commit 2cefb7ec06)
A bare 404 is indistinguishable from any other map-path error to a Tailscale
client: it retries forever, still logged in. Only a self node with a past
KeyExpiry reaches NeedsLogin. Also skip the reconnect grace wait, which a
deleted node can never satisfy.
Fixes#3410
(cherry picked from commit b1fb6ed2e6)
It fills PeersRemoved without deleting anything. The batcher now tears down
the session behind every removed id, so a caller would kill a live poll.
Updates #3410
(cherry picked from commit 42bf00523a)
Dropping the batcher entry left serveLongPoll streaming to a node that no
longer exists: Close ranges b.nodes and can no longer reach it, so shutdown
blocks and the client keeps polling instead of re-authenticating.
Updates #3410
(cherry picked from commit 0b69e844f5)
DNS names are case-insensitive, but clients match extra records against
the lowercased query name, so records with mixed-case names (for example
"Printer.fritz.box" in an extra_records_path file) never resolved and
queries fell through to the global nameserver.
Normalize record names to lowercase where the records enter the tailcfg
DNS config, covering both dns.extra_records and extra_records_path.
Fixes#2782
(cherry picked from commit 95ba1f0566)
Covers every change shape under four policy shapes, plus connect churn. The
zero-matcher shape is the gap: buildTailPeers skips ReduceNodes there, so the
peer lookup is the only self filter left.
(cherry picked from commit 8995d8a558)
ListPeers with explicit IDs filtered every node, not every peer, so a change
batch naming the recipient returned it as its own peer. db.ListPeers keeps
this out with `id <> nodeID`; the NodeStore rewrite dropped it.
(cherry picked from commit d9aebf472d)
tailscale HEAD now requires Go 1.27.1, so the test image build failed
and every integration job skipped.
Same change as f3f6c9822 on main, written against 0.29's Dockerfiles.
The rename request sent the raw --identifier flag value, which is 0 when
the user was resolved with --name, so the API answered "user not found".
Send the matched user's ID instead.
Equivalent of #3442 on main, rewritten: that fix targets the v1 HTTP client,
which 0.29 does not have.
dockertest's bundled client builds against API v1.25; Docker Engine 29
rejects it (min 1.40), surfacing as a "broken pipe" that fails every local
image build. Pin to the daemon's reported version so builds use a live path.
Closes#2937
(cherry picked from commit dfc25f06e1)
After Remove/Rename, the extra-records filewatcher retried with
context.Background and the default 15-minute backoff budget, so Close
could not stop Run. Cancel that retry when closeCh closes. If the file
is still missing after the budget, watch the parent directory so a later
recreate is seen.
Close the fsnotify watcher on NewExtraRecordsManager error paths after
NewWatcher succeeds.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
(cherry picked from commit a48a42baf4)
Serve stored a Background context for tailsql and called
context.Done() during signal shutdown. Done only returns the
done channel and does not cancel, so tailsql never stopped
when Headscale shut down.
Create a cancellable child of the Serve context, run
`runTailSQLService` in the listener errgroup so its error is
surfaced, and call the cancel func on shutdown - tailsql
unblocks on ctx.Done.
(cherry picked from commit a9f80d8802)
Fix the inverted HTTP metrics skip condition, which caused the collector to ignore all requests except OPTIONS.
Apply the correction to both the main and Noise routers so regular HTTP traffic is included in http_requests_total and http_request_duration_seconds.
(cherry picked from commit 63ce8f2295)
The steps now open the Tailscale app first to install the VPN
configuration, which contradicted the warning against opening the app
after installation. The actual constraint is not signing in before the
headscale URL is set.
(cherry picked from commit cbe30304dc)
The instructions are duplicated between the docs and the HTML page
headscale serves at /apple. Reorder the tvOS steps there to match, so
the VPN configuration is installed before the alternate coordination
server URL is set.
(cherry picked from commit efe947507b)
The instructions didn't work for tvOS 26.6 / Tailscale 1.102.2. When the `ALTERNATE COORDINATION SERVER URL` is set, the `Install VPN Configuration` breaks.
Clicking does nothing and the tvOS app logs showed `addUser: backendManager does not exist`.
Instead I first started tailscale and installed the vpn profile and then add the headscale url and then signed. Which seemed to have worked
(cherry picked from commit fad937c062)
Kristoffer Dalby
Kristoffer Dalby
Andrei Korviakov
Sean Reifschneider
Saleh
Sebastien Tardif
Igor Serganov
Paulo Luna
Igor Bernstein