As SaaS. Clients take a peer with their own user ID for a device of the same
owner, so every tagged peer was a file target and could read debug endpoints.
Updates #2462, #2970
SaaS sends its own domains, which name nothing here. Otherwise an exit node
proxies tailnet names, and where its OS resolver reaches MagicDNS a client
reads its view of the tailnet. MagicDNS only: without it, base_domain can be
public, and clients ask the exit node for its names. Reverse lookups stay
open, as on SaaS.
Updates #3626
As SaaS, on every offline patch and no online one. Peers otherwise show no
last-seen time until the next full map. SaaS sends a coarser time; the exact
one here is deliberate.
Updates #3626
SaaS treats app as if via were absent: v80 and v84 peer the same, v87 peers a
non-via router, v88 and v91 send the route on the primary. Dropping a via grant
with no ip at compile left grant-k12's nodes with no peers.
Updates #3626
Parts of a capture are read seconds apart, so an approval can split them.
Also refuses tool failures, lost nodes, unknown peers, lagging viewers and approvals that never landed.
tscap read approved_routes before the netmaps, and five captures lost a node.
Contiguous new addresses make SaaS and headscale source forms differ, so those checks are listed.
Also moved by recording now: capver 131 to 142, default-auto-update, self RoutableIPs.
dns.extra_records_path and derp.paths files ending in .json were decoded
with encoding/json, so a comment or trailing comma in otherwise valid
JSON made headscale refuse to load the file. Policy files already accept
HuJSON regardless of extension. HuJSON is a superset of JSON, so
standardizing .json input the same way as .hujson keeps every valid JSON
file decoding exactly as before.
Add tests for comments and trailing commas in extra records, in generic
.json decoding and in ACL policies, and for comment markers inside
string values.
Fixes#3627
`dnsname.SanitizeHostname` truncates a hostname to 63 characters. When
that label was already taken, resolveGivenName appended "-N" to the
full base, producing a 65+ character GivenName. Such a name is not a
valid DNS label, so the node cannot be rendered into its own netmap
or any peer's, and on PostgreSQL the varchar(63) given_name column
rejects the write.
Trim the base so base plus suffix fits in a DNS label and strip a
hyphen left at the cut. isAutoDerivedGivenName now compares against
the same bump, so a trimmed name still follows hostname changes
instead of being treated as an admin rename.
State.RenameUser went through UpdateUser and skipped the checks
db.RenameUser applies, so the API could rename an OIDC user, whose
name the identity provider owns, or rename any user to an invalid
name. Apply both checks in the update function and map the username
validation errors to 400.
A public IP permits exit defaults; private-only rules do not. Replay six
accepted and two refused SaaS captures with range-equivalence checks,
preserving provenance and the literal-default-route ACL validation gap.
Kristoffer Dalby
github-actions[bot]
Igor Serganov
Michael Lopez