The rest arrives with the first MapRequest. A relogin keeps the node's
current Hostinfo, endpoints and disco key; an oversized merge is a 400.
Fixes ANT-2026-RQS7JAPP
(cherry picked from commit 5a4d366ce1, adapted: inline auth path and OIDC error on 0.29)
Rows stored before the bounds are trimmed the same way at load; a
Hostinfo still over budget is dropped until the node reports again.
Fixes ANT-2026-RQS7JAPP
Fixes ANT-2026-5B6KE87K
Fixes ANT-2026-KFCFFM34
(cherry picked from commit 4ce928411e, adapted: dropped main-only expiry UTC load and tests)
Keep the first 256 endpoints and 4096 routes; refuse longer hostnames,
too many tags, zoned endpoints and >64 KiB NetInfo or other Hostinfo.
The body limit counted wire bytes, not what NodeStore and peers keep.
Fixes ANT-2026-RQS7JAPP
Fixes ANT-2026-5B6KE87K
Fixes ANT-2026-KFCFFM34
(cherry picked from commit 2e563635d0, adapted: 0.29 RegistrationHandler closure, serveRegister test helper)
handleRegister, the OIDC auth path and SetNodeExpiry refuse it. Expiries
are stored in UTC, which SQLite can read back, and loaded in UTC, as
PostgreSQL returns the server's zone. The v1 API answers 400.
Fixes ANT-2026-QMCAFJ1Q
(cherry picked from commit 15a8c7584e, adapted: gRPC ExpireNode instead of REST v1)
json.Marshal refuses a year outside [0,9999], so one stored expiry
failed every map with that node. TailNode and key patches send UTC, the
builder drops what fails and the boot scan names the node.
Fixes ANT-2026-QMCAFJ1Q
(cherry picked from commit e3c1bfd68e, adapted: 0.29 imports)
Only a key that speaks for a tagged node re-authenticates it: a tagged
key, or one of the user it was tagged from. Another user's key or login
adds that user's own device, or only wakes the node under its node key.
Fixes ANT-2026-AWGRB7O1
(cherry picked from commit e1de83cbdf, adapted: inline PAK re-register path, no servertest compat table)
Such a route names a node, not a subnet: it stays approved and listed
but no viewer gets it. Via inclusions skip the election, so the rule
sits on everything RoutesForPeer returns.
Fixes ANT-2026-MLP8ZR5T
(cherry picked from commit 47d82023e7, adapted: only TestServesRoute in config_test, CHANGELOG dropped)
TryNewClient returns a refused login; Login covers profile switches and
interactive logins approved through ApproveAuth; RegisterAttempts reads
the client's register log.
(cherry picked from commit 5c2cf6ed6f, adapted: ApproveAuth via State, no v1 REST in servertest)
Relogin builds a new Direct on the same machine key and persisted
node key, as tailscaled does on up --auth-key; force rotates the key.
(cherry picked from commit 1716eece74, adapted: adds main's startPollLoop and resetNetmapState)
Routers announcing tailnet addresses, approved by policy, admin key and
devices:routes token; replayed through policy, map stream and v1/v2
APIs.
Updates ANT-2026-MLP8ZR5T
(cherry picked from commit 286d6ea05d, adapted: no v1/v2 API tests on 0.29)
Replays ten routes captures through the mapper too; SaaS's address
ranges for "*" now resolve. Known gaps are skip entries per node.
(cherry picked from commit 59f7c558a6)
Self and peer profiles, by login and display name. A tagged self gets
its own profile in SaaS; listed as a skip entry until headscale matches.
(cherry picked from commit 32652326b9)
Both stages compile a tailscale tree cloned from an unpinned branch. The
golang images set GOTOOLCHAIN=local, so the moment upstream raises its go
directive the build fails outright instead of fetching a toolchain.
(cherry picked from commit e40f47abbf)
Updates #3541, #3531
Adapted: #3525 is not backported, so the inline pre-auth key
re-registration path reports keysOnly, and NodeView.IsExpiredAt comes
along from it.
(cherry picked from commit a8d6f5be81)
Kristoffer Dalby
github-actions[bot]