42 Commits

Author	SHA1	Message	Date
Kristoffer Dalby	2b30a15a68	cmd: add option to get and set policy directly from database (#2765)	2025-09-12 16:55:15 +02:00
Kristoffer Dalby	81b3e8f743	util: harden parsing of traceroute ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	9d236571f4	state/nodestore: in memory representation of nodes ... Initial work on a nodestore which stores all of the nodes and their relations in memory with relationship for peers precalculated. It is a copy-on-write structure, replacing the "snapshot" when a change to the structure occurs. It is optimised for reads, and while batches are not fast, they are grouped together to do less of the expensive peer calculation if there are many changes rapidly. Writes will block until commited, while reads are never blocked. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-09-09 09:40:00 +02:00
Kristoffer Dalby	a058bf3cd3	mapper: produce map before poll (#2628)	2025-07-28 11:15:53 +02:00
Kristoffer Dalby	c6d7b512bd	integration: replace time.Sleep with assert.EventuallyWithT (#2680)	2025-07-10 23:38:55 +02:00
nblock	e73b2a9fb9	Ensure that a username starts with a letter (#2635)	2025-06-24 14:45:44 +02:00
Kristoffer Dalby	f1206328dc	fix webauth + autoapprove routes (#2528) ... * types/node: add helper funcs for node tags Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * types/node: add DebugString method for node Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy/v2: add String func to AutoApprover interface Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy/v2: simplify, use slices.Contains Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy/v2: debug, use nodes.DebugString Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy/v1: fix potential nil pointer in NodeCanApproveRoute Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy/v1: slices.Contains Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration/tsic: fix diff in login commands Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: fix webauth running with wrong scenario Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: move common oidc opts to func Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: require node count, more verbose Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * auth: remove uneffective route approve Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * .github/workflows: fmt Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration/tsic: add id func Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: remove call that might be nil Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: test autoapprovers against web/authkey x group/tag/user Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: unique network id per scenario Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * Revert "integration: move common oidc opts to func" This reverts commit 7e9d165d4a900c304f1083b665f1a24a26e06e55. * remove cmd Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: clean docker images between runs in ci Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: run autoapprove test against differnt policy modes Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration/tsic: append, not overrwrite extra login args Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * .github/workflows: remove polv2 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-04-30 07:54:04 +02:00
Kristoffer Dalby	e3521be705	allow users to be defined with @ in v1 (#2495) ... * allow users to be defined with @ in v1 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove integration test rewrite hack Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove test rewrite hack Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add @ to integration tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * a bit to agressive removeals Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix last test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-03-30 11:19:05 +00:00
Kristoffer Dalby	603f3ad490	Multi network integration tests (#2464)	2025-03-21 11:49:32 +01:00
Kristoffer Dalby	87326f5c4f	Experimental implementation of Policy v2 (#2214) ... * utility iterator for ipset Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * split policy -> policy and v1 This commit split out the common policy logic and policy implementation into separate packages. policy contains functions that are independent of the policy implementation, this typically means logic that works on tailcfg types and generic formats. In addition, it defines the PolicyManager interface which the v1 implements. v1 is a subpackage which implements the PolicyManager using the "original" policy implementation. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use polivyv1 definitions in integration tests These can be marshalled back into JSON, which the new format might not be able to. Also, just dont change it all to JSON strings for now. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * formatter: breaks lines Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove compareprefix, use tsaddr version Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove getacl test, add back autoapprover Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use policy manager tag handling Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename display helper for user Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * introduce policy v2 package policy v2 is built from the ground up to be stricter and follow the same pattern for all types of resolvers. TODO introduce aliass resolver Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * wire up policyv2 in integration testing Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * split policy v2 tests into seperate workflow to work around github limit Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add policy manager output to /debug Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-03-10 16:20:29 +01:00
Kristoffer Dalby	7891378f57	Redo route code (#2422) ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-02-26 16:22:55 +01:00
Kristoffer Dalby	16868190c8	fix double login URL with OIDC (#2445) ... * factor out login url parser Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * move to not trigger test gen checker Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * return regresp or err after waiting for registration Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-02-25 18:16:07 +01:00
Kristoffer Dalby	b92bd3d27e	remove oidc migration (#2411) ... * remove oidc migration Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-02-07 13:49:45 +01:00
Nbelles	22277d1fc7	Spell check	2025-02-05 17:29:30 +01:00
Kristoffer Dalby	1c7f3bc440	no edit of oidc users, minimum hostname length (#2393) ... * return an error when renaming users from OIDC * set minimum hostname length of 2	2025-02-01 09:40:37 +00:00
Kristoffer Dalby	4c8e847f47	use dedicated registration ID for auth flow (#2337)	2025-01-26 22:20:11 +01:00
Kristoffer Dalby	c1f42cdf4b	relax user validation to allow emails, add tests from various oidc providers (#2364) ... * relax user validation to allow emails, add tests from various oidc providers Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-22 18:10:15 +01:00
Kristoffer Dalby	38aef77e54	allow @ and Log if OIDC username is not consider valid (#2340)	2025-01-16 18:04:54 +01:00
Kristoffer Dalby	380fcdba17	Add worker reading extra_records_path from file (#2271) ... * consolidate scheduled tasks into one goroutine Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename Tailcfg dns struct Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add dns.extra_records_path option Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * prettier lint Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * go-fmt Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-13 07:52:40 +00:00
Kristoffer Dalby	2fe65624c0	restore strip_email_domain for migration ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	a6b19e85db	more linter fixups (#2212) ... * linter fixes Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * conf Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update nix hash Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-22 15:54:58 +00:00
hopleus	cc42fc394a	#2177 Added conversion of 'Hostname' to 'givenName' in a node with FQDN rules applied (#2198)	2024-10-15 18:33:03 +02:00
Kristoffer Dalby	218138afee	Redo OIDC configuration (#2020) ... expand user, add claims to user This commit expands the user table with additional fields that can be retrieved from OIDC providers (and other places) and uses this data in various tailscale response objects if it is available. This is the beginning of implementing https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit trying to make OIDC more coherant and maintainable in addition to giving the user a better experience and integration with a provider. remove usernames in magic dns, normalisation of emails this commit removes the option to have usernames as part of MagicDNS domains and headscale will now align with Tailscale, where there is a root domain, and the machine name. In addition, the various normalisation functions for dns names has been made lighter not caring about username and special character that wont occur. Email are no longer normalised as part of the policy processing. untagle oidc and regcache, use typed cache This commits stops reusing the registration cache for oidc purposes and switches the cache to be types and not use any allowing the removal of a bunch of casting. try to make reauth/register branches clearer in oidc Currently there was a function that did a bunch of stuff, finding the machine key, trying to find the node, reauthing the node, returning some status, and it was called validate which was very confusing. This commit tries to split this into what to do if the node exists, if it needs to register etc. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-10-02 14:50:17 +02:00
Kristoffer Dalby	3964dec1c6	use tsaddr library and cleanups (#2150) ... * resuse tsaddr code instead of handrolled Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * ensure we dont give out internal tailscale IPs Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use prefix instead of string for routes Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove old custom compare func Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * trim unused util code Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-10-02 09:06:09 +02:00
enoperm	1e61084898	Add compatibility with only websocket-capable clients (#2132) ... * handle control protocol through websocket The necessary behaviour is already in place, but the wasm build only issued GETs, and the handler was not invoked. * get DERP-over-websocket working for wasm clients * Prepare for testing builtin websocket-over-DERP Still needs some way to assert that clients are connected through websockets, rather than the TCP hijacking version of DERP. * integration tests: properly differentiate between DERP transports * do not touch unrelated code * linter fixes * integration testing: unexport common implementation of derp server scenario * fixup! integration testing: unexport common implementation of derp server scenario * dockertestutil/logs: remove unhelpful comment * update changelog --------- Co-authored-by: Csaba Sarkadi <sarkadicsa@tutanota.de>	2024-09-21 12:05:36 +02:00
Kristoffer Dalby	f368ed01ed	2068 AutoApprovers tests (#2105) ... * replace old suite approved routes test with table driven Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add test to reproduce issue Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add integration test for 2068 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-09-05 16:46:20 +02:00
Kristoffer Dalby	cf6a606d74	fix route table migration wiping routes 0.22 -> 0.23 (#2076)	2024-08-27 18:54:28 +02:00
nadongjun	fdc034e8ae	Integrate GORM Logger with Zerolog and Add Configuration Options for Logging and Performance (#2040) ... * Integrate GORM logger with zerolog and add custom GORM configuration options * Add GormConfig struct to group GORM-related settings * Update debug mode instruction in config-example.yaml Co-authored-by: Kristoffer Dalby <kristoffer@dalby.cc> --------- Co-authored-by: Kristoffer Dalby <kristoffer@dalby.cc>	2024-08-19 11:47:52 +02:00
Kristoffer Dalby	11fde62b8c	remove custom contains funcs for slices.Contains (#2015) ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-07-19 09:04:04 +02:00
Kristoffer Dalby	2ce23df45a	Migrate IP fields in database to dedicated columns (#1869)	2024-04-17 07:03:06 +02:00
Kristoffer Dalby	5dbd59ca55	Get integration test netmap from watch-ipn command (#1729)	2024-02-18 23:22:18 +01:00
Kristoffer Dalby	b60ee9db54	improve errors for missing directories (#1765) ... * improve errors for missing directories Fixes #1761 Updates #1760 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update container docs Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog with /var changes Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-02-17 13:36:19 +01:00
Kristoffer Dalby	00e7550e76	Add assert func for verifying status, netmap and netcheck (#1723)	2024-02-09 07:26:41 +01:00
Kristoffer Dalby	55ca078f22	embed (hidden) tailsql for debugging (#1663) ... Signed-off-by: Kristoffer Dalby <kristoffer@dalby.cc>	2023-12-20 21:47:48 +01:00
Kristoffer Dalby	f65f4eca35	ensure online status and route changes are propagated (#1564)	2023-12-09 18:09:24 +01:00
Kristoffer Dalby	c0fd06e3f5	remove the use key stripping and store the proper keys (#1603)	2023-11-16 17:55:29 +01:00
Kristoffer Dalby	23a3adf8d2	use cmp.Diff instead of reflect.DeepEqual ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-07-01 21:55:47 +02:00
Kristoffer Dalby	665a3cc666	add generic logerr func to shorten code ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-07-01 08:35:04 +01:00
Kristoffer Dalby	717abe89c1	remove "stripEmailDomain" argument ... This commit makes a wrapper function round the normalisation requiring "stripEmailDomain" which has to be passed in almost all functions of headscale by loading it from Viper instead. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-06-21 10:31:48 +02:00
Kristoffer Dalby	c1218ad3c2	move reminder of dns funcs to util ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-06-08 16:34:15 +02:00
Kristoffer Dalby	feb15365b5	Split code into modules ... This is a massive commit that restructures the code into modules: db/ All functions related to modifying the Database types/ All type definitions and methods that can be exclusivly used on these types without dependencies policy/ All Policy related code, now without dependencies on the Database. policy/matcher/ Dedicated code to match machines in a list of FilterRules Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-05-26 12:24:50 +02:00
Kristoffer Dalby	14e29a7bee	create DB struct ... This is step one in detaching the Database layer from Headscale (h). The ultimate goal is to have all function that does database operations in its own package, and keep the business logic and writing separate. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-05-26 12:24:50 +02:00