public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-05 21:19:25 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,840 Commits 106 Branches 177 Tags
45948f2feb9dee2c81bdd980fd75dfd19cb4eea2
Commit Graph
277 Commits
Author SHA1 Message Date
Kristoffer Dalby b7fdc48a14 policy/v2, servertest: add policy generation golden data 
One policy over joins, a via router swap, an admin tag, a delete and a
group edit; filter, SSH, peers and routes per step, and the manager
against a fresh one.
 2026-10-28 14:30:16 +00:00
Kristoffer Dalby 74ed6cbf11 servertest, policy/v2: replay tag owner chain joins through registration 
A key login never asks the policy about requested tags, so the joins are
checked where headscale decides them. OAuth mints stay at
TagOwnedByTags.
 2026-10-28 14:29:59 +00:00
Kristoffer Dalby 0e93c4775f policy/v2: name the destination in sshTests failure breakdowns 
A failure reported against the wrong dst alias no longer passes.
 2026-10-28 14:29:35 +00:00
Kristoffer Dalby 2c6c7f070f policy/v2: check the SSH login 0 mapping apart from the rules 
Its skip entries no longer hide rule count, order or principals.
 2026-10-28 14:29:34 +00:00
Kristoffer Dalby 2b2149dc80 policy/v2: add grant port list refusal capture 
Grant and ACL refusals share one check-keyed refused/message check.
 2026-10-28 14:29:34 +00:00
Kristoffer Dalby 50fc2aadbc policy/v2, servertest: add via port captures 
A port-limited ACL entry beside a via grant, and a via tag with no
advertiser. Via HA replays now compare router filters by address.
 2026-10-28 14:29:32 +00:00
Kristoffer Dalby 208b617434 policy/v2, servertest: add multi-route router captures 
A seven-route router and an exit node under six policies; replayed
through policy, peer map and map stream. Peer map now checked against
SaaS peers.
 2026-10-28 14:29:31 +00:00
Kristoffer Dalby eb188b7686 policy/v2, mapper: add nextdns attr captures 
SaaS accepts malformed nextdns profiles and keeps them in the CapMap;
its resolver skips them. DoH addresses compare per node: path, query,
ID.
 2026-10-28 14:29:30 +00:00
Kristoffer Dalby 5c8d5ee8ce policy/v2: add user token captures 
SaaS answers for unknown users, a short name and a bare "@" at every
site. Each capture also runs under headscale-only user rows, at boot and
runtime; SaaS nodes must not change and overlay nodes get nothing.
 2026-10-28 14:29:30 +00:00
Kristoffer Dalby 01d4caa881 policy/v2, servertest: add via source loss captures 
Repeated via destinations, a user via source, and an empty one.
A rename that empties the via source must reach open streams as v67.
 2026-10-28 14:29:29 +00:00
Kristoffer Dalby d243cce26c policy/v2, servertest: add validation matrix and grant shape captures 
SaaS answers for sshTests sources, tests semantics, failure reports,
duplicate destinations, empty and allow-all policies, and refusals.
ACL and SSH compat checks are keyed per check; differences listed.
 2026-10-28 14:28:52 +00:00
Kristoffer Dalby 3c917c4e3d policy/v2: recapture tester rows with failure detail 
Re-runs keep SaaS's error data and validate answer. Tester compat checks
verdict, message, failure breakdown and node labels.
 2026-10-28 14:28:22 +00:00
Kristoffer Dalby 63c3436aa1 servertest: check refused policies leave the live policy unchanged 
Posts every policy SaaS refused through v2; filter, SSH, body and ETag
must stay as before. Policies headscale accepts are skip entries.
 2026-10-28 14:28:11 +00:00
Kristoffer Dalby e0b8df03b2 policy/v2: build tester nodes from the capture topology 
The fixed node list had other addresses than the captures, so address
and range tests ran against nodes SaaS never saw.
 2026-10-28 14:28:10 +00:00
Kristoffer Dalby 50a18bfce4 policy/v2: compare compat captures through the policy manager 
ACL, grant and SSH captures now also check FilterForNode and SSHPolicy,
which add the global merge and caches the per-node compile skips.
 2026-10-28 14:28:10 +00:00
Kristoffer Dalby 0467b8b9c0 servertest, policy/v2: add re-authentication golden data 
Expired, live, ephemeral and admin-tagged devices logging in again with
spent, revoked, valid and other users' keys, by key and by login;
tag ownership through tags per policy function.

Updates ANT-2026-LYVGXVSW
Updates ANT-2026-AWGRB7O1
 2026-10-28 14:20:11 +00:00
Kristoffer Dalby 388507fdea policy/v2, servertest, hscontrol: add tailnet overlap route captures 
Routers announcing tailnet addresses, approved by policy, admin key and
devices:routes token; replayed through policy, map stream and v1/v2
APIs.

Updates ANT-2026-MLP8ZR5T
 2026-10-28 14:17:50 +00:00
Kristoffer Dalby dd6e288aa1 policy/v2: index nodes by tag once per compile 
Each tag alias scanned every node, so with many tags a compile, run on
every NodeStore batch, was mostly HasTag.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 4933bb83d2 policyutil: match DstPorts as ranges when reducing filters 
Every node re-parsed every entry into an IPSet on every policy change;
under churn that was most of the batcher's CPU.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 7414c276f6 mapper: limit capability copies to requested peers 
Small peer updates should not copy capabilities for the entire tailnet.
 2026-10-22 22:17:36 +02:00
Kristoffer Dalby 65ac7af595 policy/v2: reuse grant destination resolutions 
Avoid resolving the same destination for each protocol and capability rule.
 2026-10-22 22:17:36 +02:00
Kristoffer Dalby cc66979b16 policy/v2: benchmark peer-map index alternatives 
Updates #3549
 2026-10-20 11:55:11 +02:00
Serhii Matsyshyn ce9e226994 policy/v2: explain the matcher bitset layout 2026-10-20 11:55:11 +02:00
Serhii Matsyshyn d11d392152 policy/v2: index matchers per node in BuildPeerMap 
BuildPeerMap checked every pair of nodes against every matcher. With many nodes and many rules this takes seconds, and it runs on every policy write and node registration.

Now each node's source and destination matchers are found once, and two nodes are peers when those sets share a matcher. The peer map is the same as before. A test compares the new code with the old loop on random networks.

Part of #3549
 2026-10-20 11:55:11 +02:00
Kristoffer Dalby 9f074ac15b policy/v2: keep comments in a policy set through the v2 API 
hujson.Parse aliases its input, so Standardize blanked the comments in
the caller's buffer, which api/v2 then stored.
 2026-10-15 13:28:12 +02:00
Jonas Schwartz 519b4621f3 policy/v2: add Grant.HasVia and tighten the changelog entry 2026-10-08 12:43:45 +02:00
Jonas Schwartz 9d5ce0752f policy/v2: resolve via-route grants lazily 
With a via grant in the policy, ViaRoutesForPeer still resolved every
grant's sources and destinations up front. Non-via grants are only read
once a via grant has matched the peer, which is rare (the peer must
advertise a covered route), and destinations only for grants whose
sources match the viewer. Resolve each grant on first use instead.

BenchmarkViaRoutesForPeer, mean per peer (Apple M3 Pro):

	policy     nodes  before    after
	via-mixed  100    9.5us     2.1us
	via-mixed  1000   69.0us    11.6us
	via        1000   8.1us     8.6us
 2026-10-08 12:43:45 +02:00
Jonas Schwartz f8018f177a policy/v2: skip via resolution when the policy has no via grants 
ViaRoutesForPeer runs for every peer of every map response. Before it
looks at Via, it converts every ACL to grants and resolves each grant's
sources and destinations against the whole node set. Only via grants
can add to the result and ACLs never carry via, so without a via grant
all of that work was discarded. On large tailnets it dominated map
generation. Return early instead.

BenchmarkViaRoutesForPeer, mean per peer (Apple M3 Pro):

	policy     nodes  before    after
	global     1000   21.8us    9ns, 0 allocs
	self       1000   45.0us    9ns, 0 allocs
	via        1000   8.1us     unchanged
	via-mixed  1000   69.0us    unchanged

Fixes #3512
 2026-10-08 12:43:45 +02:00
Kristoffer Dalby b8146aa7cd tests: preserve SSH regressions after combining policy fixes 
Updates #3517
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 957a332d5d policy/v2: match the login user in SSHCheckParams 
The client picks the check rule by login user; the server took the
first rule for the node pair, so a root login could get a 12h
localpart period instead of "always", or be approved after its rule
was removed while another user's rule remained. Hold URLs now carry
the concrete user: tailssh never expanded the encoded $LOCAL_USER.

Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 03e723c611 policy/v2: find SSH check params for localpart self-access 
compileSSHPolicy sends these check rules; SSHCheckParams missed them,
so they never auto-approved within checkPeriod.

Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 2a0823ca41 policy/v2: send an empty SSH policy when no rule applies 
Nil SSHPolicy means "unchanged" to clients; removed rules stayed live.
Match SaaS: "rules":[].

Fixes #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby e98e9289d6 policy/v2: test SSH rule removal yields empty SSHPolicy 
Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 961535351f policy/v2: check SSHPolicy nil vs empty against captures 
Nil keeps client's old rules; empty clears them. Old normalization hid it.

Updates #3508
 2026-10-08 10:29:23 +02:00
Kristoffer Dalby 925639b3aa policy/v2: test unregistered users at every policy site 
Each site must match the policy without them, and track their
registration and deletion.

Updates #3513
 2026-10-07 11:10:51 +02:00
Kristoffer Dalby 85c754a1ac policy/v2: resolve unregistered users to an empty set 
Callers bailing on the error dropped a whole group for one missing
member: via routes, SSH check, app grants, nodeAttrs.

Fixes #3513
 2026-10-07 11:10:51 +02:00
Kristoffer Dalby 545322aec7 policy/v2: fail rejected-compile tests on an ambiguous user 
A missing user will stop failing the compile.

Updates #3513
 2026-10-07 11:10:51 +02:00
Kristoffer Dalby a99c8a030c policy/v2: stop ViaRoutesForPeer appending into pm.pol.Grants 
Readers share pm.pol under RLock; appending ACL grants into its spare
capacity raced between concurrent callers.
 2026-10-07 11:10:38 +02:00
Kristoffer Dalby 357f34a778 state: send a node's DNS config with its own refresh 
Drained at dispatch for nodeAttrs changes from any policy, user or node
update, and for hostname/OS changes feeding NextDNS device metadata.
 2026-09-30 19:03:13 +02:00
Kristoffer Dalby 90d3e0dd73 policy/v2: check cached per-node results against a fresh compile 
Random node writes; every FilterForNode, MatchersForNode and SSHPolicy
read must match a PolicyManager built from the same nodes.
 2026-09-30 17:21:02 +02:00
Kristoffer Dalby 4fd766a431 policy/v2: leave the policy manager unchanged when a recompile fails 
updateLocked runs every fallible step before writing pm, so a failed
SetUsers or SetNodes no longer leaves half a new filter live.
 2026-09-30 17:21:02 +02:00
Kristoffer Dalby edf5cc994e policy/v2: drop per-node filter caches when users change 
autogroup:self sources resolve users by name outside the filter hash,
so SetUsers left stale self rules cached and reported no change.
 2026-09-30 17:21:02 +02:00
Kristoffer Dalby 21f6e46fb8 state: refresh policy nodes inside the peer map build 
One peer build per tag/user/IP/route write; callers detect policy moves
via NodesGeneration. Per-node caches only store results for the node
pm holds, so a mapper reading mid-build cannot pin a stale filter.
 2026-09-30 17:21:02 +02:00
Kristoffer Dalby 311d9323e0 policy/v2: count node-driven recompiles 
Lets a caller detect that its node write moved the policy when the
SetNodes ran on another goroutine.
 2026-09-30 17:21:02 +02:00
Kristoffer Dalby 86b4f7c430 state,policy: add peer map and NodeStore write benchmarks 
Cover BuildPeerMap, SetNodes, NodeStore writes and
UpdateNodeFromMapRequest across node counts and policy shapes.
 2026-09-30 17:21:02 +02:00
Kristoffer Dalby 9ce160ed5b policy/v2: keep the live policy when SetPolicy fails to compile 
SetPolicy assigned the new policy before compiling it, so a compile that
failed partway left the rejected filter live while the stored policy stayed
old.
 2026-09-30 17:21:02 +02:00
Kristoffer Dalby 3417e4cb77 policy/v2: add via exit node captures with unrelated rules 
SaaS keeps via exit steering unless a rule reaches the internet, and
sends exit nodes every rule, with or without via.

Updates #3493
 2026-09-30 17:20:46 +02:00
Kristoffer Dalby 7f5fdbe5d2 policy/v2: send exit nodes every user's autogroup:self rules 
Same as other rules: exit routes contain every self destination.

Updates #3493
 2026-09-30 17:20:46 +02:00
Kristoffer Dalby 61d1599393 policyutil: send approved exit nodes every rule 
Tailscale SaaS treats exit routes like subnet routes when reducing
filters; 0.0.0.0/0 contains every dst, so exit nodes get all rules.

Updates #3493
 2026-09-30 17:20:46 +02:00
Kristoffer Dalby 7efd22d0bb policy/v2: let autogroup:internet rules lift via exit steering 
A regular rule to the internet allows every exit node, but
autogroup:internet resolves to no prefix, so it never matched.

Updates #3493
 2026-09-30 17:20:46 +02:00