4fd4da75f2
hscontrol: fix formatting after combining SSH policy changes
...
Updates #3517
2026-10-08 10:29:23 +02:00
8c66b76353
integration: block reused HA ping callback connections
...
Updates #3517
2026-10-08 10:29:23 +02:00
b8146aa7cd
tests: preserve SSH regressions after combining policy fixes
...
Updates #3517
2026-10-08 10:29:23 +02:00
b7aa328e0c
CHANGELOG: note SSH rule removal fix
...
Updates #3508
2026-10-08 10:29:23 +02:00
785ba22c65
mapper: send SSHPolicy only when it changes for the connection
...
Any non-nil SSHPolicy forces a full client netmap rebuild; the empty
policy now sent to every node made each policy change one.
Updates #3508
2026-10-08 10:29:23 +02:00
41c137bb3b
noise: drop unused ErrNoAuthSession
...
Kept separate so the check-rule fix cherry-picks to 0.29.
Updates #3508
2026-10-08 10:29:23 +02:00
9de8e9103f
ci: regenerate integration test list
...
Updates #3508
2026-10-08 10:29:23 +02:00
16c0e6b75a
integration: test SSH is denied once its rules are removed
...
Updates #3508
2026-10-08 10:29:23 +02:00
957a332d5d
policy/v2: match the login user in SSHCheckParams
...
The client picks the check rule by login user; the server took the
first rule for the node pair, so a root login could get a 12h
localpart period instead of "always", or be approved after its rule
was removed while another user's rule remained. Hold URLs now carry
the concrete user: tailssh never expanded the encoded $LOCAL_USER.
Updates #3508
2026-10-08 10:29:23 +02:00
dceb584c89
noise: reject SSH checks the policy no longer requires
...
A stale check rule still held and accepted after login. Deny with a 200
Reject (tailssh retries errors); re-check after the verdict.
Updates #3508
2026-10-08 10:29:23 +02:00
03e723c611
policy/v2: find SSH check params for localpart self-access
...
compileSSHPolicy sends these check rules; SSHCheckParams missed them,
so they never auto-approved within checkPeriod.
Updates #3508
2026-10-08 10:29:23 +02:00
d7b333d2aa
mapper: send an empty SSH policy when compiling it fails
...
Fail closed; nil kept the client's previous rules.
Updates #3508
2026-10-08 10:29:23 +02:00
2a0823ca41
policy/v2: send an empty SSH policy when no rule applies
...
Nil SSHPolicy means "unchanged" to clients; removed rules stayed live.
Match SaaS: "rules":[].
Fixes #3508
2026-10-08 10:29:23 +02:00
82df3e088a
servertest: test client drops SSH rules on policy removal
...
Updates #3508
2026-10-08 10:29:23 +02:00
e98e9289d6
policy/v2: test SSH rule removal yields empty SSHPolicy
...
Updates #3508
2026-10-08 10:29:23 +02:00
961535351f
policy/v2: check SSHPolicy nil vs empty against captures
...
Nil keeps client's old rules; empty clears them. Old normalization hid it.
Updates #3508
2026-10-08 10:29:23 +02:00
48046dc9c5
mapper: allow unchanged self in the full-update ping test
...
Updates #3518
2026-10-07 23:36:16 +02:00
2cd82ceb0c
CHANGELOG: note the own approved routes fix
...
Updates #3502
2026-10-07 23:36:16 +02:00
ea6b0bf0b7
mapper: reconcile self on policy recomputes
...
Self renders from the same state as peers, so leaving it out of policy
responses hid an exit node's approved routes until it reconnected.
Fixes #3502
2026-10-07 23:36:16 +02:00
ba413fca3d
state: return a node's primary routes in stable order
...
They came from map iteration, so an unchanged router rendered its self
node differently on every call.
Updates #3502
2026-10-07 23:36:16 +02:00
31582dd2c2
CHANGELOG: link derp-admit to pull request
2026-10-07 22:55:03 +02:00
e7bb90bac1
CHANGELOG: name both DERP verify paths
...
Embedded DERP verifies in-process, not through /verify.
2026-10-07 22:55:03 +02:00
541ef40c87
state: report unindexed node key instead of panicking
...
A missing key yields the zero NodeView; its ID() panicked inside a reader
goroutine and took down the test binary instead of failing with a diagnostic.
2026-10-07 22:55:03 +02:00
85bda7c2c9
types: drop unused Nodes.ContainsNodeKey
2026-10-07 22:55:03 +02:00
7ffdba7175
hscontrol: admit DERP clients via NodeKey index
...
/verify scanned every node per DERP connect; use GetNodeByNodeKey.
2026-10-07 22:55:03 +02:00
bc7fe6b8eb
state: test NodeKey index agrees with node list
...
Covers put, rotation and payload writes on the reuse path, and delete.
2026-10-07 22:55:03 +02:00
b35dd2238e
integration: reuse the prebuilt image for mock OIDC
...
Updates #3522
2026-10-07 18:11:07 +02:00
0e20065f6d
CHANGELOG: link logtail to pull request
2026-10-07 18:11:07 +02:00
29e18d80b4
docs: note the audit-log shutdown lasts until tailscale up
...
Clients that opt out of logging themselves hit it whatever logtail.enabled says.
2026-10-07 18:11:07 +02:00
da6c8f9dd3
CHANGELOG: say audit-log clients stay down after the logtail fix
2026-10-07 18:11:07 +02:00
0c9186d4a3
hscontrol: send the logtail instruction on the expired-self frame
...
It opens a deleted node's stream in place of the initial map.
2026-10-07 18:11:07 +02:00
52a7f8c89c
mapper: send the logtail instruction on every full map
...
Full maps moved to buildFromChange and lost WithDebugConfig, so no
frame told clients to disable log upload. Enabled logtail sends nil.
2026-10-07 18:11:07 +02:00
56e08f10e7
CHANGELOG: link ping-full to pull request
2026-10-07 15:25:25 +02:00
85587e2e29
change: drop untargeted pings when collapsing to a full
...
The ping ID in the URL is the only authentication on the answer, so
rescuing an untargeted ping for every node would let any node answer
for another. Rescue a ping only for the node it targets.
2026-10-07 15:25:25 +02:00
d4948da301
mapper: keep pings when a full update collapses pending changes
...
A full renders state at drain time but cannot carry a one-shot
PingRequest; queue each ping as a ping-only frame after the full.
2026-10-07 15:25:25 +02:00
e93f5d6ee0
CHANGELOG: link pak-revalidate to pull request
2026-10-07 14:03:54 +02:00
c4ce3f7d14
state: revalidate pre-auth key reuse when registration applies
2026-10-07 14:03:54 +02:00
00d64db9ef
CHANGELOG: link ssh-verdict-once to pull request
2026-10-07 12:50:32 +02:00
b35cb278c8
CHANGELOG: reword SSH check replay fix
2026-10-07 12:50:32 +02:00
97c4bf264e
noise: repeat concurrent SSH verdict waiters test
...
Nothing signals that both waiters parked before FinishAuth, so one
pass mostly checks them one after the other.
2026-10-07 12:50:32 +02:00
c9992efaca
noise: cover SSH verdict replay ledger and removed check
...
A replay must neither record auth for auto-approval nor, once the
pair is no longer under a check, be answered from the consumed
verdict.
2026-10-07 12:50:32 +02:00
133f8142c6
noise: re-decide SSH check follow-up after verdict consumed
...
Closed verdict channel yields zero AuthVerdict, which Accept() treats as
success; a replayed follow-up was accepted even after Reject.
2026-10-07 12:50:32 +02:00
2dcd5c876e
CHANGELOG: note unknown users in groups for 0.29.5
...
Updates #3513
2026-10-07 11:10:51 +02:00
925639b3aa
policy/v2: test unregistered users at every policy site
...
Each site must match the policy without them, and track their
registration and deletion.
Updates #3513
2026-10-07 11:10:51 +02:00
cb299184f7
servertest: check grant-v13 group via routes against SaaS
...
Updates #3513
2026-10-07 11:10:51 +02:00
85c754a1ac
policy/v2: resolve unregistered users to an empty set
...
Callers bailing on the error dropped a whole group for one missing
member: via routes, SSH check, app grants, nodeAttrs.
Fixes #3513
2026-10-07 11:10:51 +02:00
545322aec7
policy/v2: fail rejected-compile tests on an ambiguous user
...
A missing user will stop failing the compile.
Updates #3513
2026-10-07 11:10:51 +02:00
4776898029
state: roll back only registration fields on failed re-registration
...
Restoring the whole pre-update snapshot also reverted sessions that
connected during the failed write, stranding a live node offline.
2026-10-07 11:10:38 +02:00
f7c8b4d93f
state: serialise IP backfill with node persistence
...
A persist between the backfill's database write and its NodeStore reload
wrote the old addresses back, silently undoing the backfill.
2026-10-07 11:10:38 +02:00
84cf38ce24
derp/server: resolve the live DERP map in /bootstrap-dns
...
The handler captured the startup map, so hostnames added by
derp.auto_update never resolved.
2026-10-07 11:10:38 +02:00
Kristoffer Dalby
Kristoffer Dalby