public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 12:39:25 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,797 Commits 106 Branches 177 Tags
6483fc2ae254be026ea7677cb83362941ffdbfc8
Commit Graph
4797 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kristoffer Dalby 6483fc2ae2 types, noise: bound the Hostinfo and endpoints a client reports 
Keep the first 256 endpoints and 4096 routes; refuse longer hostnames,
too many tags, zoned endpoints and >64 KiB NetInfo or other Hostinfo.
The body limit counted wire bytes, not what NodeStore and peers keep.

Fixes ANT-2026-RQS7JAPP
Fixes ANT-2026-5B6KE87K
Fixes ANT-2026-KFCFFM34
 2026-10-29 12:08:46 +00:00
Kristoffer Dalby e76e2d1170 hscontrol: refuse a key expiry that cannot be encoded 
handleRegister, the OIDC auth path and SetNodeExpiry refuse it. Expiries
are stored in UTC, which SQLite can read back, and loaded in UTC, as
PostgreSQL returns the server's zone. The v1 API answers 400.

Fixes ANT-2026-QMCAFJ1Q
 2026-10-29 12:08:46 +00:00
Kristoffer Dalby b41638b3d3 mapper: skip peers whose key expiry cannot be encoded 
json.Marshal refuses a year outside [0,9999], so one stored expiry
failed every map with that node. TailNode and key patches send UTC, the
builder drops what fails and the boot scan names the node.

Fixes ANT-2026-QMCAFJ1Q
 2026-10-29 12:08:46 +00:00
Kristoffer Dalby fb319e5cea .github: regenerate integration test workflow 2026-10-29 12:08:46 +00:00
Kristoffer Dalby af2c438dc6 state: give another user's key on a tagged machine a new device 
Only a key that speaks for a tagged node re-authenticates it: a tagged
key, or one of the user it was tagged from. Another user's key or login
adds that user's own device, or only wakes the node under its node key.

Fixes ANT-2026-AWGRB7O1
 2026-10-29 12:08:46 +00:00
Kristoffer Dalby ff668a7ab4 state: need a valid pre-auth key to re-register an expired tagged node 
Fixes ANT-2026-LYVGXVSW
 2026-10-29 12:08:46 +00:00
Kristoffer Dalby a515ea8e61 state: never serve a single address inside the node ranges 
Such a route names a node, not a subnet: it stays approved and listed
but no viewer gets it. Via inclusions skip the election, so the rule
sits on everything RoutesForPeer returns.

Fixes ANT-2026-MLP8ZR5T
 2026-10-29 12:08:46 +00:00
Kristoffer Dalby bb9387a50e servertest, policy/v2: add re-authentication golden data 
Expired, live, ephemeral and admin-tagged devices logging in again with
spent, revoked, valid and other users' keys, by key and by login;
tag ownership through tags per policy function.

Updates ANT-2026-LYVGXVSW
Updates ANT-2026-AWGRB7O1
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby fd12fc0fc0 servertest: add login, profile, restart and register log helpers 
TryNewClient returns a refused login; Login covers profile switches and
interactive logins approved through ApproveAuth; RegisterAttempts reads
the client's register log.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby 998ea87725 servertest: add route approval lifecycle golden data 
Owner changes, re-auth, revokes, policy pushes, withdraw and logout
replayed step by step against SaaS approvals and served routes.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby af5d445759 prek: exempt step captures from the large file check 
They keep a netmap per node per step and must stay as recorded.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby 848c88aaae servertest: add relogin and auth key helpers 
Relogin builds a new Direct on the same machine key and persisted
node key, as tailscaled does on up --auth-key; force rotates the key.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby be88f1636d policy/v2, servertest, hscontrol: add tailnet overlap route captures 
Routers announcing tailnet addresses, approved by policy, admin key and
devices:routes token; replayed through policy, map stream and v1/v2
APIs.

Updates ANT-2026-MLP8ZR5T
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby 0df3a06d4b servertest: compare router self routes with captures 
Replays ten routes captures through the mapper too; SaaS's address
ranges for "*" now resolve. Known gaps are skip entries per node.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby 9116117f03 servertest: compare user profiles in via captures 
Self and peer profiles, by login and display name. A tagged self gets
its own profile in SaaS; listed as a skip entry until headscale matches.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby 9d8f988fbf servertest: list passing via captures 
Fourteen committed via captures already match at map level; run them.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby 7c0d3b00c0 testcapture: record multi-step captures and API error detail 
Optional Steps, NodeIDs, error data and login state; v1 files unchanged.
Register log and raw map frame parsers; Write refuses auth keys and
login URLs.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby 998167d26e hscontrol: keep golden file names valid in Go module zips 
A '>' in one name stopped go get from fetching headscale.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby 02c748f409 .gitattributes: mark golden data as generated 
GitHub collapses generated files in pull request diffs.
 2026-10-29 12:08:45 +00:00
Kristoffer Dalby cd66e2414a noise: restrict metrics to the metrics listener 
Fixes #3571
 2026-10-29 13:05:56 +01:00
Kristoffer Dalby 1a48b276ef docs: explain how to disable SSH forwarding 2026-10-29 12:43:14 +01:00
Kristoffer Dalby 998c4b0619 policy: pin SSH forwarding behavior and recommend upgrades 2026-10-29 12:43:14 +01:00
Kristoffer Dalby bd1876e1fa tools/bump: keep the tested Terraform provider releases current 
A new release arrives as a bump pull request; verify reports a stale set.
 2026-10-29 11:04:05 +01:00
Kristoffer Dalby b730a2ccc1 servertest: test the newest three Terraform provider releases 
Releases run in parallel, each on its own server, sharing one plugin cache.
A test of a provider feature runs only on releases that have it.
 2026-10-29 11:04:05 +01:00
Kristoffer Dalby a8e20560fc gen/client/v2: regenerate for the acl/validate endpoint 2026-10-29 11:04:05 +01:00
Kristoffer Dalby a63ee3e032 api/v2: add the acl/validate endpoint 
Checks a policy as a write would, without storing it. As on Tailscale,
a refused policy answers 200 with its reason; only an empty body is 400.
Terraform provider 0.29.3 calls it at plan time.
 2026-10-29 11:04:05 +01:00
Kristoffer Dalby a336e1e7e6 policy/v2: keep failing tests apart per entry 
A refusal can then name each failing test's src.
 2026-10-29 11:04:05 +01:00
github-actions[bot] 00f597aa6d Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3599#issuecomment-6473763699
 2026-10-29 06:58:58 +01:00
Kristoffer Dalby 2d220b2eb8 mkdocs: set the current release to 0.29.6 2026-10-24 15:43:39 +02:00
Kristoffer Dalby f3fc915b71 CHANGELOG: set the 0.29.6 release date 2026-10-24 15:43:39 +02:00
Kristoffer Dalby 33544f62cb CHANGELOG: document the 0.29.6 security and patch release 
Updates #3579 and #3549.
 2026-10-24 11:15:20 +02:00
Kristoffer Dalby 30ff8df93c integration: ignore disconnected recipients when checking map state 
Disconnected streams retain historical maps and cannot receive peer updates.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby e195ce9675 CHANGELOG: map session and churn fixes 2026-10-23 18:23:53 +02:00
Kristoffer Dalby eed5c8c80a mapper: count folded patches when bounding pending 
A fold keeps every patch it merges, so counting changes hid the
backlog: the cap never fired and each fold recopied the patches.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby daad12e964 mapper: retry slow sessions from current state 
A full session channel after the send window evicted live but busy clients.
Requeue and regenerate; evict after no progress for connectionStallTimeout.
Retire blocked reconnect siblings once the newest stream accepts the frame.

Updates #3129.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby f46ea3d1df mapper: skip responses left empty by visibility filtering 
A peer change hidden from a recipient still produced a frame carrying only
ControlTime, one per sender per recipient. Drop it once the response is final.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 2047ef35b8 hscontrol: wait for map session cleanup during shutdown 
Batcher shutdown cuts reconnect grace short to keep shutdown prompt.
Wait for each session's Disconnect to persist LastSeen before the database closes.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby cd62031b98 state: stop the auth cache TTL sweeper on Close 
The expirable LRU ran its sweeper forever, one goroutine per State. Purge
first so pending waiters get ErrRegistrationExpired instead of hanging.
The OIDC state cache is closed at server shutdown for the same reason.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 5f39a68b39 go.mod: pin golang-lru/v2 to main for expirable.Close 
v2.0.7 is the last tag; the TTL sweeper got Close only on main.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 2905dbfe86 ci: run race tests through a flake check 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 51b420865e state: own request memory before storing nodes 
A reused RegisterRequest.Hostinfo was written and stored while NodeStore readers cloned it.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 6d9fc8ac34 AGENTS, README, flake: drop unused golines 
.golangci.yaml never enabled golines and lll is off; Go formatting is
gofumpt, gci and goimports. Remove golines from the dev shell too.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 8a7921ae45 mapper: fold a node's pending backlog while its bundle is in flight 
Behind workers, pending grew by every change until the next drain; under
ci-churn that held ~900 MB of queued changes.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 73dd39982b poll: let a stopped session's write in flight finish 
Expiring the deadline at once still reset streams whose last write
was in flight; a grace keeps the bound on clients that stopped reading.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 552356a2ee state: skip the caller's policy refresh once the writer applied it 
The writer refreshes the policy manager before publishing its batch, so
the caller's SetNodes with the published snapshot recompiled it back.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby a5d5e8384a change: fold a tick's node deletions into one removal 
Under delete churn each removal still rendered its own frame and split
the coalesced peer runs.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby dd6e288aa1 policy/v2: index nodes by tag once per compile 
Each tag alias scanned every node, so with many tags a compile, run on
every NodeStore batch, was mostly HasTag.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 7a2335dc2b mapper: render each tick's peer deltas as one response 
One frame per change let a join storm overflow the session channel in a
single tick, and the batcher then dropped live clients as stale.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 4933bb83d2 policyutil: match DstPorts as ranges when reducing filters 
Every node re-parsed every entry into an IPSet on every policy change;
under churn that was most of the batcher's CPU.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby fb015933ca mapper: drop pending changes for nodes without a connection 
Disconnected nodes keep their batcher entry, and every broadcast was
rendered for them only for send to discard it.
 2026-10-23 18:23:53 +02:00