Kristoffer Dalby
6c91e3fbcd
hscontrol: arm the ephemeral GC at pre-auth key registration
2026-10-30 14:55:37 +00:00
Kristoffer Dalby
9b509f62f6
hscontrol: skip garbage collecting a node that is no longer ephemeral
2026-10-30 14:55:37 +00:00
Kristoffer Dalby
eeccada116
db: wrap the sequential IP allocator so freed addresses are reused
2026-10-30 14:55:37 +00:00
Kristoffer Dalby
eb833d1dc3
state: test that a persist racing a delete cannot resurrect the node
...
DeleteNode's early persistMu unlock is safe only while node persists
stay UPDATE-only; say so where the lock is declared.
2026-10-30 14:55:37 +00:00
Kristoffer Dalby
dab63820fa
hscontrol: bound client-chosen text in request logs
...
Clip at the sinks: handler errors, the request line, SSH local_user.
2026-10-30 14:55:37 +00:00
Kristoffer Dalby
5c5fc4feb7
mapper: show an expired peer online, without endpoints or DERP
...
A connected expired node shows online to its peers. Neither its map
entry nor endpoint, DERP or disco patches carry the paths to reach it.
2026-10-30 14:55:37 +00:00
Kristoffer Dalby
6aed0d5f07
mapper: trim the Hostinfo sent to peers and to the node itself
...
As on Tailscale SaaS, the node's own entry keeps Hostname, RequestTags,
RoutableIPs and Services; peers get Hostname, OS, Services without
peerapi-dns-proxy, SSH host keys and AppConnector, and resend on those.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
706155d1f1
mapper: keep an expired node authorised in its own entry
...
Tailscale SaaS sends an expired node MachineAuthorized and no Expired
flag; its past KeyExpiry already moves the client to NeedsLogin.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
6c1418277e
.github: regenerate integration test workflow
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
d7a0349ef3
state: apply requested tags on a key login that owns them
...
A requested tag the key's user owns directly, or the key's tags own one
hop away, replaces the key's tags instead of refusing the login.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
9127edbd6d
state: auto-approve routes after an admin tag change
...
The new tags may approve announced routes. Approval runs once the policy
manager knows the new owner, as after a registration.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
cd09ccaf34
state: drop auto-approved routes when they are withdrawn
...
Only routes auto-approval alone granted go; approvals from before the
upgrade stay, as do routes an admin set.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
20117e7060
db, types: add a column for auto-approved routes
...
It starts empty: the current policy cannot tell which earlier approvals
were automatic, so all of them stay as an admin's.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
177920d84e
state: auto-approve on registration only when the node key rotates
...
Registration runs the approval itself, once the policy manager knows the
node's owner, for a new node key or a change to the announced routes.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
27f0858880
auth: store a client's earlier expiry and expire a tagged node at logout
...
A client may bring its expiry forward, which turns expiry on for a node
without one, but still cannot push it back. Logout expires tagged nodes
too.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
164c8ece40
auth, state: answer an expired node's same-key login with NodeKeyExpired
...
The client then rotates its node key and logs in again, so no key is
judged under the expired one. The machine stays authorised.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
40063d6213
state: forget a node's SSH check approvals when it is expired
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
3766d31c18
state: honour SSH check approvals only while the source keeps its owner
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
49333eb32b
state: let a pre-auth key that is no longer valid only wake its node
...
A login that keeps its node key leaves a live node's expiry alone, even
with a valid key, and a wake-up is not refused for the tags it requests.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
f7b1d0c3ec
state: serialise registrations presenting an unused single-use key
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
b0347ccccc
state: auto-approve routes in the NodeStore writer, not on reload
...
Registration approval runs on the node the writer replaces. A policy
reload approves nothing, and a map request only when its announced
routes change, so neither re-grants a route an admin revoked.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
7e29163300
state: undo a failed re-registration without reverting newer writes
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
09aba4e488
state: write node rows from the NodeStore under persistMu
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
b4f970f93c
state: apply map requests only under the node key that authorised them
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
4b4ce87cd0
policy: offer exit routes only to viewers whose rules reach the internet
...
Every destination overlaps /0, so any rule offered a peer's exit routes.
They now need a rule to the internet, the test exit-node visibility
uses; via steering defers them to a regular grant only on that test.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
4e433f7a04
mapper: send a router all of its own routes
...
Its AllowedIPs held only the primaries the policy let it reach. It now
holds every approved route, and PrimaryRoutes the ones it serves.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
ffd4f34841
policy: reduce merged destination prefixes to the node's own addresses
...
Adjacent node addresses merge into one prefix, and each node's filter
kept all of it. A prefix made only of node addresses now shrinks to the
node's own; a prefix the policy wrote, or one the node routes, stays.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
be07e0f536
api, policy/v2: refuse route prefixes with host bits
...
Routes are matched as written, so such a prefix never equals the one a
client announces. The approval APIs answer 400 and autoApprovers refuses
it at load and write, with Tailscale's text.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
3719b4db0d
policy, state: log only the routes auto-approval adds
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
bcc951ec54
poll: hold the map session's node as a view
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
05a5c11a20
policy/matcher, types: compare a node's routes to matchers as ranges
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
926998d553
policy/matcher: binary-search ranges in overlap checks
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
3c62eb17bb
policy: look up approved routes in a set when auto-approving
...
Avoid scanning the growing approval list for every announcement.
Use the sorted current routes when identifying additions.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
5314508846
types, state: reduce a node's routes against the matchers once
...
Reuse matcher membership and approved subnets across the route list.
Preserve route order and HA co-router visibility.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
9093e0108b
types: derive subnet and exit routes in one pass
...
Emit each approved route once, in announcement order.
Skip derivation when no routes are approved.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
2dc2dfc8cd
state: skip route comparison for writes that leave routes alone
...
Reuse immutable route inputs when classifying NodeStore writes.
Only derive routes when an announcement or approval changes.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
8735976f26
state, policy/v2: stop treating announced-only routes as policy changes
...
Policy evaluation reads only announced-and-approved routes.
Keep publishing Hostinfo updates without rebuilding peer adjacency.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
2377e060f2
policy/v2, state: elect primaries by oldest control session
...
A router that reconnects joins as a standby; one that kept its session
takes its routes back once available again, as on Tailscale. Both the
global and the via election use it, in place of anti-flap stickiness.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
41dc97401b
types: add when a node's run of control sessions began
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
160302e920
state: keep a prefix mapped when no router is available
...
Peers keep the routes of an offline or expired router, as on Tailscale.
The previous primary keeps the prefix, else the lowest-ID approver;
never one the prober declared unreachable.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
af6babc4fa
policy/v2, state: elect via primaries among online, healthy routers
...
Availability tests expiry itself, not only the online flag.
A health change on a via target now triggers a peer recompute.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
a1ab489eb2
state: withhold HA probe results only for routers tied to a deferred one
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
8571c2e989
state: keep probing a lone advertiser while it is unhealthy
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
2c265e1300
hscontrol, types: strip trailing slashes from server_url
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
08f600f045
db: bound the wait for a legacy hash verification slot
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
8c7d5e5551
db: reload the credential row after a legacy hash verification
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
3b2553755b
db: disable GORM's prepared statement cache on SQLite
...
database.gorm.prepare_stmt is now ignored, with a startup warning.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
f39d1b8928
policy/v2: refuse check SSH rules with tag sources
...
A check asks the source's user to log in again, and a tagged node has
none. Tailscale SaaS refuses the rule; headscale accepted it.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
7fa696a690
policy/v2: limit the destination and port pairs a policy declares
...
A grant lists dst and ip apart, so its filter grows with their product.
Refuse a policy over 100,000 pairs, on every parse.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby
cae4033813
policy/v2: refuse a port list in a grant ip entry
...
Tailscale SaaS takes one port range per ip entry; a list was accepted
and expanded. Write each range as an entry of its own.
2026-10-30 14:55:36 +00:00
Kristoffer Dalby