961535351f
policy/v2: check SSHPolicy nil vs empty against captures
...
Nil keeps client's old rules; empty clears them. Old normalization hid it.
Updates #3508
2026-10-08 10:29:23 +02:00
48046dc9c5
mapper: allow unchanged self in the full-update ping test
...
Updates #3518
2026-10-07 23:36:16 +02:00
2cd82ceb0c
CHANGELOG: note the own approved routes fix
...
Updates #3502
2026-10-07 23:36:16 +02:00
ea6b0bf0b7
mapper: reconcile self on policy recomputes
...
Self renders from the same state as peers, so leaving it out of policy
responses hid an exit node's approved routes until it reconnected.
Fixes #3502
2026-10-07 23:36:16 +02:00
ba413fca3d
state: return a node's primary routes in stable order
...
They came from map iteration, so an unchanged router rendered its self
node differently on every call.
Updates #3502
2026-10-07 23:36:16 +02:00
31582dd2c2
CHANGELOG: link derp-admit to pull request
2026-10-07 22:55:03 +02:00
e7bb90bac1
CHANGELOG: name both DERP verify paths
...
Embedded DERP verifies in-process, not through /verify.
2026-10-07 22:55:03 +02:00
541ef40c87
state: report unindexed node key instead of panicking
...
A missing key yields the zero NodeView; its ID() panicked inside a reader
goroutine and took down the test binary instead of failing with a diagnostic.
2026-10-07 22:55:03 +02:00
85bda7c2c9
types: drop unused Nodes.ContainsNodeKey
2026-10-07 22:55:03 +02:00
7ffdba7175
hscontrol: admit DERP clients via NodeKey index
...
/verify scanned every node per DERP connect; use GetNodeByNodeKey.
2026-10-07 22:55:03 +02:00
bc7fe6b8eb
state: test NodeKey index agrees with node list
...
Covers put, rotation and payload writes on the reuse path, and delete.
2026-10-07 22:55:03 +02:00
b35dd2238e
integration: reuse the prebuilt image for mock OIDC
...
Updates #3522
2026-10-07 18:11:07 +02:00
0e20065f6d
CHANGELOG: link logtail to pull request
2026-10-07 18:11:07 +02:00
29e18d80b4
docs: note the audit-log shutdown lasts until tailscale up
...
Clients that opt out of logging themselves hit it whatever logtail.enabled says.
2026-10-07 18:11:07 +02:00
da6c8f9dd3
CHANGELOG: say audit-log clients stay down after the logtail fix
2026-10-07 18:11:07 +02:00
0c9186d4a3
hscontrol: send the logtail instruction on the expired-self frame
...
It opens a deleted node's stream in place of the initial map.
2026-10-07 18:11:07 +02:00
52a7f8c89c
mapper: send the logtail instruction on every full map
...
Full maps moved to buildFromChange and lost WithDebugConfig, so no
frame told clients to disable log upload. Enabled logtail sends nil.
2026-10-07 18:11:07 +02:00
56e08f10e7
CHANGELOG: link ping-full to pull request
2026-10-07 15:25:25 +02:00
85587e2e29
change: drop untargeted pings when collapsing to a full
...
The ping ID in the URL is the only authentication on the answer, so
rescuing an untargeted ping for every node would let any node answer
for another. Rescue a ping only for the node it targets.
2026-10-07 15:25:25 +02:00
d4948da301
mapper: keep pings when a full update collapses pending changes
...
A full renders state at drain time but cannot carry a one-shot
PingRequest; queue each ping as a ping-only frame after the full.
2026-10-07 15:25:25 +02:00
e93f5d6ee0
CHANGELOG: link pak-revalidate to pull request
2026-10-07 14:03:54 +02:00
c4ce3f7d14
state: revalidate pre-auth key reuse when registration applies
2026-10-07 14:03:54 +02:00
00d64db9ef
CHANGELOG: link ssh-verdict-once to pull request
2026-10-07 12:50:32 +02:00
b35cb278c8
CHANGELOG: reword SSH check replay fix
2026-10-07 12:50:32 +02:00
97c4bf264e
noise: repeat concurrent SSH verdict waiters test
...
Nothing signals that both waiters parked before FinishAuth, so one
pass mostly checks them one after the other.
2026-10-07 12:50:32 +02:00
c9992efaca
noise: cover SSH verdict replay ledger and removed check
...
A replay must neither record auth for auto-approval nor, once the
pair is no longer under a check, be answered from the consumed
verdict.
2026-10-07 12:50:32 +02:00
133f8142c6
noise: re-decide SSH check follow-up after verdict consumed
...
Closed verdict channel yields zero AuthVerdict, which Accept() treats as
success; a replayed follow-up was accepted even after Reject.
2026-10-07 12:50:32 +02:00
2dcd5c876e
CHANGELOG: note unknown users in groups for 0.29.5
...
Updates #3513
2026-10-07 11:10:51 +02:00
925639b3aa
policy/v2: test unregistered users at every policy site
...
Each site must match the policy without them, and track their
registration and deletion.
Updates #3513
2026-10-07 11:10:51 +02:00
cb299184f7
servertest: check grant-v13 group via routes against SaaS
...
Updates #3513
2026-10-07 11:10:51 +02:00
85c754a1ac
policy/v2: resolve unregistered users to an empty set
...
Callers bailing on the error dropped a whole group for one missing
member: via routes, SSH check, app grants, nodeAttrs.
Fixes #3513
2026-10-07 11:10:51 +02:00
545322aec7
policy/v2: fail rejected-compile tests on an ambiguous user
...
A missing user will stop failing the compile.
Updates #3513
2026-10-07 11:10:51 +02:00
4776898029
state: roll back only registration fields on failed re-registration
...
Restoring the whole pre-update snapshot also reverted sessions that
connected during the failed write, stranding a live node offline.
2026-10-07 11:10:38 +02:00
f7c8b4d93f
state: serialise IP backfill with node persistence
...
A persist between the backfill's database write and its NodeStore reload
wrote the old addresses back, silently undoing the backfill.
2026-10-07 11:10:38 +02:00
84cf38ce24
derp/server: resolve the live DERP map in /bootstrap-dns
...
The handler captured the startup map, so hostnames added by
derp.auto_update never resolved.
2026-10-07 11:10:38 +02:00
57358b7430
state: backfill only IPs into NodeStore
...
PutNode of the DB row dropped session state, stranding connected nodes
offline, and nil-dereferenced nodes without Hostinfo.
2026-10-07 11:10:38 +02:00
9c34c0c90d
state: stop tag approval sorting the reported RequestTags
...
nodeToRegister.Tags aliased Hostinfo.RequestTags, so sort/compact rewrote
the stored Hostinfo ([b a a] became [a b ""]).
2026-10-07 11:10:38 +02:00
a99c8a030c
policy/v2: stop ViaRoutesForPeer appending into pm.pol.Grants
...
Readers share pm.pol under RLock; appending ACL grants into its spare
capacity raced between concurrent callers.
2026-10-07 11:10:38 +02:00
a9cc142ebe
CHANGELOG: link register-floor to pull request
2026-10-07 11:10:23 +02:00
060f2aa59b
CHANGELOG: shorten register floor entry to one clause
2026-10-07 11:10:23 +02:00
5622b519b5
noise: test a decode failure at the capability floor
...
Nothing covered a body that clears the floor yet fails to decode. Dropping
or reordering that branch would run handleRegister on a half-decoded
request with no test failing.
Inline the single-use request builder into serveRegister and finish the
OversizedBody comment.
2026-10-07 11:10:23 +02:00
ed8d546675
noise: check capability floor before handleRegister
...
Below-floor register got 400 only after logout, key use or auth-cache
write had run.
2026-10-07 11:10:23 +02:00
b4d5cdd6aa
mapper: keep reconnect removals tracked until delivered
...
AddNode reset lastSentPeers before the queued removal went out, so a
superseding full or a disconnect before the tick lost it for good.
2026-10-07 11:09:47 +02:00
f1293a805a
servertest: require via compat netmaps to hold across ticks
...
Accepting the first matching tick let a netmap that matched once and
then drifted pass. Require several consecutive passing ticks; a netmap
that settles still passes, so no assertion loosens.
2026-10-07 11:08:58 +02:00
fdb3646b67
servertest: name filters in the via HA convergence comment
...
The PacketFilter rule count lags route approval as well, so say so, as
the map compat driver already does.
2026-10-07 11:08:58 +02:00
74121aa339
servertest: retry via compat netmap comparison until converged
...
Peer count arrives before routes; compare-once raced route delivery.
2026-10-07 11:08:58 +02:00
3e00a42bd2
Update VOUCHED list
...
https://github.com/juanfont/headscale/issues/3536#issuecomment-6033904453
2026-10-07 10:33:33 +02:00
5f03627408
Update link to node attributes
2026-10-06 05:30:26 +02:00
eeaac680be
mapper: drop DNSConfig from policy responses
...
It forced every client into a full netmap rebuild; the resolver race it
guarded against was a client bug (tailscale/tailscale#19749 ).
2026-09-30 19:03:13 +02:00
357f34a778
state: send a node's DNS config with its own refresh
...
Drained at dispatch for nodeAttrs changes from any policy, user or node
update, and for hostname/OS changes feeding NextDNS device metadata.
2026-09-30 19:03:13 +02:00
Kristoffer Dalby
Kristoffer Dalby
github-actions[bot]
Sandro