public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 12:39:25 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,989 Commits 106 Branches 177 Tags
aa7b2ab404498fb445f14a812a484515b0083119
Commit Graph
4989 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kristoffer Dalby aa7b2ab404 policyutil: send a router no capability for its subnet 
via-grant-v84 and v86 show SaaS sending none.

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 3fdedefbf9 policy/v2: link a via grant's sources to its router only 
A rule naming the route also linked a router that is a source to all others
serving it. SaaS does not (via-grant-v81).

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 5642d976b2 policy, state: correct MatchersForNode's doc 
It filters routes. Peers come from BuildPeerMap.

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 5be981ca95 servertest: replay the member-to-subnet routes capture 
Same shape as #3626: the router is in no rule.

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby aeceef9cce policy/v2: anonymize a public endpoint in older captures 
Recordings since hold only documentation addresses.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby 52d6dea601 hscontrol: drop user profiles no node in a capture uses 
A client keeps every profile it was sent; these were never SaaS state.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby ec2e76e7cd servertest: replay ACL captures with auto-approved routes 
Only the policy approves their routes, so broken approval fails the replay.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby 7a47710d64 servertest: keep filter sources that name no peer 
They stopped a replay before any comparison; a side lacking one still differs.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby db0b6c9d5d policy/v2: hold source form skips to the same addresses 
A listed check hides any difference, so both filter paths must first match as ranges.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby c59e19be21 policy/v2: check that captures agree on routes 
Parts of a capture are read seconds apart, so an approval can split them.
Also refuses tool failures, lost nodes, unknown peers, lagging viewers and approvals that never landed.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby 4671143b8f policy/v2: record again captures split by a route approval 
tscap read approved_routes before the netmaps, and five captures lost a node.
Contiguous new addresses make SaaS and headscale source forms differ, so those checks are listed.
Also moved by recording now: capver 131 to 142, default-auto-update, self RoutableIPs.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby 8b41925a1f nix: support systemctl reload in the headscale service 
Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h
 2026-11-03 15:52:52 +01:00
Kristoffer Dalby c7daf6d923 .github: regenerate integration test workflow 
Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h
 2026-11-03 15:52:52 +01:00
Kristoffer Dalby 021f0294f8 integration: test TLS certificate reload on SIGHUP 
Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h
 2026-11-03 15:52:52 +01:00
Kristoffer Dalby b3ffec4269 hscontrol: reload manual TLS certificate on SIGHUP 
Files that fail to load or are not valid now keep the previous certificate.

Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h
 2026-11-03 15:52:52 +01:00
Kristoffer Dalby 7bd88aee79 .github: exempt milestoned issues from stale bot, stale after 45 days (#3652) 
Milestone means triaged. Close message said 14 days; config is 7.
 2026-11-03 15:52:47 +01:00
github-actions[bot] 2456ba1f6b Update VOUCHED list (#3651) 
https://github.com/juanfont/headscale/issues/3650#issuecomment-6601738938

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-11-03 13:15:31 +00:00
github-actions[bot] 152c7f262b Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3643#issuecomment-6581488242
 2026-11-03 13:51:44 +01:00
Igor Serganov d0e10f2d46 util: read .json files as HuJSON in UnmarshalByExt (#3634) 
dns.extra_records_path and derp.paths files ending in .json were decoded
with encoding/json, so a comment or trailing comma in otherwise valid
JSON made headscale refuse to load the file. Policy files already accept
HuJSON regardless of extension. HuJSON is a superset of JSON, so
standardizing .json input the same way as .hujson keeps every valid JSON
file decoding exactly as before.

Add tests for comments and trailing commas in extra records, in generic
.json decoding and in ACL policies, and for comment markers inside
string values.

Fixes #3627
 2026-11-02 20:35:24 +01:00
Igor Serganov c6723fa103 state: keep collision-bumped GivenName within the DNS label limit (#3635) 
`dnsname.SanitizeHostname` truncates a hostname to 63 characters. When
that label was already taken, resolveGivenName appended "-N" to the
full base, producing a 65+ character GivenName. Such a name is not a
valid DNS label, so the node cannot be rendered into its own netmap
or any peer's, and on PostgreSQL the varchar(63) given_name column
rejects the write.

Trim the base so base plus suffix fits in a DNS label and strip a
hyphen left at the cut. isAutoDerivedGivenName now compares against
the same bump, so a trimmed name still follows hostname changes
instead of being treated as an admin rename.
 2026-11-02 20:28:28 +01:00
Michael Lopez 42a97be25f state: validate the new name and refuse OIDC users in RenameUser (#3642) 
State.RenameUser went through UpdateUser and skipped the checks
db.RenameUser applies, so the API could rename an OIDC user, whose
name the identity provider owns, or rename any user to an invalid
name. Apply both checks in the update function and map the username
validation errors to 400.
 2026-11-02 20:22:23 +01:00
Kristoffer Dalby 697eff7474 CHANGELOG: enumerate policy, lifetime and API compatibility breaks 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 4cb74dfe04 policy, servertest: derive exit routes from allowed public destinations 
A public IP permits exit defaults; private-only rules do not. Replay six
accepted and two refused SaaS captures with range-equivalence checks,
preserving provenance and the literal-default-route ACL validation gap.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby f453502ef1 hscontrol: name policy, registration and map delivery decisions 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 9cc0d01026 hscontrol: preserve stale GC timer coverage after ephemeral ownership changes 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 4a00488869 mapper: read tracked peers under workMu in batcher tests 
A full map replaces the set with Clear then Store; an unlocked read
between them failed TestOlderInitialMapLeavesNewerStreamsPeers.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 4e946edb08 api/v2: enforce and document OAuth tag permissions 
Retagging requires all current and requested tags; disallowed tags return
400. Token responses list tags only when the token may assign them.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 7d94d189fa api/v2: send empty route lists under fields=all 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 1c65b9f162 gen/client/v2: regenerate for the device's join key 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 66db32dde0 api/v2: report tagged device creators and join keys 
Use the join-key creator as the device's user without changing ownership.
Omit oauthClientId when an OAuth token's source client is not recorded.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby e4396e9f9d gen/client/v2: regenerate for the key list without all=true 2026-11-02 19:15:40 +01:00
Kristoffer Dalby a08daa91fe api/v2: list token-made auth keys to a token without all=true 
Keys an OAuth token makes are marked so. No listing holds an invalid
key.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 060f145ac6 db, types: add a credentials column for keys a token made 
No released version made keys from tokens, so existing rows stay false.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby fe260f5adf api/v2: show userId on admin-made tagged keys 
An admin key's user is recorded as the creator of the tagged keys it
makes. A tagged key re-registers a machine by its tags, whoever made it.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 6474ac6dd3 api/v2: return a device name as its FQDN 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 17cbea0f6a api/v2: ignore unknown fields and reject unknown key types 
Match SaaS request decoding while refusing unsupported keyType values.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 9979be140e db: keep at most 1000 access tokens per OAuth client 
Minting needs only the client secret, whatever its scopes, and
added one row per mint. Each mint now ends tokens past the newest 1000.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 408b9b7797 api/v2: check the createKey scope before reading the body 
createKey has no static scope, so any token got its body parsed
and validated before the handler's scope check.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 0bf5b0f0af api/v2: limit request bodies and redact schema-validation details 
Bound schema, raw, and token-form bodies before parsing. Omit submitted
values from schema errors while preserving policy reasons and test labels.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 77005fac35 api/v2: keep a tagged all-scope client's tokens inside its tags 
Only an untagged all-scope client may mint tokens for any tag, so a
tagged token may not create one.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 75e2377f25 debug: refuse requests addressed to unknown host names 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 87c9659b20 types: accept only lowercase hex in auth IDs 2026-11-02 19:15:40 +01:00
Kristoffer Dalby c8e97384d7 oidc: confirm SSH checks and display registration details 
Approve SSH checks only after a click and recheck source ownership.
Show registration state and requested tags on the confirmation page.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 5dff6ca432 policy/v2: resolve user references consistently across updates 
Prefer email owners over usernames and validate grants and nodeAttrs on
write. Reject ambiguous writes; log and match nobody on reload. Bare @
matches nobody.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby bdc005e518 cli: validate offline policy set like policy check 2026-11-02 19:15:40 +01:00
Kristoffer Dalby f2ecf949a7 types: reject non-boolean values for boolean settings 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 14baf55421 state, oidc: persist user changes and refresh nodes and clients 
Write cleared user columns, discard OIDC email the provider no longer
vouches for, refresh NodeStore users, and notify clients from the callback.

Fixes #3471
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 499b58e77c oidc: refuse logins whose subject the provider identifier would alter 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 65a4f0d6fc state, change: notify clients only of effective node changes 
Send endpoint and DERP reports only to peers. Suppress redundant online,
policy, and key updates on reconnect or unchanged-key login.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby cb47fdff36 policy/v2, mapper: align NextDNS warnings and device metadata 
Warn about malformed attributes once at policy load, not on each map.
Include the node's stable ID as device_id in resolver queries.
 2026-11-02 19:15:40 +01:00