public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 04:34:07 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,986 Commits 106 Branches 177 Tags
bae4f5721584c867a0d1c7cbc53445daa00f9279
Commit Graph
4986 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kristoffer Dalby bae4f57215 api/v2: stop echoing request values in error responses 
huma sets an unexpected property's value to the whole request object.
A refused policy, or another 400, now carries its reason in message,
and a failed test run one data entry per failing test naming its src.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby b0d625c3ff api/v2: bound every request body 
huma gives RawBody no limit, and validates a whole body before
the handler runs. The token form is parsed before the secret check.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 8a73d68c21 api/v2: keep a tagged all-scope client's tokens inside its tags 
Only an untagged all-scope client may mint tokens for any tag, so a
tagged token may not create one.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 5803ddedd3 debug: refuse requests addressed to unknown host names 2026-10-30 14:55:37 +00:00
Kristoffer Dalby eeb02858d9 types: accept only lowercase hex in auth IDs 2026-10-30 14:55:37 +00:00
Kristoffer Dalby f0ecba2bd7 oidc: show requested tags on the registration confirmation page 2026-10-30 14:55:37 +00:00
Kristoffer Dalby c27a13eed8 oidc: show on the confirmation page whether the device is registered 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 1f1e75c56f oidc: approve SSH checks on the confirmation page, not in the callback 
Require an explicit click before recording the SSH verdict.
Recheck source ownership on the callback, confirmation page, and POST.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 4563650475 policy/v2: match no user for a bare "@" token 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 4d539834e5 policy/v2: match no one for an ambiguous user outside policy writes 
A change to user identifiers must not block startup or later logins.
Keep policy writes strict; log ambiguous references on load and refresh.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 7c9a167a65 policy/v2: prefer the user owning an email over a username match 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 6082a81e93 policy/v2: check grant and nodeAttrs user references on write 
Validation now refuses every input that reached the SetPolicy compile
failure, so restoring the previous policy there is defensive only.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby c8ebb83bdb cli: validate offline policy set like policy check 2026-10-30 14:55:37 +00:00
Kristoffer Dalby e2048f15f5 types: reject non-boolean values for boolean settings 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 21706d8d54 oidc: send the change from the user update in the callback 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 7888c07c2f state: refresh the NodeStore copies of a user in UpdateUser 2026-10-30 14:55:37 +00:00
Kristoffer Dalby e66fb356e8 types: drop a stored OIDC email the login no longer vouches for 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 8593547c9d state: write every user column in UpdateUser 2026-10-30 14:55:37 +00:00
Kristoffer Dalby ffc668d48e oidc: refuse logins whose subject the provider identifier would alter 2026-10-30 14:55:37 +00:00
Kristoffer Dalby b22dd41b51 state: announce a node online only after it was offline 
A stream back within the reconnect grace sent peers an online patch,
a router's sent every node a policy response, and a relogin on
unchanged keys sent a key patch; nothing had changed.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 719f6ea01d change: do not echo a node's own report back to it 
An endpoint or DERP report came back to the node as a self update;
SaaS sends it to the node's peers only.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby dc734e08e1 mapper: add device_id to the NextDNS query 
SaaS sends the node's stable ID with the other device metadata.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby d81f6169da policy/v2: warn once at load about malformed nextdns attrs 
SaaS loads them and its resolver skips them, as headscale does, but the
mapper also logged a warning per node on every DNS build.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 29ec14baeb mapper: test that a hidden peer's policy change still sends filters 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 7c7db6fe28 state, change: send a deleted node's removal only to its peers 
The removal went to every node, also those the policy hid the node from.
The delete now returns the node's peers from the snapshot it replaces.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 8e5608fe3b mapper: stop an older initial map removing peers newer streams hold 
AddNode diffed its map against tracking after sending it, when a newer
stream may have recorded its own; it now sends the node a full instead.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 8ddccb7a46 mapper: bound how long one node can block a batcher worker 
A node that drained slower than it was sent to held the worker for its
whole bundle; once its sends have waited 50ms, the rest waits a tick.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby e3f233aa55 mapper: send nothing while any stream awaits its initial map 
Sent to the ready streams alone, a change counted as delivered and
never reached the new stream; the worker retries it once the map is out.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 3201077628 mapper: cap concurrent map sessions per node 
A node chose how many map streams it held, each pinning a session.
The fifth replaces the oldest; same shape as #3468's mapper commit.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 11ae125a9f change: coalesce policy recomputes that carry an origin node 
The recompute render ignores the origin and always carries the node's
own entry, so a burst of tag writes cost every node one per write.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 78329ec0ea state: say a taken name is already taken 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 88fc804ed0 db: succeed on a repeated revoke of an auth key 
A repeated v2 DELETE of an auth key now answers 200, as Tailscale does.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby a67caf1e6e auth: answer a logout that deletes an ephemeral node as authorised 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 534368a786 cli: show a node's own ephemeral flag instead of its key's 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 898b42c4f7 gen/client/v1: regenerate for the node ephemeral flag 2026-10-30 14:55:37 +00:00
Kristoffer Dalby b3b427daef db, state: keep the ephemeral flag a node was created with 
The flag moves from the key to the node, so a login with another key no
longer changes it. A user claiming a tagged node still clears it. v1
nodes carry the flag.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 5d69e54093 db, types: add a nodes column for the ephemeral flag 
The migration fills it from the key each node references.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 4d05c505ac db: remove unused RenameNode 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 9c808311e8 state: bump duplicate node names loaded from the database 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 4bd0d63294 state: cut a label so its -N suffix fits in 63 bytes 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 5da704c7fe state: treat extra DNS record names as taken node names 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 41c388f45a state: save the name NodeStore picks for a new node 
The row is committed before the name UPDATE, so a failed UPDATE still
returns the node and registration arms ephemeral cleanup.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 961f3558dd db, api/v1: revoke rather than delete an ephemeral pre-auth key in use 
The v1 list now hides revoked keys, so keys revoked through v2 also drop
out of `headscale preauthkeys list`.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 6c91e3fbcd hscontrol: arm the ephemeral GC at pre-auth key registration 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 9b509f62f6 hscontrol: skip garbage collecting a node that is no longer ephemeral 2026-10-30 14:55:37 +00:00
Kristoffer Dalby eeccada116 db: wrap the sequential IP allocator so freed addresses are reused 2026-10-30 14:55:37 +00:00
Kristoffer Dalby eb833d1dc3 state: test that a persist racing a delete cannot resurrect the node 
DeleteNode's early persistMu unlock is safe only while node persists
stay UPDATE-only; say so where the lock is declared.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby dab63820fa hscontrol: bound client-chosen text in request logs 
Clip at the sinks: handler errors, the request line, SSH local_user.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 5c5fc4feb7 mapper: show an expired peer online, without endpoints or DERP 
A connected expired node shows online to its peers. Neither its map
entry nor endpoint, DERP or disco patches carry the paths to reach it.
 2026-10-30 14:55:37 +00:00
Kristoffer Dalby 6aed0d5f07 mapper: trim the Hostinfo sent to peers and to the node itself 
As on Tailscale SaaS, the node's own entry keeps Hostname, RequestTags,
RoutableIPs and Services; peers get Hostname, OS, Services without
peerapi-dns-proxy, SSH host keys and AppConnector, and resend on those.
 2026-10-30 14:55:36 +00:00