SaaS gives each router every device as a peer, whatever the policy
links, and the devices do not list the router back.
Headscale peers a router only with what its policy links.
SaaS judges a tests or sshTests group source by one rule naming the
group: per-member rules fail a true accept and pass a false deny.
Headscale checks each member through its own rules.
SaaS fails an accept to a bare IPv6 dst, checking the source at
::ffff:100.64.0.0, which no device holds; the IPv4 twin passes.
Headscale checks the source's own addresses and accepts.
huma sets an unexpected property's value to the whole request object.
A refused policy, or another 400, now carries its reason in message,
and a failed test run one data entry per failing test naming its src.
A stream back within the reconnect grace sent peers an online patch,
a router's sent every node a policy response, and a relogin on
unchanged keys sent a key patch; nothing had changed.
The flag moves from the key to the node, so a login with another key no
longer changes it. A user claiming a tagged node still clears it. v1
nodes carry the flag.
As on Tailscale SaaS, the node's own entry keeps Hostname, RequestTags,
RoutableIPs and Services; peers get Hostname, OS, Services without
peerapi-dns-proxy, SSH host keys and AppConnector, and resend on those.
Registration approval runs on the node the writer replaces. A policy
reload approves nothing, and a map request only when its announced
routes change, so neither re-grants a route an admin revoked.
Every destination overlaps /0, so any rule offered a peer's exit routes.
They now need a rule to the internet, the test exit-node visibility
uses; via steering defers them to a regular grant only on that test.
Adjacent node addresses merge into one prefix, and each node's filter
kept all of it. A prefix made only of node addresses now shrinks to the
node's own; a prefix the policy wrote, or one the node routes, stays.
Routes are matched as written, so such a prefix never equals the one a
client announces. The approval APIs answer 400 and autoApprovers refuses
it at load and write, with Tailscale's text.
A router that reconnects joins as a standby; one that kept its session
takes its routes back once available again, as on Tailscale. Both the
global and the via election use it, in place of anti-flap stickiness.
Peers keep the routes of an offline or expired router, as on Tailscale.
The previous primary keeps the prefix, else the lowest-ID approver;
never one the prober declared unreachable.
An accept passes only when each node behind the dst is reached, as on
Tailscale SaaS; a deny keeps its rule. A CIDR, "*" or autogroup:tagged
src names no user or host, so its test fails.
Read-only and key-making OAuth tokens of each tag set list auth keys
with and without all=true, over admin- and token-made keys of every tag
relation, one admin key made after the token-made ones.
Labels under taken hostnames, case-only renames, hostname changes, long
hostnames and a Service's name; API, peer and self per step, and State
labels as a restart would load them.
Kristoffer Dalby