public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 20:49:24 +09:00
Code Issues Packages Projects Releases Wiki Activity
4,795 Commits 106 Branches 177 Tags
d34cb46d020f6ba8679e261fe5cb91892d46ad88
Commit Graph
4795 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kristoffer Dalby d34cb46d02 servertest: pin the Terraform provider version 
0.29.3 validates ACLs at plan time through acl/validate, which
headscale lacks, so a floating constraint broke the Terraform tests.
 2026-10-28 19:05:48 +00:00
Kristoffer Dalby e1a3bdca00 oidc: keep email_verified with the address it came with 
Fixes ANT-2026-MX8FKG4K
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 38125d1043 db, state: let only the delete that removed a node free its addresses 
Fixes ANT-2026-NWTIBB02
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 8126f8727a state: drop registration locks once unused 
The lock is taken before any credential check, so client-chosen machine
keys grew the map forever. Ref-count entries; delete at zero.

Fixes ANT-2026-ZC18AF82
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 592762ea33 types, auth, noise: let one request wait on each auth session 
One verdict per session, so one waiter: the newest. A displaced one
returns at once (register error, SSH re-delegate), not at session end.

Fixes ANT-2026-NM50ZP4N
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 4fdf546861 auth: check the follow-up's machine key before it waits 
A session has one verdict; another machine holding the URL could take
it.

Fixes ANT-2026-NM50ZP4N
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 670c232cec noise: time out stalled bodies and idle tunnels 
The hijack drops the outer server's deadlines; any machine key gets a
tunnel.

Fixes ANT-2026-K903ZEUA
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 3c277949c7 auth, state: keep announced routes out of pending registrations 
Routes are the one long list; the first MapRequest reports them.
A relogin keeps the node's own routes until then.

Fixes ANT-2026-RQS7JAPP
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby c87672bcf6 state: bound client reports of nodes loaded at startup 
Rows stored before the bounds would still fan out unbounded endpoints.

Fixes ANT-2026-RQS7JAPP
Fixes ANT-2026-5B6KE87K
Fixes ANT-2026-KFCFFM34
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 76509000bc types, noise: bound the Hostinfo and endpoints a client reports 
Cut lists and hostname at decode, refuse >64 KiB of non-route Hostinfo.
The body limit counted wire bytes, not what the cache, NodeStore and
peers keep.

Fixes ANT-2026-RQS7JAPP
Fixes ANT-2026-5B6KE87K
Fixes ANT-2026-KFCFFM34
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 7259ef6edd hscontrol: refuse a key expiry that cannot be encoded 
handleRegister, the OIDC auth path and SetNodeExpiry refuse it. Expiries
are stored in UTC, which SQLite can read back, and loaded in UTC, as
PostgreSQL returns the server's zone. The v1 API answers 400.

Fixes ANT-2026-QMCAFJ1Q
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby 159deeec41 mapper: skip peers whose key expiry cannot be encoded 
json.Marshal refuses a year outside [0,9999], so one stored expiry
failed every map with that node. TailNode and key patches send UTC, the
builder drops what fails and the boot scan names the node.

Fixes ANT-2026-QMCAFJ1Q
 2026-10-28 14:25:41 +00:00
Kristoffer Dalby f2a51a8f11 .github: regenerate integration test workflow 2026-10-28 14:25:41 +00:00
Kristoffer Dalby eeb0ef0901 state: give another user's key on a tagged machine a new device 
Only a key that speaks for a tagged node re-authenticates it: a tagged
key, or one of the user it was tagged from. Another user's key or login
adds that user's own device, or only wakes the node under its node key.

Fixes ANT-2026-AWGRB7O1
 2026-10-28 14:25:32 +00:00
Kristoffer Dalby c262792660 state: need a valid pre-auth key to re-register an expired tagged node 
Fixes ANT-2026-LYVGXVSW
 2026-10-28 14:22:20 +00:00
Kristoffer Dalby abbec204a2 state: never serve a single address inside the node ranges 
Such a route names a node, not a subnet: it stays approved and listed
but no viewer gets it. Via inclusions skip the election, so the rule
sits on everything RoutesForPeer returns.

Fixes ANT-2026-MLP8ZR5T
 2026-10-28 14:21:03 +00:00
Kristoffer Dalby 0467b8b9c0 servertest, policy/v2: add re-authentication golden data 
Expired, live, ephemeral and admin-tagged devices logging in again with
spent, revoked, valid and other users' keys, by key and by login;
tag ownership through tags per policy function.

Updates ANT-2026-LYVGXVSW
Updates ANT-2026-AWGRB7O1
 2026-10-28 14:20:11 +00:00
Kristoffer Dalby 077a39ac14 servertest: add login, profile, restart and register log helpers 
TryNewClient returns a refused login; Login covers profile switches and
interactive logins approved through ApproveAuth; RegisterAttempts reads
the client's register log.
 2026-10-28 14:18:52 +00:00
Kristoffer Dalby 14e2ad8aac servertest: add route approval lifecycle golden data 
Owner changes, re-auth, revokes, policy pushes, withdraw and logout
replayed step by step against SaaS approvals and served routes.
 2026-10-28 14:18:52 +00:00
Kristoffer Dalby f4f48b2e67 prek: exempt step captures from the large file check 
They keep a netmap per node per step and must stay as recorded.
 2026-10-28 14:17:57 +00:00
Kristoffer Dalby 492de9b2e9 servertest: add relogin and auth key helpers 
Relogin builds a new Direct on the same machine key and persisted
node key, as tailscaled does on up --auth-key; force rotates the key.
 2026-10-28 14:17:57 +00:00
Kristoffer Dalby 388507fdea policy/v2, servertest, hscontrol: add tailnet overlap route captures 
Routers announcing tailnet addresses, approved by policy, admin key and
devices:routes token; replayed through policy, map stream and v1/v2
APIs.

Updates ANT-2026-MLP8ZR5T
 2026-10-28 14:17:50 +00:00
Kristoffer Dalby 931cdf8ee7 servertest: compare router self routes with captures 
Replays ten routes captures through the mapper too; SaaS's address
ranges for "*" now resolve. Known gaps are skip entries per node.
 2026-10-28 14:13:05 +00:00
Kristoffer Dalby a6db49762b servertest: compare user profiles in via captures 
Self and peer profiles, by login and display name. A tagged self gets
its own profile in SaaS; listed as a skip entry until headscale matches.
 2026-10-28 14:13:05 +00:00
Kristoffer Dalby 4a6bb8eae1 servertest: list passing via captures 
Fourteen committed via captures already match at map level; run them.
 2026-10-28 14:13:05 +00:00
Kristoffer Dalby 38d08f8a6f testcapture: record multi-step captures and API error detail 
Optional Steps, NodeIDs, error data and login state; v1 files unchanged.
Register log and raw map frame parsers; Write refuses auth keys and
login URLs.
 2026-10-28 14:13:05 +00:00
Kristoffer Dalby 2d220b2eb8 mkdocs: set the current release to 0.29.6 2026-10-24 15:43:39 +02:00
Kristoffer Dalby f3fc915b71 CHANGELOG: set the 0.29.6 release date 2026-10-24 15:43:39 +02:00
Kristoffer Dalby 33544f62cb CHANGELOG: document the 0.29.6 security and patch release 
Updates #3579 and #3549.
 2026-10-24 11:15:20 +02:00
Kristoffer Dalby 30ff8df93c integration: ignore disconnected recipients when checking map state 
Disconnected streams retain historical maps and cannot receive peer updates.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby e195ce9675 CHANGELOG: map session and churn fixes 2026-10-23 18:23:53 +02:00
Kristoffer Dalby eed5c8c80a mapper: count folded patches when bounding pending 
A fold keeps every patch it merges, so counting changes hid the
backlog: the cap never fired and each fold recopied the patches.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby daad12e964 mapper: retry slow sessions from current state 
A full session channel after the send window evicted live but busy clients.
Requeue and regenerate; evict after no progress for connectionStallTimeout.
Retire blocked reconnect siblings once the newest stream accepts the frame.

Updates #3129.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby f46ea3d1df mapper: skip responses left empty by visibility filtering 
A peer change hidden from a recipient still produced a frame carrying only
ControlTime, one per sender per recipient. Drop it once the response is final.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 2047ef35b8 hscontrol: wait for map session cleanup during shutdown 
Batcher shutdown cuts reconnect grace short to keep shutdown prompt.
Wait for each session's Disconnect to persist LastSeen before the database closes.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby cd62031b98 state: stop the auth cache TTL sweeper on Close 
The expirable LRU ran its sweeper forever, one goroutine per State. Purge
first so pending waiters get ErrRegistrationExpired instead of hanging.
The OIDC state cache is closed at server shutdown for the same reason.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 5f39a68b39 go.mod: pin golang-lru/v2 to main for expirable.Close 
v2.0.7 is the last tag; the TTL sweeper got Close only on main.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 2905dbfe86 ci: run race tests through a flake check 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 51b420865e state: own request memory before storing nodes 
A reused RegisterRequest.Hostinfo was written and stored while NodeStore readers cloned it.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 6d9fc8ac34 AGENTS, README, flake: drop unused golines 
.golangci.yaml never enabled golines and lll is off; Go formatting is
gofumpt, gci and goimports. Remove golines from the dev shell too.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 8a7921ae45 mapper: fold a node's pending backlog while its bundle is in flight 
Behind workers, pending grew by every change until the next drain; under
ci-churn that held ~900 MB of queued changes.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 73dd39982b poll: let a stopped session's write in flight finish 
Expiring the deadline at once still reset streams whose last write
was in flight; a grace keeps the bound on clients that stopped reading.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 552356a2ee state: skip the caller's policy refresh once the writer applied it 
The writer refreshes the policy manager before publishing its batch, so
the caller's SetNodes with the published snapshot recompiled it back.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby a5d5e8384a change: fold a tick's node deletions into one removal 
Under delete churn each removal still rendered its own frame and split
the coalesced peer runs.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby dd6e288aa1 policy/v2: index nodes by tag once per compile 
Each tag alias scanned every node, so with many tags a compile, run on
every NodeStore batch, was mostly HasTag.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 7a2335dc2b mapper: render each tick's peer deltas as one response 
One frame per change let a join storm overflow the session channel in a
single tick, and the batcher then dropped live clients as stale.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 4933bb83d2 policyutil: match DstPorts as ranges when reducing filters 
Every node re-parsed every entry into an IPSet on every policy change;
under churn that was most of the batcher's CPU.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby fb015933ca mapper: drop pending changes for nodes without a connection 
Disconnected nodes keep their batcher entry, and every broadcast was
rendered for them only for send to discard it.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 5d21186f22 state: release persistMu before the NodeStore delete 
Holding it serialised concurrent deletes into one NodeStore batch and
peer map build each, capping deletion at one batch tick per node.
 2026-10-23 18:23:53 +02:00
Kristoffer Dalby 371674de95 poll: expire the write deadline only for a write in flight 
An expired deadline resets the HTTP/2 stream with INTERNAL_ERROR, so
every batcher stop (delete, logout) looked like a server error.
 2026-10-23 18:23:53 +02:00