Kristoffer Dalby 9609a0b87d hscontrol: gate /key on supported capability version ...

/key handed out the Noise public key for any v>=39, a floor unrelated
to the handshake's capver.MinSupportedCapabilityVersion. Reject below
the supported floor, matching /ts2021, and drop the stale constant.

Fixes #3380

(cherry picked from commit 5b6e1e17be)

2026-07-29 14:35:31 +02:00

..

assets

assets: fix logo alignment and error icon centering

2026-04-13 17:23:47 +01:00

capver

capver, types: bump to tailscale v1.98, drop LegacyDERPString

2026-05-22 11:22:01 +02:00

db

db: preserve user_id on untagged nodes with tags='null'

2026-06-18 10:22:27 +00:00

derp

derp: clone regions when merging DERP maps

2026-06-08 10:04:49 +02:00

dns

dns: release lock before extra-records channel send

2026-06-08 10:04:49 +02:00

mapper

mapper: skip peers with invalid names instead of failing the map

2026-07-01 14:33:03 +00:00

policy

mapper,policy: add reconnect-storm and lock-concurrency regression tests

2026-07-01 14:33:03 +00:00

servertest

servertest: add logout/relogin storm repro with poll churn

2026-06-11 16:28:25 +02:00

state

state: log nodes with map-breaking data at startup

2026-07-01 14:33:03 +00:00

templates

all: apply godoc [Name] link conventions across comments

2026-05-19 09:55:22 +02:00

types

state: reject renames whose FQDN exceeds the hostname limit

2026-07-01 14:33:03 +00:00

util

util: check RNG error before slicing url-safe random string

2026-06-08 10:04:49 +02:00

app_test.go

app: add security headers middleware

2026-04-17 16:31:49 +01:00

app.go

hscontrol: register /ts2021 for WebSocket GET

2026-07-01 14:33:03 +00:00

auth_tags_test.go

test: assert NodeKey hijack is rejected on re-auth

2026-06-09 15:21:18 +02:00

auth_test.go

auth: check machine key on the followup registration path

2026-07-29 14:35:31 +02:00

auth.go

auth: check machine key on the followup registration path

2026-07-29 14:35:31 +02:00

debug.go

all: mechanical lint fixes

2026-05-19 09:55:22 +02:00

grpcv1_test.go

all: apply godoc [Name] link conventions across comments

2026-05-19 09:55:22 +02:00

grpcv1.go

all: apply godoc [Name] link conventions across comments

2026-05-19 09:55:22 +02:00

handlers_test.go

hscontrol: gate /key on supported capability version

2026-07-29 14:35:31 +02:00

handlers.go

hscontrol: gate /key on supported capability version

2026-07-29 14:35:31 +02:00

metrics.go

metrics, policy/v2: drop unused scaffolding + nil-error returns

2026-05-19 09:55:22 +02:00

noise_test.go

hscontrol: register /ts2021 for WebSocket GET

2026-07-01 14:33:03 +00:00

noise.go

noise: re-delegate SSH check when the auth session is missing (#3306)

2026-06-10 11:48:02 +02:00

oidc_confirm_test.go

all: annotate gosec false positives with rationale

2026-05-19 09:55:22 +02:00

oidc_cookiename_test.go

oidc: avoid slice panic in getCookieName for short values

2026-06-08 10:04:49 +02:00

oidc_template_test.go

oidc: render HTML error pages for browser-facing failures

2026-04-13 17:23:47 +01:00

oidc_test.go

hscontrol: satisfy golangci-lint on changed lines

2026-06-09 15:21:18 +02:00

oidc.go

oidc: set SameSite=Lax on state/nonce CSRF cookies

2026-06-09 15:21:18 +02:00

platform_config_test.go

hscontrol: read Apple platform via chi.URLParam, not mux.Vars

2026-06-05 15:00:59 +02:00

platform_config.go

hscontrol: read Apple platform via chi.URLParam, not mux.Vars

2026-06-05 15:00:59 +02:00

poll_test.go

poll: return an HTTP error on long-poll setup failure

2026-07-01 14:33:03 +00:00

poll.go

poll: return an HTTP error on long-poll setup failure

2026-07-01 14:33:03 +00:00

realip_test.go

hscontrol: gate proxy header trust on trusted_proxies

2026-05-18 17:17:55 +02:00

realip.go

all: apply godoc [Name] link conventions across comments

2026-05-19 09:55:22 +02:00

tailsql.go

all: annotate gosec false positives with rationale

2026-05-19 09:55:22 +02:00

templates_consistency_test.go

Update links to Tailscale documentation

2026-04-18 09:33:41 +02:00