Kristoffer Dalby be114c0d63 hscontrol: refuse a key expiry that cannot be encoded ...

handleRegister, the OIDC auth path and SetNodeExpiry refuse it. Expiries
are stored in UTC, which SQLite can read back, and loaded in UTC, as
PostgreSQL returns the server's zone. The v1 API answers 400.

Fixes ANT-2026-QMCAFJ1Q

(cherry picked from commit 15a8c7584e, adapted: gRPC ExpireNode instead of REST v1)

2026-10-30 10:33:17 +01:00

..

assets

…

capver

mapper: deliver peer removals as separate deltas

2026-10-13 14:35:52 +02:00

db

db: return database-open errors for 0.29.6

2026-10-24 11:15:00 +02:00

derp

go.mod: update tailscale.com to v1.104.4

2026-10-30 10:33:17 +01:00

dns

dns: cancel extra-records retry on shutdown and close watcher on setup error

2026-09-23 21:19:22 +02:00

mapper

mapper: skip peers whose key expiry cannot be encoded

2026-10-30 10:33:17 +01:00

policy

policy/v2, servertest, hscontrol: add tailnet overlap route captures

2026-10-30 10:33:17 +01:00

servertest

state: never serve a single address inside the node ranges

2026-10-30 10:33:17 +01:00

state

hscontrol: refuse a key expiry that cannot be encoded

2026-10-30 10:33:17 +01:00

templates

templates: apply the tvOS setup reorder to the served /apple page

2026-09-23 21:19:22 +02:00

types

hscontrol: refuse a key expiry that cannot be encoded

2026-10-30 10:33:17 +01:00

util

go.mod: update tailscale.com to v1.104.4

2026-10-30 10:33:17 +01:00

app_test.go

hscontrol: keep the ACME error body readable in acmeLogger

2026-09-23 21:19:22 +02:00

app.go

mapper: deliver peer removals as separate deltas

2026-10-13 14:35:52 +02:00

auth_tags_test.go

state: do not expire tagged nodes on logout

2026-07-29 14:35:31 +02:00

auth_test.go

hscontrol: refuse a key expiry that cannot be encoded

2026-10-30 10:33:17 +01:00

auth.go

hscontrol: refuse a key expiry that cannot be encoded

2026-10-30 10:33:17 +01:00

debug.go

all: mechanical lint fixes

2026-05-19 09:55:22 +02:00

grpcv1_test.go

hscontrol: refuse a key expiry that cannot be encoded

2026-10-30 10:33:17 +01:00

grpcv1.go

hscontrol: refuse a key expiry that cannot be encoded

2026-10-30 10:33:17 +01:00

handlers_test.go

oidc: harden reloadable confirmation flow

2026-09-23 21:19:22 +02:00

handlers.go

oidc: harden reloadable confirmation flow

2026-09-23 21:19:22 +02:00

metrics.go

metrics, policy/v2: drop unused scaffolding + nil-error returns

2026-05-19 09:55:22 +02:00

noise_test.go

noise: restrict metrics to the metrics listener

2026-10-30 10:33:17 +01:00

noise.go

noise: restrict metrics to the metrics listener

2026-10-30 10:33:17 +01:00

oidc_confirm_test.go

all: annotate gosec false positives with rationale

2026-05-19 09:55:22 +02:00

oidc_cookiename_test.go

oidc: avoid slice panic in getCookieName for short values

2026-06-08 10:04:49 +02:00

oidc_template_test.go

…

oidc_test.go

oidc: harden reloadable confirmation flow

2026-09-23 21:19:22 +02:00

oidc.go

oidc: harden reloadable confirmation flow

2026-09-23 21:19:22 +02:00

platform_config_test.go

hscontrol: read Apple platform via chi.URLParam, not mux.Vars

2026-06-05 15:00:59 +02:00

platform_config.go

hscontrol: read Apple platform via chi.URLParam, not mux.Vars

2026-06-05 15:00:59 +02:00

poll_test.go

poll: end stopped map sessions without resetting active streams

2026-10-24 11:15:00 +02:00

poll.go

poll: end stopped map sessions without resetting active streams

2026-10-24 11:15:00 +02:00

realip_test.go

hscontrol: gate proxy header trust on trusted_proxies

2026-05-18 17:17:55 +02:00

realip.go

all: apply godoc [Name] link conventions across comments

2026-05-19 09:55:22 +02:00

tailsql.go

all: annotate gosec false positives with rationale

2026-05-19 09:55:22 +02:00

templates_consistency_test.go

Update links to Tailscale documentation

2026-04-18 09:33:41 +02:00