Kristoffer Dalby c8fb25d451 state: give another user's key on a tagged machine a new device ...

Only a key that speaks for a tagged node re-authenticates it: a tagged
key, or one of the user it was tagged from. Another user's key or login
adds that user's own device, or only wakes the node under its node key.

Fixes ANT-2026-AWGRB7O1

(cherry picked from commit e1de83cbdf, adapted: inline PAK re-register path, no servertest compat table)

2026-10-30 10:33:17 +01:00

..

assets

assets: fix logo alignment and error icon centering

2026-04-13 17:23:47 +01:00

capver

mapper: deliver peer removals as separate deltas

2026-10-13 14:35:52 +02:00

db

db: return database-open errors for 0.29.6

2026-10-24 11:15:00 +02:00

derp

go.mod: update tailscale.com to v1.104.4

2026-10-30 10:33:17 +01:00

dns

dns: cancel extra-records retry on shutdown and close watcher on setup error

2026-09-23 21:19:22 +02:00

mapper

go.mod: update tailscale.com to v1.104.4

2026-10-30 10:33:17 +01:00

policy

policy/v2, servertest, hscontrol: add tailnet overlap route captures

2026-10-30 10:33:17 +01:00

servertest

state: never serve a single address inside the node ranges

2026-10-30 10:33:17 +01:00

state

state: give another user's key on a tagged machine a new device

2026-10-30 10:33:17 +01:00

templates

templates: apply the tvOS setup reorder to the served /apple page

2026-09-23 21:19:22 +02:00

types

state: give another user's key on a tagged machine a new device

2026-10-30 10:33:17 +01:00

util

go.mod: update tailscale.com to v1.104.4

2026-10-30 10:33:17 +01:00

app_test.go

hscontrol: keep the ACME error body readable in acmeLogger

2026-09-23 21:19:22 +02:00

app.go

mapper: deliver peer removals as separate deltas

2026-10-13 14:35:52 +02:00

auth_tags_test.go

state: do not expire tagged nodes on logout

2026-07-29 14:35:31 +02:00

auth_test.go

state: give another user's key on a tagged machine a new device

2026-10-30 10:33:17 +01:00

auth.go

mapper: deliver peer removals as separate deltas

2026-10-13 14:35:52 +02:00

debug.go

all: mechanical lint fixes

2026-05-19 09:55:22 +02:00

grpcv1_test.go

all: apply godoc [Name] link conventions across comments

2026-05-19 09:55:22 +02:00

grpcv1.go

mapper: deliver peer removals as separate deltas

2026-10-13 14:35:52 +02:00

handlers_test.go

oidc: harden reloadable confirmation flow

2026-09-23 21:19:22 +02:00

handlers.go

oidc: harden reloadable confirmation flow

2026-09-23 21:19:22 +02:00

metrics.go

metrics, policy/v2: drop unused scaffolding + nil-error returns

2026-05-19 09:55:22 +02:00

noise_test.go

noise: restrict metrics to the metrics listener

2026-10-30 10:33:17 +01:00

noise.go

noise: restrict metrics to the metrics listener

2026-10-30 10:33:17 +01:00

oidc_confirm_test.go

all: annotate gosec false positives with rationale

2026-05-19 09:55:22 +02:00

oidc_cookiename_test.go

oidc: avoid slice panic in getCookieName for short values

2026-06-08 10:04:49 +02:00

oidc_template_test.go

oidc: render HTML error pages for browser-facing failures

2026-04-13 17:23:47 +01:00

oidc_test.go

oidc: harden reloadable confirmation flow

2026-09-23 21:19:22 +02:00

oidc.go

oidc: harden reloadable confirmation flow

2026-09-23 21:19:22 +02:00

platform_config_test.go

hscontrol: read Apple platform via chi.URLParam, not mux.Vars

2026-06-05 15:00:59 +02:00

platform_config.go

hscontrol: read Apple platform via chi.URLParam, not mux.Vars

2026-06-05 15:00:59 +02:00

poll_test.go

poll: end stopped map sessions without resetting active streams

2026-10-24 11:15:00 +02:00

poll.go

poll: end stopped map sessions without resetting active streams

2026-10-24 11:15:00 +02:00

realip_test.go

hscontrol: gate proxy header trust on trusted_proxies

2026-05-18 17:17:55 +02:00

realip.go

all: apply godoc [Name] link conventions across comments

2026-05-19 09:55:22 +02:00

tailsql.go

all: annotate gosec false positives with rationale

2026-05-19 09:55:22 +02:00

templates_consistency_test.go

Update links to Tailscale documentation

2026-04-18 09:33:41 +02:00