Kristoffer Dalby d2a85b1d16 policy/v2: compile a policy without rules as explicit allow-all ...

As SaaS, sources are the tailnet ranges and approved routes. They were
"*", so a host on an exit node's network could reach its clients.

2026-11-03 17:05:00 +01:00

..

api

state: validate the new name and refuse OIDC users in RenameUser (#3642)

2026-11-02 20:22:23 +01:00

assets

assets: fix logo alignment and error icon centering

2026-04-13 17:23:47 +01:00

capver

capver: regenerate for Tailscale v1.104

2026-10-15 10:50:32 +02:00

db

api/v2: list token-made auth keys to a token without all=true

2026-11-02 19:15:40 +01:00

derp

derp: keep node order across map refreshes

2026-11-03 17:05:00 +01:00

dns

util: read .json files as HuJSON in UnmarshalByExt (#3634)

2026-11-02 20:35:24 +01:00

mapper

mapper: send a disable-ipv4 holder its peers over IPv6 only

2026-11-03 17:05:00 +01:00

policy

policy/v2: compile a policy without rules as explicit allow-all

2026-11-03 17:05:00 +01:00

scope

db: reject unknown OAuth client scopes at creation (#3424)

2026-09-25 21:24:37 +02:00

servertest

mapper: send a disable-ipv4 holder its peers over IPv6 only

2026-11-03 17:05:00 +01:00

state

state, change: send the last seen time in the offline patch

2026-11-03 16:29:03 +01:00

templates

oidc: confirm SSH checks and display registration details

2026-11-02 19:15:40 +01:00

testdata/apiv1_golden

db, state: keep the ephemeral flag a node was created with

2026-11-02 19:15:40 +01:00

types

types: leave the base domain out of search domains without MagicDNS

2026-11-03 17:05:00 +01:00

util

util: read .json files as HuJSON in UnmarshalByExt (#3634)

2026-11-02 20:35:24 +01:00

apiv1_apikeys_test.go

test: add golden parity tests for the v1 API

2026-06-19 15:21:00 +02:00

apiv1_auth_test.go

hscontrol: bound pending authentication without evicting sessions

2026-10-29 20:51:50 +01:00

apiv1_authmw_test.go

test: add golden parity tests for the v1 API

2026-06-19 15:21:00 +02:00

apiv1_client_test.go

gen/client/v1: add the generated HTTP client

2026-06-19 15:21:00 +02:00

apiv1_harness_test.go

hscontrol: keep golden file names valid in Go module zips

2026-10-29 14:00:02 +01:00

apiv1_health_test.go

test: add golden parity tests for the v1 API

2026-06-19 15:21:00 +02:00

apiv1_nodes_test.go

db, state: keep the ephemeral flag a node was created with

2026-11-02 19:15:40 +01:00

apiv1_policy_test.go

state, db: validate and store the current policy before installing it

2026-11-02 19:15:40 +01:00

apiv1_preauthkeys_test.go

db, api/v1: revoke rather than delete an ephemeral pre-auth key in use

2026-11-02 19:15:40 +01:00

apiv1_socket_test.go

gen/client/v1: add the generated HTTP client

2026-06-19 15:21:00 +02:00

apiv1_users_test.go

state: validate the new name and refuse OIDC users in RenameUser (#3642)

2026-11-02 20:22:23 +01:00

apiv2_acl_test.go

api/v2: limit request bodies and redact schema-validation details

2026-11-02 19:15:40 +01:00

apiv2_compat_test.go

api/v2: enforce and document OAuth tag permissions

2026-11-02 19:15:40 +01:00

apiv2_devices_test.go

api/v2: send empty route lists under fields=all

2026-11-02 19:15:40 +01:00

apiv2_keys_test.go

api/v2: list token-made auth keys to a token without all=true

2026-11-02 19:15:40 +01:00

apiv2_oauth_matrix_test.go

api/v2: check the createKey scope before reading the body

2026-11-02 19:15:40 +01:00

apiv2_oauth_test.go

api/v2: enforce and document OAuth tag permissions

2026-11-02 19:15:40 +01:00

apiv2_settings_test.go

mapper: send CertDomains and https cap when certificates are enabled

2026-10-18 20:53:18 +02:00

apiv2_users_test.go

hscontrol: contract-test the v2 users endpoint

2026-06-24 18:41:06 +02:00

app_test.go

debug: refuse requests addressed to unknown host names

2026-11-02 19:15:40 +01:00

app_tls_test.go

hscontrol: reload manual TLS certificate on SIGHUP

2026-11-03 15:52:52 +01:00

app.go

hscontrol: reload manual TLS certificate on SIGHUP

2026-11-03 15:52:52 +01:00

auth_compat_test.go

auth, state: preserve client expiry and require expired node key rotation

2026-11-02 19:15:40 +01:00

auth_tags_test.go

auth, state: preserve client expiry and require expired node key rotation

2026-11-02 19:15:40 +01:00

auth_test.go

auth: answer a logout that deletes an ephemeral node as authorised

2026-11-02 19:15:40 +01:00

auth.go

auth: answer a logout that deletes an ephemeral node as authorised

2026-11-02 19:15:40 +01:00

debug.go

hscontrol: name policy, registration and map delivery decisions

2026-11-02 19:15:40 +01:00

handlers_test.go

db, state: keep the ephemeral flag a node was created with

2026-11-02 19:15:40 +01:00

handlers.go

types: accept only lowercase hex in auth IDs

2026-11-02 19:15:40 +01:00

metrics.go

metrics, policy/v2: drop unused scaffolding + nil-error returns

2026-05-19 09:55:22 +02:00

noise_test.go

hscontrol: bound pending authentication without evicting sessions

2026-10-29 20:51:50 +01:00

noise.go

hscontrol: bound client-chosen text in request logs

2026-11-02 19:15:40 +01:00

oidc_confirm_test.go

hscontrol: bound pending authentication without evicting sessions

2026-10-29 20:51:50 +01:00

oidc_cookiename_test.go

oidc: avoid slice panic in getCookieName for short values

2026-06-08 10:04:49 +02:00

oidc_template_test.go

oidc: render HTML error pages for browser-facing failures

2026-04-13 17:23:47 +01:00

oidc_test.go

oidc: confirm SSH checks and display registration details

2026-11-02 19:15:40 +01:00

oidc.go

hscontrol: name policy, registration and map delivery decisions

2026-11-02 19:15:40 +01:00

platform_config_test.go

hscontrol: read Apple platform via chi.URLParam, not mux.Vars

2026-06-05 15:00:59 +02:00

platform_config.go

hscontrol: use the stdlib uuid package

2026-08-25 21:59:00 +02:00

poll_test.go

hscontrol: preserve stale GC timer coverage after ephemeral ownership changes

2026-11-02 19:15:40 +01:00

poll.go

poll: hold the map session's node as a view

2026-11-02 19:15:40 +01:00

realip_test.go

hscontrol: gate proxy header trust on trusted_proxies

2026-05-18 17:17:55 +02:00

realip.go

all: adopt slices helpers

2026-06-17 16:12:19 +02:00

tailsql.go

policy, mapper, capver, hscontrol: remove dead code

2026-06-17 16:12:19 +02:00

templates_consistency_test.go

Update links to Tailscale documentation

2026-04-18 09:33:41 +02:00