3610 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Kristoffer Dalby	c6d399a66c	changelog: prep for 0.27.2 rc ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-30 19:10:56 +01:00
Kristoffer Dalby	4fe5cbe703	hscontrol/oidc: fix ACL policy not applied to new OIDC nodes (#2890) ... Fixes #2888 Fixes #2896	2025-11-30 19:02:15 +01:00
Vitalij Dovhanyc	7e8cee6b10	chore: fix filterHash to work with autogroup:self in the acls (#2882)	2025-11-30 15:54:16 +01:00
Kristoffer Dalby	7f1631c4f1	auth: ensure machines are allowed in when pak change (#2917)	2025-11-30 15:51:01 +01:00
Kristoffer Dalby	f658a8eacd	mkdocs: 0.27.1 ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-11 13:17:02 -06:00
Kristoffer Dalby	785168a7b8	changelog: prepare for 0.27.1 ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-11 13:17:02 -06:00
Kristoffer Dalby	3bd4ecd9cd	fix: preserve node expiry when tailscaled restarts ... When tailscaled restarts, it sends RegisterRequest with Auth=nil and Expiry=zero. Previously this was treated as a logout because time.Time{}.Before(time.Now()) returns true. Add early return in handleRegister() to detect this case and preserve the existing node state without modification. Fixes #2862	2025-11-11 12:47:48 -06:00
Kristoffer Dalby	3455d1cb59	hscontrol/db: fix RenameUser to use Updates() ... RenameUser only modifies Name field, should use Updates() not Save().	2025-11-11 12:47:48 -06:00
Kristoffer Dalby	ddd31ba774	hscontrol: use Updates() instead of Save() for partial updates ... Changed UpdateUser and re-registration flows to use Updates() which only writes modified fields, preventing unintended overwrites of unchanged fields. Also updated UsePreAuthKey to use Model().Update() for single field updates and removed unused NodeSave wrapper.	2025-11-11 12:47:48 -06:00
Kristoffer Dalby	4a8dc2d445	hscontrol/state,db: preserve node expiry on MapRequest updates ... Fixes a regression introduced in v0.27.0 where node expiry times were being reset to zero when tailscaled restarts and sends a MapRequest. The issue was caused by using GORM's Save() method in persistNodeToDB(), which overwrites ALL fields including zero values. When a MapRequest updates a node (without including expiry information), Save() would overwrite the database expiry field with a zero value. Changed to use Updates() which only updates non-zero values, preserving existing database values when struct pointer fields are nil. In BackfillNodeIPs, we need to explicitly update IPv4/IPv6 fields even when nil (to remove IPs), so we use Select() to specify those fields. Added regression test that validates expiry is preserved after MapRequest. Fixes #2862	2025-11-11 12:47:48 -06:00
Kristoffer Dalby	773a46a968	integration: add test to replicate #2862 ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-11 12:47:48 -06:00
Kristoffer Dalby	4728a2ba9e	hscontrol/state: allow expired auth keys for node re-registration ... Skip auth key validation for existing nodes re-registering with the same NodeKey. Pre-auth keys are only required for initial authentication. NodeKey rotation still requires a valid auth key as it is a security-sensitive operation that changes the node's cryptographic identity. Fixes #2830	2025-11-11 05:12:59 -06:00
Florian Preinstorfer	abed534628	Document how to restrict access to exit nodes per user/group ... Updates: #2855 Ref: #2784	2025-11-11 11:51:35 +01:00
Kristoffer Dalby	21e3f2598d	policy: fix issue where non existent user results in empty ssh pol ... When we encounter a source we cannot resolve, we skipped the whole rule, even if some of the srcs could be resolved. In this case, if we had one user that exists and one that does not. In the regular policy, we log this, and still let a rule be created from what does exist, while in the SSH policy we did not. This commit fixes it so the behaviour is the same. Fixes #2863 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-10 20:34:12 +01:00
Kristoffer Dalby	a28d9bed6d	policy: reproduce 2863 in test ... reproduce that if a user does not exist, the ssh policy ends up empty Updates #2863 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-10 20:34:12 +01:00
Kristoffer Dalby	28faf8cd71	db: add defensive removal of old indicies ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-10 20:07:29 +01:00
Kristoffer Dalby	5a2ee0c391	db: add comment about removing migrations ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-10 17:32:39 +01:00
Andrey Bobelev	5cd15c3656	fix: make state cookies valid when client uses multiple login URLs ... On Windows, if the user clicks the Tailscale icon in the system tray, it opens a login URL in the browser. When the login URL is opened, `state/nonce` cookies are set for that particular URL. If the user clicks the icon again, a new login URL is opened in the browser, and new cookies are set. If the user proceeds with auth in the first tab, the redirect results in a "state did not match" error. This patch ensures that each opened login URL sets an individual cookie that remains valid on the `/oidc/callback` page. `TestOIDCMultipleOpenedLoginUrls` illustrates and tests this behavior.	2025-11-10 16:27:46 +01:00
Kristoffer Dalby	2024219bd1	types: Distinguish subnet and exit node access ... When we fixed the issue of node visibility of nodes that only had access to eachother because of a subnet route, we gave all nodes access to all exit routes by accident. This commit splits exit nodes and subnet routes in the access. If a matcher indicates that the node should have access to any part of the subnet routes, we do not remove it from the node list. If a matcher destination is equal to the internet, and the target node is an exit node, we also do not remove the access. Fixes #2784 Fixes #2788 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	d9c3eaf8c8	matcher: Add func for comparing Dests and TheInternet ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	bd9cf42b96	types: NodeView CanAccess uses internal ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	d7a43a7cf1	state: use AllApprovedRoutes instead of SubnetRoutes ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	1c0bb0338d	types: split SubnetRoutes and ExitRoutes ... There are situations where the subnet routes and exit nodes must be treated differently. This splits it so SubnetRoutes only returns routes that are not exit routes. It adds `IsExitRoutes` and `AllApprovedRoutes` for convenience. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	c649c89e00	policy: Reproduce exit node visibility issues ... Reproduces #2784 and #2788 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Vitalij Dovhanyc	af2de35b6c	chore: fix autogroup:self with other acl rules (#2842)	2025-11-02 10:48:27 +00:00
Kristoffer Dalby	02c7c1a0e7	cli: only validate bypass-grpc set policy (#2854)	2025-11-02 09:42:59 +00:00
Copilot	d23fa26395	Fix flaky TestShuffleDERPMapDeterministic by ensuring deterministic map iteration (#2848) ... Co-authored-by: kradalby <98431+kradalby@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2025-11-02 10:05:23 +01:00
Andrey	f9bb88ad24	expire nodes with a custom timestamp (#2828)	2025-11-01 08:09:13 +01:00
Kristoffer Dalby	456a5d5cce	db: ignore _litestream tables when validating (#2843)	2025-11-01 07:08:22 +00:00
Kristoffer Dalby	ddbd3e14ba	db: remove all old, unused tables (#2844)	2025-11-01 08:03:37 +01:00
Florian Preinstorfer	0a43aab8f5	Use Debian 12 as minimum version for the deb package	2025-10-28 05:55:26 +01:00
Florian Preinstorfer	4bd614a559	Use current stable base images for Debian and Alpine	2025-10-28 05:55:26 +01:00
Kristoffer Dalby	19a33394f6	changelog: set 0.27 date (#2823)	2025-10-27 12:14:02 +01:00
Kristoffer Dalby	84fe3de251	integration: reduce TestAutoApproveMultiNetwork matrix to 3 tests (#2815)	2025-10-27 11:08:52 +00:00
Paarth Shah	450a7b15ec	#2796: Add creation_time and ko_data_creation_time to goreleaser.yml kos	2025-10-27 11:18:57 +01:00
Kristoffer Dalby	64b7142e22	.goreleaser: add upgrade section (#2820)	2025-10-27 10:41:52 +01:00
Kristoffer Dalby	52d27d58f0	hscontrol: add /version HTTP endpoint (#2821)	2025-10-27 10:41:34 +01:00
Kristoffer Dalby	e68e2288f7	gen: test-integration (#2814)	2025-10-24 17:22:53 +02:00
Kristoffer Dalby	c808587de0	cli: do not show new pre-releases on stable (#2813)	2025-10-24 13:15:53 +02:00
Kristoffer Dalby	2bf1200483	policy: fix autogroup:self propagation and optimize cache invalidation (#2807)	2025-10-23 17:57:41 +02:00
Kristoffer Dalby	66826232ff	integration: add tests for api bypass (#2811)	2025-10-22 16:30:25 +02:00
Kristoffer Dalby	1cdea7ed9b	stricter hostname validation and replace (#2383)	2025-10-22 13:50:39 +02:00
Elyas Asmad	2c9e98d3f5	fix: guard every error statement with early return (#2810)	2025-10-22 13:48:07 +02:00
Florian Preinstorfer	8becb7e54a	Mention explicitly that @ is only required in policy	2025-10-21 14:28:03 +02:00
Florian Preinstorfer	ed38d00aaa	Fix autogroup:self alternative example ... Also indent and split the comment into two lines to avoid horizontal scrolling.	2025-10-21 14:28:03 +02:00
Florian Preinstorfer	8010cc574e	Remove outdated hint about an empty config file	2025-10-19 17:14:15 +02:00
Juanjo Presa	c97d0ff23d	Fix fatal error on missing config file by handling viper.ConfigFileNotFoundError ... Correctly identify Viper's ConfigFileNotFoundError in LoadConfig to log a warning and use defaults, unifying behavior with empty config files. Fixes fatal error when no config file is present for CLI commands relying on environment variables.	2025-10-19 15:29:47 +02:00
Florian Preinstorfer	047dbda136	Add FAQ on how to disable log submission ... Fixes: #2793	2025-10-19 08:24:23 +02:00
Florian Preinstorfer	2a1392fb5b	Add healthcheck to container docs	2025-10-19 08:22:30 +02:00
Florian Preinstorfer	46477b8021	Downgrade completed broadcast message to debug	2025-10-18 07:56:59 +02:00