4315 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Kristoffer Dalby	9aba06ec7d	integration: backfill CLI command coverage ... Regroup the CLI tests into per-command files and cover every command except debug/config with CRUD, flag and error permutations, asserted as JSON.	2026-06-18 15:21:11 +02:00
Kristoffer Dalby	00afce77b1	ci: run nixos module check with --fallback ... cache.nixos.org intermittently serves corrupt NARs; build from source on substitute failure instead of failing the job.	2026-06-18 14:54:44 +02:00
Kristoffer Dalby	9f1886f587	db: preserve user_id on untagged nodes with tags='null' ... A nil tags slice marshals to JSON `null`; the clear-tagged migration read that as tagged and cleared user_id. Exclude it, and recover already-detached nodes from their pre-auth key. Fixes #3323	2026-06-18 14:54:44 +02:00
Kristoffer Dalby	ea5165e325	util, db: generate key material as hex via tailscale rands	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	368b9e7edd	state: add regression test for NodeKey-rotation binding	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	abfd5c9236	types: reject port-bearing server_url under base_domain	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	e4cd846075	handlers: set verify Content-Type before writing the body	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	4b693a1320	oidc, types: validate pkce.method when OIDC is active	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	4f4e95fc80	all: adopt strings, errors, and os helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	27468f944b	all: adopt maps and cmp helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	ac725f27e4	all: adopt slices helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	60f0544b78	dns, change, noise, auth, capver: misc consolidation	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	ea5e52f662	hi: consolidate doctor and stats helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	722a2f1e18	integration, hsic, tsic, dockertestutil: consolidate container helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	75b09cb991	servertest: consolidate harness helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	0320b56911	oidc: consolidate cookie helpers and logging	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	62869f01d2	app: simplify TLS and auth setup	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	19d5d9deeb	derp: simplify DERP map handling	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	c3cfbf1cc0	grpcv1: share list-RPC response helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	fdc7e26c8a	util: consolidate parsing and encoding helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	45e6e90d11	types: consolidate DNS, identifier, and proto helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	468f70a9e5	templates: consolidate shared page and component helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	8c10a96921	hscontrol: consolidate debug-endpoint and template helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	3979887d8d	mapper: consolidate builder and connection helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	03e2d24c79	policy/v2, policy/matcher: consolidate alias and IP-set helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	e6ef1dda4d	policy: consolidate cache-invalidation and evaluation helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	145672f0b6	state: consolidate route-election and node helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	77f289a627	db: consolidate IP allocation helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	55b9e3cfda	db, sqliteconfig: consolidate query and config helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	b56326427c	cli: consolidate output and table rendering	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	0b7c8aa270	cli: consolidate gRPC command helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	b88a3cb7b2	servertest, hi, integration: remove dead test helpers	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	ed6596f9d7	policy, mapper, capver, hscontrol: remove dead code	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	f49f27adf8	db, sqliteconfig: remove dead and unreachable code	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	43ba20bebb	util: remove dead helpers and stale comments	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	c8bd4a0947	types: remove dead types, constants, and methods	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	84168fb90a	templates: remove dead style helpers and deprecated shims	2026-06-17 16:12:19 +02:00
Kristoffer Dalby	b0c221f3a1	changelog: set 0.29 date ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2026-06-17 11:09:20 +02:00
Kristoffer Dalby	68a6d3cf17	db: drop ambiguous machine-key getter, match precisely in test helper ... The First()-by-machine-key getter returned an undefined node when a machine key mapped to several nodes. It was used only by RegisterNodeForTest; match on (machine_key, user_id) there instead and remove the getter. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	1689478485	state: return all nodes for a machine key, reject ambiguous ownership ... Collapse the single-pick machine-key lookups onto GetNodesByMachineKeyAllUsers so callers see every node sharing a machine key and reject the ambiguous or impossible cases (tagged and user-owned coexistence; a tagged key with several user-owned candidates) instead of mutating an arbitrarily-picked node. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	a1d3e98255	state: allow key expiry to be set on tagged nodes ... Tagged nodes disable key expiry by default but can still have one set explicitly, and changing tags leaves expiry unchanged, matching Tailscale. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	b83bf3f993	state: serialise registration per machine key ... Concurrent registrations of one machine key each saw no existing node and created their own, duplicating nodes and IPs. Hold a per-machine lock across the find-then-create section. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	96d2e6ed60	state: roll back node store when re-registration write fails ... Re-registration mutated the node store before the database write and did not revert on failure, so a restart could drop the client's current node key. Snapshot the node and restore it if the write fails. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	9b8949727d	db: treat unknown pre-auth key as not found ... An unknown or deleted key returned a bare error matching neither the not-found nor pre-auth-key checks, so registration returned a server error instead of 401. Wrap gorm.ErrRecordNotFound. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	bff216a184	state: update node in place on pre-auth-key re-registration ... A reusable key on a converted node, or a tagged key on a user-owned node, fell through to new-node creation, leaving two nodes per machine. Match by machine key and update or convert in place. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	fd08b8fa8c	state: make any-user machine-key lookup deterministic ... The lookup returned the first map match, so re-auth branch choice varied with map order once a machine key had more than one node. Prefer the tagged node, else the lowest node ID. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	a73d38bb3f	state: reject re-registration claiming another node's key ... The pre-auth-key path wrote the client node key without the collision check the auth path applies, so a re-registration could claim another node's key and poison the node-key index. Reject keys bound to a different machine. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	e759d9fc90	auth: re-validate key when an expired node re-registers ... The re-registration fast-path skipped validation for a matching node key without checking expiry, so an expired node could re-auth with a spent key. Gate it on the node not being expired. Updates #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	0961e79e16	state: re-register converted tagged nodes with reused key ... A node converted to tagged is re-indexed under no user, so re-registration keyed on the key's owner missed it and rejected the spent one-shot key. Match the existing tagged node by machine key. Fixes #3312	2026-06-15 20:29:15 +02:00
Kristoffer Dalby	a5ef3aff15	state: patch relogins and gate endpoint broadcasts ... Relogin sent as a peer patch with endpoints preserved; endpoint-only deltas broadcast only on useful (non-STUN) changes.	2026-06-15 12:02:39 +02:00