233 commits

Author	SHA1	Message	Date
Nbelles	22277d1fc7	Spell check	2025-02-05 17:29:30 +01:00
Kristoffer Dalby	9ae3570154	drop versions older than 1.62 (#2405)	2025-02-05 12:02:32 +01:00
Kristoffer Dalby	8b92c017ec	add 1.80 to capver and update deps (#2394)	2025-02-05 07:17:51 +01:00
Kristoffer Dalby	45752db0f6	Return better web errors to the user (#2398) ... * add dedicated http error to propagate to user Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * classify user errors in http handlers Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * move validation of pre auth key out of db This move separates the logic a bit and allow us to write specific errors for the caller, in this case the web layer so we can present the user with the correct error codes without bleeding web stuff into a generic validate. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-02-01 15:25:18 +01:00
Kristoffer Dalby	1c7f3bc440	no edit of oidc users, minimum hostname length (#2393) ... * return an error when renaming users from OIDC * set minimum hostname length of 2	2025-02-01 09:40:37 +00:00
Kristoffer Dalby	9bd143852f	do not allow preauth keys to be deleted if assigned to node (#2396) ... * do not allow preauth keys to be deleted if assigned to node Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-02-01 10:31:13 +01:00
Kristoffer Dalby	d57a55c024	Rewrite authentication flow (#2374)	2025-02-01 09:16:51 +00:00
Kristoffer Dalby	e172c29360	initial capver packet tracking version (#2391) ... * initial capver packet tracking version Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * Log the minimum version as client version, not only capver Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove old versions Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use capver for integration tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * patch through m and n key Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-30 21:49:09 +00:00
Kristoffer Dalby	cd3b8e68ff	clean up handler methods, common logging (#2384) ... * clean up handler methods, common logging Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * streamline http.Error calls Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-30 22:40:29 +01:00
nblock	f44b1d37c4	Remove routes without a node_id (#2386) ... The routes table has a NOT NULL constraint on node_id. Fixes: #2376	2025-01-30 14:57:06 +01:00
Kristoffer Dalby	7ba6ad3489	simplify findUserByToken in ACL, add missing testcases (#2388) ... * update users doc on unique constraints Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * simplify finduser func Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add initial tests for findUserFromToken Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-30 11:35:49 +01:00
Kristoffer Dalby	2c279e0a7b	create and rename usernames validated by new func (#2381) ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-27 22:58:10 +01:00
Kristoffer Dalby	4c8e847f47	use dedicated registration ID for auth flow (#2337)	2025-01-26 22:20:11 +01:00
Kristoffer Dalby	d1dbe4ece9	fix panic if derp update is 0 (#2368) ... * fix panic if derp update is 0 Fixes #2362 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-23 16:16:12 +01:00
Kristoffer Dalby	9e3f945eda	fix postgres migration issue with 0.24 (#2367) ... * fix postgres migration issue with 0.24 Fixes #2351 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add postgres migration test for 2351 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-23 14:58:42 +01:00
Kristoffer Dalby	615ee5df75	make it harder to insert invalid routes (#2371) ... * make it harder to insert invalid routes Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * dont panic if node is not available for route Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-23 13:40:23 +01:00
Kristoffer Dalby	c1f42cdf4b	relax user validation to allow emails, add tests from various oidc providers (#2364) ... * relax user validation to allow emails, add tests from various oidc providers Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-22 18:10:15 +01:00
Kristoffer Dalby	5b986ed0a7	set oidc.map_legacy_users false (#2350)	2025-01-17 14:44:04 +00:00
Kristoffer Dalby	e4a3dcc3b8	use headscale server url as domain instead of base_domain (#2338)	2025-01-16 18:05:20 +01:00
Kristoffer Dalby	caad5c613d	fix nil pointer deref (#2339)	2025-01-16 18:05:05 +01:00
Kristoffer Dalby	38aef77e54	allow @ and Log if OIDC username is not consider valid (#2340)	2025-01-16 18:04:54 +01:00
Dmitry Gordin	1ab7b315a2	Update apple.md for latest version of iOS (#2321) ... The official iOS app now has a simpler login process for custom instances, directly within the app.	2025-01-13 12:09:53 +00:00
Stefan Majer	ede4f97a16	Fix typos	2025-01-09 10:38:25 +01:00
Kristoffer Dalby	fa641e38b8	Set CSRF cookies for OIDC (#2328) ... * set state and nounce in oidc to prevent csrf Fixes #2276 * try to fix new postgres issue Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-01-08 16:29:37 +01:00
Rorical	b81420bef1	feat: Add PKCE Verifier for OIDC (#2314) ... * feat: add PKCE verifier for OIDC * Update CHANGELOG.md	2024-12-22 16:46:36 +00:00
Kristoffer Dalby	770f3dcb93	fix tags not resolving to username if email is present (#2309) ... * ensure valid tags is populated on user gets too Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * ensure forced tags are added Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove unused envvar in test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * debug log auth/unauth tags in policy man Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * defer shutdown in tags test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add tag test with groups Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add email, display name, picture to create user Updates #2166 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add ability to set display and email to cli Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add email to test users in integration Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix issue where tags were only assigned to email, not username Fixes #2300 Fixes #2307 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * expand principles to correct login name and if fix an issue where nodeip principles might not expand to all relevant IPs instead of taking the first in a prefix. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix ssh unit test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update cli and oauth tests for users with email Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * index by test email Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * fix last test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-19 13:10:10 +01:00
Kristoffer Dalby	af4508b9dc	bump deps (#2308) ... * Bump go crypto Closes #2281 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * upgrade tailscale Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * upgrade rest Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * nix: flake update --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-17 15:35:42 +01:00
Shaw Drastin	7d937c6bd0	Correct macOS GUI connect guide because there's no ALT key on a mac (#2306) ... * Correct macOS GUI connect guide because there's no ALT key on a mac * also correct macOS GUI connect in hscontrol text	2024-12-17 12:11:27 +00:00
Kristoffer Dalby	ccc895b4c6	fixes to extra-record file watcher (#2298) ... * Fix excess error message during writes Fixes #2290 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * retry filewatcher on removed files This should handled if files are deleted and added again, and for rename scenarios. Fixes #2289 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * test more write and remove in filewatcher Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-16 11:26:56 +01:00
Kristoffer Dalby	5345f19693	fix issue where some oidc claim bools are sent as string (#2297) ... Jumpcloud send invalid json, so we need to handle it. Fixes #2293 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-16 11:26:32 +01:00
Kristoffer Dalby	ec8729b772	fix sighup issue with empty acl (#2296) ... Fixes #2291 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-16 07:48:19 +01:00
Kristoffer Dalby	58d089ce0a	fix deletion of exit routes without nodes (#2286) ... Fixes #2259 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-13 20:15:24 +01:00
Kristoffer Dalby	380fcdba17	Add worker reading extra_records_path from file (#2271) ... * consolidate scheduled tasks into one goroutine Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename Tailcfg dns struct Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add dns.extra_records_path option Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * prettier lint Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * go-fmt Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-12-13 07:52:40 +00:00
Florian Preinstorfer	89a648c7dd	Remove use_username_in_magic_dns option ... Upgrade the use of dns.use_username_in_magic_dns or dns_config.use_username_in_magic_dns to a fatal error and remove the option from the example configuration and integration tests. Fixes: #2219	2024-12-11 18:39:35 +01:00
Kristoffer Dalby	64fd1f9483	restructure command/api to use stable IDs (#2261)	2024-12-10 16:23:55 +01:00
Kristoffer Dalby	f7b0cbbbea	wrap policy in policy manager interface (#2255) ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-26 15:16:06 +01:00
Kristoffer Dalby	fffd23602b	Resolve user to stable unique ID in policy (#2205)	2024-11-24 00:13:27 +01:00
Kristoffer Dalby	f6276ab9d2	fix postgres constraints, add postgres testing ... This commit fixes the constraint syntax so it is both valid for sqlite and postgres. To validate this, I've added a new postgres testing library and a helper that will spin up local postgres, setup a db and use it in the constraints tests. This should also help testing db stuff in the future. postgres has been added to the nix dev shell and is now required for running the unit tests. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	7d9b430ec2	fix constraints ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	3780c9fd69	fix nil in test ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	281025bb16	fix constraints ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	5e7c3153b9	nits ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	7ba0c3d515	use userID instead of username everywhere ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	4dd12a2f97	fix oidc test, add tests for migration ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	2fe65624c0	restore strip_email_domain for migration ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	35b669fe59	add iss to identifier, only set email if verified ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	dc07779143	add @ to end of username if not present ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	d72663a4d0	remove log print ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	78214699ad	Harden OIDC migration and make optional ... This commit hardens the migration part of the OIDC from the old username based approach to the new sub based approach and makes it possible for the operator to opt out entirely. Fixes #1990 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2024-11-23 21:14:55 +01:00
Kristoffer Dalby	64bb56352f	make configurable wal auto checkpoint (#2242)	2024-11-23 21:03:48 +01:00