tailscale/ipn
Tom Meadows 87b3d7b7e5
Some checks failed
checklocks / checklocks (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
Dockerfile build / deploy (push) Has been cancelled
natlab-basic / EasyEasy (push) Has been cancelled
policybot-test / policybot-test (push) Has been cancelled
CI / gomod-cache (push) Has been cancelled
CI / fuzz (push) Has been cancelled
update-flake / update-flake (push) Has been cancelled
tailscale.com/cmd/vet / vet (push) Has been cancelled
CI / race-root-integration (1/4) (push) Has been cancelled
CI / race-root-integration (2/4) (push) Has been cancelled
CI / race-root-integration (3/4) (push) Has been cancelled
CI / race-root-integration (4/4) (push) Has been cancelled
CI / test (-race, amd64, 1/3) (push) Has been cancelled
CI / test (-race, amd64, 2/3) (push) Has been cancelled
CI / test (-race, amd64, 3/3) (push) Has been cancelled
CI / test (386) (push) Has been cancelled
CI / test (amd64) (push) Has been cancelled
CI / Windows (${{ matrix.name || matrix.shard}}) (win-bench, benchmarks) (push) Has been cancelled
CI / Windows (${{ matrix.name || matrix.shard}}) (win-shard-1-2, 1/2) (push) Has been cancelled
CI / Windows (${{ matrix.name || matrix.shard}}) (win-shard-2-2, 2/2) (push) Has been cancelled
CI / macos (push) Has been cancelled
CI / privileged (push) Has been cancelled
CI / vm (push) Has been cancelled
CI / cross (386, linux) (push) Has been cancelled
CI / cross (amd64, darwin) (push) Has been cancelled
CI / cross (amd64, freebsd) (push) Has been cancelled
CI / cross (amd64, openbsd) (push) Has been cancelled
CI / cross (amd64, windows) (push) Has been cancelled
CI / cross (arm, 5, linux) (push) Has been cancelled
CI / cross (arm, 7, linux) (push) Has been cancelled
CI / cross (arm64, darwin) (push) Has been cancelled
CI / cross (arm64, linux) (push) Has been cancelled
CI / cross (arm64, windows) (push) Has been cancelled
CI / cross (loong64, linux) (push) Has been cancelled
CI / ios (push) Has been cancelled
CI / crossmin (amd64, illumos) (push) Has been cancelled
CI / crossmin (amd64, plan9) (push) Has been cancelled
CI / crossmin (amd64, solaris) (push) Has been cancelled
CI / crossmin (ppc64, aix) (push) Has been cancelled
CI / android (push) Has been cancelled
CI / wasm (push) Has been cancelled
CI / tailscale_go (push) Has been cancelled
CI / depaware (push) Has been cancelled
CI / go_generate (push) Has been cancelled
CI / make_tidy (push) Has been cancelled
CI / licenses (push) Has been cancelled
CI / staticcheck (${{ matrix.name }}) (--with-tags-all=darwin, arm64, darwin, macOS) (push) Has been cancelled
CI / staticcheck (${{ matrix.name }}) (--with-tags-all=linux, amd64, linux, Linux) (push) Has been cancelled
CI / staticcheck (${{ matrix.name }}) (--with-tags-all=windows, amd64, windows, Windows) (push) Has been cancelled
CI / staticcheck (${{ matrix.name }}) (--without-tags-any=windows,darwin,linux --shard=1/4, amd64, linux, Portable (1/4)) (push) Has been cancelled
CI / staticcheck (${{ matrix.name }}) (--without-tags-any=windows,darwin,linux --shard=2/4, amd64, linux, Portable (2/4)) (push) Has been cancelled
CI / staticcheck (${{ matrix.name }}) (--without-tags-any=windows,darwin,linux --shard=3/4, amd64, linux, Portable (3/4)) (push) Has been cancelled
CI / staticcheck (${{ matrix.name }}) (--without-tags-any=windows,darwin,linux --shard=4/4, amd64, linux, Portable (4/4)) (push) Has been cancelled
CI / notify_slack (push) Has been cancelled
CI / merge_blocker (push) Has been cancelled
CI / check_mergeability_strict (push) Has been cancelled
CI / check_mergeability (push) Has been cancelled
ipn/localapi,client/local: honour Retry-After on cert rate-limit (#20315)
* ipn/localapi,ipnlocal,feature/acme,client/local: honour Retry-After on cert rate-limit

serveCert now responds with 429 + Retry-After when the underlying ACME
error is a rate limit, instead of a generic 500. client/local surfaces
this as a typed RateLimitedError with the parsed hint so callers can
back off intelligently.

Updates tailscale/corp#42164

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>

* tsweb,feature/acme,ipn/localapi,ipnlocal: generalise cert error → HTTP mapping via tsweb.HTTPStatuser

Introduces a tsweb.HTTPStatuser interface, any error can implement
to describe its intended HTTP response (code, message, headers).
Moves CertRateLimitedError from ipnlocal to feature/acme where it's
constructed, and it now uses HTTPStatuser to return 429 + Retry-After.

serveCert now checks for tsweb.HTTPStatuser rather than the specific
error type, so it no longer needs to know about the ACME rate-limit
type.

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>

---------

Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
2026-07-08 13:34:40 +01:00
..
auditlog all: use Go 1.26 things, run most gofix modernizers 2026-03-06 13:32:03 -08:00
conffile cmd/tailscale/cli, ipn/conffile: accept legacy serve config in set-config (#20056) 2026-06-12 18:52:17 -07:00
desktop all: don't repeat the the word "the" unnecessarily 2026-06-18 16:32:08 +01:00
ipnauth all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
ipnext ipn/ipnext, feature/routecheck: subscribe routecheck to the IPN bus 2026-07-02 20:26:27 -07:00
ipnlocal ipn/localapi,client/local: honour Retry-After on cert rate-limit (#20315) 2026-07-08 13:34:40 +01:00
ipnserver ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest 2026-06-27 16:11:42 -07:00
ipnstate all: fix typos where we repeat repeat ourselves 2026-07-03 16:09:03 +01:00
lapitest ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest 2026-06-27 16:11:42 -07:00
localapi ipn/localapi,client/local: honour Retry-After on cert rate-limit (#20315) 2026-07-08 13:34:40 +01:00
policy all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
store all: fix typos where we repeat repeat ourselves 2026-07-03 16:09:03 +01:00
backend_test.go ipn: add fmt.Stringer support to NotifyWatchOpt (#20072) 2026-06-18 10:27:16 -07:00
backend.go ipn/{ipn,ipnlocal}: add per-user policy snapshots to IPN bus (#20135) 2026-06-30 12:44:29 -07:00
conf_test.go ipn/config: add RelayServerPort and RelayServerStaticEndpoints to config file (#18300) 2026-06-26 15:45:29 -05:00
conf.go ipn/config: add RelayServerPort and RelayServerStaticEndpoints to config file (#18300) 2026-06-26 15:45:29 -05:00
doc.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
ipn_clone.go cmd/tailscale, ipn, feature/remoteconfig: add remote-config support 2026-07-07 12:10:34 -07:00
ipn_test.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
ipn_view.go cmd/tailscale, ipn, feature/remoteconfig: add remote-config support 2026-07-07 12:10:34 -07:00
prefs_test.go cmd/tailscale, ipn, feature/remoteconfig: add remote-config support 2026-07-07 12:10:34 -07:00
prefs.go cmd/tailscale, ipn, feature/remoteconfig: add remote-config support 2026-07-07 12:10:34 -07:00
serve_expand_test.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
serve_test.go ipn,ipn/localapi: require local admin to serve Unix domain sockets 2026-06-03 09:45:02 -06:00
serve.go ipn,ipn/localapi: require local admin to serve Unix domain sockets 2026-06-03 09:45:02 -06:00
store_test.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
store.go ipn/store: make WriteState(id, nil) delete key instead of adding nil entry (#19920) 2026-05-29 11:22:14 -07:00