From d87afe6f4b3ad1dd971f99d2fe0d58b2ea583e17 Mon Sep 17 00:00:00 2001 From: Samuel Batista Date: Sat, 7 Feb 2026 02:16:54 -0500 Subject: [PATCH] When tailscaled restarts and sends Auth=nil, Expiry=zero, tagged nodes will correctly return early without being routed into handleLogout and having their expiry corrupted. --- hscontrol/auth.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hscontrol/auth.go b/hscontrol/auth.go index 1aa40c7b..6f5e5938 100644 --- a/hscontrol/auth.go +++ b/hscontrol/auth.go @@ -73,7 +73,10 @@ func (h *Headscale) handleRegister( // When tailscaled restarts, it sends RegisterRequest with Auth=nil and Expiry=zero. // Return the current node state without modification. // See: https://github.com/juanfont/headscale/issues/2862 - if req.Expiry.IsZero() && node.Expiry().Valid() && !node.IsExpired() { + // Note: node.Expiry().Valid() was too strict — tagged nodes have nil expiry, + // which caused zero-time requests to fall through to handleLogout and + // incorrectly set their expiry to 0001-01-01 (Go zero time). + if req.Expiry.IsZero() && !node.IsExpired() { return nodeToRegisterResponse(node), nil }