public/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-09-18 06:22:05 +09:00
Code Issues Packages Projects Releases Wiki Activity

state: resolve changed peers through adjacency

Browse Source 
ListPeers now filters named peers against the recipient's adjacency, so
a node the policy hides is never delivered.

Updates #3417
This commit is contained in:
Kristoffer Dalby
2026-09-09 14:43:35 +00:00
parent e3c4c81b18
commit 4c6a2dff52
3 changed files with 19 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hscontrol/mapper/mapper.go
+3 -3
View File
@@ -438,9 +438,9 @@ func (m *mapper) buildFromChange(
// incremental peer-change and user-profile paths, computed from the same live
// per-node matchers and [policy.ReduceNodes] filter that
// [MapResponseBuilder.buildTailPeers] applies to full peer objects, so the
// paths cannot drift. The snapshot peer map ([NodeStore.ListPeers]) is used
// only as the candidate set, matching buildTailPeers; the live policy decides
// visibility because the snapshot is not rebuilt on policy changes.
// paths cannot drift. The recipient's adjacency from the NodeStore
// ([NodeStore.ListPeers]) is the authority for which peers exist for it; the
// live matchers only narrow that set further, matching buildTailPeers.
//
// ok is false when the node or its matchers cannot be resolved; callers must
// then fail closed (emit nothing) rather than risk leaking forbidden peers.