public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-02 11:44:05 +09:00
Code Issues Packages Projects Releases Wiki Activity

mapper: send an empty SSH policy when compiling it fails

Browse Source 
Fail closed; nil kept the client's previous rules.

Updates #3508
This commit is contained in:
Kristoffer Dalby authored and Kristoffer Dalby committed 2026-10-08 10:29:23 +02:00
1 parent 2a0823ca41
commit d7b333d2aa
3 files changed
+63 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

hscontrol/mapper/builder.go
+5 -6
View File
@@ -151,16 +151,15 @@ func (b *MapResponseBuilder) WithSSHPolicy() *MapResponseBuilder {
sshPolicy, err := b.mapper.state.SSHPolicy(node)
if err != nil {
// SSH policy is optional for a node to function. Rather than fail the
// whole map (leaving the node unable to connect), log and continue
// without it; the node still receives a usable netmap.
log.Warn().Caller().
// Don't fail the whole map over SSH, but fail closed: a nil
// SSHPolicy would leave the client's previous rules in force.
log.Error().Caller().
Err(err).
Uint64(zf.NodeID, node.ID().Uint64()).
Str(zf.NodeHostname, node.Hostname()).
Msg("building map response: skipping SSH policy for node; node will receive a map without SSH rules")
Msg("building map response: compiling SSH policy failed; sending empty SSH policy")
return b
sshPolicy = &tailcfg.SSHPolicy{Rules: []*tailcfg.SSHRule{}}
}
b.resp.SSHPolicy = sshPolicy