8 Commits

Include renames

Author	SHA1	Message	Date
Kristoffer Dalby	4cca63155d	all: apply godoc [Name] link conventions across comments ... Every Go-identifier reference in // and /* */ comments now uses godoc's [Name] linking syntax so pkg.go.dev and `go doc` render them as clickable cross-references. No behaviour change. Pattern applied across the tree: In-package [Foo], [Foo.Bar] Cross-package [pkg.Foo], [pkg.Foo.Bar] Stdlib [netip.Prefix], [errors.Is], [context.Context] Tailscale [tailcfg.MapResponse], [tailcfg.Node.CapMap], [tailcfg.NodeAttrSuggestExitNode] Skip rules: - File:line refs left as plain text - HuJSON wire keys inside backtick raw strings untouched - ACL/policy syntax tokens (tag:foo, autogroup:self, ...) not Go symbols, left as plain text - JSON/OIDC wire keys, gorm tags, RFC IPv6 placeholders, markdown link tags, decorative dividers — all left as-is	2026-05-19 09:55:22 +02:00
Kristoffer Dalby	c7a0ca709f	policy: surface exit nodes via autogroup:internet (#3212) ... compileFilterRules skipped autogroup:internet destinations to keep them out of the wire-format PacketFilter, but those same compiled rules are the source of pm.matchers — and Node.CanAccess relies on a matcher whose DestsIsTheInternet covers the public internet to surface exit-node peers to ACL sources. With the skip in place no such matcher existed, exit nodes silently dropped out of the source's peer list, and the docs' exit-node walkthrough stopped working: `tailscale exit-node list` returned "no exit nodes found" and `tailscale set --exit-node=<ip>` returned "no node found in netmap with IP". Drop the compile-time skip so autogroup:internet flows through normal matcher derivation, and teach ReduceFilterRules to keep the resulting client packet-filter rule on exit-route advertisers — Tailscale SaaS sends those rules to exit nodes so the kernel filter accepts traffic forwarded by autogroup:internet sources. Verified against a live tailnet on 2026-04-28 via tscap; the b17/b18 captures land under testdata/issue_3212/ as a regression guard. The captures are isolated from testdata/routes_results/ because the broader TestRoutesCompat machinery assumes a CIDR-prefix wire format that differs from the IPSet-range form SaaS emits for autogroup:internet — aligning that wire format is tracked separately. Fixes #3212	2026-04-29 11:24:33 +01:00
Kristoffer Dalby	ded51a4d30	policyutil: fix reduceCapGrantRule and add route reduction ... reduceCapGrantRule was dropping rules whose CapGrant IPs overlap a subnet route; treat subnet routes as part of node identity so those rules survive reduction. ReduceFilterRules now also reduces route-reachable destinations. Updates #3157	2026-04-17 16:31:49 +01:00
Kristoffer Dalby	93860a5c06	all: apply formatter changes	2026-04-13 17:23:47 +01:00
Kristoffer Dalby	0e3acdd8ec	policy/v2: implement CapGrant compilation with companion capabilities ... Compile grant app fields into CapGrant FilterRules matching Tailscale SaaS behavior. Key changes: - Generate CapGrant rules in compileFilterRules and compileGrantWithAutogroupSelf, with node-specific /32 and /128 Dsts for autogroup:self grants - Add reversed companion rules for drive→drive-sharer and relay→relay-target capabilities, ordered by original cap name - Narrow broad CapGrant Dsts to node-specific prefixes in ReduceFilterRules via new reduceCapGrantRule helper - Skip merging CapGrant rules in mergeFilterRules to preserve per-capability structure - Remove ip+app mutual exclusivity validation (Tailscale accepts both) - Add semantic JSON comparison for RawMessage types and netip.Prefix comparators in test infrastructure Reduces grant compat test skips from 99 to 41 (58 newly passing). Updates #2180	2026-04-01 14:10:42 +01:00
Kristoffer Dalby	f95b254ea9	policy/v2: exclude exit routes from ReduceFilterRules ... Add exit route check in ReduceFilterRules to prevent exit nodes from receiving packet filter rules for destinations that only overlap via exit routes. Remove resolved SUBNET_ROUTE_FILTER_RULES grant skip entries and update error message formatting for grant validation. Updates #2180	2026-04-01 14:10:42 +01:00
Kristoffer Dalby	ce580f8245	all: fix golangci-lint issues (#3064)	2026-02-06 21:45:32 +01:00
Kristoffer Dalby	2bf1200483	policy: fix autogroup:self propagation and optimize cache invalidation (#2807)	2025-10-23 17:57:41 +02:00