7 Commits

Include renames

Author	SHA1	Message	Date
Kristoffer Dalby	0f6d312ada	all: upgrade to Go 1.26rc2 and modernize codebase ... This commit upgrades the codebase from Go 1.25.5 to Go 1.26rc2 and adopts new language features. Toolchain updates: - go.mod: go 1.25.5 → go 1.26rc2 - flake.nix: buildGo125Module → buildGo126Module, go_1_25 → go_1_26 - flake.nix: build golangci-lint from source with Go 1.26 - Dockerfile.integration: golang:1.25-trixie → golang:1.26rc2-trixie - Dockerfile.tailscale-HEAD: golang:1.25-alpine → golang:1.26rc2-alpine - Dockerfile.derper: golang:alpine → golang:1.26rc2-alpine - .goreleaser.yml: go mod tidy -compat=1.25 → -compat=1.26 - cmd/hi/run.go: fallback Go version 1.25 → 1.26rc2 - .pre-commit-config.yaml: simplify golangci-lint hook entry Code modernization using Go 1.26 features: - Replace tsaddr.SortPrefixes with slices.SortFunc + netip.Prefix.Compare - Replace ptr.To(x) with new(x) syntax - Replace errors.As with errors.AsType[T] Lint rule updates: - Add forbidigo rules to prevent regression to old patterns	2026-02-08 12:35:23 +01:00
Kristoffer Dalby	ce580f8245	all: fix golangci-lint issues (#3064)	2026-02-06 21:45:32 +01:00
Kristoffer Dalby	835b7eb960	policy: autogroup:internet does not generate packet filters ... According to Tailscale SaaS behavior, autogroup:internet is handled by exit node routing via AllowedIPs, not by packet filtering. ACL rules with autogroup:internet as destination should produce no filter rules for any node. Previously, Headscale expanded autogroup:internet to public CIDR ranges and distributed filters to exit nodes (because 0.0.0.0/0 "covers" internet destinations). This was incorrect. Add detection for AutoGroupInternet in filter compilation to skip filter generation for this autogroup. Update test expectations accordingly.	2026-02-05 19:29:16 +01:00
Kristoffer Dalby	29aa08df0e	policy: update test expectations for merged filter rules ... Update test expectations across policy tests to expect merged FilterRule entries instead of separate ones. Tests now expect: - Single FilterRule with combined DstPorts for same source - Reduced matcher counts for exit node tests Updates #3036	2026-02-05 19:29:16 +01:00
Kristoffer Dalby	f735502eae	policy: add ICMP protocols to default and export constants ... When ACL rules don't specify a protocol, Headscale now defaults to [TCP, UDP, ICMP, ICMPv6] instead of just [TCP, UDP], matching Tailscale's behavior. Also export protocol number constants (ProtocolTCP, ProtocolUDP, etc.) for use in external test packages, renaming the string protocol constants to ProtoNameTCP, ProtoNameUDP, etc. to avoid conflicts. This resolves 78 ICMP-related TODOs in the Tailscale compatibility tests, reducing the total from 165 to 87. Updates #3036	2026-02-05 19:29:16 +01:00
Kristoffer Dalby	eb788cd007	make tags first class node owner (#2885) ... This PR changes tags to be something that exists on nodes in addition to users, to being its own thing. It is part of moving our tags support towards the correct tailscale compatible implementation. There are probably rough edges in this PR, but the intention is to get it in, and then start fixing bugs from 0.28.0 milestone (long standing tags issue) to discover what works and what doesnt. Updates #2417 Closes #2619	2025-12-02 12:01:25 +01:00
Kristoffer Dalby	2bf1200483	policy: fix autogroup:self propagation and optimize cache invalidation (#2807)	2025-10-23 17:57:41 +02:00