7 Commits

Include renames

Author	SHA1	Message	Date
Kristoffer Dalby	f95b254ea9	policy/v2: exclude exit routes from ReduceFilterRules ... Add exit route check in ReduceFilterRules to prevent exit nodes from receiving packet filter rules for destinations that only overlap via exit routes. Remove resolved SUBNET_ROUTE_FILTER_RULES grant skip entries and update error message formatting for grant validation. Updates #2180	2026-04-01 14:10:42 +01:00
Kristoffer Dalby	49744cd467	policy/v2: accept RFC 3986 bracketed IPv6 in ACL destinations ... Headscale rejects IPv6 addresses with square brackets in ACL policy destinations (e.g. "[fd7a:115c:a1e0::87e1]:80,443"), while Tailscale SaaS accepts them. The root cause is that splitDestinationAndPort uses strings.LastIndex(":") which leaves brackets on the destination string, and netip.ParseAddr does not accept brackets. Add a bracket-handling branch at the top of splitDestinationAndPort that uses net.SplitHostPort for RFC 3986 parsing when input starts with "[". The extracted host is validated with netip.ParseAddr/ParsePrefix to ensure brackets are only accepted around IP addresses and CIDR prefixes, not hostnames or other alias types like tags and groups. Fixes #2754	2026-02-20 21:49:21 +01:00
Kristoffer Dalby	ce580f8245	all: fix golangci-lint issues (#3064)	2026-02-06 21:45:32 +01:00
Kristoffer Dalby	eec196d200	modernize: run gopls modernize to bring up to 1.25 (#2920)	2025-12-01 19:40:25 +01:00
Kristoffer Dalby	2938d03878	policy: reject unsupported fields (#2764)	2025-09-12 14:47:56 +02:00
Kristoffer Dalby	bd6ed80936	policy/v2: error on missing or zero port (#2606) ... * policy/v2: error on missing or zero port Fixes #2605 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog: add entry Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-16 17:30:47 +02:00
Kristoffer Dalby	87326f5c4f	Experimental implementation of Policy v2 (#2214) ... * utility iterator for ipset Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * split policy -> policy and v1 This commit split out the common policy logic and policy implementation into separate packages. policy contains functions that are independent of the policy implementation, this typically means logic that works on tailcfg types and generic formats. In addition, it defines the PolicyManager interface which the v1 implements. v1 is a subpackage which implements the PolicyManager using the "original" policy implementation. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use polivyv1 definitions in integration tests These can be marshalled back into JSON, which the new format might not be able to. Also, just dont change it all to JSON strings for now. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * formatter: breaks lines Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove compareprefix, use tsaddr version Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove getacl test, add back autoapprover Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use policy manager tag handling Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename display helper for user Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * introduce policy v2 package policy v2 is built from the ground up to be stricter and follow the same pattern for all types of resolvers. TODO introduce aliass resolver Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * wire up policyv2 in integration testing Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * split policy v2 tests into seperate workflow to work around github limit Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add policy manager output to /debug Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-03-10 16:20:29 +01:00