7 Commits

Include renames

Author	SHA1	Message	Date
alaningtrump	048308511c	chore: fix function comment to match actual function name ... Signed-off-by: alaningtrump <alaningtrump@outlook.com>	2026-07-03 07:27:08 +02:00
Kristoffer Dalby	f95b254ea9	policy/v2: exclude exit routes from ReduceFilterRules ... Add exit route check in ReduceFilterRules to prevent exit nodes from receiving packet filter rules for destinations that only overlap via exit routes. Remove resolved SUBNET_ROUTE_FILTER_RULES grant skip entries and update error message formatting for grant validation. Updates #2180	2026-04-01 14:10:42 +01:00
Kristoffer Dalby	f74ea5b8ed	hscontrol/policy/v2: add Grant policy format support ... Add support for the Grant policy format as an alternative to ACL format, following Tailscale's policy v2 specification. Grants provide a more structured way to define network access rules with explicit separation of IP-based and capability-based permissions. Key changes: - Add Grant struct with Sources, Destinations, InternetProtocols (ip), and App (capabilities) fields - Add ProtocolPort type for unmarshaling protocol:port strings - Add Grant validation in Policy.validate() to enforce: - Mutual exclusivity of ip and app fields - Required ip or app field presence - Non-empty sources and destinations - Refactor compileFilterRules to support both ACLs and Grants - Convert ACLs to Grants internally via aclToGrants() for unified processing - Extract destinationsToNetPortRange() helper for cleaner code - Rename parseProtocol() to toIANAProtocolNumbers() for clarity - Add ProtocolNumberToName mapping for reverse lookups The Grant format allows policies to be written using either the legacy ACL format or the new Grant format. ACLs are converted to Grants internally, ensuring backward compatibility while enabling the new format's benefits. Updates #2180	2026-04-01 14:10:42 +01:00
Kristoffer Dalby	49744cd467	policy/v2: accept RFC 3986 bracketed IPv6 in ACL destinations ... Headscale rejects IPv6 addresses with square brackets in ACL policy destinations (e.g. "[fd7a:115c:a1e0::87e1]:80,443"), while Tailscale SaaS accepts them. The root cause is that splitDestinationAndPort uses strings.LastIndex(":") which leaves brackets on the destination string, and netip.ParseAddr does not accept brackets. Add a bracket-handling branch at the top of splitDestinationAndPort that uses net.SplitHostPort for RFC 3986 parsing when input starts with "[". The extracted host is validated with netip.ParseAddr/ParsePrefix to ensure brackets are only accepted around IP addresses and CIDR prefixes, not hostnames or other alias types like tags and groups. Fixes #2754	2026-02-20 21:49:21 +01:00
Kristoffer Dalby	ce580f8245	all: fix golangci-lint issues (#3064)	2026-02-06 21:45:32 +01:00
Kristoffer Dalby	c6d7b512bd	integration: replace time.Sleep with assert.EventuallyWithT (#2680)	2025-07-10 23:38:55 +02:00
Kristoffer Dalby	87326f5c4f	Experimental implementation of Policy v2 (#2214) ... * utility iterator for ipset Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * split policy -> policy and v1 This commit split out the common policy logic and policy implementation into separate packages. policy contains functions that are independent of the policy implementation, this typically means logic that works on tailcfg types and generic formats. In addition, it defines the PolicyManager interface which the v1 implements. v1 is a subpackage which implements the PolicyManager using the "original" policy implementation. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use polivyv1 definitions in integration tests These can be marshalled back into JSON, which the new format might not be able to. Also, just dont change it all to JSON strings for now. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * formatter: breaks lines Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove compareprefix, use tsaddr version Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove getacl test, add back autoapprover Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use policy manager tag handling Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename display helper for user Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * introduce policy v2 package policy v2 is built from the ground up to be stricter and follow the same pattern for all types of resolvers. TODO introduce aliass resolver Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * wire up policyv2 in integration testing Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * split policy v2 tests into seperate workflow to work around github limit Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add policy manager output to /debug Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-03-10 16:20:29 +01:00