10 Commits

Include renames

Author	SHA1	Message	Date
Kristoffer Dalby	ce580f8245	all: fix golangci-lint issues (#3064)	2026-02-06 21:45:32 +01:00
Kristoffer Dalby	0b1727c337	policy: merge filter rules with identical SrcIPs and IPProto ... Tailscale merges multiple ACL rules into fewer FilterRule entries when they have identical SrcIPs and IPProto, combining their DstPorts arrays. This change implements the same behavior in Headscale. Add mergeFilterRules() which uses O(n) hash map lookup to merge rules with identical keys. DstPorts are NOT deduplicated to match Tailscale behavior. Also fix DestsIsTheInternet() to handle merged filter rules where TheInternet is combined with other destinations - now uses superset check instead of equality check. Updates #3036	2026-02-05 19:29:16 +01:00
Kristoffer Dalby	d9c3eaf8c8	matcher: Add func for comparing Dests and TheInternet ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-11-02 13:19:59 +01:00
Kristoffer Dalby	c6d7b512bd	integration: replace time.Sleep with assert.EventuallyWithT (#2680)	2025-07-10 23:38:55 +02:00
Kristoffer Dalby	45e38cb080	policy: reduce routes sent to peers based on packetfilter (#2561) ... * notifier: use convenience funcs Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy: reduce routes based on policy Fixes #2365 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * hsic: more helper methods Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy: more test cases Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: add route with filter acl integration test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * integration: correct route reduce test, now failing Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * mapper: compare peer routes against node Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * hs: more output to debug strings Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * types/node: slice.ContainsFunc Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy: more reduce route test Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * changelog: add entry for route filter Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-04 21:52:47 +02:00
Kristoffer Dalby	d810597414	policy/matcher: fix bug using contains instead of overlap (#2556) ... * policy/matcher: slices.ContainsFunc Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy/matcher: slices.ContainsFunc, correct contains vs overlap Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy: add tests to validate fix for 2181 Fixes #2181 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-02 22:08:56 +02:00
3 people	4651d06fa8	Make matchers part of the Policy interface (#2514) ... * Make matchers part of the Policy interface * Prevent race condition between rules and matchers * Test also matchers in tests for Policy.Filter * Compute `filterChanged` in v2 policy correctly * Fix nil vs. empty list issue in v2 policy test * policy/v2: always clear ssh map Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> Co-authored-by: Aras Ergus <aras.ergus@tngtech.com> Co-authored-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-05-01 07:06:30 +02:00
Kristoffer Dalby	7891378f57	Redo route code (#2422) ... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-02-26 16:22:55 +01:00
Kristoffer Dalby	9c425a1c08	Finish SSH ... This commit allows SSH rules to be assigned to each relevant not and by doing that allow SSH to be rejected, completing the initial SSH support. This commit enables SSH by default and removes the experimental flag. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-06-21 10:31:48 +02:00
Kristoffer Dalby	feb15365b5	Split code into modules ... This is a massive commit that restructures the code into modules: db/ All functions related to modifying the Database types/ All type definitions and methods that can be exclusivly used on these types without dependencies policy/ All Policy related code, now without dependencies on the Database. policy/matcher/ Dedicated code to match machines in a list of FilterRules Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2023-05-26 12:24:50 +02:00