Kristoffer Dalby 51522195ef policy/v2: reject hosts-table aliases as SSH dst ...

SaaS rejects any hosts-table alias on an SSH rule dst with
`invalid dst "alias"`, irrespective of whether the alias resolves
to a single IP or a CIDR. headscale was resolving the alias through
the same path as ACL dsts and accepting the policy. Validate at the
per-SSH-rule pass so the error body matches SaaS. The existing
host-alias-as-dst sshtest_test row tested the now-rejected shape
and is dropped along with its unused commonHosts fixture.

2026-05-13 10:04:39 +00:00

..

matcher

policy/matcher: include CapGrant.Dsts in match destinations

2026-05-11 14:55:06 +01:00

policyutil

policy: surface exit nodes via autogroup:internet (#3212)

2026-04-29 11:24:33 +01:00

v2

policy/v2: reject hosts-table aliases as SSH dst

2026-05-13 10:04:39 +00:00

pm.go

policy/v2,state,mapper: implement per-viewer via route steering

2026-04-01 14:10:42 +01:00

policy_autoapprove_test.go

policy/v2: refactor alias resolution to use ResolvedAddresses

2026-04-01 14:10:42 +01:00

policy_route_approval_test.go

all: apply golangci-lint 2.9.0 fixes

2026-02-19 08:21:23 +01:00

policy_test.go

policy/v2: align SSH rule validation with Tailscale SaaS

2026-05-13 08:17:01 +00:00

policy.go

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00

route_approval_test.go

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00