Kristoffer Dalby 8addacb06a policy/v2: add peer visibility compat tests for subnet-to-subnet ACLs ...

Add TestRoutesCompatPeerVisibility and TestRoutesCompatNoFalsePositivePeers
which use the Tailscale SaaS golden file data to validate the CanAccess /
ReduceNodes / ReduceRoutes code paths for subnet-to-subnet ACL scenarios.

These tests derive expected peer relationships from the golden file
captures: if Tailscale SaaS delivers filter rules to a node with SrcIPs
overlapping another node's subnet routes, those nodes must be peers. This
exercises the CanAccess fix where subnet routes are treated as source
identity, ensuring the fix is validated against real SaaS behavior.

Also fix buildRoutesUsersAndNodes to auto-assign unique node IDs when the
golden files don't provide them, which is required for ReduceNodes to
correctly skip self-comparisons.

Updates #3157
Updates #3169

2026-04-02 20:47:06 +00:00

..

assets

Swap favicon for updated version

2026-03-03 05:59:40 +01:00

capver

capver: regenerate from docker tags

2026-02-07 08:23:51 +01:00

db

all: fix test flakiness and improve test infrastructure

2026-03-14 02:52:28 -07:00

derp

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

dns

Fix typo in comment about fsnotify behavior

2026-02-27 15:23:06 +01:00

mapper

types,mapper,integration: enable Taildrive and add cap/drive grant lifecycle test

2026-04-01 14:10:42 +01:00

policy

policy/v2: add peer visibility compat tests for subnet-to-subnet ACLs

2026-04-02 20:47:06 +00:00

routes

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00

servertest

testdata: convert .json to .hujson with header comments

2026-04-01 14:10:42 +01:00

state

policy/v2: fix via grants in BuildPeerMap, MatchersForNode, and ViaRoutesForPeer

2026-04-01 14:10:42 +01:00

templates

templates: generalise auth templates for web and OIDC

2026-02-25 21:28:05 +01:00

types

types: consider subnet routes as source identity in ACL matching

2026-04-02 13:23:23 +00:00

util

mapper/batcher: restructure internals for correctness

2026-03-14 02:52:28 -07:00

app.go

hscontrol: add servertest harness for in-process control plane testing

2026-03-19 07:05:58 +01:00

auth_tags_test.go

auth: generalise auth flow and introduce AuthVerdict

2026-02-25 21:28:05 +01:00

auth_test.go

all: fix test flakiness and improve test infrastructure

2026-03-14 02:52:28 -07:00

auth.go

Update docs for auth-id changes

2026-03-01 13:38:22 +01:00

debug.go

mapper: remove Batcher interface, rename to Batcher struct

2026-03-14 02:52:28 -07:00

grpcv1_test.go

hscontrol: add tests for deleting users with tagged nodes

2026-02-20 21:51:00 +01:00

grpcv1.go

hscontrol, cli: add auth register and approve commands

2026-02-25 21:28:05 +01:00

handlers.go

Update docs for auth-id changes

2026-03-01 13:38:22 +01:00

metrics.go

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

noise_test.go

noise: limit request body size to prevent unauthenticated OOM

2026-03-16 09:28:31 +01:00

noise.go

noise: limit request body size to prevent unauthenticated OOM

2026-03-16 09:28:31 +01:00

oidc_template_test.go

templates: generalise auth templates for web and OIDC

2026-02-25 21:28:05 +01:00

oidc_test.go

oidc: make email verification configurable

2025-12-18 11:42:32 +00:00

oidc.go

Update docs for auth-id changes

2026-03-01 13:38:22 +01:00

platform_config.go

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

poll_test.go

poll: fix poll test linter violations

2026-03-12 01:27:34 -07:00

poll.go

hscontrol/poll,state: fix grace period disconnect TOCTOU race

2026-03-19 07:05:58 +01:00

tailsql.go

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

templates_consistency_test.go

templates: generalise auth templates for web and OIDC

2026-02-25 21:28:05 +01:00