mirror of
https://github.com/juanfont/headscale.git
synced 2026-09-09 18:21:32 +09:00
Kristoffer Dalby
ac8f9c7ecc
Fix fragile IP indexing in reduceCapGrantRule: replace hard-coded nodeIPs[0]/nodeIPs[1] access with a range loop, matching the pattern used by the adjacent broad-prefix branch. The old code would panic if a node had zero IPs. Remove redundant SubnetRoutes check in ReduceFilterRules: the check was strictly redundant with the RoutableIPs check since SubnetRoutes is always a subset of RoutableIPs. Document that golden data always has routable_ips == approved_routes so we cannot determine which set Tailscale actually checks. Add tests: - TestReduceFilterRulesCapGrant: 7 cases covering IP narrowing, non-matching filtered out, subnet route overlap, exit route skipping, mixed DstPorts+CapGrant, IPv4-only, and zero-IP nodes - TestReduceFilterRulesPartialApproval: 3 cases documenting behavior for approved, unapproved-but-advertised, and non-advertised routes Updates #3157