Ubuntu ea85dcbc14 types: consider subnet routes as source identity in ACL matching ...

CanAccess and CanAccessRoute only used a node's Tailscale IPs as
source identity when matching ACL rules. A subnet router acting on
behalf of its advertised subnets was invisible to ACLs that reference
subnet CIDRs as source (e.g. src=10.88.8.0/24 dst=10.99.9.0/24).

Extend both functions to also check whether the node's approved
subnet routes overlap the matcher's source set. This makes subnet
routers visible to each other when ACLs reference their subnet CIDRs,
enabling subnet-to-subnet traffic routing.

The new checks are guarded by len(subnetRoutes) > 0, so non-router
nodes (the vast majority) pay zero additional cost.

Fixes #3157

2026-04-02 13:23:23 +00:00

..

change

all: apply golangci-lint 2.9.0 fixes

2026-02-19 08:21:23 +01:00

testdata

Restore support for "Override local DNS" (#2438)

2025-04-17 17:16:59 +02:00

api_key.go

types: add MarshalZerologObject to domain types

2026-02-06 07:40:29 +01:00

common_test.go

mapper: produce map before poll (#2628)

2025-07-28 11:15:53 +02:00

common.go

all: fix test flakiness and improve test infrastructure

2026-03-14 02:52:28 -07:00

config_test.go

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

config.go

fix: align banner right-side border to consistent 64-char width

2026-03-19 07:08:35 +01:00

const.go

improve testing of route failover logic

2024-04-15 12:31:53 +02:00

main_test.go

all: fix test flakiness and improve test infrastructure

2026-03-14 02:52:28 -07:00

node_benchmark_test.go

types: avoid NodeView clone in CanAccess

2026-02-26 19:15:07 -08:00

node_tags_test.go

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00

node_test.go

types,policy: add tests for subnet-to-subnet route visibility

2026-04-02 13:23:14 +00:00

node.go

types: consider subnet routes as source identity in ACL matching

2026-04-02 13:23:23 +00:00

policy.go

feat: implements apis for managing headscale policy (#1792)

2024-07-18 07:38:25 +02:00

preauth_key_test.go

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00

preauth_key.go

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

routes.go

Redo route code (#2422)

2025-02-26 16:22:55 +01:00

types_clone.go

make tags first class node owner (#2885)

2025-12-02 12:01:25 +01:00

types_view.go

hscontrol/types: regenerate types_view.go

2026-02-20 21:51:00 +01:00

users_test.go

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

users.go

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

version.go

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00