Kristoffer Dalby e5fcd01ee6 policy/v2: match via-grant destinations by prefix overlap ...

slices.Contains required exact equality between grant dst and the
advertised subnet route. Any non-identical pair was rejected, so a
via grant with broader (or narrower) dst emitted no filter rule and
added no route to the viewer's AllowedIPs. Tailscale SaaS uses
containment in either direction.

Switch to slices.ContainsFunc(routes, dst.Overlaps) for filter rule
emission (keep dst literal in DstPorts), and append overlapping
advertised routes to ViaRoutesForPeer.Include / Exclude. Rewrite the
multi-router HA election and regular-grant overlap detection to key
off the matched routes rather than the dst. Resolve *Host aliases to
*Prefix once in compileOneViaGrant and at the top of ViaRoutesForPeer
so the switch arms reach them.

Fixes #3267

2026-05-18 14:02:00 +02:00

..

matcher

policy/matcher: include CapGrant.Dsts in match destinations

2026-05-11 14:55:06 +01:00

policyutil

policy: surface exit nodes via autogroup:internet (#3212)

2026-04-29 11:24:33 +01:00

v2

policy/v2: match via-grant destinations by prefix overlap

2026-05-18 14:02:00 +02:00

pm.go

policy/v2: parse, validate, and compile nodeAttrs

2026-05-13 14:22:30 +02:00

policy_autoapprove_test.go

policy/v2: refactor alias resolution to use ResolvedAddresses

2026-04-01 14:10:42 +01:00

policy_route_approval_test.go

all: apply golangci-lint 2.9.0 fixes

2026-02-19 08:21:23 +01:00

policy_test.go

policy/v2: align SSH rule validation with Tailscale

2026-05-13 21:10:13 +02:00

policy.go

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00

route_approval_test.go

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00