starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] Headscale does not accept IPv6 addresses with brackets #1094

New Issue
Open
opened 2025-12-29 02:28:14 +01:00 by adam · 0 comments
adam commented 2025-12-29 02:28:14 +01:00
Owner
Copy Link

Originally created by @nblock on GitHub (Aug 30, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

The following ACL is accepted by Tailscale SaaS:

{
	"acls": [
		{
			"action": "accept",
			"src":    ["alice@"],
			"dst":    ["[fd7a:115c:a1e0::87e1]:80,443"]
		}
	]
}

Headscale 0.26.1 refuses to load this ACL, error:

FTL ../runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="creating new headscale: loading ACL policy: creating policy manager: parsing policy: parsing policy from bytes: Invalid alias \"[fd7a:115c:a1e0::87e1]\". An alias must be one of the following types:\n- wildcard (*)\n- user (containing an \"@\")\n- group (starting with \"group:\")\n- tag (starting with \"tag:\")\n- autogroup (starting with \"autogroup:\")\n- host\n\nPlease check the format and try again."

As a workaround, rewrite as:

  • "fd7a:115c:a1e0::87e1:80,443" or
  • "fd7a:115c:a1e0::87e1/128:80,443"

Expected Behavior

It should accept IPv6 addresses written with [].

Steps To Reproduce

  1. Setup Headscale 0.26.1 with the above policy (v2)

Environment

- OS: Debian 13
- Headscale version: 0.26.1
- Tailscale version: -

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Debug information

not required.

Originally created by @nblock on GitHub (Aug 30, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior The following ACL is accepted by Tailscale SaaS: ```json { "acls": [ { "action": "accept", "src": ["alice@"], "dst": ["[fd7a:115c:a1e0::87e1]:80,443"] } ] } ``` Headscale 0.26.1 refuses to load this ACL, error: ``` FTL ../runner/work/headscale/headscale/cmd/headscale/cli/serve.go:24 > Error initializing error="creating new headscale: loading ACL policy: creating policy manager: parsing policy: parsing policy from bytes: Invalid alias \"[fd7a:115c:a1e0::87e1]\". An alias must be one of the following types:\n- wildcard (*)\n- user (containing an \"@\")\n- group (starting with \"group:\")\n- tag (starting with \"tag:\")\n- autogroup (starting with \"autogroup:\")\n- host\n\nPlease check the format and try again." ``` As a workaround, rewrite as: - `"fd7a:115c:a1e0::87e1:80,443"` or - `"fd7a:115c:a1e0::87e1/128:80,443"` ### Expected Behavior It should accept IPv6 addresses written with `[]`. ### Steps To Reproduce 1. Setup Headscale 0.26.1 with the above policy (v2) ### Environment ```markdown - OS: Debian 13 - Headscale version: 0.26.1 - Tailscale version: - ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [x] Headscale runs in a container ### Debug information not required.
adam added the bugtailscale-feature-gapno-stale-bot labels 2025-12-29 02:28:14 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug no-stale-bot tailscale-feature-gap
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1094
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?