mirror of
https://github.com/juanfont/headscale.git
synced 2026-01-11 20:00:28 +01:00
[Bug] v0.27.0 policy apply errors #1118
Closed
opened 2025-12-29 02:28:21 +01:00 by adam
·
14 comments
No Branch/Tag Specified
main
update_flake_lock_action
gh-pages
kradalby/release-v0.27.2
dependabot/go_modules/golang.org/x/crypto-0.45.0
dependabot/go_modules/github.com/opencontainers/runc-1.3.3
copilot/investigate-headscale-issue-2788
copilot/investigate-visibility-issue-2788
copilot/investigate-issue-2833
copilot/debug-issue-2846
copilot/fix-issue-2847
dependabot/go_modules/github.com/go-viper/mapstructure/v2-2.4.0
dependabot/go_modules/github.com/docker/docker-28.3.3incompatible
kradalby/cli-experiement3
doc/0.26.1
doc/0.25.1
doc/0.25.0
doc/0.24.3
doc/0.24.2
doc/0.24.1
doc/0.24.0
kradalby/build-docker-on-pr
topic/docu-versioning
topic/docker-kos
juanfont/fix-crash-node-id
juanfont/better-disclaimer
update-contributors
topic/prettier
revert-1893-add-test-stage-to-docs
add-test-stage-to-docs
remove-node-check-interval
fix-empty-prefix
fix-ephemeral-reusable
bug_report-debuginfo
autogroups
logs-to-stderr
revert-1414-topic/fix_unix_socket
rename-machine-node
port-embedded-derp-tests-v2
port-derp-tests
duplicate-word-linter
update-tailscale-1.36
warn-against-apache
ko-fi-link
more-acl-tests
fix-typo-standalone
parallel-nolint
tparallel-fix
rerouting
ssh-changelog-docs
oidc-cleanup
web-auth-flow-tests
kradalby-gh-runner
fix-proto-lint
remove-funding-links
go-1.19
enable-1.30-in-tests
0.16.x
cosmetic-changes-integration
tmp-fix-integration-docker
fix-integration-docker
configurable-update-interval
show-nodes-online
hs2021
acl-syntax-fixes
ts2021-implementation
fix-spurious-updates
unstable-integration-tests
mandatory-stun
embedded-derp
prtemplate-fix
v0.28.0-beta.1
v0.27.2-rc.1
v0.27.1
v0.27.0
v0.27.0-beta.2
v0.27.0-beta.1
v0.26.1
v0.26.0
v0.26.0-beta.2
v0.26.0-beta.1
v0.25.1
v0.25.0
v0.25.0-beta.2
v0.24.3
v0.25.0-beta.1
v0.24.2
v0.24.1
v0.24.0
v0.24.0-beta.2
v0.24.0-beta.1
v0.23.0
v0.23.0-rc.1
v0.23.0-beta.5
v0.23.0-beta.4
v0.23.0-beta3
v0.23.0-beta2
v0.23.0-beta1
v0.23.0-alpha12
v0.23.0-alpha11
v0.23.0-alpha10
v0.23.0-alpha9
v0.23.0-alpha8
v0.23.0-alpha7
v0.23.0-alpha6
v0.23.0-alpha5
v0.23.0-alpha4
v0.23.0-alpha4-docker-ko-test9
v0.23.0-alpha4-docker-ko-test8
v0.23.0-alpha4-docker-ko-test7
v0.23.0-alpha4-docker-ko-test6
v0.23.0-alpha4-docker-ko-test5
v0.23.0-alpha-docker-release-test-debug2
v0.23.0-alpha-docker-release-test-debug
v0.23.0-alpha4-docker-ko-test4
v0.23.0-alpha4-docker-ko-test3
v0.23.0-alpha4-docker-ko-test2
v0.23.0-alpha4-docker-ko-test
v0.23.0-alpha3
v0.23.0-alpha2
v0.23.0-alpha1
v0.22.3
v0.22.2
v0.23.0-alpha-docker-release-test
v0.22.1
v0.22.0
v0.22.0-alpha3
v0.22.0-alpha2
v0.22.0-alpha1
v0.22.0-nfpmtest
v0.21.0
v0.20.0
v0.19.0
v0.19.0-beta2
v0.19.0-beta1
v0.18.0
v0.18.0-beta4
v0.18.0-beta3
v0.18.0-beta2
v0.18.0-beta1
v0.17.1
v0.17.0
v0.17.0-beta5
v0.17.0-beta4
v0.17.0-beta3
v0.17.0-beta2
v0.17.0-beta1
v0.17.0-alpha4
v0.17.0-alpha3
v0.17.0-alpha2
v0.17.0-alpha1
v0.16.4
v0.16.3
v0.16.2
v0.16.1
v0.16.0
v0.16.0-beta7
v0.16.0-beta6
v0.16.0-beta5
v0.16.0-beta4
v0.16.0-beta3
v0.16.0-beta2
v0.16.0-beta1
v0.15.0
v0.15.0-beta6
v0.15.0-beta5
v0.15.0-beta4
v0.15.0-beta3
v0.15.0-beta2
v0.15.0-beta1
v0.14.0
v0.14.0-beta2
v0.14.0-beta1
v0.13.0
v0.13.0-beta3
v0.13.0-beta2
v0.13.0-beta1
upstream/v0.12.4
v0.12.4
v0.12.3
v0.12.2
v0.12.2-beta1
v0.12.1
v0.12.0-beta2
v0.12.0-beta1
v0.11.0
v0.10.8
v0.10.7
v0.10.6
v0.10.5
v0.10.4
v0.10.3
v0.10.2
v0.10.1
v0.10.0
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.1
v0.8.0
v0.7.1
v0.7.0
v0.6.1
v0.6.0
v0.5.2
v0.5.1
v0.5.0
v0.4.0
v0.3.6
v0.3.5
v0.3.4
v0.3.3
v0.3.2
v0.3.1
v0.3.0
v0.2.2
v0.2.1
v0.2.0
v0.1.1
v0.1.0
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
Mirrored from GitHub Pull Request
No Label
bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/headscale#1118
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @YouSysAdmin on GitHub (Oct 27, 2025).
Is this a support request?
Is there an existing issue for this?
Current Behavior
Multiple errors during policy apply
As far as I understand, this error is displayed separately for each group and with list of all users in group.
Users:
Policy:
Expected Behavior
headscale policy set -f policy.jsonSteps To Reproduce
Environment
Runtime environment
Debug information
@kradalby commented on GitHub (Oct 27, 2025):
Could you share more of your policy?
The useful thing would be a minimally reproducible example as this is not sufficient to reproduce, most policies and our tests pass, so there must be a case we do not know about.
@YouSysAdmin commented on GitHub (Oct 27, 2025):
Yes, I'll try to reproduce the problem in a test environment and provide a ready-made database. There's nothing special in the policy itself, just a bunch of groups and ACLs, but unfortunately I can't publish it.
@mhahl commented on GitHub (Oct 28, 2025):
I started seeing the same error after upgrading 0.26.1 -> 0.27.0 with Keycloak.
I had to change my acls to use the email.
However I can't replicate on a fresh install.
@schwankner commented on GitHub (Oct 28, 2025):
I've been getting this error
cannot unmarshal JSON string into Go v2.AliasWithPorts within \"/acls/1/dst/0\": hostport must contain a colon (\":\")"since updating from 0.26.1 to 0.27.0 — I think it's related to this issue as well.@kradalby commented on GitHub (Oct 28, 2025):
Hi!,
First, I really wish you guys would have helped testing the betas with a copy of your databases and policies, it would have helps us tremendously and it would have been great to get all of these things sorted before we release.
We have an issue templates that asks for information, including version of the policy file that reproduce the issue, and so on. We ask this for us to be able to fix it quickly and efficiently.
We have quite an extensive test set for the policy, and clearly, we have missing cases, those are cases we already do not know about, and reversing them from the errors are not trivial. When we know how to test it, we aim to both fix, improve or change the error message to be more helpful. But we need information.
@mhahl commented on GitHub (Oct 28, 2025):
I think this one is mentioned in the release notes.
Have a look through: https://github.com/juanfont/headscale/pull/2606
@YouSysAdmin commented on GitHub (Oct 28, 2025):
@kradalby
I started testing the beta, but unfortunately I'm from Ukraine and reality is making its own adjustments in the life. :(
I will try to reproduce the problem in a test environment and share the db and policy.
@YouSysAdmin commented on GitHub (Oct 28, 2025):
@kradalby
DB+Policy: https://storage.sysadmin.host/public/headscale-test.tar.gz
The mode for policy
databaseIt appears the problem is occurring on the CLI side during policy application.
During the policy verification process, the CLI attempts to retrieve user addresses, but it does not have this data on its side.
If the mode is switched to
file, Headscale does not show any errors on startup. Similarly, if the policy already exists in the database and the mode is set todatabase, there will also be no errors on startup – the problem only occurs on the CLI side for thepolicy setcommand.P.S. No errors occur if the ACL list is empty.
@schwankner commented on GitHub (Oct 28, 2025):
Yes, this solved the problem, thanks!
@mhahl commented on GitHub (Oct 29, 2025):
@YouSysAdmin Just quickly testing with your database and policy:
Using the following
compose.yamlDropped your database into
/data/containers/headscale/dataand yourpolicy.jsonin to/data/containers/headscale/datawith a basic config.yaml.Running the container (built with the v0.27.0 tag):
I can indeed replicate your issue!
Just quickly looking though the code. (For the record I'm not a Go dev)
450a7b15ec/cmd/headscale/cli/policy.go (L130-L134)Seems that setting the second argument in
NewPolicyManagertonilcauses thelen()check below forpotentialUsersto always be 0,450a7b15ec/hscontrol/policy/v2/types.go (L163-L192)Always returning the error:
450a7b15ec/hscontrol/policy/v2/types.go (L184)@StarkZarn commented on GitHub (Nov 1, 2025):
I had include port "0" in my ACLs to permit the use of a node for routability to on-network endpoints without allowing explicit access to that node itself. Is this no longer required? I don't see mention of this use-case in the release notes or the PR.
@nblock commented on GitHub (Nov 2, 2025):
You could use a icmp rule instead:
But I believe this is no longer required.
@YouSysAdmin commented on GitHub (Nov 2, 2025):
Hi @kradalby @nblock
Thnx for the fix.
I will test this on a real infrastructure and let you know the results.
@YouSysAdmin commented on GitHub (Nov 10, 2025):
Hi @kradalby @nblock
Everything seems fine.
I hope that 0.27.1 is just around the corner :)
It would be great to include this fix, without it, viewing routes is very inconvenient :)
https://github.com/juanfont/headscale/pull/2760