starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] Unknown users break group policies. Deleted users do not correctly propogate. #1171

New Issue
Open
opened 2025-12-29 02:28:42 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:28:42 +01:00
Owner
Copy Link

Originally created by @rittycat on GitHub (Dec 17, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

Apologies in advance if this should be two separate issues, they just showed up together when testing.

  1. Non-existent / deleted users will completely invalidate a group, causing issues in larger, complex groups where we might publish a policy before the user has joined, or remove a user from headscale before the policy has been updated.
  2. User deletions do not seem to propogate properly. When a user is deleted, the group bug does not trigger until either a new user is added, or headscale is restarted.

v0.27.2-rc.1 specific notes:

  1. This bug is still entirely present
  2. It appears in this version that adding a new user no longer triggers the deleted user's state to be cleaned. I had to perform the additional step of adding a second non-existant user to the ACL for bug-1 to surface again

This issue seems closely related:
https://github.com/juanfont/headscale/issues/2863

Expected Behavior

  1. Users in ACL groups that don't yet exist in Headscale are simply ignored, and the rest of the group is parsed normally
  2. When a user is deleted, it properly cleans up its state in the same way that restarting headscale / adding a new user appears to

Steps To Reproduce

Bug 1 simply requires an ACL like the following:

{
    "groups": {
        "group:admin": [
            "ritty@example.com",
            "nonexistantuser@",
        ],
    },
    "acls": [
        {
            "action": "accept",
            "src":    ["group:admin"],
            "dst":    ["*:*"],
        },
    ],
}

Bug 2 shows the same behaviour though, and can be replicated with these steps:

V0.27.1

  1. Create a policy as follows. Pinging other devices should be possible
{
    "groups": {
        "group:admin": [
            "ritty@example.com",
        ],
    },
    "acls": [
        {
            "action": "accept",
            "src":    ["group:admin"],
            "dst":    ["*:*"],
        },
    ],
}
  1. Create two users deleteable and existinguser. Pinging should continue
  2. In the ACL, add deleteable@ to the group. Pinging should continue
        "group:admin": [
            "ritty@example.com",
            "deleteable@",
        ],
  1. Now remove the deleteable user without changing the ACL. Pinging should continue
  2. Add the existinguser@ to the ACL. Pinging should continue
        "group:admin": [
            "ritty@example.com",
            "deleteable@",
            "existinguser@",
        ],
  1. Create a new user anotheruser. Pinging will stop, even without updating the policy

V0.27.2-rc1
Do all up to 6, pinging will still continue after completing 6
7. Add another invalid user. Pinging will stop

        "group:admin": [
            "ritty@example.com",
            "deleteable@",
            "existinguser@",
            "nonexistinguser@",
        ],

Environment

- OS: Ubuntu 24.04.3 LTS - 6.8.0-71-generic Kernel
- Headscale version:
  - V0.27.1
    
    headscale version v0.27.1+dirty
    commit: f658a8eacd4d86edc65424b50635afed46ca4b2a
    build time: 2025-11-11T19:17:02Z
    built with: go1.25.1 linux/amd64
    
  - V0.27.2-rc1
    
    headscale version v0.27.2-rc.1+dirty
    commit: c6d399a66ca9ec94bb84e78e8edf9a31981f554c
    build time: 2025-11-30T18:10:56Z
    built with: go1.25.1 linux/amd64
    

- Tailscale version: 1.92.1
    
    tailscale commit: fb55d39055de6bb41a76cefebc923f2a7fe3dfec
    long version: 1.92.1-tfb55d3905-g9ac7fadc0
    other commit: 9ac7fadc0bb77ed38a4c7ca463af06e21002bbdb
    go version: go1.25.5

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Debug information

(None Apply)

Originally created by @rittycat on GitHub (Dec 17, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior Apologies in advance if this should be two separate issues, they just showed up together when testing. 1. Non-existent / deleted users will completely invalidate a group, causing issues in larger, complex groups where we might publish a policy before the user has joined, or remove a user from headscale before the policy has been updated. 2. User deletions do not seem to propogate properly. When a user is deleted, the group bug does not trigger until either a new user is added, or headscale is restarted. v0.27.2-rc.1 specific notes: 1. This bug is still entirely present 2. It appears in this version that adding a new user no longer triggers the deleted user's state to be cleaned. I had to perform the additional step of adding a second non-existant user to the ACL for bug-1 to surface again This issue seems closely related: https://github.com/juanfont/headscale/issues/2863 ### Expected Behavior 1. Users in ACL groups that don't yet exist in Headscale are simply ignored, and the rest of the group is parsed normally 2. When a user is deleted, it properly cleans up its state in the same way that restarting headscale / adding a new user appears to ### Steps To Reproduce Bug 1 simply requires an ACL like the following: ```json { "groups": { "group:admin": [ "ritty@example.com", "nonexistantuser@", ], }, "acls": [ { "action": "accept", "src": ["group:admin"], "dst": ["*:*"], }, ], } ``` Bug 2 shows the same behaviour though, and can be replicated with these steps: V0.27.1 1. Create a policy as follows. Pinging other devices should be possible ```json { "groups": { "group:admin": [ "ritty@example.com", ], }, "acls": [ { "action": "accept", "src": ["group:admin"], "dst": ["*:*"], }, ], } ``` 2. Create two users `deleteable` and `existinguser`. Pinging should continue 3. In the ACL, add `deleteable@` to the group. Pinging should continue ```json "group:admin": [ "ritty@example.com", "deleteable@", ], ``` 4. Now remove the `deleteable` user without changing the ACL. Pinging should continue 5. Add the `existinguser@` to the ACL. Pinging should continue ```json "group:admin": [ "ritty@example.com", "deleteable@", "existinguser@", ], ``` 6. Create a new user `anotheruser`. Pinging will stop, even without updating the policy V0.27.2-rc1 Do all up to 6, pinging will still continue after completing 6 7. Add another invalid user. Pinging will stop ```json "group:admin": [ "ritty@example.com", "deleteable@", "existinguser@", "nonexistinguser@", ], ``` ### Environment ```markdown - OS: Ubuntu 24.04.3 LTS - 6.8.0-71-generic Kernel - Headscale version: - V0.27.1 headscale version v0.27.1+dirty commit: f658a8eacd4d86edc65424b50635afed46ca4b2a build time: 2025-11-11T19:17:02Z built with: go1.25.1 linux/amd64 - V0.27.2-rc1 headscale version v0.27.2-rc.1+dirty commit: c6d399a66ca9ec94bb84e78e8edf9a31981f554c build time: 2025-11-30T18:10:56Z built with: go1.25.1 linux/amd64 - Tailscale version: 1.92.1 tailscale commit: fb55d39055de6bb41a76cefebc923f2a7fe3dfec long version: 1.92.1-tfb55d3905-g9ac7fadc0 other commit: 9ac7fadc0bb77ed38a4c7ca463af06e21002bbdb go version: go1.25.5 ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [x] Headscale runs in a container ### Debug information (None Apply)
adam added the bug label 2025-12-29 02:28:42 +01:00
adam commented 2025-12-29 02:28:42 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Dec 20, 2025):

Can you try the new beta?

@kradalby commented on GitHub (Dec 20, 2025): Can you try the new beta?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1171
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?