starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

ACLs with Action's using tags where no nodes with that tag don't parse. #148

New Issue
Closed
opened 2025-12-29 01:24:01 +01:00 by adam · 4 comments
adam commented 2025-12-29 01:24:01 +01:00
Owner
Copy Link

Originally created by @kyhwana on GitHub (Mar 4, 2022).

ACLs won't parse if you have an ACL where there are no nodes with the tag (or namespace?) specified in the ACL
For example:

 "tagOwners": {
            "tag:externalservers": [ "group:admin" ] 
        },
[snip]
{
            "Action": "accept",
            "Users": [ "group:users", "group:admin" ],
            "Ports": [ "externalservers:22" ]
        }
  • `Version 0.15-beta3
  • 1.22.0
Mar  4 02:22:23 headscaletest headscale[471972]: 2022-03-04T02:22:23Z DBG Loading ACL policy from path func=LoadACLPolicy path=/etc/headscale/acls.json
Mar  4 02:22:23 headscaletest headscale[471972]: 2022-03-04T02:22:23Z ERR Error parsing ACL 8, Port 0
Mar  4 02:22:23 headscaletest headscale[471972]: 2022-03-04T02:22:23Z ERR Could not load the ACL policy error="invalid user section" path=/etc/headscale/acls.json

As in, there are no nodes with the "externalservers" tag. If this is the case, the ACL file will fail to parse.
Removing the Action ACL and restarting headscale results in the ACL json file being parsed correctly.

Originally created by @kyhwana on GitHub (Mar 4, 2022). ACLs won't parse if you have an ACL where there are no nodes with the tag (or namespace?) specified in the ACL For example: ``` "tagOwners": { "tag:externalservers": [ "group:admin" ] }, [snip] { "Action": "accept", "Users": [ "group:users", "group:admin" ], "Ports": [ "externalservers:22" ] } ``` - `Version 0.15-beta3 - 1.22.0 ``` Mar 4 02:22:23 headscaletest headscale[471972]: 2022-03-04T02:22:23Z DBG Loading ACL policy from path func=LoadACLPolicy path=/etc/headscale/acls.json Mar 4 02:22:23 headscaletest headscale[471972]: 2022-03-04T02:22:23Z ERR Error parsing ACL 8, Port 0 Mar 4 02:22:23 headscaletest headscale[471972]: 2022-03-04T02:22:23Z ERR Could not load the ACL policy error="invalid user section" path=/etc/headscale/acls.json ```` As in, there are no nodes with the "externalservers" tag. If this is the case, the ACL file will fail to parse. Removing the Action ACL and restarting headscale results in the ACL json file being parsed correctly.
adam added the bug label 2025-12-29 01:24:01 +01:00
adam closed this issue 2025-12-29 01:24:01 +01:00
adam commented 2025-12-29 01:24:02 +01:00
Author
Owner
Copy Link

@restanrm commented on GitHub (Mar 4, 2022):

I believe this bug should have been fixed with #384

@restanrm commented on GitHub (Mar 4, 2022): I believe this bug should have been fixed with #384
adam commented 2025-12-29 01:24:02 +01:00
Author
Owner
Copy Link

@restanrm commented on GitHub (Mar 4, 2022):

Also, the tag will not be matched in the port section here. You should use the full name ie tag:externalservers

@restanrm commented on GitHub (Mar 4, 2022): Also, the tag will not be matched in the port section here. You should use the full name ie `tag:externalservers`
adam commented 2025-12-29 01:24:03 +01:00
Author
Owner
Copy Link

@restanrm commented on GitHub (Mar 7, 2022):

@kyhwana did you check if this solved your issue ?

@restanrm commented on GitHub (Mar 7, 2022): @kyhwana did you check if this solved your issue ?
adam commented 2025-12-29 01:24:04 +01:00
Author
Owner
Copy Link

@kyhwana commented on GitHub (Mar 8, 2022):

Looks like this was fixed in #384

@kyhwana commented on GitHub (Mar 8, 2022): Looks like this was fixed in #384
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#148
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?