starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #2089] [MERGED] validate policy against nodes, error if not valid #2486

New Issue
Closed
opened 2025-12-29 03:21:29 +01:00 by adam · 0 comments
adam commented 2025-12-29 03:21:29 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2089
Author: @kradalby
Created: 8/30/2024
Status: ✅ Merged
Merged: 8/30/2024
Merged by: @kradalby

Base: main ← Head: kradalby/acl-invalid-action

📝 Commits (5)

  • 4bd6936 validate policy against nodes, error if not valid
  • cb12055 ensure stderr can be used in err checks
  • 7860d37 test policy set validation
  • be6acdd add new integration test to ghaction
  • d5a3253 add back defer for cli tst

📊 Changes

6 files changed (+129 additions, -5 deletions)

View changed files

📝 .github/workflows/test-integration.yaml (+1 -0)
📝 hscontrol/app.go (+26 -0)
📝 hscontrol/grpcv1.go (+26 -3)
📝 integration/cli_test.go (+74 -0)
📝 integration/dockertestutil/execute.go (+1 -1)
📝 integration/hsic/hsic.go (+1 -1)

📄 Description

this commit aims to improve the feedback of "runtime" policy errors which would only manifest when the rules are compiled to filter rules with nodes.

this change will in;

file-based mode load the nodes from the db and try to compile the rules on start up and return an error if they would not work as intended.

database-based mode prevent a new ACL being written to the database if it does not compile with the current set of node.

Fixes #2073
Fixes #2044

Summary by CodeRabbit

  • New Features

    • Enhanced validation for Access Control List (ACL) policies to prevent runtime errors from invalid configurations.
    • Improved error reporting with additional context when setting policies, aiding in better issue traceability.

  • Bug Fixes

    • Resolved potential issues related to policy application by ensuring policies are validated against the current database state.
    • Added tests to validate error handling for invalid policy configurations, ensuring system integrity.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2089 **Author:** [@kradalby](https://github.com/kradalby) **Created:** 8/30/2024 **Status:** ✅ Merged **Merged:** 8/30/2024 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `kradalby/acl-invalid-action` --- ### 📝 Commits (5) - [`4bd6936`](https://github.com/juanfont/headscale/commit/4bd6936c52ae7440fbb0955eba51ceed377fff50) validate policy against nodes, error if not valid - [`cb12055`](https://github.com/juanfont/headscale/commit/cb12055780e4d2954b8d59e69843a0ad2c00d421) ensure stderr can be used in err checks - [`7860d37`](https://github.com/juanfont/headscale/commit/7860d371bfff453b842e18c85744241a90e9af7e) test policy set validation - [`be6acdd`](https://github.com/juanfont/headscale/commit/be6acddaa4d7906d3b797637330a11e538849781) add new integration test to ghaction - [`d5a3253`](https://github.com/juanfont/headscale/commit/d5a325323a673d81cbf660f891ae777b63379d0a) add back defer for cli tst ### 📊 Changes **6 files changed** (+129 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/test-integration.yaml` (+1 -0) 📝 `hscontrol/app.go` (+26 -0) 📝 `hscontrol/grpcv1.go` (+26 -3) 📝 `integration/cli_test.go` (+74 -0) 📝 `integration/dockertestutil/execute.go` (+1 -1) 📝 `integration/hsic/hsic.go` (+1 -1) </details> ### 📄 Description this commit aims to improve the feedback of "runtime" policy errors which would only manifest when the rules are compiled to filter rules with nodes. this change will in; file-based mode load the nodes from the db and try to compile the rules on start up and return an error if they would not work as intended. database-based mode prevent a new ACL being written to the database if it does not compile with the current set of node. Fixes #2073 Fixes #2044 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced validation for Access Control List (ACL) policies to prevent runtime errors from invalid configurations. - Improved error reporting with additional context when setting policies, aiding in better issue traceability. - **Bug Fixes** - Resolved potential issues related to policy application by ensuring policies are validated against the current database state. - Added tests to validate error handling for invalid policy configurations, ensuring system integrity. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 03:21:29 +01:00
adam closed this issue 2025-12-29 03:21:30 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2486
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?