starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #2764] [MERGED] policy: reject unsupported fields #2844

New Issue
Closed
opened 2025-12-29 04:19:16 +01:00 by adam · 0 comments
adam commented 2025-12-29 04:19:16 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2764
Author: @kradalby
Created: 9/10/2025
Status: ✅ Merged
Merged: 9/12/2025
Merged by: @kradalby

Base: main ← Head: kradalby/acl-invalid-fields

📝 Commits (10+)

  • 6d4cecb policy: use jsonv2 package
  • ef07aab policy: remove unused vars
  • 2fd9c12 policy: add tests for rejecting unknown
  • bb44db3 policy: add ACL unmarshal for # fields
  • ccc9b68 policy: ensure same json opts
  • 462ef80 policy: add tests for invalid fields
  • 64ad05f policy: make ACL action and protocol strict types
  • 9a37717 policy: make SSH action strict types
  • a31249c changelog: add entry about reject unsupported
  • ab7eefb policy: validate protocol and portnumber

📊 Changes

10 files changed (+1175 additions, -131 deletions)

View changed files

📝 CHANGELOG.md (+2 -0)
📝 go.mod (+1 -1)
📝 hscontrol/policy/policy_test.go (+12 -1)
📝 hscontrol/policy/v2/filter.go (+4 -9)
📝 hscontrol/policy/v2/filter_test.go (+6 -0)
📝 hscontrol/policy/v2/types.go (+363 -29)
📝 hscontrol/policy/v2/types_test.go (+783 -17)
📝 hscontrol/policy/v2/utils.go (+0 -70)
📝 integration/cli_test.go (+1 -1)
📝 integration/route_test.go (+3 -3)

📄 Description

This PR switches to using the new jsonv2 package in go making it easier for us to reject unsupported fields in the policy, fixing #2626.

It adds an exception to allow fields starting with # in ACL rules to allow metadata used by headscale-admin (cc @GoodiesHQ).

It also introduces some stricter types for Action and Protocol making it part of the strict parsing format and not a "runtime" check.

In addition it cleans up a bit of unused variables.

Fixes #2626

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2764 **Author:** [@kradalby](https://github.com/kradalby) **Created:** 9/10/2025 **Status:** ✅ Merged **Merged:** 9/12/2025 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `kradalby/acl-invalid-fields` --- ### 📝 Commits (10+) - [`6d4cecb`](https://github.com/juanfont/headscale/commit/6d4cecbfac75e432a4d8aa59ca760fc3f6670e10) policy: use jsonv2 package - [`ef07aab`](https://github.com/juanfont/headscale/commit/ef07aabb856b46684a1473d30be00edabfe061fe) policy: remove unused vars - [`2fd9c12`](https://github.com/juanfont/headscale/commit/2fd9c127b258aae88a05590612661c0e9392c4af) policy: add tests for rejecting unknown - [`bb44db3`](https://github.com/juanfont/headscale/commit/bb44db32dcdfab97f9ceb530651a3dbbe7dfd45d) policy: add ACL unmarshal for # fields - [`ccc9b68`](https://github.com/juanfont/headscale/commit/ccc9b68d93998a101a4ed9d30757e538e6480e91) policy: ensure same json opts - [`462ef80`](https://github.com/juanfont/headscale/commit/462ef80f420882830d24044dd795a8fe3ac58539) policy: add tests for invalid fields - [`64ad05f`](https://github.com/juanfont/headscale/commit/64ad05f1c56ff0ad54951395c5eab321fa774234) policy: make ACL action and protocol strict types - [`9a37717`](https://github.com/juanfont/headscale/commit/9a3771772636895ce54a1452fe8b631bfd658301) policy: make SSH action strict types - [`a31249c`](https://github.com/juanfont/headscale/commit/a31249c043351b2dbb442f65c9745c130361197e) changelog: add entry about reject unsupported - [`ab7eefb`](https://github.com/juanfont/headscale/commit/ab7eefb9c9c070a4857f5035c7b82496ad6dd7d7) policy: validate protocol and portnumber ### 📊 Changes **10 files changed** (+1175 additions, -131 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+2 -0) 📝 `go.mod` (+1 -1) 📝 `hscontrol/policy/policy_test.go` (+12 -1) 📝 `hscontrol/policy/v2/filter.go` (+4 -9) 📝 `hscontrol/policy/v2/filter_test.go` (+6 -0) 📝 `hscontrol/policy/v2/types.go` (+363 -29) 📝 `hscontrol/policy/v2/types_test.go` (+783 -17) 📝 `hscontrol/policy/v2/utils.go` (+0 -70) 📝 `integration/cli_test.go` (+1 -1) 📝 `integration/route_test.go` (+3 -3) </details> ### 📄 Description This PR switches to using the new jsonv2 package in go making it easier for us to reject unsupported fields in the policy, fixing #2626. It adds an exception to allow fields starting with `#` in ACL rules to allow metadata used by headscale-admin (cc @GoodiesHQ). It also introduces some stricter types for `Action` and `Protocol` making it part of the strict parsing format and not a "runtime" check. In addition it cleans up a bit of unused variables. Fixes #2626 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 04:19:16 +01:00
adam closed this issue 2025-12-29 04:19:16 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2844
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?