starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #2855] [MERGED] types: Distinguish subnet and exit node access #2899

New Issue
Closed
opened 2025-12-29 04:19:34 +01:00 by adam · 0 comments
adam commented 2025-12-29 04:19:34 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2855
Author: @kradalby
Created: 11/1/2025
Status: ✅ Merged
Merged: 11/2/2025
Merged by: @kradalby

Base: main ← Head: kradalby/2788-exit-visibility

📝 Commits (6)

  • 7be765a policy: Reproduce exit node visibility issues
  • 47cf26b types: split SubnetRoutes and ExitRoutes
  • 5cfff99 state: use AllApprovedRoutes instead of SubnetRoutes
  • 7e80372 types: NodeView CanAccess uses internal
  • fe9060e matcher: Add func for comparing Dests and TheInternet
  • f247467 types: Distinguish subnet and exit node access

📊 Changes

7 files changed (+363 additions, -38 deletions)

View changed files

📝 hscontrol/db/node.go (+12 -0)
📝 hscontrol/db/node_test.go (+3 -3)
📝 hscontrol/mapper/tail_test.go (+3 -1)
📝 hscontrol/policy/matcher/matcher.go (+10 -0)
📝 hscontrol/policy/policy_test.go (+277 -1)
📝 hscontrol/state/state.go (+7 -7)
📝 hscontrol/types/node.go (+51 -26)

📄 Description

When we fixed the issue of node visibility of nodes
that only had access to each other because of a subnet
route, we gave all nodes access to all exit routes by
accident.

This commit splits exit nodes and subnet routes in the
access.

If a matcher indicates that the node should have access to
any part of the subnet routes, we do not remove it from the
node list.

If a matcher destination is equal to the internet, and the
target node is an exit node, we also do not remove the access.

Fixes https://github.com/juanfont/headscale/issues/2784
Fixes https://github.com/juanfont/headscale/issues/2788

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2855 **Author:** [@kradalby](https://github.com/kradalby) **Created:** 11/1/2025 **Status:** ✅ Merged **Merged:** 11/2/2025 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `kradalby/2788-exit-visibility` --- ### 📝 Commits (6) - [`7be765a`](https://github.com/juanfont/headscale/commit/7be765a43e1374e9d5881a4e64223489d2cb448d) policy: Reproduce exit node visibility issues - [`47cf26b`](https://github.com/juanfont/headscale/commit/47cf26ba9f55c2b4793f094c58c56700f21fb5b9) types: split SubnetRoutes and ExitRoutes - [`5cfff99`](https://github.com/juanfont/headscale/commit/5cfff99298d7d1d559114715aee49c913ca130e7) state: use AllApprovedRoutes instead of SubnetRoutes - [`7e80372`](https://github.com/juanfont/headscale/commit/7e80372a695d892f98fdf5ec453a9856cd6b00a8) types: NodeView CanAccess uses internal - [`fe9060e`](https://github.com/juanfont/headscale/commit/fe9060eaf28ff573d358cf676f5e7a799c502b79) matcher: Add func for comparing Dests and TheInternet - [`f247467`](https://github.com/juanfont/headscale/commit/f24746782e1da9fdbf0a7b3c115f959f077c14c1) types: Distinguish subnet and exit node access ### 📊 Changes **7 files changed** (+363 additions, -38 deletions) <details> <summary>View changed files</summary> 📝 `hscontrol/db/node.go` (+12 -0) 📝 `hscontrol/db/node_test.go` (+3 -3) 📝 `hscontrol/mapper/tail_test.go` (+3 -1) 📝 `hscontrol/policy/matcher/matcher.go` (+10 -0) 📝 `hscontrol/policy/policy_test.go` (+277 -1) 📝 `hscontrol/state/state.go` (+7 -7) 📝 `hscontrol/types/node.go` (+51 -26) </details> ### 📄 Description When we fixed the issue of node visibility of nodes that only had access to each other because of a subnet route, we gave all nodes access to all exit routes by accident. This commit splits exit nodes and subnet routes in the access. If a matcher indicates that the node should have access to any part of the subnet routes, we do not remove it from the node list. If a matcher destination is equal to the internet, and the target node is an exit node, we also do not remove the access. Fixes https://github.com/juanfont/headscale/issues/2784 Fixes https://github.com/juanfont/headscale/issues/2788 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 04:19:34 +01:00
adam closed this issue 2025-12-29 04:19:34 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2899
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?