starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

ACL forbidden subnet routes should not be routed #469

New Issue
Closed
opened 2025-12-29 01:29:56 +01:00 by adam · 7 comments
adam commented 2025-12-29 01:29:56 +01:00
Owner
Copy Link

Originally created by @ItsShadowCone on GitHub (Apr 8, 2023).

Bug description

Subnet routes which are inaccessible via ACL are still pushed to clients. A client who cannot access a specific subnet should not see it.

To Reproduce

  • machine a advertising subnet routes
  • machine b accepting routes
  • ACL in place so b cannot access the subnet (i.e. via hosts). i.e. ACL present but missing for this subnet case.

Context info

Headscale 0.21.0, tailscale linux & android (latest as of writing).

Originally created by @ItsShadowCone on GitHub (Apr 8, 2023). **Bug description** Subnet routes which are inaccessible via ACL are still pushed to clients. A client who cannot access a specific subnet should not see it. **To Reproduce** - machine a advertising subnet routes - machine b accepting routes - ACL in place so b cannot access the subnet (i.e. via hosts). i.e. ACL present but missing for this subnet case. **Context info** Headscale 0.21.0, tailscale linux & android (latest as of writing).
adam added the stalebug labels 2025-12-29 01:29:56 +01:00
adam closed this issue 2025-12-29 01:29:57 +01:00
adam commented 2025-12-29 01:29:57 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Oct 5, 2023):

This issue is stale because it has been open for 180 days with no activity.

@github-actions[bot] commented on GitHub (Oct 5, 2023): This issue is stale because it has been open for 180 days with no activity.
adam commented 2025-12-29 01:29:58 +01:00
Author
Owner
Copy Link

@almereyda commented on GitHub (Oct 5, 2023):

Still an issue AFAIK.

@almereyda commented on GitHub (Oct 5, 2023): Still an issue AFAIK.
adam commented 2025-12-29 01:29:58 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jan 4, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Jan 4, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:29:59 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jan 11, 2024):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (Jan 11, 2024): This issue was closed because it has been inactive for 14 days since being marked as stale.
adam commented 2025-12-29 01:29:59 +01:00
Author
Owner
Copy Link

@ItsShadowCone commented on GitHub (Jan 19, 2024):

I don't think this should be auto closed, we should take a look still applies in the current version / alpha.

@ItsShadowCone commented on GitHub (Jan 19, 2024): I don't think this should be auto closed, we should take a look still applies in the current version / alpha.
adam commented 2025-12-29 01:29:59 +01:00
Author
Owner
Copy Link

@almereyda commented on GitHub (Jan 19, 2024):

There is ongoing work with #1604, which has just been pre-released in v0.23.0-alpha3.

@almereyda commented on GitHub (Jan 19, 2024): There is ongoing work with #1604, which has just been pre-released in v0.23.0-alpha3.
adam commented 2025-12-29 01:29:59 +01:00
Author
Owner
Copy Link

@Murgeye commented on GitHub (Sep 24, 2024):

I don't think this is the same Issue as #1604 and it is still an present in 0.23.0.

If you set a subnet route on node A and do not allow node B access to it in the ACLs, the route still gets pushed to node B. Node B will try routing all subnet traffic through it (and fail due to the ACL) - blocking all traffic to that subnet from node B even if node B is able to access that subnet from its own network.

@Murgeye commented on GitHub (Sep 24, 2024): I don't think this is the same Issue as #1604 and it is still an present in 0.23.0. If you set a subnet route on node A and do not allow node B access to it in the ACLs, the route still gets pushed to node B. Node B will try routing all subnet traffic through it (and fail due to the ACL) - blocking all traffic to that subnet from node B even if node B is able to access that subnet from its own network.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#469
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?