headscale

mirror of https://github.com/juanfont/headscale.git synced 2026-04-11 03:27:20 +02:00

Files

Kristoffer Dalby 687cf0882f policy/v2: implement autogroup:danger-all support

Add autogroup:danger-all as a valid source alias that matches ALL IP
addresses including non-Tailscale addresses. When used as a source,
it resolves to 0.0.0.0/0 + ::/0 internally but produces SrcIPs: ["*"]
in filter rules. When used as a destination, it is rejected with an
error matching Tailscale SaaS behavior.

Key changes:
- Add AutoGroupDangerAll constant and validation
- Add sourcesHaveDangerAll() helper and hasDangerAll parameter to
  srcIPsWithRoutes() across all compilation paths
- Add ErrAutogroupDangerAllDst for destination rejection
- Remove 3 AUTOGROUP_DANGER_ALL skip entries (K6, K7, K8)

Updates #2180

2026-04-01 14:10:42 +01:00

testdata

policy/v2: add advertised routes to compat test topologies

2026-04-01 14:10:42 +01:00

filter_test.go

policy/v2: use bare IPs in autogroup:self DstPorts

2026-04-01 14:10:42 +01:00

filter.go

policy/v2: implement autogroup:danger-all support

2026-04-01 14:10:42 +01:00

main_test.go

all: fix test flakiness and improve test infrastructure