Kristoffer Dalby e0cb46ca53 policy/v2: preserve non-wildcard source IPs alongside wildcard ranges ...

When an ACL source list contains a wildcard (*) alongside explicit
sources (tags, groups, hosts, etc.), Tailscale preserves the individual
IPs from non-wildcard sources in SrcIPs alongside the merged wildcard
CGNAT ranges. Previously, headscale's IPSetBuilder would merge all
sources into a single set, absorbing the explicit IPs into the wildcard
range.

Track non-wildcard resolved addresses separately during source
resolution, then append their individual IP strings to the output
when a wildcard is also present. This fixes the remaining 5 ACL
compat test failures (K01 and M06 subtests).

Updates #2180

2026-03-25 15:17:23 +00:00

..

matcher

all: fix golangci-lint issues (#3064)

2026-02-06 21:45:32 +01:00

policyutil

policy/policyutil: exclude exit routes from ReduceFilterRules

2026-03-25 15:17:23 +00:00

v2

policy/v2: preserve non-wildcard source IPs alongside wildcard ranges

2026-03-25 15:17:23 +00:00

pm.go

state, policy, noise: implement SSH check period auto-approval

2026-02-25 21:28:05 +01:00

policy_autoapprove_test.go

hscontrol/policy: fix test assertions and expectations

2026-03-25 15:17:23 +00:00

policy_route_approval_test.go

all: apply golangci-lint 2.9.0 fixes

2026-02-19 08:21:23 +01:00

policy_test.go

policy/v2: add localpart:*@domain SSH user compilation

2026-02-28 05:14:11 -08:00

policy.go

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00

route_approval_test.go

all: upgrade to Go 1.26rc2 and modernize codebase

2026-02-08 12:35:23 +01:00