headscale

mirror of https://github.com/juanfont/headscale.git synced 2026-03-22 09:29:36 +01:00

Files

Kristoffer Dalby fb137a8fe3 policy/v2: use partial IPSet on group resolution errors in autogroup:self path

In compileACLWithAutogroupSelf, when a group contains a non-existent
user, Group.Resolve() returns a partial IPSet (with IPs from valid
users) alongside an error. The code was discarding the entire result
via `continue`, losing valid IPs. The non-autogroup-self path
(compileFilterRules) already handles this correctly by logging the
error and using the IPSet if non-empty.

Remove the `continue` on error for both source and destination
resolution, matching the existing behavior in compileFilterRules.
Also reorder the IsTagged check before User().ID() comparison
in the same-user node filter to prevent nil dereference on tagged
nodes that have no User set.

Fixes #2990

2026-02-03 16:53:15 +01:00

matcher

matcher: Add func for comparing Dests and TheInternet

2025-11-02 13:19:59 +01:00

policyutil

make tags first class node owner (#2885 )

2025-12-02 12:01:25 +01:00

policy/v2: use partial IPSet on group resolution errors in autogroup:self path

2026-02-03 16:53:15 +01:00

pm.go

tags: process tags on registration, simplify policy (#2931 )

2025-12-08 18:51:07 +01:00