rsp2k/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

policy: autogroup:internet does not generate packet filters

Browse source 
According to Tailscale SaaS behavior, autogroup:internet is handled
by exit node routing via AllowedIPs, not by packet filtering. ACL
rules with autogroup:internet as destination should produce no
filter rules for any node.

Previously, Headscale expanded autogroup:internet to public CIDR
ranges and distributed filters to exit nodes (because 0.0.0.0/0
"covers" internet destinations). This was incorrect.

Add detection for AutoGroupInternet in filter compilation to skip
filter generation for this autogroup. Update test expectations
accordingly.
This commit is contained in:
Kristoffer Dalby 2026-01-28 13:08:38 +00:00
parent 95b1fd636e
commit 835b7eb960
4 changed files with 22 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

40
hscontrol/policy/v2/tailscale_routes_compat_test.go
View file

@ -1124,31 +1124,15 @@ func TestTailscaleRoutesCompatExitNodes(t *testing.T) {
"user1": wildcardFilter,
},
},
// TODO: Fix autogroup:internet to not generate filters
//
// B8: autogroup:internet generates no filters
//
// TAILSCALE BEHAVIOR:
// - autogroup:internet is handled by exit node routing, not packet filters
// - ALL nodes should get null/empty filters for autogroup:internet destination
// - Traffic is routed through exit nodes via AllowedIPs, not filtered
//
// HEADSCALE BEHAVIOR:
// - Exit nodes (exit-node, multi-router) incorrectly receive filters
// - Because 0.0.0.0/0 "covers" autogroup:internet destinations
//
// ROOT CAUSE:
// Headscale treats autogroup:internet like a regular destination and
// distributes filters to nodes whose routes cover it (exit nodes)
//
// FIX REQUIRED:
// autogroup:internet should never generate packet filters
// autogroup:internet is handled by exit node routing via AllowedIPs,
// not by packet filtering. ALL nodes should get null/empty filters.
{
name: "B8_autogroup_internet_no_filters",
policy: makeRoutesPolicy(`
{"action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:internet:*"]}
`),
/* EXPECTED (Tailscale):
wantFilters: map[string][]tailcfg.FilterRule{
"client1": nil,
"client2": nil,
@ -1160,26 +1144,6 @@ func TestTailscaleRoutesCompatExitNodes(t *testing.T) {
"big-router": nil,
"user1": nil,
},
*/
// ACTUAL (Headscale):
// Non-exit nodes correctly get nil.
// INCORRECT: exit-node and multi-router get filters with expanded public
// CIDR ranges from util.TheInternet() (all public IPs excluding CGNAT,
// private ranges, and Tailscale ULA). The exact CIDRs are complex and
// impractical to list here. Skipping comparison for exit nodes but
// documenting the difference: Tailscale returns nil, Headscale returns
// filters with SrcIPs=member IPs and DstPorts=expanded public CIDRs.
wantFilters: map[string][]tailcfg.FilterRule{
"client1": nil,
"client2": nil,
"subnet-router": nil,
"ha-router1": nil,
"ha-router2": nil,
"big-router": nil,
"user1": nil,
// exit-node and multi-router omitted - they incorrectly receive filters
// with expanded autogroup:internet CIDRs in Headscale (Tailscale: nil)
},
},
// B3: Exit node advertises exit routes (verify RoutableIPs)
//