policy: use CGNAT/ULA ranges for wildcard resolution

Browse source

Change Asterix.Resolve() to use Tailscale's CGNAT range (100.64.0.0/10)
and ULA range (fd7a:115c:a1e0::/48) instead of all IPs (0.0.0.0/0 and
::/0).
This better matches Tailscale's security model where wildcard (*) means
"any node in the tailnet" rather than literally "any IP address on the
internet".
Updates #3036

Updates #3036

...

This commit is contained in:

Kristoffer Dalby 2026-01-23 20:52:35 +00:00

parent ebdbe03639

commit 8baa14ef4a

4 changed files with 410 additions and 412 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

792

hscontrol/policy/v2/tailscale_compat_test.go

View file

File diff suppressed because it is too large Load diff