rsp2k/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

policyutil: fix reduceCapGrantRule and add route reduction

Browse source 
reduceCapGrantRule was dropping rules whose CapGrant IPs overlap a
subnet route; treat subnet routes as part of node identity so those rules
survive reduction. ReduceFilterRules now also reduces route-reachable
destinations.

Updates #3157
This commit is contained in:
Kristoffer Dalby 2026-04-15 08:27:42 +00:00
parent b051e7b2bc
commit ded51a4d30
3 changed files with 553 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hscontrol/policy/policyutil/doc.go Normal file
View file

@ -0,0 +1,9 @@
// Package policyutil contains pure functions that transform compiled
// policy rules for a specific node. The headline function is
// ReduceFilterRules, which filters global rules down to those relevant
// to one node.
//
// A node's SubnetRoutes (approved, non-exit) participate in rule
// matching so subnet routers receive filter rules for destinations
// their subnets cover — the fix for issue #3169.
package policyutil