rsp2k/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

policy/v2: exclude exit routes from ReduceFilterRules

Browse source 
Add exit route check in ReduceFilterRules to prevent exit nodes from receiving packet filter rules for destinations that only overlap via exit routes. Remove resolved SUBNET_ROUTE_FILTER_RULES grant skip entries and update error message formatting for grant validation.

Updates #2180
This commit is contained in:
Kristoffer Dalby 2026-03-18 14:40:12 +00:00
parent e05f45cfb1
commit f95b254ea9
7 changed files with 45 additions and 93 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hscontrol/policy/v2/utils_test.go
View file

@ -162,8 +162,8 @@ func TestParsePort(t *testing.T) {
{"65535", 65535, ""},
{"-1", 0, "port number out of range"},
{"65536", 0, "port number out of range"},
{"abc", 0, "invalid port number"},
{"", 0, "invalid port number"},
{"abc", 0, "invalid first integer"},
{"", 0, "invalid first integer"},
}
for _, test := range tests {
@ -195,9 +195,9 @@ func TestParsePortRange(t *testing.T) {
{"*", []tailcfg.PortRange{tailcfg.PortRangeAny}, ""},
{"80-", nil, "invalid port range format"},
{"-90", nil, "invalid port range format"},
{"80-90,", nil, "invalid port number"},
{"80-90,", nil, "invalid first integer"},
{"80,90-", nil, "invalid port range format"},
{"80-90,abc", nil, "invalid port number"},
{"80-90,abc", nil, "invalid first integer"},
{"80-90,65536", nil, "port number out of range"},
{"80-90,90-80", nil, "invalid port range: first port is greater than last port"},
}