headscale

rsp2k/headscale

Fork 0

Commit graph

Author	SHA1	Message	Date
Kristoffer Dalby	95b1fd636e	policy: fix wildcard DstPorts format and proto:icmp handling Fix two compatibility issues discovered in Tailscale SaaS testing: 1. Wildcard DstPorts format: Headscale was expanding wildcard destinations to CGNAT ranges (100.64.0.0/10, fd7a:115c:a1e0::/48) while Tailscale uses {IP: "*"} directly. Add detection for wildcard (Asterix) alias type in filter compilation to use the correct format. 2. proto:icmp handling: The "icmp" protocol name was returning both ICMPv4 (1) and ICMPv6 (58), but Tailscale only returns ICMPv4. Users should use "ipv6-icmp" or protocol number 58 explicitly for IPv6 ICMP. Update all test expectations accordingly. This significantly reduces test file line count by replacing duplicated CGNAT range patterns with single wildcard entries.	2026-02-05 19:29:16 +01:00
Kristoffer Dalby	834ac27779	policy/v2: add subnet routes and exit node compatibility tests Add comprehensive test file for validating Headscale's ACL engine behavior for subnet routes and exit nodes against documented Tailscale SaaS behavior. Tests cover: - Category A: Subnet route basics (wildcard includes routes, tag-based ACL excludes routes) - Category B: Exit node behavior (exit routes not in SrcIPs) - Category F: Filter placement rules (filters on destination nodes) - Category G: Protocol and port restrictions - Category R: Route coverage rules - Category O: Overlapping routes - Category H: Edge cases (wildcard formats, CGNAT handling) - Category T: Tag resolution (tags resolve to node IPs only) - Category I: IPv6 specific behavior The tests document expected Tailscale SaaS behavior with TODOs marking areas where Headscale currently differs. This provides a baseline for compatibility improvements.	2026-02-05 19:29:16 +01:00

Author

SHA1

Message

Date

Kristoffer Dalby

95b1fd636e

policy: fix wildcard DstPorts format and proto:icmp handling

Fix two compatibility issues discovered in Tailscale SaaS testing:

1. Wildcard DstPorts format: Headscale was expanding wildcard
   destinations to CGNAT ranges (100.64.0.0/10, fd7a:115c:a1e0::/48)
   while Tailscale uses {IP: "*"} directly. Add detection for
   wildcard (Asterix) alias type in filter compilation to use the
   correct format.

2. proto:icmp handling: The "icmp" protocol name was returning both
   ICMPv4 (1) and ICMPv6 (58), but Tailscale only returns ICMPv4.
   Users should use "ipv6-icmp" or protocol number 58 explicitly
   for IPv6 ICMP.

Update all test expectations accordingly. This significantly reduces
test file line count by replacing duplicated CGNAT range patterns
with single wildcard entries.

2026-02-05 19:29:16 +01:00

Kristoffer Dalby

834ac27779

policy/v2: add subnet routes and exit node compatibility tests

Add comprehensive test file for validating Headscale's ACL engine
behavior for subnet routes and exit nodes against documented
Tailscale SaaS behavior.

Tests cover:
- Category A: Subnet route basics (wildcard includes routes, tag-based
  ACL excludes routes)
- Category B: Exit node behavior (exit routes not in SrcIPs)
- Category F: Filter placement rules (filters on destination nodes)
- Category G: Protocol and port restrictions
- Category R: Route coverage rules
- Category O: Overlapping routes
- Category H: Edge cases (wildcard formats, CGNAT handling)
- Category T: Tag resolution (tags resolve to node IPs only)
- Category I: IPv6 specific behavior

The tests document expected Tailscale SaaS behavior with TODOs marking
areas where Headscale currently differs. This provides a baseline for
compatibility improvements.

2026-02-05 19:29:16 +01:00

2 commits