362696a5ef
In compileSSHPolicy, when resolving other (non-autogroup:self) destinations, the code discards the entire result on error via `continue`. If a destination alias (e.g., a tag owned by a group with a non-existent user) returns a partial IPSet alongside an error, valid IPs are lost. Both ACL compilation paths (compileFilterRules and compileACLWithAutogroupSelf) already handle this correctly by logging the error and using the IPSet if non-nil. Remove the `continue` so the SSH path is consistent with the ACL paths. Fixes #2990 |
||
|---|---|---|
| .. | ||
| matcher | ||
| policyutil | ||
| v2 | ||
| pm.go | ||
| policy.go | ||
| policy_autoapprove_test.go | ||
| policy_route_approval_test.go | ||
| policy_test.go | ||
| route_approval_test.go | ||