49744cd467
Headscale rejects IPv6 addresses with square brackets in ACL policy
destinations (e.g. "[fd7a:115c:a1e0::87e1]:80,443"), while Tailscale
SaaS accepts them. The root cause is that splitDestinationAndPort uses
strings.LastIndex(":") which leaves brackets on the destination string,
and netip.ParseAddr does not accept brackets.
Add a bracket-handling branch at the top of splitDestinationAndPort that
uses net.SplitHostPort for RFC 3986 parsing when input starts with "[".
The extracted host is validated with netip.ParseAddr/ParsePrefix to
ensure brackets are only accepted around IP addresses and CIDR prefixes,
not hostnames or other alias types like tags and groups.
Fixes #2754
|
||
|---|---|---|
| .. | ||
| filter.go | ||
| filter_test.go | ||
| policy.go | ||
| policy_test.go | ||
| tailscale_compat_test.go | ||
| tailscale_routes_compat_test.go | ||
| types.go | ||
| types_test.go | ||
| utils.go | ||
| utils_test.go | ||