headscale 0.23.0-alpha5 ignores /32 masks in ACLs

[winterheart]

Bug description

We have tailnet network with node1 as subnet router to 172.16.0.0/24 network.

After updating to 0.23.0-alpha5 some of our users lost access to resources provided by ACL. Here short example of acl.yaml:

groups:
  group:access:
    - user1
hosts:
  net.vlan0: 172.16.0.0/24
  net.dns01: 172.16.0.21/32
# ...
acls:
  - action: accept
    src:
      - group:access
    dst:
      - tag:access-servers:* # node1 in it
      - net.dns01:*

Users in group access (user1) now cannot access to 172.16.0.21. If I change net.dns01 with net.vlan0 in ACL, user1 can ping
172.16.0.21 (and other addresses in 172.16.0/24 too which is undesirable). Previous version 0.22.3 was allowed access to hosts with /32 mask.

Environment

• OS: Linux
• Headscale version: 0.23.0-alpha5
• Tailscale version: 1.56, 1.60

• Headscale is behind a (reverse) proxy
• Headscale runs in a container

To Reproduce

Have subnet router and ACLs to networks behind it.

Logs and attachments

netmap with acl /32 in config:

...
                {
                        "SrcIPs": [
                                "100.64.0.3/32",
                                "fd7a:115c:a1e0::b/128"
                        ]
                        "DstPorts": [
                                {
                                        "IP": "100.64.0.2/32",
                                        "Bits": null,
                                        "Ports": {
                                                "First": 0,
                                                "Last": 65535
                                        }
                                },
                                {
                                        "IP": "fd7a:115c:a1e0::2/128",
                                        "Bits": null,
                                        "Ports": {
                                                "First": 0,
                                                "Last": 65535
                                        }
                                },
                        ]
                 }

netmap with acl /24 in config:

...
                {
                        "SrcIPs": [
                                "100.64.0.3/32",
                                "fd7a:115c:a1e0::b/128"
                        ]
                        "DstPorts": [
                                {
                                        "IP": "100.64.0.2/32",
                                        "Bits": null,
                                        "Ports": {
                                                "First": 0,
                                                "Last": 65535
                                        }
                                },
                                {
                                        "IP": "fd7a:115c:a1e0::2/128",
                                        "Bits": null,
                                        "Ports": {
                                                "First": 0,
                                                "Last": 65535
                                        }
                                },
                                {
                                        "IP": "172.16.0.0/24",
                                        "Bits": null,
                                        "Ports": {
                                                "First": 0,
                                                "Last": 65535
                                        }
                                }
                        ]
                 }

[winterheart]

Seems this regression somehow related to #1786 as exit-node functionality is broken too in our environment.

[kradalby]

This should be addressed in #1917, it also addresses #1786.

If you have the opportunity to test it before it gets merged that would be great!

[kradalby]

This should be addressed in https://github.com/juanfont/headscale/releases/tag/v0.23.0-alpha10, check it out.