Users that don't belong to any ACL can access the whole network

[reynico]

Bug description
If a new user is enrolled into Headscale and it doesn't belong to any group, the user has access to the whole network.

To Reproduce
Describing an ACL as following:

{
    "groups": {
        "group:dev": [
            "john",
            "doe",
        ],
        "group:support": [
            "sandy",
            "joe",
        ],
    },
    "hosts": {
        "db": "10.10.11.7/32",
        "server1": "10.10.0.2/32",
        "server2": "100.100.100.100/32",
    },
    "acls": [
        {
            "action": "accept",
            "src": [
                "100.64.0.1",
            ],
            "dst": [
                "*:*",
            ],
        },
        {
            "action": "accept",
            "src": [
                "group:dev",
            ],
            "dst": [
                "db:5432",
                "server1:*",
                "server2:*",

                "100.64.0.1:0",
            ]
        },
        {
            "action": "accept",
            "src": [
                "group:support",
            ],
            "dst": [
                "db:5432",

                "100.64.0.1:0",
            ]
        }
    ]
}

permits the support team to access a PostgreSQL database, but prohibits access to the servers, while the developers have access to the database and servers.

if a new user marty is enrolled, marty has access to everything, bypassing the ACLs.

• Version of headscale used: v0.20.0
• Version of tailscale client: 1.38.2
• OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version: macOS Ventura

[kradalby]

Is this a new bug, or has it always been like this? I will add it to #1069 (tracking my ACL improvement work).

[reynico]

I have a gut feeling that it has always been like this.

[kradalby]

Noted, I will try to write a test case to "prove" it and then fix it for the #1069 work and hopefully get it resolve when I am sitting down with that work.

[github-actions]

This issue is stale because it has been open for 90 days with no activity.

[github-actions]

This issue was closed because it has been inactive for 14 days since being marked as stale.