2021-07-03 11:55:32 +02:00
|
|
|
package headscale
|
|
|
|
|
|
|
|
import (
|
2021-07-04 12:35:18 +02:00
|
|
|
"encoding/json"
|
2022-04-15 18:01:13 +02:00
|
|
|
"errors"
|
2021-07-03 17:31:32 +02:00
|
|
|
"fmt"
|
2021-07-03 11:55:32 +02:00
|
|
|
"io"
|
|
|
|
"os"
|
2022-02-27 09:04:48 +01:00
|
|
|
"path/filepath"
|
2021-07-04 12:35:18 +02:00
|
|
|
"strconv"
|
2021-07-03 17:31:32 +02:00
|
|
|
"strings"
|
2021-07-03 11:55:32 +02:00
|
|
|
|
2021-08-05 19:18:18 +02:00
|
|
|
"github.com/rs/zerolog/log"
|
2021-07-03 11:55:32 +02:00
|
|
|
"github.com/tailscale/hujson"
|
2022-02-27 09:04:48 +01:00
|
|
|
"gopkg.in/yaml.v3"
|
2021-07-03 17:31:32 +02:00
|
|
|
"inet.af/netaddr"
|
|
|
|
"tailscale.com/tailcfg"
|
2021-07-03 11:55:32 +02:00
|
|
|
)
|
|
|
|
|
2021-11-04 23:16:56 +01:00
|
|
|
const (
|
2022-03-03 23:53:08 +01:00
|
|
|
errEmptyPolicy = Error("empty policy")
|
|
|
|
errInvalidAction = Error("invalid action")
|
|
|
|
errInvalidGroup = Error("invalid group")
|
|
|
|
errInvalidTag = Error("invalid tag")
|
|
|
|
errInvalidPortFormat = Error("invalid port format")
|
2022-06-08 17:55:32 +02:00
|
|
|
errWildcardIsNeeded = Error("wildcard as port is required for the protocol")
|
2021-11-04 23:16:56 +01:00
|
|
|
)
|
2021-07-03 11:55:32 +02:00
|
|
|
|
2021-11-14 18:31:51 +01:00
|
|
|
const (
|
2022-01-28 19:58:22 +01:00
|
|
|
Base8 = 8
|
2021-11-15 18:24:24 +01:00
|
|
|
Base10 = 10
|
|
|
|
BitSize16 = 16
|
2022-01-28 19:58:22 +01:00
|
|
|
BitSize32 = 32
|
|
|
|
BitSize64 = 64
|
2021-11-15 18:24:24 +01:00
|
|
|
portRangeBegin = 0
|
|
|
|
portRangeEnd = 65535
|
|
|
|
expectedTokenItems = 2
|
2021-11-14 18:31:51 +01:00
|
|
|
)
|
|
|
|
|
2022-06-11 14:09:08 +02:00
|
|
|
// For some reason golang.org/x/net/internal/iana is an internal package
|
|
|
|
const (
|
|
|
|
protocolICMP = 1 // Internet Control Message
|
|
|
|
protocolIGMP = 2 // Internet Group Management
|
|
|
|
protocolIPv4 = 4 // IPv4 encapsulation
|
|
|
|
protocolTCP = 6 // Transmission Control
|
|
|
|
protocolEGP = 8 // Exterior Gateway Protocol
|
|
|
|
protocolIGP = 9 // any private interior gateway (used by Cisco for their IGRP)
|
|
|
|
protocolUDP = 17 // User Datagram
|
|
|
|
protocolGRE = 47 // Generic Routing Encapsulation
|
|
|
|
protocolESP = 50 // Encap Security Payload
|
|
|
|
protocolAH = 51 // Authentication Header
|
|
|
|
protocolIPv6ICMP = 58 // ICMP for IPv6
|
|
|
|
protocolSCTP = 132 // Stream Control Transmission Protocol
|
|
|
|
ProtocolFC = 133 // Fibre Channel
|
|
|
|
)
|
|
|
|
|
2021-11-13 09:39:04 +01:00
|
|
|
// LoadACLPolicy loads the ACL policy from the specify path, and generates the ACL rules.
|
2021-07-04 13:33:00 +02:00
|
|
|
func (h *Headscale) LoadACLPolicy(path string) error {
|
2021-12-01 20:02:00 +01:00
|
|
|
log.Debug().
|
|
|
|
Str("func", "LoadACLPolicy").
|
|
|
|
Str("path", path).
|
|
|
|
Msg("Loading ACL policy from path")
|
|
|
|
|
2021-07-03 11:55:32 +02:00
|
|
|
policyFile, err := os.Open(path)
|
|
|
|
if err != nil {
|
2021-07-03 17:31:32 +02:00
|
|
|
return err
|
2021-07-03 11:55:32 +02:00
|
|
|
}
|
|
|
|
defer policyFile.Close()
|
|
|
|
|
|
|
|
var policy ACLPolicy
|
2021-11-14 20:32:03 +01:00
|
|
|
policyBytes, err := io.ReadAll(policyFile)
|
2021-07-03 11:55:32 +02:00
|
|
|
if err != nil {
|
2021-07-03 17:31:32 +02:00
|
|
|
return err
|
2021-07-03 11:55:32 +02:00
|
|
|
}
|
2021-11-05 08:24:00 +01:00
|
|
|
|
2022-02-27 09:04:48 +01:00
|
|
|
switch filepath.Ext(path) {
|
|
|
|
case ".yml", ".yaml":
|
|
|
|
log.Debug().
|
|
|
|
Str("path", path).
|
|
|
|
Bytes("file", policyBytes).
|
|
|
|
Msg("Loading ACLs from YAML")
|
|
|
|
|
|
|
|
err := yaml.Unmarshal(policyBytes, &policy)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
log.Trace().
|
|
|
|
Interface("policy", policy).
|
|
|
|
Msg("Loaded policy from YAML")
|
|
|
|
|
|
|
|
default:
|
|
|
|
ast, err := hujson.Parse(policyBytes)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
ast.Standardize()
|
|
|
|
policyBytes = ast.Pack()
|
|
|
|
err = json.Unmarshal(policyBytes, &policy)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-07-04 13:33:00 +02:00
|
|
|
}
|
2022-02-27 09:04:48 +01:00
|
|
|
|
2021-07-03 11:55:32 +02:00
|
|
|
if policy.IsZero() {
|
2021-11-15 17:33:16 +01:00
|
|
|
return errEmptyPolicy
|
2021-07-03 11:55:32 +02:00
|
|
|
}
|
|
|
|
|
2021-07-03 17:31:32 +02:00
|
|
|
h.aclPolicy = &policy
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2022-02-03 20:00:41 +01:00
|
|
|
return h.UpdateACLRules()
|
|
|
|
}
|
|
|
|
|
|
|
|
func (h *Headscale) UpdateACLRules() error {
|
2021-07-04 13:24:05 +02:00
|
|
|
rules, err := h.generateACLRules()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-12-01 20:02:00 +01:00
|
|
|
log.Trace().Interface("ACL", rules).Msg("ACL rules generated")
|
2022-02-03 20:00:41 +01:00
|
|
|
h.aclRules = rules
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2021-07-04 13:24:05 +02:00
|
|
|
return nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2021-11-04 23:16:56 +01:00
|
|
|
func (h *Headscale) generateACLRules() ([]tailcfg.FilterRule, error) {
|
2021-07-03 17:31:32 +02:00
|
|
|
rules := []tailcfg.FilterRule{}
|
|
|
|
|
2022-02-21 20:06:31 +01:00
|
|
|
if h.aclPolicy == nil {
|
|
|
|
return nil, errEmptyPolicy
|
|
|
|
}
|
|
|
|
|
2022-02-25 10:26:34 +01:00
|
|
|
machines, err := h.ListMachines()
|
2022-02-07 16:12:05 +01:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2021-11-14 20:32:03 +01:00
|
|
|
for index, acl := range h.aclPolicy.ACLs {
|
|
|
|
if acl.Action != "accept" {
|
2021-11-15 17:33:16 +01:00
|
|
|
return nil, errInvalidAction
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
srcIPs := []string{}
|
2022-06-08 13:40:15 +02:00
|
|
|
for innerIndex, src := range acl.Sources {
|
|
|
|
srcs, err := h.generateACLPolicySrcIP(machines, *h.aclPolicy, src)
|
2021-07-03 17:31:32 +02:00
|
|
|
if err != nil {
|
2021-08-05 19:18:18 +02:00
|
|
|
log.Error().
|
2022-06-08 13:40:15 +02:00
|
|
|
Msgf("Error parsing ACL %d, Source %d", index, innerIndex)
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-07-03 17:31:32 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-04 23:16:56 +01:00
|
|
|
srcIPs = append(srcIPs, srcs...)
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-06-08 17:43:59 +02:00
|
|
|
protocols, needsWildcard, err := parseProtocol(acl.Protocol)
|
|
|
|
if err != nil {
|
|
|
|
log.Error().
|
|
|
|
Msgf("Error parsing ACL %d. protocol unknown %s", index, acl.Protocol)
|
|
|
|
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2021-07-04 12:35:18 +02:00
|
|
|
destPorts := []tailcfg.NetPortRange{}
|
2022-06-08 13:40:15 +02:00
|
|
|
for innerIndex, dest := range acl.Destinations {
|
2022-06-08 17:43:59 +02:00
|
|
|
dests, err := h.generateACLPolicyDest(machines, *h.aclPolicy, dest, needsWildcard)
|
2021-07-04 12:35:18 +02:00
|
|
|
if err != nil {
|
2021-08-05 19:18:18 +02:00
|
|
|
log.Error().
|
2022-06-08 13:40:15 +02:00
|
|
|
Msgf("Error parsing ACL %d, Destination %d", index, innerIndex)
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-07-04 12:35:18 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-04 23:16:56 +01:00
|
|
|
destPorts = append(destPorts, dests...)
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
rules = append(rules, tailcfg.FilterRule{
|
|
|
|
SrcIPs: srcIPs,
|
|
|
|
DstPorts: destPorts,
|
2022-06-08 17:43:59 +02:00
|
|
|
IPProto: protocols,
|
2021-07-04 12:35:18 +02:00
|
|
|
})
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2021-11-04 23:16:56 +01:00
|
|
|
return rules, nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-02-14 15:54:51 +01:00
|
|
|
func (h *Headscale) generateACLPolicySrcIP(
|
|
|
|
machines []Machine,
|
|
|
|
aclPolicy ACLPolicy,
|
2022-06-08 13:40:15 +02:00
|
|
|
src string,
|
2022-02-14 15:54:51 +01:00
|
|
|
) ([]string, error) {
|
2022-06-08 13:40:15 +02:00
|
|
|
return expandAlias(machines, aclPolicy, src, h.cfg.OIDC.StripEmaildomain)
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
|
|
|
|
2022-06-08 13:40:15 +02:00
|
|
|
func (h *Headscale) generateACLPolicyDest(
|
2022-02-07 16:12:05 +01:00
|
|
|
machines []Machine,
|
|
|
|
aclPolicy ACLPolicy,
|
2022-06-08 13:40:15 +02:00
|
|
|
dest string,
|
2022-06-08 17:43:59 +02:00
|
|
|
needsWildcard bool,
|
2021-11-13 09:36:45 +01:00
|
|
|
) ([]tailcfg.NetPortRange, error) {
|
2022-06-08 13:40:15 +02:00
|
|
|
tokens := strings.Split(dest, ":")
|
2021-11-15 18:24:24 +01:00
|
|
|
if len(tokens) < expectedTokenItems || len(tokens) > 3 {
|
2021-11-15 17:33:16 +01:00
|
|
|
return nil, errInvalidPortFormat
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
var alias string
|
|
|
|
// We can have here stuff like:
|
|
|
|
// git-server:*
|
|
|
|
// 192.168.1.0/24:22
|
|
|
|
// tag:montreal-webserver:80,443
|
|
|
|
// tag:api-server:443
|
|
|
|
// example-host-1:*
|
2021-11-15 18:24:24 +01:00
|
|
|
if len(tokens) == expectedTokenItems {
|
2021-07-04 12:35:18 +02:00
|
|
|
alias = tokens[0]
|
|
|
|
} else {
|
|
|
|
alias = fmt.Sprintf("%s:%s", tokens[0], tokens[1])
|
|
|
|
}
|
|
|
|
|
2022-03-01 21:01:46 +01:00
|
|
|
expanded, err := expandAlias(
|
|
|
|
machines,
|
|
|
|
aclPolicy,
|
|
|
|
alias,
|
|
|
|
h.cfg.OIDC.StripEmaildomain,
|
|
|
|
)
|
2021-07-04 12:35:18 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2022-06-08 17:43:59 +02:00
|
|
|
ports, err := expandPorts(tokens[len(tokens)-1], needsWildcard)
|
2021-07-04 12:35:18 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
dests := []tailcfg.NetPortRange{}
|
2021-11-04 23:16:56 +01:00
|
|
|
for _, d := range expanded {
|
2021-07-04 12:35:18 +02:00
|
|
|
for _, p := range *ports {
|
|
|
|
pr := tailcfg.NetPortRange{
|
|
|
|
IP: d,
|
|
|
|
Ports: p,
|
|
|
|
}
|
|
|
|
dests = append(dests, pr)
|
|
|
|
}
|
|
|
|
}
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-11-04 23:16:56 +01:00
|
|
|
return dests, nil
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
|
|
|
|
2022-06-08 17:43:59 +02:00
|
|
|
// parseProtocol reads the proto field of the ACL and generates a list of
|
|
|
|
// protocols that will be allowed, following the IANA IP protocol number
|
|
|
|
// https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
|
|
|
|
//
|
|
|
|
// If the ACL proto field is empty, it allows ICMPv4, ICMPv6, TCP, and UDP,
|
|
|
|
// as per Tailscale behaviour (see tailcfg.FilterRule).
|
|
|
|
//
|
|
|
|
// Also returns a boolean indicating if the protocol
|
|
|
|
// requires all the destinations to use wildcard as port number (only TCP,
|
|
|
|
// UDP and SCTP support specifying ports).
|
|
|
|
func parseProtocol(protocol string) ([]int, bool, error) {
|
|
|
|
switch protocol {
|
|
|
|
case "":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolICMP, protocolIPv6ICMP, protocolTCP, protocolUDP}, false, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "igmp":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolIGMP}, true, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "ipv4", "ip-in-ip":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolIPv4}, true, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "tcp":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolTCP}, false, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "egp":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolEGP}, true, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "igp":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolIGP}, true, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "udp":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolUDP}, false, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "gre":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolGRE}, true, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "esp":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolESP}, true, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "ah":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolAH}, true, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "sctp":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolSCTP}, false, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
case "icmp":
|
2022-06-11 14:09:08 +02:00
|
|
|
return []int{protocolICMP, protocolIPv6ICMP}, true, nil
|
2022-06-08 17:43:59 +02:00
|
|
|
|
|
|
|
default:
|
|
|
|
protocolNumber, err := strconv.Atoi(protocol)
|
|
|
|
if err != nil {
|
|
|
|
return nil, false, err
|
|
|
|
}
|
2022-06-11 14:09:08 +02:00
|
|
|
needsWildcard := protocolNumber != protocolTCP && protocolNumber != protocolUDP && protocolNumber != protocolSCTP
|
2022-06-08 17:43:59 +02:00
|
|
|
|
|
|
|
return []int{protocolNumber}, needsWildcard, nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-02-05 17:18:39 +01:00
|
|
|
// expandalias has an input of either
|
|
|
|
// - a namespace
|
|
|
|
// - a group
|
|
|
|
// - a tag
|
2022-02-14 15:26:54 +01:00
|
|
|
// and transform these in IPAddresses.
|
2022-02-14 15:54:51 +01:00
|
|
|
func expandAlias(
|
|
|
|
machines []Machine,
|
|
|
|
aclPolicy ACLPolicy,
|
|
|
|
alias string,
|
2022-03-01 21:01:46 +01:00
|
|
|
stripEmailDomain bool,
|
2022-02-14 15:54:51 +01:00
|
|
|
) ([]string, error) {
|
2022-02-07 16:12:05 +01:00
|
|
|
ips := []string{}
|
2021-11-14 20:32:03 +01:00
|
|
|
if alias == "*" {
|
2021-11-04 23:16:56 +01:00
|
|
|
return []string{"*"}, nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-03-02 21:46:02 +01:00
|
|
|
log.Debug().
|
|
|
|
Str("alias", alias).
|
|
|
|
Msg("Expanding")
|
|
|
|
|
2021-11-14 20:32:03 +01:00
|
|
|
if strings.HasPrefix(alias, "group:") {
|
2022-03-01 21:01:46 +01:00
|
|
|
namespaces, err := expandGroup(aclPolicy, alias, stripEmailDomain)
|
2022-02-05 17:18:39 +01:00
|
|
|
if err != nil {
|
2022-02-07 16:12:05 +01:00
|
|
|
return ips, err
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
2022-02-05 17:18:39 +01:00
|
|
|
for _, n := range namespaces {
|
2022-02-20 21:24:02 +01:00
|
|
|
nodes := filterMachinesByNamespace(machines, n)
|
2021-11-04 23:16:56 +01:00
|
|
|
for _, node := range nodes {
|
2022-01-16 14:16:59 +01:00
|
|
|
ips = append(ips, node.IPAddresses.ToStringSlice()...)
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2021-11-04 23:16:56 +01:00
|
|
|
return ips, nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2021-11-14 20:32:03 +01:00
|
|
|
if strings.HasPrefix(alias, "tag:") {
|
2022-06-01 15:39:59 +02:00
|
|
|
// check for forced tags
|
|
|
|
for _, machine := range machines {
|
|
|
|
if contains(machine.ForcedTags, alias) {
|
|
|
|
ips = append(ips, machine.IPAddresses.ToStringSlice()...)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// find tag owners
|
2022-03-01 21:01:46 +01:00
|
|
|
owners, err := expandTagOwners(aclPolicy, alias, stripEmailDomain)
|
2022-02-05 17:18:39 +01:00
|
|
|
if err != nil {
|
2022-04-15 18:01:13 +02:00
|
|
|
if errors.Is(err, errInvalidTag) {
|
|
|
|
if len(ips) == 0 {
|
2022-04-15 18:27:57 +02:00
|
|
|
return ips, fmt.Errorf(
|
2022-05-16 14:59:46 +02:00
|
|
|
"%w. %v isn't owned by a TagOwner and no forced tags are defined",
|
2022-04-15 18:27:57 +02:00
|
|
|
errInvalidTag,
|
|
|
|
alias,
|
|
|
|
)
|
2022-04-15 18:01:13 +02:00
|
|
|
}
|
2022-06-08 17:43:59 +02:00
|
|
|
|
2022-04-15 18:01:13 +02:00
|
|
|
return ips, nil
|
|
|
|
} else {
|
|
|
|
return ips, err
|
|
|
|
}
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
2022-06-01 15:39:59 +02:00
|
|
|
|
|
|
|
// filter out machines per tag owner
|
2022-02-05 17:18:39 +01:00
|
|
|
for _, namespace := range owners {
|
2022-02-20 21:24:02 +01:00
|
|
|
machines := filterMachinesByNamespace(machines, namespace)
|
2022-02-05 17:18:39 +01:00
|
|
|
for _, machine := range machines {
|
2022-03-01 17:34:24 +01:00
|
|
|
hi := machine.GetHostInfo()
|
2022-06-01 15:39:59 +02:00
|
|
|
if contains(hi.RequestTags, alias) {
|
|
|
|
ips = append(ips, machine.IPAddresses.ToStringSlice()...)
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2021-11-04 23:16:56 +01:00
|
|
|
return ips, nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
// if alias is a namespace
|
2022-02-20 21:24:02 +01:00
|
|
|
nodes := filterMachinesByNamespace(machines, alias)
|
2022-03-02 09:15:14 +01:00
|
|
|
nodes = excludeCorrectlyTaggedNodes(aclPolicy, nodes, alias)
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
for _, n := range nodes {
|
|
|
|
ips = append(ips, n.IPAddresses.ToStringSlice()...)
|
|
|
|
}
|
|
|
|
if len(ips) > 0 {
|
2021-11-04 23:16:56 +01:00
|
|
|
return ips, nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
// if alias is an host
|
|
|
|
if h, ok := aclPolicy.Hosts[alias]; ok {
|
2021-11-04 23:16:56 +01:00
|
|
|
return []string{h.String()}, nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
// if alias is an IP
|
2021-11-14 20:32:03 +01:00
|
|
|
ip, err := netaddr.ParseIP(alias)
|
2021-07-03 17:31:32 +02:00
|
|
|
if err == nil {
|
2021-11-04 23:16:56 +01:00
|
|
|
return []string{ip.String()}, nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
// if alias is an CIDR
|
2021-11-14 20:32:03 +01:00
|
|
|
cidr, err := netaddr.ParseIPPrefix(alias)
|
2021-07-03 17:31:32 +02:00
|
|
|
if err == nil {
|
2021-11-04 23:16:56 +01:00
|
|
|
return []string{cidr.String()}, nil
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-03-02 21:46:02 +01:00
|
|
|
log.Warn().Msgf("No IPs found with the alias %v", alias)
|
|
|
|
|
|
|
|
return ips, nil
|
2021-07-03 11:55:32 +02:00
|
|
|
}
|
2021-07-04 12:35:18 +02:00
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
// excludeCorrectlyTaggedNodes will remove from the list of input nodes the ones
|
|
|
|
// that are correctly tagged since they should not be listed as being in the namespace
|
|
|
|
// we assume in this function that we only have nodes from 1 namespace.
|
2022-02-14 15:54:51 +01:00
|
|
|
func excludeCorrectlyTaggedNodes(
|
|
|
|
aclPolicy ACLPolicy,
|
|
|
|
nodes []Machine,
|
|
|
|
namespace string,
|
2022-03-02 09:15:14 +01:00
|
|
|
) []Machine {
|
2022-02-07 16:12:05 +01:00
|
|
|
out := []Machine{}
|
|
|
|
tags := []string{}
|
|
|
|
for tag, ns := range aclPolicy.TagOwners {
|
2022-04-25 21:50:40 +02:00
|
|
|
if contains(ns, namespace) {
|
2022-02-07 16:12:05 +01:00
|
|
|
tags = append(tags, tag)
|
|
|
|
}
|
2022-02-05 17:18:39 +01:00
|
|
|
}
|
2022-02-07 16:12:05 +01:00
|
|
|
// for each machine if tag is in tags list, don't append it.
|
|
|
|
for _, machine := range nodes {
|
2022-03-01 17:34:24 +01:00
|
|
|
hi := machine.GetHostInfo()
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
found := false
|
|
|
|
for _, t := range hi.RequestTags {
|
2022-04-25 21:50:40 +02:00
|
|
|
if contains(tags, t) {
|
2022-02-07 16:12:05 +01:00
|
|
|
found = true
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
break
|
2022-02-05 17:18:39 +01:00
|
|
|
}
|
|
|
|
}
|
2022-04-15 18:01:13 +02:00
|
|
|
if len(machine.ForcedTags) > 0 {
|
|
|
|
found = true
|
|
|
|
}
|
2022-02-07 16:12:05 +01:00
|
|
|
if !found {
|
|
|
|
out = append(out, machine)
|
2022-02-05 17:18:39 +01:00
|
|
|
}
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2022-03-02 09:15:14 +01:00
|
|
|
return out
|
2022-02-05 17:18:39 +01:00
|
|
|
}
|
|
|
|
|
2022-06-08 17:43:59 +02:00
|
|
|
func expandPorts(portsStr string, needsWildcard bool) (*[]tailcfg.PortRange, error) {
|
2021-11-14 20:32:03 +01:00
|
|
|
if portsStr == "*" {
|
2021-11-14 18:31:51 +01:00
|
|
|
return &[]tailcfg.PortRange{
|
2021-11-15 18:24:24 +01:00
|
|
|
{First: portRangeBegin, Last: portRangeEnd},
|
2021-11-14 18:31:51 +01:00
|
|
|
}, nil
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
|
|
|
|
2022-06-08 17:43:59 +02:00
|
|
|
if needsWildcard {
|
|
|
|
return nil, errWildcardIsNeeded
|
|
|
|
}
|
|
|
|
|
2021-07-04 12:35:18 +02:00
|
|
|
ports := []tailcfg.PortRange{}
|
2021-11-14 20:32:03 +01:00
|
|
|
for _, portStr := range strings.Split(portsStr, ",") {
|
|
|
|
rang := strings.Split(portStr, "-")
|
2021-11-14 18:44:37 +01:00
|
|
|
switch len(rang) {
|
|
|
|
case 1:
|
2021-11-15 18:24:24 +01:00
|
|
|
port, err := strconv.ParseUint(rang[0], Base10, BitSize16)
|
2021-07-04 12:35:18 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
ports = append(ports, tailcfg.PortRange{
|
2021-11-14 20:32:03 +01:00
|
|
|
First: uint16(port),
|
|
|
|
Last: uint16(port),
|
2021-07-04 12:35:18 +02:00
|
|
|
})
|
2021-11-14 18:44:37 +01:00
|
|
|
|
2021-11-15 18:24:24 +01:00
|
|
|
case expectedTokenItems:
|
|
|
|
start, err := strconv.ParseUint(rang[0], Base10, BitSize16)
|
2021-07-04 12:35:18 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-15 18:24:24 +01:00
|
|
|
last, err := strconv.ParseUint(rang[1], Base10, BitSize16)
|
2021-07-04 12:35:18 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
ports = append(ports, tailcfg.PortRange{
|
|
|
|
First: uint16(start),
|
|
|
|
Last: uint16(last),
|
|
|
|
})
|
2021-11-14 18:44:37 +01:00
|
|
|
|
|
|
|
default:
|
2021-11-15 17:33:16 +01:00
|
|
|
return nil, errInvalidPortFormat
|
2021-07-04 12:35:18 +02:00
|
|
|
}
|
|
|
|
}
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-07-04 12:35:18 +02:00
|
|
|
return &ports, nil
|
|
|
|
}
|
2022-02-07 16:12:05 +01:00
|
|
|
|
2022-02-20 21:24:02 +01:00
|
|
|
func filterMachinesByNamespace(machines []Machine, namespace string) []Machine {
|
2022-02-07 16:12:05 +01:00
|
|
|
out := []Machine{}
|
|
|
|
for _, machine := range machines {
|
|
|
|
if machine.Namespace.Name == namespace {
|
|
|
|
out = append(out, machine)
|
|
|
|
}
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
return out
|
|
|
|
}
|
|
|
|
|
|
|
|
// expandTagOwners will return a list of namespace. An owner can be either a namespace or a group
|
2022-02-14 15:26:54 +01:00
|
|
|
// a group cannot be composed of groups.
|
2022-03-01 21:01:46 +01:00
|
|
|
func expandTagOwners(
|
|
|
|
aclPolicy ACLPolicy,
|
|
|
|
tag string,
|
|
|
|
stripEmailDomain bool,
|
|
|
|
) ([]string, error) {
|
2022-02-07 16:12:05 +01:00
|
|
|
var owners []string
|
|
|
|
ows, ok := aclPolicy.TagOwners[tag]
|
|
|
|
if !ok {
|
2022-02-14 15:54:51 +01:00
|
|
|
return []string{}, fmt.Errorf(
|
|
|
|
"%w. %v isn't owned by a TagOwner. Please add one first. https://tailscale.com/kb/1018/acls/#tag-owners",
|
|
|
|
errInvalidTag,
|
|
|
|
tag,
|
|
|
|
)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
for _, owner := range ows {
|
|
|
|
if strings.HasPrefix(owner, "group:") {
|
2022-03-01 21:01:46 +01:00
|
|
|
gs, err := expandGroup(aclPolicy, owner, stripEmailDomain)
|
2022-02-07 16:12:05 +01:00
|
|
|
if err != nil {
|
|
|
|
return []string{}, err
|
|
|
|
}
|
|
|
|
owners = append(owners, gs...)
|
|
|
|
} else {
|
2022-02-14 15:26:54 +01:00
|
|
|
owners = append(owners, owner)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
return owners, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// expandGroup will return the list of namespace inside the group
|
2022-02-14 15:26:54 +01:00
|
|
|
// after some validation.
|
2022-03-01 21:01:46 +01:00
|
|
|
func expandGroup(
|
|
|
|
aclPolicy ACLPolicy,
|
|
|
|
group string,
|
|
|
|
stripEmailDomain bool,
|
|
|
|
) ([]string, error) {
|
|
|
|
outGroups := []string{}
|
|
|
|
aclGroups, ok := aclPolicy.Groups[group]
|
2022-02-07 16:12:05 +01:00
|
|
|
if !ok {
|
2022-02-14 15:54:51 +01:00
|
|
|
return []string{}, fmt.Errorf(
|
|
|
|
"group %v isn't registered. %w",
|
|
|
|
group,
|
|
|
|
errInvalidGroup,
|
|
|
|
)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
2022-03-01 21:01:46 +01:00
|
|
|
for _, group := range aclGroups {
|
|
|
|
if strings.HasPrefix(group, "group:") {
|
2022-02-14 15:54:51 +01:00
|
|
|
return []string{}, fmt.Errorf(
|
|
|
|
"%w. A group cannot be composed of groups. https://tailscale.com/kb/1018/acls/#groups",
|
|
|
|
errInvalidGroup,
|
|
|
|
)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
2022-03-07 23:20:30 +01:00
|
|
|
grp, err := NormalizeToFQDNRules(group, stripEmailDomain)
|
2022-03-01 21:01:46 +01:00
|
|
|
if err != nil {
|
|
|
|
return []string{}, fmt.Errorf(
|
|
|
|
"failed to normalize group %q, err: %w",
|
|
|
|
group,
|
|
|
|
errInvalidGroup,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
outGroups = append(outGroups, grp)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
|
2022-03-01 21:01:46 +01:00
|
|
|
return outGroups, nil
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|