1
0
mirror of https://github.com/juanfont/headscale.git synced 2024-12-20 19:09:07 +01:00

chore(format): run prettier on repo

This commit is contained in:
Adrien Raffin-Caboisse 2022-02-21 16:06:20 +01:00
parent 4bbe0051f6
commit 25550f8866
4 changed files with 77 additions and 38 deletions

View File

@ -5,9 +5,9 @@
**0.14.0 (2022-xx-xx):** **0.14.0 (2022-xx-xx):**
**UPCOMING BREAKING**: **UPCOMING BREAKING**:
From the **next** version (`0.15.0`), all machines will be able to communicate regardless of From the **next** version (`0.15.0`), all machines will be able to communicate regardless of
if they are in the same namespace. This means that the behaviour currently limited to ACLs if they are in the same namespace. This means that the behaviour currently limited to ACLs
will become default. From version `0.15.0`, all limitation of communications must be done will become default. From version `0.15.0`, all limitation of communications must be done
with ACLs. with ACLs.
This is a part of aligning `headscale`'s behaviour with Tailscale's upstream behaviour. This is a part of aligning `headscale`'s behaviour with Tailscale's upstream behaviour.
@ -17,7 +17,7 @@ This is a part of aligning `headscale`'s behaviour with Tailscale's upstream beh
- ACLs have been rewritten to align with the bevaviour Tailscale Control Panel provides. **NOTE:** This is only active if you use ACLs - ACLs have been rewritten to align with the bevaviour Tailscale Control Panel provides. **NOTE:** This is only active if you use ACLs
- Namespaces are now treated as Users - Namespaces are now treated as Users
- All machines can communicate with all machines by default - All machines can communicate with all machines by default
- Tags should now work correctly and adding a host to Headscale should now reload the rules. - Tags should now work correctly and adding a host to Headscale should now reload the rules.
- The documentation have a [fictional example](docs/acls.md) that should cover some use cases of the ACLs features - The documentation have a [fictional example](docs/acls.md) that should cover some use cases of the ACLs features
**0.13.0 (2022-02-18):** **0.13.0 (2022-02-18):**

View File

@ -919,8 +919,10 @@ func Test_expandAlias(t *testing.T) {
}, },
}, },
aclPolicy: ACLPolicy{ aclPolicy: ACLPolicy{
Groups: Groups{"group:accountant": []string{"joe", "marc"}}, Groups: Groups{"group:accountant": []string{"joe", "marc"}},
TagOwners: TagOwners{"tag:accountant-webserver": []string{"group:accountant"}}, TagOwners: TagOwners{
"tag:accountant-webserver": []string{"group:accountant"},
},
}, },
}, },
want: []string{}, want: []string{},

View File

@ -143,12 +143,22 @@ func containsAddresses(inputs []string, addrs []string) bool {
} }
// matchSourceAndDestinationWithRule. // matchSourceAndDestinationWithRule.
func matchSourceAndDestinationWithRule(ruleSources []string, ruleDestinations []string, source []string, destination []string) bool { func matchSourceAndDestinationWithRule(
return containsAddresses(ruleSources, source) && containsAddresses(ruleDestinations, destination) ruleSources []string,
ruleDestinations []string,
source []string,
destination []string,
) bool {
return containsAddresses(ruleSources, source) &&
containsAddresses(ruleDestinations, destination)
} }
// getFilteredByACLPeerss should return the list of peers authorized to be accessed from machine. // getFilteredByACLPeerss should return the list of peers authorized to be accessed from machine.
func getFilteredByACLPeers(machines []Machine, rules []tailcfg.FilterRule, machine *Machine) Machines { func getFilteredByACLPeers(
machines []Machine,
rules []tailcfg.FilterRule,
machine *Machine,
) Machines {
log.Trace(). log.Trace().
Caller(). Caller().
Str("machine", machine.Name). Str("machine", machine.Name).
@ -181,7 +191,12 @@ func getFilteredByACLPeers(machines []Machine, rules []tailcfg.FilterRule, machi
for _, d := range rule.DstPorts { for _, d := range rule.DstPorts {
dst = append(dst, d.IP) dst = append(dst, d.IP)
} }
if matchSourceAndDestinationWithRule(rule.SrcIPs, dst, machine.IPAddresses.ToStringSlice(), peer.IPAddresses.ToStringSlice()) || // match source and destination if matchSourceAndDestinationWithRule(
rule.SrcIPs,
dst,
machine.IPAddresses.ToStringSlice(),
peer.IPAddresses.ToStringSlice(),
) || // match source and destination
matchSourceAndDestinationWithRule(rule.SrcIPs, dst, machine.IPAddresses.ToStringSlice(), []string{"*"}) || // match source and all destination matchSourceAndDestinationWithRule(rule.SrcIPs, dst, machine.IPAddresses.ToStringSlice(), []string{"*"}) || // match source and all destination
matchSourceAndDestinationWithRule(rule.SrcIPs, dst, peer.IPAddresses.ToStringSlice(), machine.IPAddresses.ToStringSlice()) { // match return path matchSourceAndDestinationWithRule(rule.SrcIPs, dst, peer.IPAddresses.ToStringSlice(), machine.IPAddresses.ToStringSlice()) { // match return path
peers[peer.ID] = peer peers[peer.ID] = peer

View File

@ -312,19 +312,25 @@ func Test_getFilteredByACLPeers(t *testing.T) {
args: args{ args: args{
machines: []Machine{ // list of all machines in the database machines: []Machine{ // list of all machines in the database
{ {
ID: 1, ID: 1,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.1")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "joe"}, netaddr.MustParseIP("100.64.0.1"),
},
Namespace: Namespace{Name: "joe"},
}, },
{ {
ID: 2, ID: 2,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.2")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "marc"}, netaddr.MustParseIP("100.64.0.2"),
},
Namespace: Namespace{Name: "marc"},
}, },
{ {
ID: 3, ID: 3,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.3")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "mickael"}, netaddr.MustParseIP("100.64.0.3"),
},
Namespace: Namespace{Name: "mickael"},
}, },
}, },
rules: []tailcfg.FilterRule{ // list of all ACLRules registered rules: []tailcfg.FilterRule{ // list of all ACLRules registered
@ -359,19 +365,25 @@ func Test_getFilteredByACLPeers(t *testing.T) {
args: args{ args: args{
machines: []Machine{ // list of all machines in the database machines: []Machine{ // list of all machines in the database
{ {
ID: 1, ID: 1,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.1")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "joe"}, netaddr.MustParseIP("100.64.0.1"),
},
Namespace: Namespace{Name: "joe"},
}, },
{ {
ID: 2, ID: 2,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.2")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "marc"}, netaddr.MustParseIP("100.64.0.2"),
},
Namespace: Namespace{Name: "marc"},
}, },
{ {
ID: 3, ID: 3,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.3")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "mickael"}, netaddr.MustParseIP("100.64.0.3"),
},
Namespace: Namespace{Name: "mickael"},
}, },
}, },
rules: []tailcfg.FilterRule{ // list of all ACLRules registered rules: []tailcfg.FilterRule{ // list of all ACLRules registered
@ -401,19 +413,25 @@ func Test_getFilteredByACLPeers(t *testing.T) {
args: args{ args: args{
machines: []Machine{ // list of all machines in the database machines: []Machine{ // list of all machines in the database
{ {
ID: 1, ID: 1,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.1")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "joe"}, netaddr.MustParseIP("100.64.0.1"),
},
Namespace: Namespace{Name: "joe"},
}, },
{ {
ID: 2, ID: 2,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.2")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "marc"}, netaddr.MustParseIP("100.64.0.2"),
},
Namespace: Namespace{Name: "marc"},
}, },
{ {
ID: 3, ID: 3,
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.3")}, IPAddresses: MachineAddresses{
Namespace: Namespace{Name: "mickael"}, netaddr.MustParseIP("100.64.0.3"),
},
Namespace: Namespace{Name: "mickael"},
}, },
}, },
rules: []tailcfg.FilterRule{ // list of all ACLRules registered rules: []tailcfg.FilterRule{ // list of all ACLRules registered
@ -441,7 +459,11 @@ func Test_getFilteredByACLPeers(t *testing.T) {
} }
for _, tt := range tests { for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) { t.Run(tt.name, func(t *testing.T) {
got := getFilteredByACLPeers(tt.args.machines, tt.args.rules, tt.args.machine) got := getFilteredByACLPeers(
tt.args.machines,
tt.args.rules,
tt.args.machine,
)
if !reflect.DeepEqual(got, tt.want) { if !reflect.DeepEqual(got, tt.want) {
t.Errorf("getFilteredByACLPeers() = %v, want %v", got, tt.want) t.Errorf("getFilteredByACLPeers() = %v, want %v", got, tt.want)
} }