Mirrors/juanfont.headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2024-12-20 19:09:07 +01:00
Code Issues Projects Releases Wiki Activity

fix(acl): fix issue with groups in excludeCorretlyTaggedNodes

Browse Source 
This commit fix issue #563
This commit is contained in:
Adrien Raffin-Caboisse 2022-08-04 10:42:47 +02:00
parent f9c4d577e2
commit babf9470c2
No known key found for this signature in database
GPG Key ID: 7FB60532DEBEAD6A
2 changed files with 64 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
acls.go
View File

@ -367,7 +367,7 @@ func expandAlias(
// if alias is a namespace
nodes := filterMachinesByNamespace(machines, alias)
nodes = excludeCorrectlyTaggedNodes(aclPolicy, nodes, alias)
nodes = excludeCorrectlyTaggedNodes(aclPolicy, nodes, alias, stripEmailDomain)
for _, n := range nodes {
ips = append(ips, n.IPAddresses.ToStringSlice()...)
@ -405,10 +405,13 @@ func excludeCorrectlyTaggedNodes(
aclPolicy ACLPolicy,
nodes []Machine,
namespace string,
stripEmailDomain bool,
) []Machine {
out := []Machine{}
tags := []string{}
for tag, ns := range aclPolicy.TagOwners {
owners, _ := expandTagOwners(aclPolicy, namespace, stripEmailDomain)
ns = append(owners, namespace)
if contains(ns, namespace) {
tags = append(tags, tag)
}

54
acls_test.go
View File

@ -1204,6 +1204,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
aclPolicy ACLPolicy
nodes []Machine
namespace string
stripEmailDomain bool
}
tests := []struct {
name string
@ -1248,6 +1249,56 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
},
},
namespace: "joe",
stripEmailDomain: true,
},
want: []Machine{
{
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.4")},
Namespace: Namespace{Name: "joe"},
},
},
},
{
name: "exclude nodes with valid tags, and owner is in a group",
args: args{
aclPolicy: ACLPolicy{
Groups: Groups{
"group:accountant": []string{"joe", "bar"},
},
TagOwners: TagOwners{"tag:accountant-webserver": []string{"group:accountant"}},
},
nodes: []Machine{
{
IPAddresses: MachineAddresses{
netaddr.MustParseIP("100.64.0.1"),
},
Namespace: Namespace{Name: "joe"},
HostInfo: HostInfo{
OS: "centos",
Hostname: "foo",
RequestTags: []string{"tag:accountant-webserver"},
},
},
{
IPAddresses: MachineAddresses{
netaddr.MustParseIP("100.64.0.2"),
},
Namespace: Namespace{Name: "joe"},
HostInfo: HostInfo{
OS: "centos",
Hostname: "foo",
RequestTags: []string{"tag:accountant-webserver"},
},
},
{
IPAddresses: MachineAddresses{
netaddr.MustParseIP("100.64.0.4"),
},
Namespace: Namespace{Name: "joe"},
},
},
namespace: "joe",
stripEmailDomain: true,
},
want: []Machine{
{
@ -1289,6 +1340,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
},
},
namespace: "joe",
stripEmailDomain: true,
},
want: []Machine{
{
@ -1334,6 +1386,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
},
},
namespace: "joe",
stripEmailDomain: true,
},
want: []Machine{
{
@ -1373,6 +1426,7 @@ func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
test.args.aclPolicy,
test.args.nodes,
test.args.namespace,
test.args.stripEmailDomain,
)
if !reflect.DeepEqual(got, test.want) {
t.Errorf("excludeCorrectlyTaggedNodes() = %v, want %v", got, test.want)