mirror of
https://github.com/juanfont/headscale.git
synced 2025-03-13 23:12:54 -04:00
87326f5c4f
* utility iterator for ipset Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * split policy -> policy and v1 This commit split out the common policy logic and policy implementation into separate packages. policy contains functions that are independent of the policy implementation, this typically means logic that works on tailcfg types and generic formats. In addition, it defines the PolicyManager interface which the v1 implements. v1 is a subpackage which implements the PolicyManager using the "original" policy implementation. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use polivyv1 definitions in integration tests These can be marshalled back into JSON, which the new format might not be able to. Also, just dont change it all to JSON strings for now. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * formatter: breaks lines Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove compareprefix, use tsaddr version Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * remove getacl test, add back autoapprover Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * use policy manager tag handling Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * rename display helper for user Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * introduce policy v2 package policy v2 is built from the ground up to be stricter and follow the same pattern for all types of resolvers. TODO introduce aliass resolver Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * wire up policyv2 in integration testing Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * split policy v2 tests into seperate workflow to work around github limit Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * add policy manager output to /debug Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * update changelog Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
63 lines
1.7 KiB
Go
63 lines
1.7 KiB
Go
package util
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
"net/netip"
|
|
"sync"
|
|
|
|
"go4.org/netipx"
|
|
"tailscale.com/net/tsaddr"
|
|
)
|
|
|
|
func GrpcSocketDialer(ctx context.Context, addr string) (net.Conn, error) {
|
|
var d net.Dialer
|
|
|
|
return d.DialContext(ctx, "unix", addr)
|
|
}
|
|
|
|
func PrefixesToString(prefixes []netip.Prefix) []string {
|
|
ret := make([]string, 0, len(prefixes))
|
|
for _, prefix := range prefixes {
|
|
ret = append(ret, prefix.String())
|
|
}
|
|
|
|
return ret
|
|
}
|
|
|
|
func MustStringsToPrefixes(strings []string) []netip.Prefix {
|
|
ret := make([]netip.Prefix, 0, len(strings))
|
|
for _, str := range strings {
|
|
prefix := netip.MustParsePrefix(str)
|
|
ret = append(ret, prefix)
|
|
}
|
|
|
|
return ret
|
|
}
|
|
|
|
// TheInternet returns the IPSet for the Internet.
|
|
// https://www.youtube.com/watch?v=iDbyYGrswtg
|
|
var TheInternet = sync.OnceValue(func() *netipx.IPSet {
|
|
var internetBuilder netipx.IPSetBuilder
|
|
internetBuilder.AddPrefix(netip.MustParsePrefix("2000::/3"))
|
|
internetBuilder.AddPrefix(tsaddr.AllIPv4())
|
|
|
|
// Delete Private network addresses
|
|
// https://datatracker.ietf.org/doc/html/rfc1918
|
|
internetBuilder.RemovePrefix(netip.MustParsePrefix("fc00::/7"))
|
|
internetBuilder.RemovePrefix(netip.MustParsePrefix("10.0.0.0/8"))
|
|
internetBuilder.RemovePrefix(netip.MustParsePrefix("172.16.0.0/12"))
|
|
internetBuilder.RemovePrefix(netip.MustParsePrefix("192.168.0.0/16"))
|
|
|
|
// Delete Tailscale networks
|
|
internetBuilder.RemovePrefix(tsaddr.TailscaleULARange())
|
|
internetBuilder.RemovePrefix(tsaddr.CGNATRange())
|
|
|
|
// Delete "can't find DHCP networks"
|
|
internetBuilder.RemovePrefix(netip.MustParsePrefix("fe80::/10")) // link-local
|
|
internetBuilder.RemovePrefix(netip.MustParsePrefix("169.254.0.0/16"))
|
|
|
|
theInternetSet, _ := internetBuilder.IPSet()
|
|
return theInternetSet
|
|
})
|