Work in progress in rule generation

acls.go

@@ -1,30 +1,119 @@
 package headscale
 
 import (
+	"fmt"
 	"io"
 	"os"
+	"strings"
 
 	"github.com/tailscale/hujson"
+	"inet.af/netaddr"
+	"tailscale.com/tailcfg"
 )
 
-const errorInvalidPolicy = Error("invalid policy")
+const errorEmptyPolicy = Error("empty policy")
+const errorInvalidAction = Error("invalid action")
+const errorInvalidUserSection = Error("invalid user section")
+const errorInvalidGroup = Error("invalid group")
 
-func (h *Headscale) ParsePolicy(path string) (*ACLPolicy, error) {
+func (h *Headscale) LoadPolicy(path string) error {
 	policyFile, err := os.Open(path)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	defer policyFile.Close()
 
 	var policy ACLPolicy
 	b, err := io.ReadAll(policyFile)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	err = hujson.Unmarshal(b, &policy)
 	if policy.IsZero() {
-		return nil, errorInvalidPolicy
+		return errorEmptyPolicy
 	}
 
-	return &policy, err
+	h.aclPolicy = &policy
+	return err
+}
+
+func (h *Headscale) generateACLRules() (*[]tailcfg.FilterRule, error) {
+	rules := []tailcfg.FilterRule{}
+
+	for i, a := range h.aclPolicy.ACLs {
+		if a.Action != "accept" {
+			return nil, errorInvalidAction
+		}
+
+		r := tailcfg.FilterRule{}
+
+		srcIPs := []string{}
+		for j, u := range a.Users {
+			fmt.Printf("acl %d, user %d: ", i, j)
+			srcs, err := h.generateAclPolicySrcIP(u)
+			fmt.Printf("  ->  %s\n", err)
+			if err != nil {
+				return nil, err
+			}
+			srcIPs = append(srcIPs, *srcs...)
+		}
+		r.SrcIPs = srcIPs
+
+	}
+
+	return &rules, nil
+}
+
+func (h *Headscale) generateAclPolicySrcIP(u string) (*[]string, error) {
+	if u == "*" {
+		fmt.Printf("%s -> wildcard", u)
+		return &[]string{"*"}, nil
+	}
+
+	if strings.HasPrefix(u, "group:") {
+		fmt.Printf("%s -> group", u)
+		if _, ok := h.aclPolicy.Groups[u]; !ok {
+			return nil, errorInvalidGroup
+		}
+		return nil, nil
+	}
+
+	if strings.HasPrefix(u, "tag:") {
+		fmt.Printf("%s -> tag", u)
+		return nil, nil
+	}
+
+	n, err := h.GetNamespace(u)
+	if err == nil {
+		fmt.Printf("%s -> namespace %s", u, n.Name)
+		nodes, err := h.ListMachinesInNamespace(n.Name)
+		if err != nil {
+			return nil, err
+		}
+		ips := []string{}
+		for _, n := range *nodes {
+			ips = append(ips, n.IPAddress)
+		}
+		return &ips, nil
+	}
+
+	if h, ok := h.aclPolicy.Hosts[u]; ok {
+		fmt.Printf("%s -> host %s", u, h)
+		return &[]string{h.String()}, nil
+	}
+
+	ip, err := netaddr.ParseIP(u)
+	if err == nil {
+		fmt.Printf(" %s -> ip %s", u, ip)
+		return &[]string{ip.String()}, nil
+	}
+
+	cidr, err := netaddr.ParseIPPrefix(u)
+	if err == nil {
+		fmt.Printf("%s -> cidr %s", u, cidr)
+		return &[]string{cidr.String()}, nil
+	}
+
+	fmt.Printf("%s: cannot be mapped to anything\n", u)
+	return nil, errorInvalidUserSection
 }