eyjhb/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

policy/v2: make default (#2546)

Browse source 
* policy/v2: make default

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* integration: do not run v1 tests

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* policy/v2: fix potential nil pointers

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* mapper: fix test failures in v2

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

---------

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby 2025-04-29 17:27:41 +03:00 • committed by GitHub
parent 9a4d0e1a99
commit 2b38f7bef7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 35 additions and 202 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hscontrol/mapper/mapper_test.go
View file

@ -346,7 +346,7 @@ func Test_fullMapResponse(t *testing.T) {
{
"action": "accept",
"src": ["100.64.0.2"],
"dst": ["user1:*"],
"dst": ["user1@:*"],
},
],
}
@ -382,7 +382,7 @@ func Test_fullMapResponse(t *testing.T) {
},
},
},
SSHPolicy: &tailcfg.SSHPolicy{},
SSHPolicy: nil,
UserProfiles: []tailcfg.UserProfile{
{ID: tailcfg.UserID(user1.ID), LoginName: "user1", DisplayName: "user1"},
{ID: tailcfg.UserID(user2.ID), LoginName: "user2", DisplayName: "user2"},

8
hscontrol/policy/pm.go
View file

@ -11,7 +11,7 @@ import (
)
var (
polv2 = envknob.Bool("HEADSCALE_EXPERIMENTAL_POLICY_V2")
polv1 = envknob.Bool("HEADSCALE_POLICY_V1")
)
type PolicyManager interface {
@ -35,13 +35,13 @@ type PolicyManager interface {
func NewPolicyManager(pol []byte, users []types.User, nodes types.Nodes) (PolicyManager, error) {
var polMan PolicyManager
var err error
if polv2 {
polMan, err = policyv2.NewPolicyManager(pol, users, nodes)
if polv1 {
polMan, err = policyv1.NewPolicyManager(pol, users, nodes)
if err != nil {
return nil, err
}
} else {
polMan, err = policyv1.NewPolicyManager(pol, users, nodes)
polMan, err = policyv2.NewPolicyManager(pol, users, nodes)
if err != nil {
return nil, err
}

10
hscontrol/policy/v2/filter.go
View file

@ -38,7 +38,7 @@ func (pol *Policy) compileFilterRules(
log.Trace().Err(err).Msgf("resolving source ips")
}
if len(srcIPs.Prefixes()) == 0 {
if srcIPs == nil || len(srcIPs.Prefixes()) == 0 {
continue
}
@ -56,6 +56,10 @@ func (pol *Policy) compileFilterRules(
log.Trace().Err(err).Msgf("resolving destination ips")
}
if ips == nil {
continue
}
for _, pref := range ips.Prefixes() {
for _, port := range dest.Ports {
pr := tailcfg.NetPortRange{
@ -162,6 +166,10 @@ func (pol *Policy) compileSSHPolicy(
func ipSetToPrefixStringList(ips *netipx.IPSet) []string {
var out []string
if ips == nil {
return out
}
for _, pref := range ips.Prefixes() {
out = append(out, pref.String())
}