TheArchive/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2025-03-12 16:30:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove policy handling for old capver (#2429)

Browse Source 
* remove policy handling for old capver

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* update tests

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

---------

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby 2025-03-10 19:19:25 +01:00 committed by GitHub
parent 0a243b4162
commit 0b5c29e875
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hscontrol/mapper/mapper.go
View File

@ -555,27 +555,13 @@ func appendPeerChanges(
resp.UserProfiles = profiles resp.UserProfiles = profiles
resp.SSHPolicy = sshPolicy resp.SSHPolicy = sshPolicy
// 81: 2023-11-17: MapResponse.PacketFilters (incremental packet filter updates) // CapVer 81: 2023-11-17: MapResponse.PacketFilters (incremental packet filter updates)
if capVer >= 81 {
// Currently, we do not send incremental package filters, however using the // Currently, we do not send incremental package filters, however using the
// new PacketFilters field and "base" allows us to send a full update when we // new PacketFilters field and "base" allows us to send a full update when we
// have to send an empty list, avoiding the hack in the else block. // have to send an empty list, avoiding the hack in the else block.
resp.PacketFilters = map[string][]tailcfg.FilterRule{ resp.PacketFilters = map[string][]tailcfg.FilterRule{
"base": policy.ReduceFilterRules(node, filter), "base": policy.ReduceFilterRules(node, filter),
} }
} else {
// This is a hack to avoid sending an empty list of packet filters.
// Since tailcfg.PacketFilter has omitempty, any empty PacketFilter will
// be omitted, causing the client to consider it unchanged, keeping the
// previous packet filter. Worst case, this can cause a node that previously
// has access to a node to _not_ loose access if an empty (allow none) is sent.
reduced := policy.ReduceFilterRules(node, filter)
if len(reduced) > 0 {
resp.PacketFilter = reduced
} else {
resp.PacketFilter = filter
}
}
return nil return nil
} }

8
hscontrol/mapper/mapper_test.go
View File

@ -291,8 +291,8 @@ func Test_fullMapResponse(t *testing.T) {
DisplayName: "user1", DisplayName: "user1",
}, },
}, },
PacketFilter: tailcfg.FilterAllowAll,
ControlTime: &time.Time{}, ControlTime: &time.Time{},
PacketFilters: map[string][]tailcfg.FilterRule{"base": tailcfg.FilterAllowAll},
Debug: &tailcfg.Debug{ Debug: &tailcfg.Debug{
DisableLogTail: true, DisableLogTail: true,
}, },
@ -326,8 +326,8 @@ func Test_fullMapResponse(t *testing.T) {
{ID: tailcfg.UserID(user1.ID), LoginName: "user1", DisplayName: "user1"}, {ID: tailcfg.UserID(user1.ID), LoginName: "user1", DisplayName: "user1"},
{ID: tailcfg.UserID(user2.ID), LoginName: "user2", DisplayName: "user2"}, {ID: tailcfg.UserID(user2.ID), LoginName: "user2", DisplayName: "user2"},
}, },
PacketFilter: tailcfg.FilterAllowAll,
ControlTime: &time.Time{}, ControlTime: &time.Time{},
PacketFilters: map[string][]tailcfg.FilterRule{"base": tailcfg.FilterAllowAll},
Debug: &tailcfg.Debug{ Debug: &tailcfg.Debug{
DisableLogTail: true, DisableLogTail: true,
}, },
@ -368,7 +368,8 @@ func Test_fullMapResponse(t *testing.T) {
DNSConfig: &tailcfg.DNSConfig{}, DNSConfig: &tailcfg.DNSConfig{},
Domain: "", Domain: "",
CollectServices: "false", CollectServices: "false",
PacketFilter: []tailcfg.FilterRule{ PacketFilters: map[string][]tailcfg.FilterRule{
"base": {
{ {
SrcIPs: []string{"100.64.0.2/32"}, SrcIPs: []string{"100.64.0.2/32"},
DstPorts: []tailcfg.NetPortRange{ DstPorts: []tailcfg.NetPortRange{
@ -376,6 +377,7 @@ func Test_fullMapResponse(t *testing.T) {
}, },
}, },
}, },
},
SSHPolicy: &tailcfg.SSHPolicy{}, SSHPolicy: &tailcfg.SSHPolicy{},
UserProfiles: []tailcfg.UserProfile{ UserProfiles: []tailcfg.UserProfile{
{ID: tailcfg.UserID(user1.ID), LoginName: "user1", DisplayName: "user1"}, {ID: tailcfg.UserID(user1.ID), LoginName: "user1", DisplayName: "user1"},