mirror of
https://github.com/tailscale/tailscale.git
synced 2024-12-11 10:44:41 +00:00
3a635db06e
connector-gen can initially generate connector ACL snippets and advertise-routes flags for Github and AWS based on their public IP / domain data. Updates ENG-2425 Signed-off-by: James Tucker <james@tailscale.com>
117 lines
3.1 KiB
Go
117 lines
3.1 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"log"
|
|
"net/http"
|
|
"net/netip"
|
|
"slices"
|
|
"strings"
|
|
|
|
"go4.org/netipx"
|
|
)
|
|
|
|
// See https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-githubs-ip-addresses
|
|
|
|
type GithubMeta struct {
|
|
VerifiablePasswordAuthentication bool `json:"verifiable_password_authentication"`
|
|
SSHKeyFingerprints struct {
|
|
Sha256Ecdsa string `json:"SHA256_ECDSA"`
|
|
Sha256Ed25519 string `json:"SHA256_ED25519"`
|
|
Sha256Rsa string `json:"SHA256_RSA"`
|
|
} `json:"ssh_key_fingerprints"`
|
|
SSHKeys []string `json:"ssh_keys"`
|
|
Hooks []string `json:"hooks"`
|
|
Web []string `json:"web"`
|
|
API []string `json:"api"`
|
|
Git []string `json:"git"`
|
|
GithubEnterpriseImporter []string `json:"github_enterprise_importer"`
|
|
Packages []string `json:"packages"`
|
|
Pages []string `json:"pages"`
|
|
Importer []string `json:"importer"`
|
|
Actions []string `json:"actions"`
|
|
Dependabot []string `json:"dependabot"`
|
|
Domains struct {
|
|
Website []string `json:"website"`
|
|
Codespaces []string `json:"codespaces"`
|
|
Copilot []string `json:"copilot"`
|
|
Packages []string `json:"packages"`
|
|
} `json:"domains"`
|
|
}
|
|
|
|
func github() {
|
|
r, err := http.Get("https://api.github.com/meta")
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
|
|
var ghm GithubMeta
|
|
|
|
if err := json.NewDecoder(r.Body).Decode(&ghm); err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
r.Body.Close()
|
|
|
|
var ips netipx.IPSetBuilder
|
|
|
|
var lists []string
|
|
lists = append(lists, ghm.Hooks...)
|
|
lists = append(lists, ghm.Web...)
|
|
lists = append(lists, ghm.API...)
|
|
lists = append(lists, ghm.Git...)
|
|
lists = append(lists, ghm.GithubEnterpriseImporter...)
|
|
lists = append(lists, ghm.Packages...)
|
|
lists = append(lists, ghm.Pages...)
|
|
lists = append(lists, ghm.Importer...)
|
|
lists = append(lists, ghm.Actions...)
|
|
lists = append(lists, ghm.Dependabot...)
|
|
|
|
for _, s := range lists {
|
|
ips.AddPrefix(netip.MustParsePrefix(s))
|
|
}
|
|
|
|
set, err := ips.IPSet()
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
|
|
fmt.Println(`"routes": [`)
|
|
for _, pfx := range set.Prefixes() {
|
|
fmt.Printf(`"%s": ["tag:connector"],%s`, pfx.String(), "\n")
|
|
}
|
|
fmt.Println(`]`)
|
|
|
|
fmt.Println()
|
|
|
|
var domains []string
|
|
domains = append(domains, ghm.Domains.Website...)
|
|
domains = append(domains, ghm.Domains.Codespaces...)
|
|
domains = append(domains, ghm.Domains.Copilot...)
|
|
domains = append(domains, ghm.Domains.Packages...)
|
|
slices.Sort(domains)
|
|
domains = slices.Compact(domains)
|
|
|
|
var bareDomains []string
|
|
for _, domain := range domains {
|
|
trimmed := strings.TrimPrefix(domain, "*.")
|
|
if trimmed != domain {
|
|
bareDomains = append(bareDomains, trimmed)
|
|
}
|
|
}
|
|
domains = append(domains, bareDomains...)
|
|
slices.Sort(domains)
|
|
domains = slices.Compact(domains)
|
|
|
|
fmt.Println(`"domains": [`)
|
|
for _, domain := range domains {
|
|
fmt.Printf(`"%s",%s`, domain, "\n")
|
|
}
|
|
fmt.Println(`]`)
|
|
|
|
advertiseRoutes(set)
|
|
}
|