mirror of
https://github.com/tailscale/tailscale.git
synced 2025-04-20 13:41:41 +00:00
cab0e1a6f7
This updates the syspolicy package to support multiple policy sources in the three policy scopes: user, profile, and device, and provides a merged resultant policy. A policy source is a syspolicy/source.Store that has a name and provides access to policy settings for a given scope. It can be registered with syspolicy/rsop.RegisterStore. Policy sources and policy stores can be either platform-specific or platform-agnostic. On Windows, we have the Registry-based, platform-specific policy store implemented as syspolicy/source.PlatformPolicyStore. This store provides access to the Group Policy and MDM policy settings stored in the Registry. On other platforms, we currently provide a wrapper that converts a syspolicy.Handler into a syspolicy/source.Store. However, we should update them in follow-up PRs. An example of a platform-agnostic policy store would be a policy deployed from the control, a local policy config file, or even environment variables. We maintain the current, most recent version of the resultant policy for each scope in an rsop.Policy. This is done by reading and merging the policy settings from the registered stores the first time the resultant policy is requested, then re-reading and re-merging them if a store implements the source.Changeable interface and reports a policy change. Policy change notifications are debounced to avoid re-reading policy settings multiple times if there are several changes within a short period. The rsop.Policy can notify clients if the resultant policy has changed. However, we do not currently expose this via the syspolicy package and plan to do so differently along with a struct-based policy hierarchy in the next PR. To facilitate this, all policy settings should be registered with the setting.Register function. The syspolicy package does this automatically for all policy settings defined in policy_keys.go. The new functionality is available through the existing syspolicy.Read* set of functions. However, we plan to expose it via a struct-based policy hierarchy, along with policy change notifications that other subsystems can use, in the next PR. We also plan to send the resultant policy back from tailscaled to the clients via the LocalAPI. This is primarily a foundational PR to facilitate future changes, but the immediate observable changes on Windows include: - The service will use the current policy setting values instead of those read at OS boot time. - The GUI has access to policy settings configured on a per-user basis. On Android: - We now report policy setting usage via clientmetrics. Updates #12687 Signed-off-by: Nick Khyl <nickk@tailscale.com>
64 lines
1.7 KiB
Go
64 lines
1.7 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
// Package internal contains miscellaneous functions and types
|
|
// that are internal to the syspolicy packages.
|
|
package internal
|
|
|
|
import (
|
|
"bytes"
|
|
|
|
"github.com/go-json-experiment/json/jsontext"
|
|
"tailscale.com/types/lazy"
|
|
"tailscale.com/version"
|
|
)
|
|
|
|
// OSForTesting is the operating system override used for testing.
|
|
// It follows the same naming convention as [version.OS].
|
|
var OSForTesting lazy.SyncValue[string]
|
|
|
|
// OS is like [version.OS], but supports a test hook.
|
|
func OS() string {
|
|
return OSForTesting.Get(version.OS)
|
|
}
|
|
|
|
// TB is a subset of testing.TB that we use to set up test helpers.
|
|
// It's defined here to avoid pulling in the testing package.
|
|
type TB interface {
|
|
Helper()
|
|
Cleanup(func())
|
|
Logf(format string, args ...any)
|
|
Error(args ...any)
|
|
Errorf(format string, args ...any)
|
|
Fatal(args ...any)
|
|
Fatalf(format string, args ...any)
|
|
}
|
|
|
|
// EqualJSONForTest compares the JSON in j1 and j2 for semantic equality.
|
|
// It returns "", "", true if j1 and j2 are equal. Otherwise, it returns
|
|
// indented versions of j1 and j2 and false.
|
|
func EqualJSONForTest(tb TB, j1, j2 jsontext.Value) (s1, s2 string, equal bool) {
|
|
tb.Helper()
|
|
j1 = j1.Clone()
|
|
j2 = j2.Clone()
|
|
// Canonicalize JSON values for comparison.
|
|
if err := j1.Canonicalize(); err != nil {
|
|
tb.Error(err)
|
|
}
|
|
if err := j2.Canonicalize(); err != nil {
|
|
tb.Error(err)
|
|
}
|
|
// Check and return true if the two values are structurally equal.
|
|
if bytes.Equal(j1, j2) {
|
|
return "", "", true
|
|
}
|
|
// Otherwise, format the values for display and return false.
|
|
if err := j1.Indent("", "\t"); err != nil {
|
|
tb.Fatal(err)
|
|
}
|
|
if err := j2.Indent("", "\t"); err != nil {
|
|
tb.Fatal(err)
|
|
}
|
|
return j1.String(), j2.String(), false
|
|
}
|