juanfont/headscale
1
1
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2024-09-20 07:16:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Load ACL policy on headscale startup

Browse source
This commit is contained in:
Juan Font 2021-07-04 13:24:05 +02:00
parent 401e6aec32
commit 202d6b506f
4 changed files with 18 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
acls.go
View file

@ -22,7 +22,7 @@ const errorInvalidTag = Error("invalid tag")
const errorInvalidNamespace = Error("invalid namespace")
const errorInvalidPortFormat = Error("invalid port format")
func (h *Headscale) LoadPolicy(path string) error {
func (h *Headscale) LoadAclPolicy(path string) error {
policyFile, err := os.Open(path)
if err != nil {
return err
@ -40,7 +40,12 @@ func (h *Headscale) LoadPolicy(path string) error {
}
h.aclPolicy = &policy
return err
rules, err := h.generateACLRules()
if err != nil {
return err
}
h.aclRules = rules
return nil
}
func (h *Headscale) generateACLRules() (*[]tailcfg.FilterRule, error) {

2
api.go
View file

@ -373,7 +373,7 @@ func (h *Headscale) getMapResponse(mKey wgkey.Key, req tailcfg.MapRequest, m Mac
DNS: []netaddr.IP{},
SearchPaths: []string{},
Domain: "foobar@example.com",
PacketFilter: tailcfg.FilterAllowAll,
PacketFilter: *h.aclRules,
DERPMap: h.cfg.DerpMap,
UserProfiles: []tailcfg.UserProfile{},
}

3
app.go
View file

@ -50,6 +50,7 @@ type Headscale struct {
privateKey *wgkey.Private
aclPolicy *ACLPolicy
aclRules *[]tailcfg.FilterRule
pollMu sync.Mutex
clientsPolling map[uint64]chan []byte // this is by all means a hackity hack
@ -84,7 +85,9 @@ func NewHeadscale(cfg Config) (*Headscale, error) {
dbString: dbString,
privateKey: privKey,
publicKey: &pubKey,
aclRules: &tailcfg.FilterAllowAll, // default allowall
}
err = h.initDB()
if err != nil {
return nil, err

7
cmd/headscale/cli/utils.go
View file

@ -119,6 +119,13 @@ func getHeadscaleApp() (*headscale.Headscale, error) {
if err != nil {
return nil, err
}
// We are doing this here, as in the future could be cool to have it also hot-reload
err = h.LoadAclPolicy(absPath(viper.GetString("acl_policy_path")))
if err != nil {
log.Printf("Could not load the ACL policy: %s", err)
}
return h, nil
}