Skip to content

Commit 3f3f519

Browse files
clstokesclstokes
committed
policyfile: add grants and ipsets
Fixes #35
1 parent 5f581da commit 3f3f519

File tree

4 files changed

+161
-2
lines changed

4 files changed

+161
-2
lines changed

‎policyfile.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ type ACL struct {
6969
DisableIPv4 bool `json:"disableIPv4,omitempty" hujson:"DisableIPv4,omitempty"`
7070
OneCGNATRoute string `json:"oneCGNATRoute,omitempty" hujson:"OneCGNATRoute,omitempty"`
7171
RandomizeClientPort bool `json:"randomizeClientPort,omitempty" hujson:"RandomizeClientPort,omitempty"`
72+
Grants []Grant `json:"grants,omitempty" hujson:"Grants,omitempty"`
73+
IPSets map[string][]string `json:"ipsets,omitempty" hujson:"IPSets,omitempty"`
7274

7375
// Postures and DefaultSourcePosture are for an experimental feature and not yet public or documented as of 2023-08-17.
7476
// This API is subject to change. Internal bug: corp/13986
@@ -160,6 +162,15 @@ type NodeAttrGrantApp struct {
160162
Domains []string `json:"domains,omitempty" hujson:"Domains,omitempty"`
161163
}
162164

165+
type Grant struct {
166+
Source []string `json:"src,omitempty" hujson:"Src,omitempty"`
167+
Destination []string `json:"dst,omitempty" hujson:"Dst,omitempty"`
168+
IP []string `json:"ip,omitempty" hujson:"IP,omitempty"`
169+
App map[string][]map[string]any `json:"app,omitempty" hujson:"App,omitempty"`
170+
SrcPosture []string `json:"srcPosture,omitempty" hujson:"SrcPosture,omitempty"`
171+
Via []string `json:"via,omitempty" hujson:"Via,omitempty"`
172+
}
173+
163174
// Get retrieves the [ACL] that is currently set for the tailnet.
164175
func (pr *PolicyFileResource) Get(ctx context.Context) (*ACL, error) {
165176
req, err := pr.buildRequest(ctx, http.MethodGet, pr.buildTailnetURL("acl"))

‎policyfile_test.go

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,45 @@ func TestACL_Unmarshal(t *testing.T) {
117117
CheckPeriod: SSHCheckPeriod(time.Hour * 20),
118118
},
119119
},
120+
Grants: []Grant{
121+
{
122+
Source: []string{"autogroup:member"},
123+
Destination: []string{"autogroup:self"},
124+
IP: []string{"*"},
125+
SrcPosture: []string{"posture:latestMac"},
126+
Via: []string{"tag:subnet-router"},
127+
},
128+
{
129+
Source: []string{"group:prod"},
130+
Destination: []string{"tag:k8s-operator"},
131+
App: map[string][]map[string]any{
132+
"tailscale.com/cap/kubernetes": {
133+
{
134+
"impersonate": map[string]any{
135+
"groups": []any{"system:masters"},
136+
},
137+
},
138+
},
139+
},
140+
},
141+
{
142+
Source: []string{"autogroup:admin"},
143+
Destination: []string{"tag:golinks"},
144+
App: map[string][]map[string]any{
145+
"tailscale.com/cap/golink": {
146+
{
147+
"admin": true,
148+
},
149+
},
150+
},
151+
},
152+
},
153+
IPSets: map[string][]string{
154+
"ipset:prod": {
155+
"add 192.0.2.0/24",
156+
"remove 192.0.2.33",
157+
},
158+
},
120159
},
121160
},
122161
{
@@ -219,6 +258,45 @@ func TestACL_Unmarshal(t *testing.T) {
219258
Source: "[email protected]",
220259
Accept: []string{"tag:dev:80"}},
221260
},
261+
Grants: []Grant{
262+
{
263+
Source: []string{"autogroup:member"},
264+
Destination: []string{"autogroup:self"},
265+
IP: []string{"*"},
266+
SrcPosture: []string{"posture:latestMac"},
267+
Via: []string{"tag:subnet-router"},
268+
},
269+
{
270+
Source: []string{"group:prod"},
271+
Destination: []string{"tag:k8s-operator"},
272+
App: map[string][]map[string]any{
273+
"tailscale.com/cap/kubernetes": {
274+
{
275+
"impersonate": map[string]any{
276+
"groups": []any{"system:masters"},
277+
},
278+
},
279+
},
280+
},
281+
},
282+
{
283+
Source: []string{"autogroup:admin"},
284+
Destination: []string{"tag:golinks"},
285+
App: map[string][]map[string]any{
286+
"tailscale.com/cap/golink": {
287+
{
288+
"admin": true,
289+
},
290+
},
291+
},
292+
},
293+
},
294+
IPSets: map[string][]string{
295+
"ipset:prod": {
296+
"add 192.0.2.0/24",
297+
"remove 192.0.2.33",
298+
},
299+
},
222300
},
223301
},
224302
}

‎testdata/acl.hujson

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,5 +65,40 @@
6565
"users": ["root", "autogroup:nonroot"],
6666
"checkPeriod": "always"
6767
},
68-
]
68+
],
69+
"grants": [
70+
{
71+
"src": ["autogroup:member"],
72+
"dst": ["autogroup:self"],
73+
"ip": ["*"],
74+
"srcPosture": ["posture:latestMac"],
75+
"via": ["tag:subnet-router"]
76+
},
77+
{
78+
"src": ["group:prod"],
79+
"dst": ["tag:k8s-operator"],
80+
"app": {
81+
"tailscale.com/cap/kubernetes": [
82+
{
83+
"impersonate": {
84+
"groups": ["system:masters"]
85+
}
86+
}
87+
]
88+
}
89+
},
90+
{
91+
"src": ["autogroup:admin"],
92+
"dst": ["tag:golinks"],
93+
"app": {
94+
"tailscale.com/cap/golink": [{"admin": true}]
95+
}
96+
},
97+
],
98+
"ipsets": {
99+
"ipset:prod": [
100+
"add 192.0.2.0/24",
101+
"remove 192.0.2.33"
102+
]
103+
},
69104
}

‎testdata/acl.json

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,5 +45,40 @@
4545
"users": ["root", "autogroup:nonroot"],
4646
"checkPeriod": "20h"
4747
}
48-
]
48+
],
49+
"grants": [
50+
{
51+
"src": ["autogroup:member"],
52+
"dst": ["autogroup:self"],
53+
"ip": ["*"],
54+
"srcPosture": ["posture:latestMac"],
55+
"via": ["tag:subnet-router"]
56+
},
57+
{
58+
"src": ["group:prod"],
59+
"dst": ["tag:k8s-operator"],
60+
"app": {
61+
"tailscale.com/cap/kubernetes": [
62+
{
63+
"impersonate": {
64+
"groups": ["system:masters"]
65+
}
66+
}
67+
]
68+
}
69+
},
70+
{
71+
"src": ["autogroup:admin"],
72+
"dst": ["tag:golinks"],
73+
"app": {
74+
"tailscale.com/cap/golink": [{"admin": true}]
75+
}
76+
}
77+
],
78+
"ipsets": {
79+
"ipset:prod": [
80+
"add 192.0.2.0/24",
81+
"remove 192.0.2.33"
82+
]
83+
}
4984
}

0 commit comments

Comments
 (0)