Documentation
¶
Index ¶
- Constants
- func PassesChecks(checks []Check, peer *Peer) bool
- func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool
- func PostureVerdictChanged(checks []*PostureChecks, oldPeer, newPeer *Peer) bool
- type AccountSettingsInfo
- type Check
- type ChecksDefinition
- type CustomZone
- type DNSSettings
- type File
- type Flags
- type GeoLocation
- type GeoLocationCheck
- type Group
- type MinKernelVersionCheck
- type MinVersionCheck
- type NBVersionCheck
- type NameServer
- type NameServerGroup
- type Network
- type NetworkAddress
- type NetworkResource
- type NetworkRouter
- type OSVersionCheck
- type Peer
- func (p *Peer) AddedWithSSOLogin() bool
- func (p *Peer) FQDN(dnsDomain string) string
- func (p *Peer) GetLastLogin() time.Time
- func (p *Peer) HasCapability(capability int32) bool
- func (p *Peer) LoginExpired(expiresIn time.Duration) (bool, time.Duration)
- func (p *Peer) SessionExpiresAt(accountExpirationEnabled bool, expiresIn time.Duration) time.Time
- func (p *Peer) SupportsIPv6() bool
- func (p *Peer) SupportsSourcePrefixes() bool
- type PeerLocation
- type PeerNetworkRangeCheck
- type PeerSystemMeta
- type Policy
- type PolicyRule
- type PostureChecks
- type Process
- type ProcessCheck
- type ProxyDomain
- type ProxyMeta
- type Resource
- type Route
- type RulePortRange
- type Service
- type ServiceTarget
- type SimpleRecord
Constants ¶
const ( PeerCapabilitySourcePrefixes int32 = 1 PeerCapabilityIPv6Overlay int32 = 2 PeerCapabilityComponentNetworkMap int32 = 3 )
Peer capability constants mirror the proto enum values.
const ( NetworkTypeInvalid = 0 NetworkTypeIPv4 = 1 NetworkTypeIPv6 = 2 NetworkTypeDomain = 3 )
NetworkType mirrors route.NetworkType iota values.
const GroupAllName = "All"
GroupAllName is the reserved name of the default group that contains every peer in an account.
Variables ¶
This section is empty.
Functions ¶
func PassesChecks ¶
PassesChecks is Passes over an already built check set, for callers that evaluate many peers against the same bundle.
func PolicyRuleImpliesLegacySSH ¶
func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool
PolicyRuleImpliesLegacySSH is the twin-typed sibling of types.PolicyRuleImpliesLegacySSH.
func PostureVerdictChanged ¶
func PostureVerdictChanged(checks []*PostureChecks, oldPeer, newPeer *Peer) bool
PostureVerdictChanged reports whether any check in the bundles gives a different verdict for newPeer than for oldPeer. Checks are replayed one by one, so a change that moves a field but stays on the same side of a threshold does not count. An evaluation error is a deny, like in PassesChecks.
Types ¶
type AccountSettingsInfo ¶
type AccountSettingsInfo struct {
PeerLoginExpirationEnabled bool
PeerLoginExpiration time.Duration
PeerInactivityExpirationEnabled bool
PeerInactivityExpiration time.Duration
DNSDomain string
IPv6EnabledGroups []string
RoutingPeerDNSResolutionEnabled bool
LazyConnectionEnabled bool
AutoUpdateVersion string
AutoUpdateAlways bool
MetricsPushEnabled bool
}
AccountSettingsInfo is the slim twin of types.AccountSettingsInfo.
type Check ¶
type Check interface {
// contains filtered or unexported methods
}
Check is the slim twin of posture.Check. It is sealed: only the check types in this package implement it.
type ChecksDefinition ¶
type ChecksDefinition struct {
NBVersionCheck *NBVersionCheck
OSVersionCheck *OSVersionCheck
GeoLocationCheck *GeoLocationCheck
PeerNetworkRangeCheck *PeerNetworkRangeCheck
ProcessCheck *ProcessCheck
}
ChecksDefinition is the slim twin of posture.ChecksDefinition.
type CustomZone ¶
type CustomZone struct {
Domain string
Records []SimpleRecord
SearchDomainDisabled bool
NonAuthoritative bool
}
CustomZone is the slim twin of dns.CustomZone.
type DNSSettings ¶
type DNSSettings struct {
DisabledManagementGroups []string
}
DNSSettings is the slim twin of types.DNSSettings.
type GeoLocation ¶
GeoLocation is the slim twin of posture.Location.
type GeoLocationCheck ¶
type GeoLocationCheck struct {
Locations []GeoLocation
Action string
}
GeoLocationCheck is the slim twin of posture.GeoLocationCheck.
type MinKernelVersionCheck ¶
type MinKernelVersionCheck struct {
MinKernelVersion string
}
MinKernelVersionCheck is the slim twin of posture.MinKernelVersionCheck.
type MinVersionCheck ¶
type MinVersionCheck struct {
MinVersion string
}
MinVersionCheck is the slim twin of posture.MinVersionCheck.
type NBVersionCheck ¶
type NBVersionCheck struct {
MinVersion string
}
NBVersionCheck is the slim twin of posture.NBVersionCheck.
type NameServer ¶
NameServer is the slim twin of dns.NameServer.
type NameServerGroup ¶
type NameServerGroup struct {
ID string
PublicID string
Name string
Description string
NameServers []NameServer
Groups []string
Primary bool
Domains []string
Enabled bool
SearchDomainsEnabled bool
}
NameServerGroup is the slim twin of dns.NameServerGroup.
type NetworkAddress ¶
NetworkAddress is the slim twin of peer.NetworkAddress.
type NetworkResource ¶
type NetworkResource struct {
ID string
NetworkID string
AccountID string
PublicID string
Name string
Description string
Type string
Address string // TODO: isn't persisted in the DB
Domain string
Prefix netip.Prefix
Enabled bool
}
NetworkResource is the slim twin of resources/types.NetworkResource.
type NetworkRouter ¶
type NetworkRouter struct {
PublicID string
PeerGroups []string
Masquerade bool
Metric int
Enabled bool
}
NetworkRouter is the slim twin of routers/types.NetworkRouter.
type OSVersionCheck ¶
type OSVersionCheck struct {
Android *MinVersionCheck
Darwin *MinVersionCheck
Ios *MinVersionCheck
Linux *MinKernelVersionCheck
Windows *MinKernelVersionCheck
}
OSVersionCheck is the slim twin of posture.OSVersionCheck.
type Peer ¶
type Peer struct {
ID string
Key string
SSHKey string
DNSLabel string
UserID string
SSHEnabled bool
LoginExpirationEnabled bool
LastLogin *time.Time
IP netip.Addr
IPv6 netip.Addr
RequiresApproval bool
Connected bool
ExtraDNSLabels []string
Meta PeerSystemMeta
ProxyMeta ProxyMeta
Location PeerLocation
}
Peer is the slim twin of peer.Peer.
func (*Peer) AddedWithSSOLogin ¶
func (*Peer) GetLastLogin ¶
func (*Peer) HasCapability ¶
func (*Peer) LoginExpired ¶
func (*Peer) SessionExpiresAt ¶
SessionExpiresAt mirrors peer.Peer.SessionExpiresAt.
func (*Peer) SupportsIPv6 ¶
func (*Peer) SupportsSourcePrefixes ¶
type PeerLocation ¶
PeerLocation is the slim twin of peer.Location.
type PeerNetworkRangeCheck ¶
PeerNetworkRangeCheck is the slim twin of posture.PeerNetworkRangeCheck.
type PeerSystemMeta ¶
type PeerSystemMeta struct {
WtVersion string
GoOS string
OSVersion string
KernelVersion string
NetworkAddresses []NetworkAddress
Files []File
Capabilities []int32
Flags Flags
SyncMessageVersion int
}
PeerSystemMeta is the slim twin of peer.PeerSystemMeta.
type Policy ¶
type Policy struct {
ID string
PublicID string
Enabled bool
SourcePostureChecks []string
Rules []*PolicyRule
}
Policy is the slim twin of types.Policy.
func (*Policy) SourceGroups ¶
type PolicyRule ¶
type PolicyRule struct {
ID string
PolicyID string
Enabled bool
Action string
Protocol string
Bidirectional bool
Sources []string
Destinations []string
SourceResource Resource
DestinationResource Resource
Ports []string
PortRanges []RulePortRange
AuthorizedGroups map[string][]string
AuthorizedUser string
}
PolicyRule is the slim twin of types.PolicyRule.
type PostureChecks ¶
type PostureChecks struct {
ID string
Checks ChecksDefinition
}
PostureChecks is the slim twin of posture.Checks.
func (*PostureChecks) GetChecks ¶
func (pc *PostureChecks) GetChecks() []Check
GetChecks returns the initialized checks in the same order as posture.Checks.GetChecks.
func (*PostureChecks) Passes ¶
func (pc *PostureChecks) Passes(peer *Peer) bool
Passes reports whether the peer satisfies every check in this bundle. It mirrors the server posture path: a check returning (false, _) — including on an evaluation error — fails the bundle.
type ProcessCheck ¶
type ProcessCheck struct {
Processes []Process
}
ProcessCheck is the slim twin of posture.ProcessCheck.
type ProxyDomain ¶
ProxyDomain is the slim twin of a registered reverse-proxy domain, carrying what private-service zone resolution needs: the apex a service domain can sit under, and the cluster it is registered against.
type Route ¶
type Route struct {
ID string
AccountID string
PublicID string
Network netip.Prefix
Domains domain.List
KeepRoute bool
NetID string
Description string
Peer string
PeerID string
PeerGroups []string
NetworkType int
Masquerade bool
Metric int
Enabled bool
Groups []string
AccessControlGroups []string
SkipAutoApply bool
}
Route is the slim twin of route.Route.
func (*Route) GetHAUniqueID ¶
func (*Route) GetResourceID ¶
type RulePortRange ¶
RulePortRange is the slim twin of types.RulePortRange.
type Service ¶
type Service struct {
ID string
Enabled bool
Private bool
Mode string
Domain string
ProxyCluster string
AccessGroups []string
Targets []*ServiceTarget
}
Service is the slim twin of the reverse-proxy service.Service. It carries only the state proxy-policy injection reads: the persisted reverse-proxy services and the in-memory ones synthesised from agent-network state, which are never written to the database.