Documentation
¶
Overview ¶
Package policy parses the mesh access-control policy and compiles it into packet-filter rules and peer visibility for each node.
A policy is HuJSON (JSON with comments and trailing commas):
{
"hosts": {"office": "10.1.0.0/24"},
"acls": [
// Developers may SSH to servers and reach the office LAN.
{"action": "accept", "src": ["tag:dev"], "dst": ["tag:server:22", "office:*"]},
],
"autoApprovers": {"routes": {"10.1.0.0/24": ["tag:router"]}, "exitNode": ["tag:exit"]},
"tests": [{"src": "tag:dev", "accept": ["tag:server:22"], "deny": ["tag:server:80"]}],
}
Selectors name traffic sources and destinations: "*" (anything), "tag:<name>" (nodes with that tag), a node name, a host alias from "hosts", or an IP address or CIDR prefix. Destinations add ports: "<selector>:<ports>" where ports is "*", a port, a range "8000-8999" or a comma-separated list of those. Anything not accepted by a rule is denied.
Index ¶
Constants ¶
const Default = `` /* 564-byte string literal not displayed */
Default is the policy of a new coordinator: every node may reach every other node (and every approved route) on any port.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type ACL ¶
type ACL struct {
Action string `json:"action"`
Src []string `json:"src"`
Dst []string `json:"dst"`
// Proto restricts the rule to "tcp", "udp" or "icmp"; empty means any.
Proto string `json:"proto,omitempty"`
}
ACL is one rule as written.
type AutoApprovers ¶
type AutoApprovers struct {
// Routes maps a prefix to the nodes that may advertise it or any prefix
// inside it.
Routes map[string][]string `json:"routes,omitempty"`
// ExitNode lists nodes that may become exit nodes.
ExitNode []string `json:"exitNode,omitempty"`
}
AutoApprovers names nodes whose advertised routes need no admin approval.
type Compiled ¶
type Compiled struct {
// contains filtered or unexported fields
}
Compiled is a policy resolved against the current set of nodes.
func (*Compiled) Allowed ¶
Allowed reports whether a packet from src to dst would be admitted by the destination, returning the index of the first matching ACL.
func (*Compiled) CanReach ¶
CanReach reports whether some rule lets node from send anything to node to (its address or its routes).
func (*Compiled) FilterFor ¶
FilterFor returns the rules node n enforces on inbound traffic: those with a destination n delivers, narrowed to what n delivers.
type Node ¶
type Node struct {
Name string
IP netip.Addr
Tags []string
// Routes are the node's approved subnet routes (0.0.0.0/0 for an exit
// node).
Routes []netip.Prefix
}
Node is what the policy needs to know about a mesh member.
type Policy ¶
type Policy struct {
Hosts map[string]string `json:"hosts,omitempty"`
ACLs []ACL `json:"acls"`
AutoApprovers AutoApprovers `json:"autoApprovers,omitzero"`
Tests []Test `json:"tests,omitempty"`
// contains filtered or unexported fields
}
Policy is a parsed policy document.
func (*Policy) AutoApproved ¶
AutoApproved returns the subset of advertised routes node n may use without an administrator's approval.
Source Files