public/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-07-07 16:40:21 +09:00
Code Issues Packages Projects Releases Wiki Activity

policy: document CanAccessRoute and filterForNodeLocked design

Browse Source 
Add source comments explaining design decisions:

CanAccessRoute (types/node.go): Explain why DestsIsTheInternet is
intentionally absent. Exit routes are handled by RoutesForPeer via
ExitRoutes(), not ACL-based filtering. autogroup:internet is skipped
during filter compilation, so no matchers contain 'the internet'.

Updates #3157
Updates #3169
This commit is contained in:
Kristoffer Dalby
2026-04-04 13:20:45 +00:00
parent 6e3a03ab54
commit 4dedb70818
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hscontrol/types/node.go
+16
View File
@@ -363,6 +363,22 @@ func (node *Node) CanAccess(matchers []matcher.Match, node2 *Node) bool {
return false
}
// CanAccessRoute determines whether a specific route prefix should be
// visible to this node based on the given matchers.
//
// Unlike CanAccess, this function intentionally does NOT check
// DestsIsTheInternet(). Exit routes (0.0.0.0/0, ::/0) are handled by
// RoutesForPeer (state.go) which adds them unconditionally from
// ExitRoutes(), not through ACL-based route filtering. The
// DestsIsTheInternet check in CanAccess exists solely for peer
// visibility determination (should two nodes see each other), which
// is a separate concern from route prefix authorization.
//
// Additionally, autogroup:internet is explicitly skipped during filter
// rule compilation (filter.go), so no matchers ever contain "the
// internet" from internet-targeted ACLs. Wildcard "*" dests produce
// matchers where DestsOverlapsPrefixes(0.0.0.0/0) already returns
// true, so the check would be redundant for that case.
func (node *Node) CanAccessRoute(matchers []matcher.Match, route netip.Prefix) bool {
src := node.IPs()
subnetRoutes := node.SubnetRoutes()