public/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-09-19 14:54:53 +09:00
Code Issues Packages Projects Releases Wiki Activity

policy: document CanAccessRoute and filterForNodeLocked design

Browse Source 
Updates #3157
This commit is contained in:
Kristoffer Dalby
2026-04-04 13:20:45 +00:00
parent f55d6c3cb0
commit 8201be9b4b
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hscontrol/types/node.go
+16
View File
@@ -363,6 +363,22 @@ func (node *Node) CanAccess(matchers []matcher.Match, node2 *Node) bool {
return false return false
} }
// CanAccessRoute determines whether a specific route prefix should be
// visible to this node based on the given matchers.
//
// Unlike CanAccess, this function intentionally does NOT check
// DestsIsTheInternet(). Exit routes (0.0.0.0/0, ::/0) are handled by
// RoutesForPeer (state.go) which adds them unconditionally from
// ExitRoutes(), not through ACL-based route filtering. The
// DestsIsTheInternet check in CanAccess exists solely for peer
// visibility determination (should two nodes see each other), which
// is a separate concern from route prefix authorization.
//
// Additionally, autogroup:internet is explicitly skipped during filter
// rule compilation (filter.go), so no matchers ever contain "the
// internet" from internet-targeted ACLs. Wildcard "*" dests produce
// matchers where DestsOverlapsPrefixes(0.0.0.0/0) already returns
// true, so the check would be redundant for that case.
func (node *Node) CanAccessRoute(matchers []matcher.Match, route netip.Prefix) bool { func (node *Node) CanAccessRoute(matchers []matcher.Match, route netip.Prefix) bool {
src := node.IPs() src := node.IPs()
subnetRoutes := node.SubnetRoutes() subnetRoutes := node.SubnetRoutes()