mirror of
https://github.com/juanfont/headscale.git
synced 2026-09-14 04:22:01 +09:00
Simon Law
3aece65014
PR tailscale/tailscale#20646 changed the representation of DERP region
IDs from plain ints to a tailcfg.DERPRegionID type. This patch
requires that version of the tailscale.com library and updates our
code to also use the new type.
Updates: tailscale/tailscale#20165
(cherry picked from commit 79695ab51b)
62 lines
2.0 KiB
Go
62 lines
2.0 KiB
Go
package zlog
|
|
|
|
import (
|
|
"github.com/juanfont/headscale/hscontrol/util/zlog/zf"
|
|
"github.com/rs/zerolog"
|
|
"tailscale.com/tailcfg"
|
|
)
|
|
|
|
// SafeHostinfo wraps [tailcfg.Hostinfo] for safe logging.
|
|
//
|
|
// SECURITY: This wrapper intentionally redacts device fingerprinting data
|
|
// that could be used to identify or track specific devices:
|
|
// - OSVersion, DeviceModel, DistroName, DistroVersion (device fingerprinting)
|
|
// - IPNVersion (client version fingerprinting)
|
|
// - Machine, FrontendLogID (device identifiers)
|
|
//
|
|
// Only safe fields are logged:
|
|
// - hostname: The device hostname
|
|
// - os: The OS family (e.g., "linux", "windows") without version
|
|
// - routable_ips_count: Number of advertised routes (not the actual routes)
|
|
// - request_tags: Tags requested by the client
|
|
// - derp: Preferred DERP region ID
|
|
type SafeHostinfo struct {
|
|
hi *tailcfg.Hostinfo
|
|
}
|
|
|
|
// Hostinfo creates a [SafeHostinfo] wrapper for safe logging.
|
|
func Hostinfo(hi *tailcfg.Hostinfo) SafeHostinfo {
|
|
return SafeHostinfo{hi: hi}
|
|
}
|
|
|
|
// MarshalZerologObject implements [zerolog.LogObjectMarshaler].
|
|
func (s SafeHostinfo) MarshalZerologObject(e *zerolog.Event) {
|
|
if s.hi == nil {
|
|
return
|
|
}
|
|
|
|
// Safe fields only - no device fingerprinting data.
|
|
e.Str(zf.Hostname, s.hi.Hostname)
|
|
e.Str(zf.OS, s.hi.OS) // OS family only, NOT version
|
|
|
|
if len(s.hi.RoutableIPs) > 0 {
|
|
e.Int(zf.RoutableIPCount, len(s.hi.RoutableIPs))
|
|
}
|
|
|
|
if len(s.hi.RequestTags) > 0 {
|
|
e.Strs(zf.RequestTags, s.hi.RequestTags)
|
|
}
|
|
|
|
if s.hi.NetInfo != nil && s.hi.NetInfo.PreferredDERP != 0 {
|
|
e.Int64(zf.DERP, s.hi.NetInfo.PreferredDERP.Int64())
|
|
}
|
|
|
|
// SECURITY: The following fields are intentionally NOT logged:
|
|
// - OSVersion, DistroName, DistroVersion, DistroCodeName: device fingerprinting
|
|
// - DeviceModel: device fingerprinting
|
|
// - IPNVersion: client version fingerprinting
|
|
// - Machine, FrontendLogID: device identifiers
|
|
// - GoArch, GoArchVar, GoVersion: build environment fingerprinting
|
|
// - Userspace, UserspaceRouter: network configuration details
|
|
}
|