starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-04-11 03:27:20 +02:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

policy/v2,state,mapper: implement per-viewer via route steering

Browse Source 
Via grants steer routes to specific nodes per viewer. Until now,
all clients saw the same routes for each peer because route
assembly was viewer-independent. This implements per-viewer route
visibility so that via-designated peers serve routes only to
matching viewers, while non-designated peers have those routes
withdrawn.

Add ViaRouteResult type (Include/Exclude prefix lists) and
ViaRoutesForPeer to the PolicyManager interface. The v2
implementation iterates via grants, resolves sources against the
viewer, matches destinations against the peer's advertised routes
(both subnet and exit), and categorizes prefixes by whether the
peer has the via tag.

Add RoutesForPeer to State which composes global primary election,
via Include/Exclude filtering, exit routes, and ACL reduction.
When no via grants exist, it falls back to existing behavior.

Update the mapper to call RoutesForPeer per-peer instead of using
a single route function for all peers. The route function now
returns all routes (subnet + exit), and TailNode filters exit
routes out of the PrimaryRoutes field for HA tracking.

Updates #2180
This commit is contained in:
Kristoffer Dalby
2026-03-22 20:43:28 +00:00
parent 66ac9a26ff
commit aed573e813
6 changed files with 182 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
hscontrol/types/node.go
View File

@@ -36,9 +36,17 @@ var (
)
// RouteFunc is a function that takes a node ID and returns a list of
// netip.Prefixes representing the primary routes for that node.
// netip.Prefixes representing the routes for that node.
type RouteFunc func(id NodeID) []netip.Prefix
// ViaRouteResult describes via grant effects for a viewer-peer pair.
type ViaRouteResult struct {
// Include contains prefixes this peer should serve to this viewer (via-designated).
Include []netip.Prefix
// Exclude contains prefixes steered to OTHER peers (suppress from global primary).
Exclude []netip.Prefix
}
type (
NodeID uint64
NodeIDs []NodeID
@@ -1106,10 +1114,20 @@ func (nv NodeView) TailNode(
keyExpiry = nv.Expiry().Get()
}
primaryRoutes := primaryRouteFunc(nv.ID())
allowedIPs := slices.Concat(nv.Prefixes(), primaryRoutes, nv.ExitRoutes())
// routeFunc returns ALL routes (subnet + exit) for this node.
allRoutes := primaryRouteFunc(nv.ID())
allowedIPs := slices.Concat(nv.Prefixes(), allRoutes)
slices.SortFunc(allowedIPs, netip.Prefix.Compare)
// PrimaryRoutes only includes non-exit subnet routes for HA tracking.
var primaryRoutes []netip.Prefix
for _, r := range allRoutes {
if !tsaddr.IsExitRoute(r) {
primaryRoutes = append(primaryRoutes, r)
}
}
capMap := tailcfg.NodeCapMap{
tailcfg.CapabilityAdmin: []tailcfg.RawMessage{},
tailcfg.CapabilitySSH: []tailcfg.RawMessage{},