Skip to content

Commit 7445823

Browse files
wadeywadey
committed
Merge remote-tracking branch 'origin/master' into holepunch-remote-allow-list
2 parents 1170ff1 + f5f6c26 commit 7445823

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+1945
-2691
lines changed

‎allow_list.go

+26-65
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,24 @@ package nebula
22

33
import (
44
"fmt"
5-
"net"
5+
"net/netip"
66
"regexp"
77

8-
"github.com/slackhq/nebula/cidr"
8+
"github.com/gaissmai/bart"
99
"github.com/slackhq/nebula/config"
10-
"github.com/slackhq/nebula/iputil"
1110
)
1211

1312
type AllowList struct {
1413
// The values of this cidrTree are `bool`, signifying allow/deny
15-
cidrTree *cidr.Tree6[bool]
14+
cidrTree *bart.Table[bool]
1615
}
1716

1817
type RemoteAllowList struct {
1918
AllowList *AllowList
2019

2120
// Inside Range Specific, keys of this tree are inside CIDRs and values
2221
// are *AllowList
23-
insideAllowLists *cidr.Tree6[*AllowList]
22+
insideAllowLists *bart.Table[*AllowList]
2423
}
2524

2625
type LocalAllowList struct {
@@ -88,7 +87,7 @@ func newAllowList(k string, raw interface{}, handleKey func(key string, value in
8887
return nil, fmt.Errorf("config `%s` has invalid type: %T", k, raw)
8988
}
9089

91-
tree := cidr.NewTree6[bool]()
90+
tree := new(bart.Table[bool])
9291

9392
// Keep track of the rules we have added for both ipv4 and ipv6
9493
type allowListRules struct {
@@ -122,18 +121,20 @@ func newAllowList(k string, raw interface{}, handleKey func(key string, value in
122121
return nil, fmt.Errorf("config `%s` has invalid value (type %T): %v", k, rawValue, rawValue)
123122
}
124123

125-
_, ipNet, err := net.ParseCIDR(rawCIDR)
124+
ipNet, err := netip.ParsePrefix(rawCIDR)
126125
if err != nil {
127-
return nil, fmt.Errorf("config `%s` has invalid CIDR: %s", k, rawCIDR)
126+
return nil, fmt.Errorf("config `%s` has invalid CIDR: %s. %w", k, rawCIDR, err)
128127
}
129128

129+
ipNet = netip.PrefixFrom(ipNet.Addr().Unmap(), ipNet.Bits())
130+
130131
// TODO: should we error on duplicate CIDRs in the config?
131-
tree.AddCIDR(ipNet, value)
132+
tree.Insert(ipNet, value)
132133

133-
maskBits, maskSize := ipNet.Mask.Size()
134+
maskBits := ipNet.Bits()
134135

135136
var rules *allowListRules
136-
if maskSize == 32 {
137+
if ipNet.Addr().Is4() {
137138
rules = &rules4
138139
} else {
139140
rules = &rules6
@@ -156,17 +157,15 @@ func newAllowList(k string, raw interface{}, handleKey func(key string, value in
156157

157158
if !rules4.defaultSet {
158159
if rules4.allValuesMatch {
159-
_, zeroCIDR, _ := net.ParseCIDR("0.0.0.0/0")
160-
tree.AddCIDR(zeroCIDR, !rules4.allValues)
160+
tree.Insert(netip.PrefixFrom(netip.IPv4Unspecified(), 0), !rules4.allValues)
161161
} else {
162162
return nil, fmt.Errorf("config `%s` contains both true and false rules, but no default set for 0.0.0.0/0", k)
163163
}
164164
}
165165

166166
if !rules6.defaultSet {
167167
if rules6.allValuesMatch {
168-
_, zeroCIDR, _ := net.ParseCIDR("::/0")
169-
tree.AddCIDR(zeroCIDR, !rules6.allValues)
168+
tree.Insert(netip.PrefixFrom(netip.IPv6Unspecified(), 0), !rules6.allValues)
170169
} else {
171170
return nil, fmt.Errorf("config `%s` contains both true and false rules, but no default set for ::/0", k)
172171
}
@@ -218,13 +217,13 @@ func getAllowListInterfaces(k string, v interface{}) ([]AllowListNameRule, error
218217
return nameRules, nil
219218
}
220219

221-
func getRemoteAllowRanges(c *config.C, k string) (*cidr.Tree6[*AllowList], error) {
220+
func getRemoteAllowRanges(c *config.C, k string) (*bart.Table[*AllowList], error) {
222221
value := c.Get(k)
223222
if value == nil {
224223
return nil, nil
225224
}
226225

227-
remoteAllowRanges := cidr.NewTree6[*AllowList]()
226+
remoteAllowRanges := new(bart.Table[*AllowList])
228227

229228
rawMap, ok := value.(map[interface{}]interface{})
230229
if !ok {
@@ -241,45 +240,27 @@ func getRemoteAllowRanges(c *config.C, k string) (*cidr.Tree6[*AllowList], error
241240
return nil, err
242241
}
243242

244-
_, ipNet, err := net.ParseCIDR(rawCIDR)
243+
ipNet, err := netip.ParsePrefix(rawCIDR)
245244
if err != nil {
246-
return nil, fmt.Errorf("config `%s` has invalid CIDR: %s", k, rawCIDR)
245+
return nil, fmt.Errorf("config `%s` has invalid CIDR: %s. %w", k, rawCIDR, err)
247246
}
248247

249-
remoteAllowRanges.AddCIDR(ipNet, allowList)
248+
remoteAllowRanges.Insert(netip.PrefixFrom(ipNet.Addr().Unmap(), ipNet.Bits()), allowList)
250249
}
251250

252251
return remoteAllowRanges, nil
253252
}
254253

255-
func (al *AllowList) Allow(ip net.IP) bool {
256-
if al == nil {
257-
return true
258-
}
259-
260-
_, result := al.cidrTree.MostSpecificContains(ip)
261-
return result
262-
}
263-
264-
func (al *AllowList) AllowIpV4(ip iputil.VpnIp) bool {
265-
if al == nil {
266-
return true
267-
}
268-
269-
_, result := al.cidrTree.MostSpecificContainsIpV4(ip)
270-
return result
271-
}
272-
273-
func (al *AllowList) AllowIpV6(hi, lo uint64) bool {
254+
func (al *AllowList) Allow(ip netip.Addr) bool {
274255
if al == nil {
275256
return true
276257
}
277258

278-
_, result := al.cidrTree.MostSpecificContainsIpV6(hi, lo)
259+
result, _ := al.cidrTree.Lookup(ip)
279260
return result
280261
}
281262

282-
func (al *LocalAllowList) Allow(ip net.IP) bool {
263+
func (al *LocalAllowList) Allow(ip netip.Addr) bool {
283264
if al == nil {
284265
return true
285266
}
@@ -301,43 +282,23 @@ func (al *LocalAllowList) AllowName(name string) bool {
301282
return !al.nameRules[0].Allow
302283
}
303284

304-
func (al *RemoteAllowList) AllowUnknownVpnIp(ip net.IP) bool {
285+
func (al *RemoteAllowList) AllowUnknownVpnIp(ip netip.Addr) bool {
305286
if al == nil {
306287
return true
307288
}
308289
return al.AllowList.Allow(ip)
309290
}
310291

311-
func (al *RemoteAllowList) Allow(vpnIp iputil.VpnIp, ip net.IP) bool {
292+
func (al *RemoteAllowList) Allow(vpnIp netip.Addr, ip netip.Addr) bool {
312293
if !al.getInsideAllowList(vpnIp).Allow(ip) {
313294
return false
314295
}
315296
return al.AllowList.Allow(ip)
316297
}
317298

318-
func (al *RemoteAllowList) AllowIpV4(vpnIp iputil.VpnIp, ip iputil.VpnIp) bool {
319-
if al == nil {
320-
return true
321-
}
322-
if !al.getInsideAllowList(vpnIp).AllowIpV4(ip) {
323-
return false
324-
}
325-
return al.AllowList.AllowIpV4(ip)
326-
}
327-
328-
func (al *RemoteAllowList) AllowIpV6(vpnIp iputil.VpnIp, hi, lo uint64) bool {
329-
if al == nil {
330-
return true
331-
}
332-
if !al.getInsideAllowList(vpnIp).AllowIpV6(hi, lo) {
333-
return false
334-
}
335-
return al.AllowList.AllowIpV6(hi, lo)
336-
}
337-
338-
func (al *RemoteAllowList) getInsideAllowList(vpnIp iputil.VpnIp) *AllowList {
299+
func (al *RemoteAllowList) getInsideAllowList(vpnIp netip.Addr) *AllowList {
339300
if al.insideAllowLists != nil {
340-
ok, inside := al.insideAllowLists.MostSpecificContainsIpV4(vpnIp)
301+
inside, ok := al.insideAllowLists.Lookup(vpnIp)
341302
if ok {
342303
return inside
343304
}

‎allow_list_test.go

+21-21
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
package nebula
22

33
import (
4-
"net"
4+
"net/netip"
55
"regexp"
66
"testing"
77

8-
"github.com/slackhq/nebula/cidr"
8+
"github.com/gaissmai/bart"
99
"github.com/slackhq/nebula/config"
1010
"github.com/slackhq/nebula/test"
1111
"github.com/stretchr/testify/assert"
@@ -18,7 +18,7 @@ func TestNewAllowListFromConfig(t *testing.T) {
1818
"192.168.0.0": true,
1919
}
2020
r, err := newAllowListFromConfig(c, "allowlist", nil)
21-
assert.EqualError(t, err, "config `allowlist` has invalid CIDR: 192.168.0.0")
21+
assert.EqualError(t, err, "config `allowlist` has invalid CIDR: 192.168.0.0. netip.ParsePrefix(\"192.168.0.0\"): no '/'")
2222
assert.Nil(t, r)
2323

2424
c.Settings["allowlist"] = map[interface{}]interface{}{
@@ -98,26 +98,26 @@ func TestNewAllowListFromConfig(t *testing.T) {
9898
}
9999

100100
func TestAllowList_Allow(t *testing.T) {
101-
assert.Equal(t, true, ((*AllowList)(nil)).Allow(net.ParseIP("1.1.1.1")))
102-
103-
tree := cidr.NewTree6[bool]()
104-
tree.AddCIDR(cidr.Parse("0.0.0.0/0"), true)
105-
tree.AddCIDR(cidr.Parse("10.0.0.0/8"), false)
106-
tree.AddCIDR(cidr.Parse("10.42.42.42/32"), true)
107-
tree.AddCIDR(cidr.Parse("10.42.0.0/16"), true)
108-
tree.AddCIDR(cidr.Parse("10.42.42.0/24"), true)
109-
tree.AddCIDR(cidr.Parse("10.42.42.0/24"), false)
110-
tree.AddCIDR(cidr.Parse("::1/128"), true)
111-
tree.AddCIDR(cidr.Parse("::2/128"), false)
101+
assert.Equal(t, true, ((*AllowList)(nil)).Allow(netip.MustParseAddr("1.1.1.1")))
102+
103+
tree := new(bart.Table[bool])
104+
tree.Insert(netip.MustParsePrefix("0.0.0.0/0"), true)
105+
tree.Insert(netip.MustParsePrefix("10.0.0.0/8"), false)
106+
tree.Insert(netip.MustParsePrefix("10.42.42.42/32"), true)
107+
tree.Insert(netip.MustParsePrefix("10.42.0.0/16"), true)
108+
tree.Insert(netip.MustParsePrefix("10.42.42.0/24"), true)
109+
tree.Insert(netip.MustParsePrefix("10.42.42.0/24"), false)
110+
tree.Insert(netip.MustParsePrefix("::1/128"), true)
111+
tree.Insert(netip.MustParsePrefix("::2/128"), false)
112112
al := &AllowList{cidrTree: tree}
113113

114-
assert.Equal(t, true, al.Allow(net.ParseIP("1.1.1.1")))
115-
assert.Equal(t, false, al.Allow(net.ParseIP("10.0.0.4")))
116-
assert.Equal(t, true, al.Allow(net.ParseIP("10.42.42.42")))
117-
assert.Equal(t, false, al.Allow(net.ParseIP("10.42.42.41")))
118-
assert.Equal(t, true, al.Allow(net.ParseIP("10.42.0.1")))
119-
assert.Equal(t, true, al.Allow(net.ParseIP("::1")))
120-
assert.Equal(t, false, al.Allow(net.ParseIP("::2")))
114+
assert.Equal(t, true, al.Allow(netip.MustParseAddr("1.1.1.1")))
115+
assert.Equal(t, false, al.Allow(netip.MustParseAddr("10.0.0.4")))
116+
assert.Equal(t, true, al.Allow(netip.MustParseAddr("10.42.42.42")))
117+
assert.Equal(t, false, al.Allow(netip.MustParseAddr("10.42.42.41")))
118+
assert.Equal(t, true, al.Allow(netip.MustParseAddr("10.42.0.1")))
119+
assert.Equal(t, true, al.Allow(netip.MustParseAddr("::1")))
120+
assert.Equal(t, false, al.Allow(netip.MustParseAddr("::2")))
121121
}
122122

123123
func TestLocalAllowList_AllowName(t *testing.T) {

0 commit comments

Comments
 (0)