2021-02-27 16:58:09 -07:00
|
|
|
package headscale
|
|
|
|
|
|
|
|
import (
|
2021-06-24 07:44:19 -06:00
|
|
|
"errors"
|
2022-02-22 04:45:50 -07:00
|
|
|
"fmt"
|
|
|
|
"regexp"
|
2021-11-04 16:15:17 -06:00
|
|
|
"strconv"
|
2022-02-22 04:45:50 -07:00
|
|
|
"strings"
|
2021-02-27 16:58:09 -07:00
|
|
|
"time"
|
|
|
|
|
2021-11-04 16:15:17 -06:00
|
|
|
v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
|
2021-08-05 11:23:02 -06:00
|
|
|
"github.com/rs/zerolog/log"
|
2021-11-04 16:15:17 -06:00
|
|
|
"google.golang.org/protobuf/types/known/timestamppb"
|
2021-06-24 07:44:19 -06:00
|
|
|
"gorm.io/gorm"
|
2021-02-27 16:58:09 -07:00
|
|
|
"tailscale.com/tailcfg"
|
|
|
|
)
|
|
|
|
|
2021-11-04 16:15:17 -06:00
|
|
|
const (
|
2021-11-15 09:33:16 -07:00
|
|
|
errNamespaceExists = Error("Namespace already exists")
|
|
|
|
errNamespaceNotFound = Error("Namespace not found")
|
|
|
|
errNamespaceNotEmptyOfNodes = Error("Namespace not empty: node(s) found")
|
2022-02-22 04:45:50 -07:00
|
|
|
errInvalidNamespaceName = Error("Invalid namespace name")
|
2021-11-04 16:15:17 -06:00
|
|
|
)
|
2021-05-09 09:12:05 -06:00
|
|
|
|
2022-02-22 13:05:39 -07:00
|
|
|
const (
|
|
|
|
// value related to RFC 1123 and 952.
|
|
|
|
labelHostnameLength = 63
|
|
|
|
)
|
|
|
|
|
2022-02-23 03:07:24 -07:00
|
|
|
var invalidCharsInNamespaceRegex = regexp.MustCompile("[^a-z0-9-.]+")
|
2022-02-22 04:45:50 -07:00
|
|
|
|
2021-02-27 16:58:09 -07:00
|
|
|
// Namespace is the way Headscale implements the concept of users in Tailscale
|
|
|
|
//
|
|
|
|
// At the end of the day, users in Tailscale are some kind of 'bubbles' or namespaces
|
|
|
|
// that contain our machines.
|
|
|
|
type Namespace struct {
|
|
|
|
gorm.Model
|
|
|
|
Name string `gorm:"unique"`
|
|
|
|
}
|
|
|
|
|
|
|
|
// CreateNamespace creates a new Namespace. Returns error if could not be created
|
2021-11-13 01:39:04 -07:00
|
|
|
// or another namespace already exists.
|
2021-02-27 16:58:09 -07:00
|
|
|
func (h *Headscale) CreateNamespace(name string) (*Namespace, error) {
|
2022-03-07 14:55:54 -07:00
|
|
|
err := CheckForFQDNRules(name)
|
2022-02-22 04:45:50 -07:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2022-02-23 03:13:37 -07:00
|
|
|
namespace := Namespace{}
|
2021-11-14 12:32:03 -07:00
|
|
|
if err := h.db.Where("name = ?", name).First(&namespace).Error; err == nil {
|
2021-11-15 09:33:16 -07:00
|
|
|
return nil, errNamespaceExists
|
2021-02-27 16:58:09 -07:00
|
|
|
}
|
2021-11-14 12:32:03 -07:00
|
|
|
namespace.Name = name
|
|
|
|
if err := h.db.Create(&namespace).Error; err != nil {
|
2021-08-05 11:23:02 -06:00
|
|
|
log.Error().
|
2021-08-05 13:57:47 -06:00
|
|
|
Str("func", "CreateNamespace").
|
2021-08-05 11:23:02 -06:00
|
|
|
Err(err).
|
|
|
|
Msg("Could not create row")
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-02-27 16:58:09 -07:00
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
return &namespace, nil
|
2021-02-27 16:58:09 -07:00
|
|
|
}
|
|
|
|
|
2021-05-09 09:12:05 -06:00
|
|
|
// DestroyNamespace destroys a Namespace. Returns error if the Namespace does
|
|
|
|
// not exist or if there are machines associated with it.
|
|
|
|
func (h *Headscale) DestroyNamespace(name string) error {
|
2021-11-14 12:32:03 -07:00
|
|
|
namespace, err := h.GetNamespace(name)
|
2021-05-09 09:12:05 -06:00
|
|
|
if err != nil {
|
2021-11-15 09:33:16 -07:00
|
|
|
return errNamespaceNotFound
|
2021-05-09 09:12:05 -06:00
|
|
|
}
|
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
machines, err := h.ListMachinesInNamespace(name)
|
2021-05-09 09:12:05 -06:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-11-14 12:32:03 -07:00
|
|
|
if len(machines) > 0 {
|
2021-11-15 09:33:16 -07:00
|
|
|
return errNamespaceNotEmptyOfNodes
|
2021-11-13 12:01:05 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
keys, err := h.ListPreAuthKeys(name)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-11-14 12:32:03 -07:00
|
|
|
for _, key := range keys {
|
2021-11-15 11:31:52 -07:00
|
|
|
err = h.DestroyPreAuthKey(key)
|
2021-11-13 13:24:32 -07:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-05-09 09:12:05 -06:00
|
|
|
}
|
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
if result := h.db.Unscoped().Delete(&namespace); result.Error != nil {
|
2021-10-16 09:14:37 -06:00
|
|
|
return result.Error
|
2021-05-09 09:12:05 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-10-16 09:20:06 -06:00
|
|
|
// RenameNamespace renames a Namespace. Returns error if the Namespace does
|
|
|
|
// not exist or if another Namespace exists with the new name.
|
|
|
|
func (h *Headscale) RenameNamespace(oldName, newName string) error {
|
2022-02-22 04:45:50 -07:00
|
|
|
var err error
|
2021-11-14 12:32:03 -07:00
|
|
|
oldNamespace, err := h.GetNamespace(oldName)
|
2021-10-16 09:20:06 -06:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2022-03-07 14:55:54 -07:00
|
|
|
err = CheckForFQDNRules(newName)
|
2022-02-22 04:45:50 -07:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-10-16 09:20:06 -06:00
|
|
|
_, err = h.GetNamespace(newName)
|
|
|
|
if err == nil {
|
2021-11-15 09:33:16 -07:00
|
|
|
return errNamespaceExists
|
2021-10-16 09:20:06 -06:00
|
|
|
}
|
2021-11-15 09:33:16 -07:00
|
|
|
if !errors.Is(err, errNamespaceNotFound) {
|
2021-10-16 09:20:06 -06:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
oldNamespace.Name = newName
|
2021-10-16 09:20:06 -06:00
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
if result := h.db.Save(&oldNamespace); result.Error != nil {
|
2021-10-16 09:20:06 -06:00
|
|
|
return result.Error
|
|
|
|
}
|
|
|
|
|
2021-05-09 09:12:05 -06:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-11-13 01:39:04 -07:00
|
|
|
// GetNamespace fetches a namespace by name.
|
2021-02-27 16:58:09 -07:00
|
|
|
func (h *Headscale) GetNamespace(name string) (*Namespace, error) {
|
2022-02-23 03:13:37 -07:00
|
|
|
namespace := Namespace{}
|
2021-11-14 12:32:03 -07:00
|
|
|
if result := h.db.First(&namespace, "name = ?", name); errors.Is(
|
2021-11-13 01:36:45 -07:00
|
|
|
result.Error,
|
|
|
|
gorm.ErrRecordNotFound,
|
|
|
|
) {
|
2021-11-15 09:33:16 -07:00
|
|
|
return nil, errNamespaceNotFound
|
2021-02-27 16:58:09 -07:00
|
|
|
}
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
return &namespace, nil
|
2021-02-27 16:58:09 -07:00
|
|
|
}
|
|
|
|
|
2021-11-13 01:39:04 -07:00
|
|
|
// ListNamespaces gets all the existing namespaces.
|
2021-11-04 16:15:17 -06:00
|
|
|
func (h *Headscale) ListNamespaces() ([]Namespace, error) {
|
2021-02-27 16:58:09 -07:00
|
|
|
namespaces := []Namespace{}
|
2021-07-04 13:40:46 -06:00
|
|
|
if err := h.db.Find(&namespaces).Error; err != nil {
|
2021-02-27 16:58:09 -07:00
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-11-04 16:15:17 -06:00
|
|
|
return namespaces, nil
|
2021-02-27 16:58:09 -07:00
|
|
|
}
|
|
|
|
|
2021-11-13 01:39:04 -07:00
|
|
|
// ListMachinesInNamespace gets all the nodes in a given namespace.
|
2021-11-04 16:15:17 -06:00
|
|
|
func (h *Headscale) ListMachinesInNamespace(name string) ([]Machine, error) {
|
2022-03-07 14:55:54 -07:00
|
|
|
err := CheckForFQDNRules(name)
|
2022-02-22 04:45:50 -07:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-14 12:32:03 -07:00
|
|
|
namespace, err := h.GetNamespace(name)
|
2021-02-27 16:58:09 -07:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
machines := []Machine{}
|
2021-11-14 12:32:03 -07:00
|
|
|
if err := h.db.Preload("AuthKey").Preload("AuthKey.Namespace").Preload("Namespace").Where(&Machine{NamespaceID: namespace.ID}).Find(&machines).Error; err != nil {
|
2021-02-27 16:58:09 -07:00
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-11-04 16:15:17 -06:00
|
|
|
return machines, nil
|
2021-02-27 16:58:09 -07:00
|
|
|
}
|
|
|
|
|
2021-11-13 01:39:04 -07:00
|
|
|
// SetMachineNamespace assigns a Machine to a namespace.
|
2021-11-14 12:32:03 -07:00
|
|
|
func (h *Headscale) SetMachineNamespace(machine *Machine, namespaceName string) error {
|
2022-03-07 14:55:54 -07:00
|
|
|
err := CheckForFQDNRules(namespaceName)
|
2022-02-22 04:45:50 -07:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-11-14 12:32:03 -07:00
|
|
|
namespace, err := h.GetNamespace(namespaceName)
|
2021-02-27 16:58:09 -07:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2021-11-14 12:32:03 -07:00
|
|
|
machine.NamespaceID = namespace.ID
|
|
|
|
h.db.Save(&machine)
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-02-27 16:58:09 -07:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (n *Namespace) toUser() *tailcfg.User {
|
2021-11-14 12:32:03 -07:00
|
|
|
user := tailcfg.User{
|
2021-02-27 16:58:09 -07:00
|
|
|
ID: tailcfg.UserID(n.ID),
|
2021-07-11 08:39:19 -06:00
|
|
|
LoginName: n.Name,
|
2021-02-27 16:58:09 -07:00
|
|
|
DisplayName: n.Name,
|
|
|
|
ProfilePicURL: "",
|
2021-07-11 08:39:19 -06:00
|
|
|
Domain: "headscale.net",
|
2021-02-27 16:58:09 -07:00
|
|
|
Logins: []tailcfg.LoginID{},
|
|
|
|
Created: time.Time{},
|
|
|
|
}
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
return &user
|
2021-02-27 16:58:09 -07:00
|
|
|
}
|
2021-10-15 09:09:55 -06:00
|
|
|
|
|
|
|
func (n *Namespace) toLogin() *tailcfg.Login {
|
2021-11-14 12:32:03 -07:00
|
|
|
login := tailcfg.Login{
|
2021-10-15 09:09:55 -06:00
|
|
|
ID: tailcfg.LoginID(n.ID),
|
|
|
|
LoginName: n.Name,
|
|
|
|
DisplayName: n.Name,
|
|
|
|
ProfilePicURL: "",
|
|
|
|
Domain: "headscale.net",
|
|
|
|
}
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
return &login
|
2021-10-15 09:09:55 -06:00
|
|
|
}
|
2021-10-19 08:26:18 -06:00
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
func getMapResponseUserProfiles(machine Machine, peers Machines) []tailcfg.UserProfile {
|
2021-10-17 15:58:09 -06:00
|
|
|
namespaceMap := make(map[string]Namespace)
|
2021-11-14 12:32:03 -07:00
|
|
|
namespaceMap[machine.Namespace.Name] = machine.Namespace
|
|
|
|
for _, peer := range peers {
|
|
|
|
namespaceMap[peer.Namespace.Name] = peer.Namespace // not worth checking if already is there
|
2021-10-17 15:58:09 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
profiles := []tailcfg.UserProfile{}
|
|
|
|
for _, namespace := range namespaceMap {
|
|
|
|
profiles = append(profiles,
|
|
|
|
tailcfg.UserProfile{
|
|
|
|
ID: tailcfg.UserID(namespace.ID),
|
|
|
|
LoginName: namespace.Name,
|
|
|
|
DisplayName: namespace.Name,
|
|
|
|
})
|
|
|
|
}
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-10-17 15:58:09 -06:00
|
|
|
return profiles
|
|
|
|
}
|
2021-11-04 16:15:17 -06:00
|
|
|
|
|
|
|
func (n *Namespace) toProto() *v1.Namespace {
|
|
|
|
return &v1.Namespace{
|
2021-11-15 10:24:24 -07:00
|
|
|
Id: strconv.FormatUint(uint64(n.ID), Base10),
|
2021-11-04 16:15:17 -06:00
|
|
|
Name: n.Name,
|
|
|
|
CreatedAt: timestamppb.New(n.CreatedAt),
|
|
|
|
}
|
|
|
|
}
|
2022-02-22 04:45:50 -07:00
|
|
|
|
2022-03-07 14:55:54 -07:00
|
|
|
// NormalizeToFQDNRules will replace forbidden chars in namespace
|
2022-02-22 13:05:39 -07:00
|
|
|
// it can also return an error if the namespace doesn't respect RFC 952 and 1123.
|
2022-03-07 14:55:54 -07:00
|
|
|
func NormalizeToFQDNRules(name string, stripEmailDomain bool) (string, error) {
|
2022-02-22 04:45:50 -07:00
|
|
|
name = strings.ToLower(name)
|
|
|
|
name = strings.ReplaceAll(name, "'", "")
|
2022-02-23 06:28:20 -07:00
|
|
|
atIdx := strings.Index(name, "@")
|
|
|
|
if stripEmailDomain && atIdx > 0 {
|
|
|
|
name = name[:atIdx]
|
2022-02-23 06:03:07 -07:00
|
|
|
} else {
|
|
|
|
name = strings.ReplaceAll(name, "@", ".")
|
|
|
|
}
|
2022-02-23 03:07:24 -07:00
|
|
|
name = invalidCharsInNamespaceRegex.ReplaceAllString(name, "-")
|
2022-02-22 04:45:50 -07:00
|
|
|
|
|
|
|
for _, elt := range strings.Split(name, ".") {
|
2022-02-22 13:05:39 -07:00
|
|
|
if len(elt) > labelHostnameLength {
|
2022-02-22 04:45:50 -07:00
|
|
|
return "", fmt.Errorf(
|
|
|
|
"label %v is more than 63 chars: %w",
|
|
|
|
elt,
|
|
|
|
errInvalidNamespaceName,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return name, nil
|
|
|
|
}
|
2022-02-23 03:07:24 -07:00
|
|
|
|
2022-03-07 14:55:54 -07:00
|
|
|
func CheckForFQDNRules(name string) error {
|
2022-02-23 03:07:24 -07:00
|
|
|
if len(name) > labelHostnameLength {
|
|
|
|
return fmt.Errorf(
|
2022-05-16 12:31:32 -06:00
|
|
|
"DNS segment must not be over 63 chars. %v doesn't comply with this rule: %w",
|
2022-02-23 03:07:24 -07:00
|
|
|
name,
|
|
|
|
errInvalidNamespaceName,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
if strings.ToLower(name) != name {
|
|
|
|
return fmt.Errorf(
|
2022-05-16 12:31:32 -06:00
|
|
|
"DNS segment should be lowercase. %v doesn't comply with this rule: %w",
|
2022-02-23 03:07:24 -07:00
|
|
|
name,
|
|
|
|
errInvalidNamespaceName,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
if invalidCharsInNamespaceRegex.MatchString(name) {
|
|
|
|
return fmt.Errorf(
|
2022-05-16 12:31:32 -06:00
|
|
|
"DNS segment should only be composed of lowercase ASCII letters numbers, hyphen and dots. %v doesn't comply with theses rules: %w",
|
2022-02-23 03:07:24 -07:00
|
|
|
name,
|
|
|
|
errInvalidNamespaceName,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|