ab/amnezia-fellow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed group scope
Build and Publish / Build and Publish Docker Image (push) Canceled after 2m2s
Details

Browse Source
This commit is contained in:
Ultradesu
2026-07-30 23:27:34 +01:00
parent 9614ff8a60
commit e890d1c147
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -65,7 +65,7 @@ The database stores all client data needed to restore configs:
- created/updated timestamps - created/updated timestamps
The Kubernetes Secret is derived from the database. Active clients are rendered The Kubernetes Secret is derived from the database. Active clients are rendered
into `peers.conf`; exact same-owner/same-group IPv4 pairs are rendered into into `peers.conf`; exact same-group IPv4 pairs are rendered into
`policy.conf`. Clients without a group are isolated from other VPN clients. `policy.conf`. Clients without a group are isolated from other VPN clients.
## Kubernetes Sync ## Kubernetes Sync
src/vpn.rs
+6 -4
View File
@@ -242,7 +242,7 @@ pub fn render_peer_secret(clients: &[VpnClient]) -> String {
pub fn render_client_policy(clients: &[VpnClient], cidr: &str) -> Result<String, String> { pub fn render_client_policy(clients: &[VpnClient], cidr: &str) -> Result<String, String> {
parse_ipv4_cidr(cidr)?; parse_ipv4_cidr(cidr)?;
let mut groups = BTreeMap::<(i64, String), Vec<Ipv4Addr>>::new(); let mut groups = BTreeMap::<String, Vec<Ipv4Addr>>::new();
for client in clients.iter().filter(|client| client.enabled()) { for client in clients.iter().filter(|client| client.enabled()) {
let Some(group_name) = client.group_name_str() else { let Some(group_name) = client.group_name_str() else {
continue; continue;
@@ -262,7 +262,7 @@ pub fn render_client_policy(clients: &[VpnClient], cidr: &str) -> Result<String,
)); ));
} }
groups groups
.entry((client.owner_user_id(), group_name.to_owned())) .entry(group_name.to_owned())
.or_default() .or_default()
.push(address); .push(address);
} }
@@ -1257,7 +1257,7 @@ mod tests {
} }
#[test] #[test]
fn client_policy_allows_only_exact_pairs_with_same_owner_and_group() { fn client_policy_allows_only_exact_pairs_with_same_group() {
let clients = vec![ let clients = vec![
test_client(1, 10, "10.8.0.2", Some("home")), test_client(1, 10, "10.8.0.2", Some("home")),
test_client(2, 10, "10.8.0.3", Some("home")), test_client(2, 10, "10.8.0.3", Some("home")),
@@ -1269,9 +1269,11 @@ mod tests {
let policy = render_client_policy(&clients, "10.8.0.0/16").unwrap(); let policy = render_client_policy(&clients, "10.8.0.0/16").unwrap();
assert!(policy.contains("10.8.0.2/32 10.8.0.3/32\n")); assert!(policy.contains("10.8.0.2/32 10.8.0.3/32\n"));
assert!(policy.contains("10.8.0.3/32 10.8.0.2/32\n")); assert!(policy.contains("10.8.0.3/32 10.8.0.2/32\n"));
assert!(policy.contains("10.8.0.2/32 10.8.0.5/32\n"));
assert!(policy.contains("10.8.0.5/32 10.8.0.2/32\n"));
assert_eq!( assert_eq!(
policy.lines().filter(|line| !line.starts_with('#')).count(), policy.lines().filter(|line| !line.starts_with('#')).count(),
2 6
); );
} }