personal_interest_mirrors/nebula
1
0
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2025-11-09 04:03:58 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix "any" firewall rules for unsafe_routes (#1099)

Browse Source
This commit is contained in:
John Maguire 2024-03-28 16:17:12 -04:00 committed by GitHub
parent f8fb9759e9
commit 8b68a08723
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
firewall.go
View File

@ -876,13 +876,15 @@ func (fr *FirewallRule) match(p firewall.Packet, c *cert.NebulaCertificate) bool
} }
func (flc *firewallLocalCIDR) addRule(f *Firewall, localIp *net.IPNet) error { func (flc *firewallLocalCIDR) addRule(f *Firewall, localIp *net.IPNet) error {
if localIp == nil || (localIp != nil && localIp.Contains(net.IPv4(0, 0, 0, 0))) { if localIp == nil {
if !f.hasSubnets || f.defaultLocalCIDRAny { if !f.hasSubnets || f.defaultLocalCIDRAny {
flc.Any = true flc.Any = true
return nil return nil
} }
localIp = f.assignedCIDR localIp = f.assignedCIDR
} else if localIp.Contains(net.IPv4(0, 0, 0, 0)) {
flc.Any = true
} }
flc.LocalCIDR.AddCIDR(localIp, struct{}{}) flc.LocalCIDR.AddCIDR(localIp, struct{}{})