10 Commits

Include renames

Author	SHA1	Message	Date
Wade Simmons	879852c32a	upgrade to yaml.v3 (#1148) ... * upgrade to yaml.v3 The main nice fix here is that maps unmarshal into `map[string]any` instead of `map[any]any`, so it cleans things up a bit. * add config.AsBool Since yaml.v3 doesn't automatically convert yes to bool now, for backwards compat * use type aliases for m * more cleanup * more cleanup * more cleanup * go mod cleanup	2025-03-31 16:08:34 -04:00
Caleb Jasik	088af8edb2	Enable running testifylint in CI (#1350)	2025-03-10 17:38:14 -05:00
Caleb Jasik	612637f529	Fix testifylint lint errors (#1321) ... * Fix bool-compare * Fix empty * Fix encoded-compare * Fix error-is-as * Fix error-nil * Fix expected-actual * Fix len	2025-03-10 10:18:34 -04:00
Nate Brown	e264a0ff88	Switch most everything to netip in prep for ipv6 in the overlay (#1173)	2024-07-31 10:18:56 -05:00
Nate Brown	5181cb0474	Use generics for CIDRTrees to avoid casting issues (#1004)	2023-11-02 17:05:08 -05:00
Nate Brown	4453964e34	Move util to test, contextual errors to util (#575)	2021-11-10 21:47:38 -06:00
Nate Brown	bcabcfdaca	Rework some things into packages (#489)	2021-11-03 20:54:04 -05:00
Wade Simmons	ea2c186a77	remote_allow_ranges: allow inside CIDR specific remote_allow_lists (#540) ... This allows you to configure remote allow lists specific to different subnets of the inside CIDR. Example: remote_allow_ranges: 10.42.42.0/24: 192.168.0.0/16: true This would only allow hosts with a VPN IP in the 10.42.42.0/24 range to have private IPs (and thus don't connect over public IPs). The PR also refactors AllowList into RemoteAllowList and LocalAllowList to make it clearer which methods are allowed on which allow list.	2021-10-19 10:54:30 -04:00
Nathan Brown	7073d204a8	IPv6 support for outside (udp) (#369)	2021-03-18 20:37:24 -05:00
Wade Simmons	0a474e757b	Add lighthouse.{remoteAllowList,localAllowList} (#217) ... These settings make it possible to blacklist / whitelist IP addresses that are used for remote connections. `lighthouse.remoteAllowList` filters which remote IPs are allow when fetching from the lighthouse (or, if you are the lighthouse, which IPs you store and forward to querying hosts). By default, any remote IPs are allowed. You can provide CIDRs here with `true` to allow and `false` to deny. The most specific CIDR rule applies to each remote. If all rules are "allow", the default will be "deny", and vice-versa. If both "allow" and "deny" rules are present, then you MUST set a rule for "0.0.0.0/0" as the default. lighthouse: remoteAllowList: # Example to block IPs from this subnet from being used for remote IPs. "172.16.0.0/12": false # A more complicated example, allow public IPs but only private IPs from a specific subnet "0.0.0.0/0": true "10.0.0.0/8": false "10.42.42.0/24": true `lighthouse.localAllowList` has the same logic as above, but it applies to the local addresses we advertise to the lighthouse. Additionally, you can specify an `interfaces` map of regular expressions to match against interface names. The regexp must match the entire name. All interface rules must be either true or false (and the default rule will be the inverse). CIDR rules are matched after interface name rules. Default is all local IP addresses. lighthouse: localAllowList: # Example to blacklist docker interfaces. interfaces: 'docker.*': false # Example to only advertise IPs in this subnet to the lighthouse. "10.0.0.0/8": true	2020-04-08 15:36:43 -04:00