mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-14 18:59:08 +02:00
71 lines
2.1 KiB
Go
71 lines
2.1 KiB
Go
//go:build !ios && !android
|
|
|
|
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
"slices"
|
|
"strings"
|
|
)
|
|
|
|
// Principal kinds an --allow-group value resolves to. The kind:value form is
|
|
// the same one profile owners use, so a value in service.json or in a service
|
|
// unit says which namespace it belongs to instead of being a bare number that
|
|
// means one thing on Unix and another on Windows.
|
|
const (
|
|
allowGroupKindGID = "gid"
|
|
allowGroupKindSID = "sid"
|
|
)
|
|
|
|
// resolveAllowGroups turns the values given on --allow-group into the typed
|
|
// principals the daemon enforces on its sockets, dropping empty entries and
|
|
// duplicates. Names are resolved through the platform's directory service, so
|
|
// an entry that does not resolve is an error: a restriction the daemon cannot
|
|
// evaluate must not become one that admits everybody. Values already in
|
|
// kind:value form are validated and passed through, which is the form an
|
|
// installed service hands to `service run`.
|
|
func resolveAllowGroups(values []string) ([]string, error) {
|
|
var resolved []string
|
|
for _, value := range values {
|
|
value = strings.TrimSpace(value)
|
|
if value == "" {
|
|
continue
|
|
}
|
|
|
|
principal, err := resolveAllowGroup(value)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("resolve --allow-group %q: %w", value, err)
|
|
}
|
|
if !slices.Contains(resolved, principal) {
|
|
resolved = append(resolved, principal)
|
|
}
|
|
}
|
|
|
|
if err := checkAllowGroupSet(resolved); err != nil {
|
|
return nil, err
|
|
}
|
|
return resolved, nil
|
|
}
|
|
|
|
// cutKind splits a value on the kind separator. ok is false when the value
|
|
// carries no kind, which is the case for a plain group or account name: neither
|
|
// a Unix group name nor a Windows account name may contain a colon, so the
|
|
// separator is unambiguous.
|
|
func cutKind(value string) (kind, rest string, ok bool) {
|
|
kind, rest, ok = strings.Cut(value, ":")
|
|
if !ok || rest == "" {
|
|
return "", value, false
|
|
}
|
|
return kind, rest, true
|
|
}
|
|
|
|
// principalValue returns the value part of a kind:value principal of the
|
|
// expected kind.
|
|
func principalValue(principal, kind string) (string, bool) {
|
|
got, value, ok := strings.Cut(principal, ":")
|
|
if !ok || got != kind || value == "" {
|
|
return "", false
|
|
}
|
|
return value, true
|
|
}
|