authorizeNodePrefixes verifies that every prefix is a /128 address derived from the agent's own UUID (or the legacy workspace agent IP).
(prefixes []string)
| 89 | // authorizeNodePrefixes verifies that every prefix is a /128 address derived |
| 90 | // from the agent's own UUID (or the legacy workspace agent IP). |
| 91 | func (a AgentCoordinateeAuth) authorizeNodePrefixes(prefixes []string) error { |
| 92 | for _, prefixStr := range prefixes { |
| 93 | pre, err := netip.ParsePrefix(prefixStr) |
| 94 | if err != nil { |
| 95 | return xerrors.Errorf("parse node address: %w", err) |
| 96 | } |
| 97 | |
| 98 | if pre.Bits() != 128 { |
| 99 | return InvalidAddressBitsError{pre.Bits()} |
| 100 | } |
| 101 | |
| 102 | if TailscaleServicePrefix.AddrFromUUID(a.ID).Compare(pre.Addr()) != 0 && |
| 103 | CoderServicePrefix.AddrFromUUID(a.ID).Compare(pre.Addr()) != 0 && |
| 104 | legacyWorkspaceAgentIP.Compare(pre.Addr()) != 0 { |
| 105 | return InvalidNodeAddressError{pre.Addr().String()} |
| 106 | } |
| 107 | } |
| 108 | |
| 109 | return nil |
| 110 | } |
| 111 | |
| 112 | type ClientUserCoordinateeAuth struct { |
| 113 | Auth TunnelAuthorizer |