acl2dot.go

package main

import (
	"log"
	"os"
	"strings"

	"github.com/goccy/go-graphviz"
	"github.com/goccy/go-graphviz/cgraph"
	"github.com/tailscale/hujson"
	"tailscale.io/control/policy"
)

func main() {
	j, err := os.ReadFile("acl.json")
	check(err)
	var p policy.Policy
	err = hujson.Unmarshal(j, &p)
	check(err)

	g := graphviz.New()
	graph, err := g.Graph()
	check(err)

	defer func() {
		err := graph.Close()
		check(err)
		g.Close()
	}()

	userNodes := make(map[string]*cgraph.Node)
	portNodes := make(map[string]*cgraph.Node)
	for _, acl := range p.ACLs {
		for _, u := range acl.Users {
			n, err := graph.CreateNode(u)
			check(err)
			userNodes[u] = n
		}

		for _, r := range acl.Ports {
			r = strings.TrimSuffix(r, ":*")
			n, err := graph.CreateNode(r)
			check(err)
			portNodes[r] = n
		}

		for _, u := range acl.Users {
			for _, r := range acl.Ports {
				r = strings.TrimSuffix(r, ":*")
				var label string
				if acl.Proto != "" {
					label = "Accept " + acl.Proto
				}
				e, err := graph.CreateEdge(label, userNodes[u], portNodes[r])
				check(err)
				e.SetLabel(label)
			}
		}
	}

	err = g.RenderFilename(graph, graphviz.PNG, "graph.png")
	check(err)
}

func check(err error) {
	if err != nil {
		log.Panic(err)
	}
}