2022-02-26 00:06:03 +08:00
|
|
|
package acls
|
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
2023-06-26 23:02:52 +08:00
|
|
|
"sync"
|
2022-02-26 00:06:03 +08:00
|
|
|
|
|
|
|
"github.com/gravitl/netmaker/database"
|
2023-06-16 21:48:53 +08:00
|
|
|
"golang.org/x/exp/slog"
|
2022-02-26 00:06:03 +08:00
|
|
|
)
|
|
|
|
|
2023-06-26 23:02:52 +08:00
|
|
|
var (
|
|
|
|
aclCacheMutex = &sync.RWMutex{}
|
|
|
|
aclCacheMap = make(map[ContainerID]ACLContainer)
|
2023-06-28 16:12:01 +08:00
|
|
|
aclMutex = &sync.RWMutex{}
|
2023-06-26 23:02:52 +08:00
|
|
|
)
|
|
|
|
|
|
|
|
func fetchAclContainerFromCache(containerID ContainerID) (aclCont ACLContainer, ok bool) {
|
|
|
|
aclCacheMutex.RLock()
|
|
|
|
aclCont, ok = aclCacheMap[containerID]
|
|
|
|
aclCacheMutex.RUnlock()
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
func storeAclContainerInCache(containerID ContainerID, aclContainer ACLContainer) {
|
|
|
|
aclCacheMutex.Lock()
|
|
|
|
aclCacheMap[containerID] = aclContainer
|
|
|
|
aclCacheMutex.Unlock()
|
|
|
|
}
|
|
|
|
|
|
|
|
func DeleteAclFromCache(containerID ContainerID) {
|
|
|
|
aclCacheMutex.Lock()
|
|
|
|
delete(aclCacheMap, containerID)
|
|
|
|
aclCacheMutex.Unlock()
|
|
|
|
}
|
|
|
|
|
2022-02-26 00:06:03 +08:00
|
|
|
// == type functions ==
|
|
|
|
|
2022-03-11 05:01:36 +08:00
|
|
|
// ACL.Allow - allows access by ID in memory
|
2022-02-26 00:06:03 +08:00
|
|
|
func (acl ACL) Allow(ID AclID) {
|
2023-06-29 03:36:26 +08:00
|
|
|
aclMutex.Lock()
|
|
|
|
defer aclMutex.Unlock()
|
2022-02-26 00:06:03 +08:00
|
|
|
acl[ID] = Allowed
|
|
|
|
}
|
|
|
|
|
2022-03-11 05:01:36 +08:00
|
|
|
// ACL.DisallowNode - disallows access by ID in memory
|
2022-02-26 00:06:03 +08:00
|
|
|
func (acl ACL) Disallow(ID AclID) {
|
2023-06-29 03:36:26 +08:00
|
|
|
aclMutex.Lock()
|
|
|
|
defer aclMutex.Unlock()
|
2022-02-26 00:06:03 +08:00
|
|
|
acl[ID] = NotAllowed
|
|
|
|
}
|
|
|
|
|
2022-03-11 05:01:36 +08:00
|
|
|
// ACL.Remove - removes a node from a ACL in memory
|
2022-02-26 00:06:03 +08:00
|
|
|
func (acl ACL) Remove(ID AclID) {
|
2023-06-29 03:36:26 +08:00
|
|
|
aclMutex.Lock()
|
|
|
|
defer aclMutex.Unlock()
|
2022-02-26 00:06:03 +08:00
|
|
|
delete(acl, ID)
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACL.Update - updates a ACL in DB
|
2022-02-26 03:08:44 +08:00
|
|
|
func (acl ACL) Save(containerID ContainerID, ID AclID) (ACL, error) {
|
|
|
|
return upsertACL(containerID, ID, acl)
|
2022-02-26 00:06:03 +08:00
|
|
|
}
|
|
|
|
|
2022-02-26 03:08:44 +08:00
|
|
|
// ACL.IsAllowed - sees if ID is allowed in referring ACL
|
2023-06-29 04:27:00 +08:00
|
|
|
func (acl ACL) IsAllowed(ID AclID) (allowed bool) {
|
2023-06-29 03:36:26 +08:00
|
|
|
aclMutex.RLock()
|
2023-06-29 04:27:00 +08:00
|
|
|
allowed = acl[ID] == Allowed
|
|
|
|
aclMutex.RUnlock()
|
|
|
|
return
|
2022-02-26 00:06:03 +08:00
|
|
|
}
|
|
|
|
|
2022-02-26 03:08:44 +08:00
|
|
|
// ACLContainer.UpdateACL - saves the state of a ACL in the ACLContainer in memory
|
|
|
|
func (aclContainer ACLContainer) UpdateACL(ID AclID, acl ACL) ACLContainer {
|
2023-06-29 03:36:26 +08:00
|
|
|
aclMutex.Lock()
|
|
|
|
defer aclMutex.Unlock()
|
2022-02-26 00:06:03 +08:00
|
|
|
aclContainer[ID] = acl
|
|
|
|
return aclContainer
|
|
|
|
}
|
|
|
|
|
2022-02-26 03:08:44 +08:00
|
|
|
// ACLContainer.RemoveACL - removes the state of a ACL in the ACLContainer in memory
|
|
|
|
func (aclContainer ACLContainer) RemoveACL(ID AclID) ACLContainer {
|
2023-06-29 03:36:26 +08:00
|
|
|
aclMutex.Lock()
|
|
|
|
defer aclMutex.Unlock()
|
2022-02-26 00:06:03 +08:00
|
|
|
delete(aclContainer, ID)
|
|
|
|
return aclContainer
|
|
|
|
}
|
|
|
|
|
2022-02-26 03:08:44 +08:00
|
|
|
// ACLContainer.ChangeAccess - changes the relationship between two nodes in memory
|
|
|
|
func (networkACL ACLContainer) ChangeAccess(ID1, ID2 AclID, value byte) {
|
2023-06-16 21:46:23 +08:00
|
|
|
if _, ok := networkACL[ID1]; !ok {
|
|
|
|
slog.Error("ACL missing for ", "id", ID1)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
if _, ok := networkACL[ID2]; !ok {
|
|
|
|
slog.Error("ACL missing for ", "id", ID2)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
if _, ok := networkACL[ID1][ID2]; !ok {
|
|
|
|
slog.Error("ACL missing for ", "id1", ID1, "id2", ID2)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
if _, ok := networkACL[ID2][ID1]; !ok {
|
|
|
|
slog.Error("ACL missing for ", "id2", ID2, "id1", ID1)
|
|
|
|
return
|
|
|
|
}
|
2022-02-26 00:06:03 +08:00
|
|
|
networkACL[ID1][ID2] = value
|
|
|
|
networkACL[ID2][ID1] = value
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLContainer.Save - saves the state of a ACLContainer to the db
|
2022-02-26 03:08:44 +08:00
|
|
|
func (aclContainer ACLContainer) Save(containerID ContainerID) (ACLContainer, error) {
|
|
|
|
return upsertACLContainer(containerID, aclContainer)
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLContainer.New - saves the state of a ACLContainer to the db
|
|
|
|
func (aclContainer ACLContainer) New(containerID ContainerID) (ACLContainer, error) {
|
|
|
|
return upsertACLContainer(containerID, nil)
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLContainer.Get - saves the state of a ACLContainer to the db
|
|
|
|
func (aclContainer ACLContainer) Get(containerID ContainerID) (ACLContainer, error) {
|
|
|
|
return fetchACLContainer(containerID)
|
2022-02-26 00:06:03 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// == private ==
|
|
|
|
|
2022-03-11 05:01:36 +08:00
|
|
|
// fetchACLContainer - fetches all current rules in given ACL container
|
2022-02-26 03:08:44 +08:00
|
|
|
func fetchACLContainer(containerID ContainerID) (ACLContainer, error) {
|
2023-06-28 16:12:01 +08:00
|
|
|
aclMutex.RLock()
|
|
|
|
defer aclMutex.RUnlock()
|
2023-06-26 23:02:52 +08:00
|
|
|
if aclContainer, ok := fetchAclContainerFromCache(containerID); ok {
|
|
|
|
return aclContainer, nil
|
|
|
|
}
|
2022-02-26 03:08:44 +08:00
|
|
|
aclJson, err := fetchACLContainerJson(ContainerID(containerID))
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
var currentNetworkACL ACLContainer
|
|
|
|
if err := json.Unmarshal([]byte(aclJson), ¤tNetworkACL); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2023-06-26 23:02:52 +08:00
|
|
|
storeAclContainerInCache(containerID, currentNetworkACL)
|
2022-02-26 03:08:44 +08:00
|
|
|
return currentNetworkACL, nil
|
|
|
|
}
|
|
|
|
|
2022-03-11 05:01:36 +08:00
|
|
|
// fetchACLContainerJson - fetch the current ACL of given container except in json string
|
2022-02-26 03:08:44 +08:00
|
|
|
func fetchACLContainerJson(containerID ContainerID) (ACLJson, error) {
|
|
|
|
currentACLs, err := database.FetchRecord(database.NODE_ACLS_TABLE_NAME, string(containerID))
|
|
|
|
if err != nil {
|
|
|
|
return ACLJson(""), err
|
|
|
|
}
|
|
|
|
return ACLJson(currentACLs), nil
|
|
|
|
}
|
|
|
|
|
2022-02-26 00:06:03 +08:00
|
|
|
// upsertACL - applies a ACL to the db, overwrites or creates
|
2022-02-26 03:08:44 +08:00
|
|
|
func upsertACL(containerID ContainerID, ID AclID, acl ACL) (ACL, error) {
|
|
|
|
currentNetACL, err := fetchACLContainer(containerID)
|
2022-02-26 00:06:03 +08:00
|
|
|
if err != nil {
|
|
|
|
return acl, err
|
|
|
|
}
|
|
|
|
currentNetACL[ID] = acl
|
2022-02-26 03:08:44 +08:00
|
|
|
_, err = upsertACLContainer(containerID, currentNetACL)
|
2022-02-26 00:06:03 +08:00
|
|
|
return acl, err
|
|
|
|
}
|
|
|
|
|
2022-03-11 05:01:36 +08:00
|
|
|
// upsertACLContainer - Inserts or updates a network ACL given the json string of the ACL and the container ID
|
2022-02-26 00:06:03 +08:00
|
|
|
// if nil, create it
|
2022-02-26 03:08:44 +08:00
|
|
|
func upsertACLContainer(containerID ContainerID, aclContainer ACLContainer) (ACLContainer, error) {
|
2023-06-28 16:12:01 +08:00
|
|
|
aclMutex.Lock()
|
|
|
|
defer aclMutex.Unlock()
|
2022-02-26 00:06:03 +08:00
|
|
|
if aclContainer == nil {
|
|
|
|
aclContainer = make(ACLContainer)
|
|
|
|
}
|
2023-06-28 16:12:01 +08:00
|
|
|
|
2023-06-26 23:02:52 +08:00
|
|
|
err := database.Insert(string(containerID), string(convertNetworkACLtoACLJson(aclContainer)), database.NODE_ACLS_TABLE_NAME)
|
|
|
|
if err != nil {
|
|
|
|
return aclContainer, err
|
|
|
|
}
|
|
|
|
storeAclContainerInCache(containerID, aclContainer)
|
|
|
|
return aclContainer, nil
|
2022-02-26 00:06:03 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
func convertNetworkACLtoACLJson(networkACL ACLContainer) ACLJson {
|
|
|
|
data, err := json.Marshal(networkACL)
|
|
|
|
if err != nil {
|
|
|
|
return ""
|
|
|
|
}
|
|
|
|
return ACLJson(data)
|
|
|
|
}
|