gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-09-10 15:14:22 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'develop' into NM-37

Browse source
This commit is contained in:
Vishal Dalwadi 2025-07-28 15:23:03 +05:30 • committed by GitHub
commit 0fea8af3e1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
26 changed files with 229 additions and 150 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
auth/host_session.go
View file

@ -77,7 +77,7 @@ func SessionHandler(conn *websocket.Conn) {
_, err := logic.VerifyAuthRequest(models.UserAuthParams{
UserName: registerMessage.User,
Password: registerMessage.Password,
})
}, logic.NetclientApp)
if err != nil {
err = conn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
if err != nil {

1
config/config.go
View file

@ -89,6 +89,7 @@ type ServerConfig struct {
DeployedByOperator bool `yaml:"deployed_by_operator"`
Environment string `yaml:"environment"`
JwtValidityDuration time.Duration `yaml:"jwt_validity_duration" swaggertype:"primitive,integer" format:"int64"`
JwtValidityDurationClients time.Duration `yaml:"jwt_validity_duration_clients" swaggertype:"primitive,integer" format:"int64"`
RacRestrictToSingleNetwork bool `yaml:"rac_restrict_to_single_network"`
CacheEnabled string `yaml:"caching_enabled"`
EndpointDetection bool `yaml:"endpoint_detection"`

1
controllers/controller.go
View file

@ -56,6 +56,7 @@ func HandleRESTRequests(wg *sync.WaitGroup, ctx context.Context) {
"Content-Type",
"authorization",
"From-Ui",
"X-Application-Name",
},
)
originsOk := handlers.AllowedOrigins(strings.Split(servercfg.GetAllowedOrigin(), ","))

10
controllers/server.go
View file

@ -56,6 +56,7 @@ func serverHandlers(r *mux.Router) {
Methods(http.MethodPost)
r.HandleFunc("/api/server/mem_profile", logic.SecurityCheck(false, http.HandlerFunc(memProfile))).
Methods(http.MethodPost)
r.HandleFunc("/api/server/feature_flags", getFeatureFlags).Methods(http.MethodGet)
}
func cpuProfile(w http.ResponseWriter, r *http.Request) {
@ -325,3 +326,12 @@ func reInit(curr, new models.ServerSettings, force bool) {
go mq.PublishPeerUpdate(false)
}
// @Summary Get feature flags for this server.
// @Router /api/server/feature_flags [get]
// @Tags Server
// @Security oauth2
// @Success 200 {object} config.ServerSettings
func getFeatureFlags(w http.ResponseWriter, r *http.Request) {
logic.ReturnSuccessResponseWithJson(w, r, logic.GetFeatureFlags(), "")
}

13
controllers/user.go
View file

@ -255,6 +255,10 @@ func deleteUserAccessTokens(w http.ResponseWriter, r *http.Request) {
// @Failure 401 {object} models.ErrorResponse
// @Failure 500 {object} models.ErrorResponse
func authenticateUser(response http.ResponseWriter, request *http.Request) {
appName := request.Header.Get("X-Application-Name")
if appName == "" {
appName = logic.NetmakerDesktopApp
}
// Auth request consists of Mac Address and Password (from node that is authorizing
// in case of Master, auth is ignored and mac is set to "mastermac"
@ -345,7 +349,7 @@ func authenticateUser(response http.ResponseWriter, request *http.Request) {
}
username := authRequest.UserName
jwt, err := logic.VerifyAuthRequest(authRequest)
jwt, err := logic.VerifyAuthRequest(authRequest, appName)
if err != nil {
logger.Log(0, username, "user validation failed: ",
err.Error())
@ -578,6 +582,11 @@ func completeTOTPSetup(w http.ResponseWriter, r *http.Request) {
func verifyTOTP(w http.ResponseWriter, r *http.Request) {
username := r.Header.Get("user")
appName := r.Header.Get("X-Application-Name")
if appName == "" {
appName = logic.NetmakerDesktopApp
}
var req models.UserTOTPVerificationParams
err := json.NewDecoder(r.Body).Decode(&req)
if err != nil {
@ -603,7 +612,7 @@ func verifyTOTP(w http.ResponseWriter, r *http.Request) {
}
if totp.Validate(req.TOTP, user.TOTPSecret) {
jwt, err := logic.CreateUserJWT(user.UserName, user.PlatformRoleID)
jwt, err := logic.CreateUserJWT(user.UserName, user.PlatformRoleID, appName)
if err != nil {
err = fmt.Errorf("error creating token: %v", err)
logger.Log(0, err.Error())

16
logic/auth.go
View file

@ -24,6 +24,12 @@ const (
auth_key = "netmaker_auth"
)
const (
DashboardApp = "dashboard"
NetclientApp = "netclient"
NetmakerDesktopApp = "netmaker-desktop"
)
var (
superUser = models.User{}
)
@ -178,7 +184,8 @@ func CreateUser(user *models.User) error {
user.AuthType = models.OAuth
}
AddGlobalNetRolesToAdmins(user)
_, err = CreateUserJWT(user.UserName, user.PlatformRoleID)
// create user will always be called either from API or Dashboard.
_, err = CreateUserJWT(user.UserName, user.PlatformRoleID, DashboardApp)
if err != nil {
logger.Log(0, "failed to generate token", err.Error())
return err
@ -212,7 +219,7 @@ func CreateSuperAdmin(u *models.User) error {
}
// VerifyAuthRequest - verifies an auth request
func VerifyAuthRequest(authRequest models.UserAuthParams) (string, error) {
func VerifyAuthRequest(authRequest models.UserAuthParams, appName string) (string, error) {
var result models.User
if authRequest.UserName == "" {
return "", errors.New("username can't be empty")
@ -245,7 +252,7 @@ func VerifyAuthRequest(authRequest models.UserAuthParams) (string, error) {
return tokenString, nil
} else {
// Create a new JWT for the node
tokenString, err := CreateUserJWT(authRequest.UserName, result.PlatformRoleID)
tokenString, err := CreateUserJWT(authRequest.UserName, result.PlatformRoleID, appName)
if err != nil {
slog.Error("error creating jwt", "error", err)
return "", err
@ -483,8 +490,9 @@ func GetState(state string) (*models.SsoState, error) {
}
// SetState - sets a state with new expiration
func SetState(state string) error {
func SetState(appName, state string) error {
s := models.SsoState{
AppName: appName,
Value: state,
Expiration: time.Now().Add(models.DefaultExpDuration),
}

5
logic/hosts.go
View file

@ -6,6 +6,7 @@ import (
"errors"
"fmt"
"os"
"reflect"
"sort"
"sync"
@ -307,6 +308,10 @@ func UpdateHostFromClient(newHost, currHost *models.Host) (sendPeerUpdate bool)
sendPeerUpdate = true
isEndpointChanged = true
}
if !reflect.DeepEqual(currHost.Interfaces, newHost.Interfaces) {
currHost.Interfaces = newHost.Interfaces
sendPeerUpdate = true
}
if isEndpointChanged {
for _, nodeID := range currHost.Nodes {

10
logic/jwts.go
View file

@ -83,9 +83,13 @@ func CreateUserAccessJwtToken(username string, role models.UserRoleID, d time.Ti
}
// CreateUserJWT - creates a user jwt token
func CreateUserJWT(username string, role models.UserRoleID) (response string, err error) {
settings := GetServerSettings()
expirationTime := time.Now().Add(time.Duration(settings.JwtValidityDuration) * time.Minute)
func CreateUserJWT(username string, role models.UserRoleID, appName string) (response string, err error) {
duration := GetJwtValidityDuration()
if appName == NetclientApp || appName == NetmakerDesktopApp {
duration = GetJwtValidityDurationForClients()
}
expirationTime := time.Now().Add(duration)
claims := &models.UserClaims{
UserName: username,
Role: role,

5
logic/server.go
View file

@ -1,7 +1,12 @@
package logic
import "github.com/gravitl/netmaker/models"
// EnterpriseCheckFuncs - can be set to run functions for EE
var EnterpriseCheckFuncs []func()
var GetFeatureFlags = func() models.FeatureFlags {
return models.FeatureFlags{}
}
// == Join, Checkin, and Leave for Server ==

35
logic/settings.go
View file

@ -86,22 +86,28 @@ func DeleteUserSettings(userID string) error {
func ValidateNewSettings(req models.ServerSettings) bool {
// TODO: add checks for different fields
if req.JwtValidityDuration > 525600 || req.JwtValidityDuration < 5 {
return false
}
return true
}
func GetServerSettingsFromEnv() (s models.ServerSettings) {
s = models.ServerSettings{
NetclientAutoUpdate: servercfg.AutoUpdateEnabled(),
Verbosity: servercfg.GetVerbosity(),
AuthProvider: os.Getenv("AUTH_PROVIDER"),
OIDCIssuer: os.Getenv("OIDC_ISSUER"),
ClientID: os.Getenv("CLIENT_ID"),
ClientSecret: os.Getenv("CLIENT_SECRET"),
AzureTenant: servercfg.GetAzureTenant(),
Telemetry: servercfg.Telemetry(),
BasicAuth: servercfg.IsBasicAuthEnabled(),
JwtValidityDuration: servercfg.GetJwtValidityDurationFromEnv() / 60,
NetclientAutoUpdate: servercfg.AutoUpdateEnabled(),
Verbosity: servercfg.GetVerbosity(),
AuthProvider: os.Getenv("AUTH_PROVIDER"),
OIDCIssuer: os.Getenv("OIDC_ISSUER"),
ClientID: os.Getenv("CLIENT_ID"),
ClientSecret: os.Getenv("CLIENT_SECRET"),
AzureTenant: servercfg.GetAzureTenant(),
Telemetry: servercfg.Telemetry(),
BasicAuth: servercfg.IsBasicAuthEnabled(),
JwtValidityDuration: servercfg.GetJwtValidityDurationFromEnv() / 60,
// setting client's jwt validity duration to be the same as that of
// dashboard.
JwtValidityDurationClients: servercfg.GetJwtValidityDurationFromEnv() / 60,
RacRestrictToSingleNetwork: servercfg.GetRacRestrictToSingleNetwork(),
EndpointDetection: servercfg.IsEndpointDetectionEnabled(),
AllowedEmailDomains: servercfg.GetAllowedEmailDomains(),
@ -176,6 +182,7 @@ func GetServerConfig() config.ServerConfig {
cfg.IsPro = "yes"
}
cfg.JwtValidityDuration = time.Duration(settings.JwtValidityDuration) * time.Minute
cfg.JwtValidityDurationClients = time.Duration(settings.JwtValidityDurationClients) * time.Minute
cfg.RacRestrictToSingleNetwork = settings.RacRestrictToSingleNetwork
cfg.MetricInterval = settings.MetricInterval
cfg.ManageDNS = settings.ManageDNS
@ -238,7 +245,13 @@ func Telemetry() string {
// GetJwtValidityDuration - returns the JWT validity duration in minutes
func GetJwtValidityDuration() time.Duration {
return GetServerConfig().JwtValidityDuration
return time.Duration(GetServerSettings().JwtValidityDuration) * time.Minute
}
// GetJwtValidityDurationForClients returns the JWT validity duration in
// minutes for clients.
func GetJwtValidityDurationForClients() time.Duration {
return time.Duration(GetServerSettings().JwtValidityDurationClients) * time.Minute
}
// GetRacRestrictToSingleNetwork - returns whether the feature to allow simultaneous network connections via RAC is enabled

20
logic/util.go
View file

@ -20,6 +20,7 @@ import (
"github.com/c-robinson/iplib"
"github.com/gravitl/netmaker/database"
"github.com/gravitl/netmaker/logger"
"github.com/gravitl/netmaker/models"
)
// IsBase64 - checks if a string is in base64 format
@ -253,3 +254,22 @@ func GetClientIP(r *http.Request) string {
}
return ip
}
// CompareIfaceSlices compares two slices of Iface for deep equality (order-sensitive)
func CompareIfaceSlices(a, b []models.Iface) bool {
if len(a) != len(b) {
return false
}
for i := range a {
if !compareIface(a[i], b[i]) {
return false
}
}
return true
}
func compareIface(a, b models.Iface) bool {
return a.Name == b.Name &&
a.Address.IP.Equal(b.Address.IP) &&
a.Address.Mask.String() == b.Address.Mask.String() &&
a.AddressString == b.AddressString
}

3
migrate/migrate.go
View file

@ -641,5 +641,8 @@ func migrateSettings() {
if settings.DefaultDomain == "" {
settings.DefaultDomain = servercfg.GetDefaultDomain()
}
if settings.JwtValidityDurationClients == 0 {
settings.JwtValidityDurationClients = servercfg.GetJwtValidityDurationFromEnv() / 60
}
logic.UpsertServerSettings(settings)
}

69
models/settings.go
View file

@ -9,38 +9,43 @@ const (
)
type ServerSettings struct {
NetclientAutoUpdate bool `json:"netclientautoupdate"`
Verbosity int32 `json:"verbosity"`
AuthProvider string `json:"authprovider"`
OIDCIssuer string `json:"oidcissuer"`
ClientID string `json:"client_id"`
ClientSecret string `json:"client_secret"`
SyncEnabled bool `json:"sync_enabled"`
GoogleAdminEmail string `json:"google_admin_email"`
GoogleSACredsJson string `json:"google_sa_creds_json"`
AzureTenant string `json:"azure_tenant"`
UserFilters []string `json:"user_filters"`
GroupFilters []string `json:"group_filters"`
IDPSyncInterval string `json:"idp_sync_interval"`
Telemetry string `json:"telemetry"`
BasicAuth bool `json:"basic_auth"`
JwtValidityDuration int `json:"jwt_validity_duration"`
MFAEnforced bool `json:"mfa_enforced"`
RacRestrictToSingleNetwork bool `json:"rac_restrict_to_single_network"`
EndpointDetection bool `json:"endpoint_detection"`
AllowedEmailDomains string `json:"allowed_email_domains"`
EmailSenderAddr string `json:"email_sender_addr"`
EmailSenderUser string `json:"email_sender_user"`
EmailSenderPassword string `json:"email_sender_password"`
SmtpHost string `json:"smtp_host"`
SmtpPort int `json:"smtp_port"`
MetricInterval string `json:"metric_interval"`
MetricsPort int `json:"metrics_port"`
ManageDNS bool `json:"manage_dns"`
DefaultDomain string `json:"default_domain"`
Stun bool `json:"stun"`
StunServers string `json:"stun_servers"`
AuditLogsRetentionPeriodInDays int `json:"audit_logs_retention_period"`
NetclientAutoUpdate bool `json:"netclientautoupdate"`
Verbosity int32 `json:"verbosity"`
AuthProvider string `json:"authprovider"`
OIDCIssuer string `json:"oidcissuer"`
ClientID string `json:"client_id"`
ClientSecret string `json:"client_secret"`
SyncEnabled bool `json:"sync_enabled"`
GoogleAdminEmail string `json:"google_admin_email"`
GoogleSACredsJson string `json:"google_sa_creds_json"`
AzureTenant string `json:"azure_tenant"`
UserFilters []string `json:"user_filters"`
GroupFilters []string `json:"group_filters"`
IDPSyncInterval string `json:"idp_sync_interval"`
Telemetry string `json:"telemetry"`
BasicAuth bool `json:"basic_auth"`
// JwtValidityDuration is the validity duration of auth tokens for users
// on the dashboard (NMUI).
JwtValidityDuration int `json:"jwt_validity_duration"`
// JwtValidityDurationClients is the validity duration of auth tokens for
// users on the clients (NetDesk).
JwtValidityDurationClients int `json:"jwt_validity_duration_clients"`
MFAEnforced bool `json:"mfa_enforced"`
RacRestrictToSingleNetwork bool `json:"rac_restrict_to_single_network"`
EndpointDetection bool `json:"endpoint_detection"`
AllowedEmailDomains string `json:"allowed_email_domains"`
EmailSenderAddr string `json:"email_sender_addr"`
EmailSenderUser string `json:"email_sender_user"`
EmailSenderPassword string `json:"email_sender_password"`
SmtpHost string `json:"smtp_host"`
SmtpPort int `json:"smtp_port"`
MetricInterval string `json:"metric_interval"`
MetricsPort int `json:"metrics_port"`
ManageDNS bool `json:"manage_dns"`
DefaultDomain string `json:"default_domain"`
Stun bool `json:"stun"`
StunServers string `json:"stun_servers"`
AuditLogsRetentionPeriodInDays int `json:"audit_logs_retention_period"`
}
type UserSettings struct {

1
models/ssocache.go
View file

@ -7,6 +7,7 @@ const DefaultExpDuration = time.Minute * 5
// SsoState - holds SSO sign-in session data
type SsoState struct {
AppName string `json:"app_name"`
Value string `json:"value"`
Expiration time.Time `json:"expiration"`
}

7
models/structs.go
View file

@ -16,6 +16,13 @@ const (
PLACEHOLDER_TOKEN_TEXT = "ACCESS_TOKEN"
)
type FeatureFlags struct {
EnableNetworkActivity bool `json:"enable_network_activity"`
EnableOAuth bool `json:"enable_oauth"`
EnableIDPIntegration bool `json:"enable_idp_integration"`
AllowMultiServerLicense bool `json:"allow_multi_server_license"`
}
// AuthParams - struct for auth params
type AuthParams struct {
MacAddress string `json:"macaddress"`

2
mq/handlers.go
View file

@ -274,7 +274,7 @@ func HandleHostCheckin(h, currentHost *models.Host) bool {
return false
}
}
ifaceDelta := len(h.Interfaces) != len(currentHost.Interfaces) ||
ifaceDelta := len(h.Interfaces) != len(currentHost.Interfaces) || !logic.CompareIfaceSlices(h.Interfaces, currentHost.Interfaces) ||
!h.EndpointIP.Equal(currentHost.EndpointIP) ||
(len(h.NatType) > 0 && h.NatType != currentHost.NatType) ||
h.DefaultInterface != currentHost.DefaultInterface ||

19
pro/auth/azure-ad.go
View file

@ -40,13 +40,18 @@ func initAzureAD(redirectURL string, clientID string, clientSecret string) {
}
func handleAzureLogin(w http.ResponseWriter, r *http.Request) {
appName := r.Header.Get("X-Application-Name")
if appName == "" {
appName = logic.NetmakerDesktopApp
}
var oauth_state_string = logic.RandomString(user_signin_length)
if auth_provider == nil {
handleOauthNotConfigured(w)
return
}
if err := logic.SetState(oauth_state_string); err != nil {
if err := logic.SetState(appName, oauth_state_string); err != nil {
handleOauthNotConfigured(w)
return
}
@ -56,9 +61,15 @@ func handleAzureLogin(w http.ResponseWriter, r *http.Request) {
}
func handleAzureCallback(w http.ResponseWriter, r *http.Request) {
var rState, rCode = getStateAndCode(r)
var content, err = getAzureUserInfo(rState, rCode)
state, err := logic.GetState(rState)
if err != nil {
handleOauthNotValid(w)
return
}
content, err := getAzureUserInfo(rState, rCode)
if err != nil {
logger.Log(1, "error when getting user info from azure:", err.Error())
if strings.Contains(err.Error(), "invalid oauth state") || strings.Contains(err.Error(), "failed to fetch user email from SSO state") {
@ -179,7 +190,7 @@ func handleAzureCallback(w http.ResponseWriter, r *http.Request) {
Password: newPass,
}
var jwt, jwtErr = logic.VerifyAuthRequest(authRequest)
var jwt, jwtErr = logic.VerifyAuthRequest(authRequest, state.AppName)
if jwtErr != nil {
logger.Log(1, "could not parse jwt for user", authRequest.UserName)
return

19
pro/auth/github.go
View file

@ -40,13 +40,18 @@ func initGithub(redirectURL string, clientID string, clientSecret string) {
}
func handleGithubLogin(w http.ResponseWriter, r *http.Request) {
appName := r.Header.Get("X-Application-Name")
if appName == "" {
appName = logic.NetmakerDesktopApp
}
var oauth_state_string = logic.RandomString(user_signin_length)
if auth_provider == nil {
handleOauthNotConfigured(w)
return
}
if err := logic.SetState(oauth_state_string); err != nil {
if err := logic.SetState(appName, oauth_state_string); err != nil {
handleOauthNotConfigured(w)
return
}
@ -56,9 +61,15 @@ func handleGithubLogin(w http.ResponseWriter, r *http.Request) {
}
func handleGithubCallback(w http.ResponseWriter, r *http.Request) {
var rState, rCode = getStateAndCode(r)
var content, err = getGithubUserInfo(rState, rCode)
state, err := logic.GetState(rState)
if err != nil {
handleOauthNotValid(w)
return
}
content, err := getGithubUserInfo(rState, rCode)
if err != nil {
logger.Log(1, "error when getting user info from github:", err.Error())
if strings.Contains(err.Error(), "invalid oauth state") || strings.Contains(err.Error(), "failed to fetch user email from SSO state") {
@ -170,7 +181,7 @@ func handleGithubCallback(w http.ResponseWriter, r *http.Request) {
Password: newPass,
}
var jwt, jwtErr = logic.VerifyAuthRequest(authRequest)
var jwt, jwtErr = logic.VerifyAuthRequest(authRequest, state.AppName)
if jwtErr != nil {
logger.Log(1, "could not parse jwt for user", authRequest.UserName)
return

19
pro/auth/google.go
View file

@ -40,13 +40,18 @@ func initGoogle(redirectURL string, clientID string, clientSecret string) {
}
func handleGoogleLogin(w http.ResponseWriter, r *http.Request) {
appName := r.Header.Get("X-Application-Name")
if appName == "" {
appName = logic.NetmakerDesktopApp
}
var oauth_state_string = logic.RandomString(user_signin_length)
if auth_provider == nil {
handleOauthNotConfigured(w)
return
}
logger.Log(0, "Setting OAuth State ", oauth_state_string)
if err := logic.SetState(oauth_state_string); err != nil {
if err := logic.SetState(appName, oauth_state_string); err != nil {
handleOauthNotConfigured(w)
return
}
@ -56,10 +61,16 @@ func handleGoogleLogin(w http.ResponseWriter, r *http.Request) {
}
func handleGoogleCallback(w http.ResponseWriter, r *http.Request) {
var rState, rCode = getStateAndCode(r)
logger.Log(0, "Fetched OAuth State ", rState)
var content, err = getGoogleUserInfo(rState, rCode)
state, err := logic.GetState(rState)
if err != nil {
handleOauthNotValid(w)
return
}
content, err := getGoogleUserInfo(rState, rCode)
if err != nil {
logger.Log(1, "error when getting user info from google:", err.Error())
if strings.Contains(err.Error(), "invalid oauth state") {
@ -162,7 +173,7 @@ func handleGoogleCallback(w http.ResponseWriter, r *http.Request) {
Password: newPass,
}
var jwt, jwtErr = logic.VerifyAuthRequest(authRequest)
var jwt, jwtErr = logic.VerifyAuthRequest(authRequest, state.AppName)
if jwtErr != nil {
logger.Log(1, "could not parse jwt for user", authRequest.UserName)
return

2
pro/auth/headless_callback.go
View file

@ -86,7 +86,7 @@ func HandleHeadlessSSOCallback(w http.ResponseWriter, r *http.Request) {
jwt, jwtErr := logic.VerifyAuthRequest(models.UserAuthParams{
UserName: user.UserName,
Password: newPass,
})
}, logic.NetclientApp)
if jwtErr != nil {
logger.Log(1, "could not parse jwt for user", userClaims.getUserName())
return

18
pro/auth/oidc.go
View file

@ -52,13 +52,18 @@ func initOIDC(redirectURL string, clientID string, clientSecret string, issuer s
}
func handleOIDCLogin(w http.ResponseWriter, r *http.Request) {
appName := r.Header.Get("X-Application-Name")
if appName == "" {
appName = logic.NetmakerDesktopApp
}
var oauth_state_string = logic.RandomString(user_signin_length)
if auth_provider == nil {
handleOauthNotConfigured(w)
return
}
if err := logic.SetState(oauth_state_string); err != nil {
if err := logic.SetState(appName, oauth_state_string); err != nil {
handleOauthNotConfigured(w)
return
}
@ -67,10 +72,15 @@ func handleOIDCLogin(w http.ResponseWriter, r *http.Request) {
}
func handleOIDCCallback(w http.ResponseWriter, r *http.Request) {
var rState, rCode = getStateAndCode(r)
var content, err = getOIDCUserInfo(rState, rCode)
state, err := logic.GetState(rState)
if err != nil {
handleOauthNotValid(w)
return
}
content, err := getOIDCUserInfo(rState, rCode)
if err != nil {
logger.Log(1, "error when getting user info from callback:", err.Error())
if strings.Contains(err.Error(), "invalid oauth state") {
@ -170,7 +180,7 @@ func handleOIDCCallback(w http.ResponseWriter, r *http.Request) {
Password: newPass,
}
var jwt, jwtErr = logic.VerifyAuthRequest(authRequest)
var jwt, jwtErr = logic.VerifyAuthRequest(authRequest, state.AppName)
if jwtErr != nil {
logger.Log(1, "could not parse jwt for user", authRequest.UserName, jwtErr.Error())
return

2
pro/initialize.go
View file

@ -155,7 +155,7 @@ func InitPro() {
logic.GetFwRulesForNodeAndPeerOnGw = proLogic.GetFwRulesForNodeAndPeerOnGw
logic.GetFwRulesForUserNodesOnGw = proLogic.GetFwRulesForUserNodesOnGw
logic.GetHostLocInfo = proLogic.GetHostLocInfo
logic.GetFeatureFlags = proLogic.GetFeatureFlags
}
func retrieveProLogo() string {

3
pro/license.go
View file

@ -135,6 +135,8 @@ func ValidateLicense() (err error) {
return err
}
proLogic.SetFeatureFlags(licenseResponse.FeatureFlags)
slog.Info("License validation succeeded!")
return nil
}
@ -200,6 +202,7 @@ func validateLicenseKey(encryptedData []byte, publicKey *[32]byte) ([]byte, bool
LicenseKey: servercfg.GetLicenseKey(),
NmServerPubKey: base64encode(publicKeyBytes),
EncryptedPart: base64encode(encryptedData),
NmBaseDomain: servercfg.GetNmBaseDomain(),
}
requestBody, err := json.Marshal(msg)

13
pro/logic/server.go Normal file
View file

@ -0,0 +1,13 @@
package logic
import "github.com/gravitl/netmaker/models"
var featureFlagsCache models.FeatureFlags
func SetFeatureFlags(featureFlags models.FeatureFlags) {
featureFlagsCache = featureFlags
}
func GetFeatureFlags() models.FeatureFlags {
return featureFlagsCache
}

7
pro/types.go
View file

@ -5,6 +5,7 @@ package pro
import (
"errors"
"github.com/gravitl/netmaker/models"
)
const (
@ -32,8 +33,9 @@ type LicenseKey struct {
// ValidatedLicense - the validated license struct
type ValidatedLicense struct {
LicenseValue string `json:"license_value" binding:"required"` // license that validation is being requested for
EncryptedLicense string `json:"encrypted_license" binding:"required"` // to be decrypted by Netmaker using Netmaker server's private key
LicenseValue string `json:"license_value" binding:"required"` // license that validation is being requested for
EncryptedLicense string `json:"encrypted_license" binding:"required"` // to be decrypted by Netmaker using Netmaker server's private key
FeatureFlags models.FeatureFlags `json:"feature_flags" binding:"required"`
}
// LicenseSecret - the encrypted struct for sending user-id
@ -74,6 +76,7 @@ type ValidateLicenseRequest struct {
LicenseKey string `json:"license_key" binding:"required"`
NmServerPubKey string `json:"nm_server_pub_key" binding:"required"` // Netmaker server public key used to send data back to Netmaker for the Netmaker server to decrypt (eg output from validating license)
EncryptedPart string `json:"secret" binding:"required"`
NmBaseDomain string `json:"nm_base_domain"`
}
type licenseResponseCache struct {

77
servercfg/serverconf.go
View file

@ -38,82 +38,7 @@ func SetHost() error {
return nil
}
// GetServerConfig - gets the server config into memory from file or env
func GetServerConfig() config.ServerConfig {
var cfg config.ServerConfig
cfg.APIConnString = GetAPIConnString()
cfg.CoreDNSAddr = GetCoreDNSAddr()
cfg.APIHost = GetAPIHost()
cfg.APIPort = GetAPIPort()
cfg.MasterKey = "(hidden)"
cfg.DNSKey = "(hidden)"
cfg.AllowedOrigin = GetAllowedOrigin()
cfg.RestBackend = "off"
cfg.NodeID = GetNodeID()
cfg.BrokerType = GetBrokerType()
cfg.EmqxRestEndpoint = GetEmqxRestEndpoint()
if AutoUpdateEnabled() {
cfg.NetclientAutoUpdate = "enabled"
} else {
cfg.NetclientAutoUpdate = "disabled"
}
if IsRestBackend() {
cfg.RestBackend = "on"
}
cfg.DNSMode = "off"
if IsDNSMode() {
cfg.DNSMode = "on"
}
cfg.DisplayKeys = "off"
if IsDisplayKeys() {
cfg.DisplayKeys = "on"
}
cfg.DisableRemoteIPCheck = "off"
if DisableRemoteIPCheck() {
cfg.DisableRemoteIPCheck = "on"
}
cfg.Database = GetDB()
cfg.Platform = GetPlatform()
cfg.Version = GetVersion()
cfg.PublicIp = GetServerHostIP()
// == auth config ==
var authInfo = GetAuthProviderInfo()
cfg.AuthProvider = authInfo[0]
cfg.ClientID = authInfo[1]
cfg.ClientSecret = authInfo[2]
cfg.FrontendURL = GetFrontendURL()
cfg.Telemetry = Telemetry()
cfg.Server = GetServer()
cfg.Verbosity = GetVerbosity()
cfg.IsPro = "no"
if IsPro {
cfg.IsPro = "yes"
}
cfg.JwtValidityDuration = GetJwtValidityDuration()
cfg.RacRestrictToSingleNetwork = GetRacRestrictToSingleNetwork()
cfg.MetricInterval = GetMetricInterval()
cfg.ManageDNS = GetManageDNS()
cfg.Stun = IsStunEnabled()
cfg.StunServers = GetStunServers()
cfg.DefaultDomain = GetDefaultDomain()
return cfg
}
// GetJwtValidityDuration - returns the JWT validity duration in seconds
func GetJwtValidityDuration() time.Duration {
var defaultDuration = time.Duration(24) * time.Hour
if os.Getenv("JWT_VALIDITY_DURATION") != "" {
t, err := strconv.Atoi(os.Getenv("JWT_VALIDITY_DURATION"))
if err != nil {
return defaultDuration
}
return time.Duration(t) * time.Second
}
return defaultDuration
}
// GetJwtValidityDuration - returns the JWT validity duration in seconds
// GetJwtValidityDurationFromEnv - returns the JWT validity duration in seconds
func GetJwtValidityDurationFromEnv() int {
var defaultDuration = 43200
if os.Getenv("JWT_VALIDITY_DURATION") != "" {