gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-09-03 19:54:22 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #3504 from gravitl/depracate-rac-autodisable

Browse source 
chore: deprecate rac autodisable flag
This commit is contained in:
Aceix 2025-06-24 18:13:44 +00:00 • committed by GitHub
parent 657a24ef23
commit 2df02f747e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 23 additions and 44 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
config/config.go
View file

@ -89,7 +89,6 @@ type ServerConfig struct {
DeployedByOperator bool `yaml:"deployed_by_operator"`
Environment string `yaml:"environment"`
JwtValidityDuration time.Duration `yaml:"jwt_validity_duration" swaggertype:"primitive,integer" format:"int64"`
RacAutoDisable bool `yaml:"rac_auto_disable"`
RacRestrictToSingleNetwork bool `yaml:"rac_restrict_to_single_network"`
CacheEnabled string `yaml:"caching_enabled"`
EndpointDetection bool `yaml:"endpoint_detection"`

2
controllers/user.go
View file

@ -377,7 +377,7 @@ func authenticateUser(response http.ResponseWriter, request *http.Request) {
response.Write(successJSONResponse)
go func() {
if servercfg.IsPro && logic.GetRacAutoDisable() {
if servercfg.IsPro {
// enable all associeated clients for the user
clients, err := logic.GetAllExtClients()
if err != nil {

16
logic/jwts.go
View file

@ -58,11 +58,10 @@ func CreateJWT(uuid string, macAddress string, network string) (response string,
// CreateUserJWT - creates a user jwt token
func CreateUserAccessJwtToken(username string, role models.UserRoleID, d time.Time, tokenID string) (response string, err error) {
claims := &models.UserClaims{
UserName: username,
Role: role,
TokenType: models.AccessTokenType,
Api: servercfg.GetAPIHost(),
RacAutoDisable: GetRacAutoDisable() && (role != models.SuperAdminRole && role != models.AdminRole),
UserName: username,
Role: role,
TokenType: models.AccessTokenType,
Api: servercfg.GetAPIHost(),
RegisteredClaims: jwt.RegisteredClaims{
Issuer: "Netmaker",
Subject: fmt.Sprintf("user|%s", username),
@ -85,10 +84,9 @@ func CreateUserJWT(username string, role models.UserRoleID) (response string, er
settings := GetServerSettings()
expirationTime := time.Now().Add(time.Duration(settings.JwtValidityDuration) * time.Minute)
claims := &models.UserClaims{
UserName: username,
Role: role,
TokenType: models.UserIDTokenType,
RacAutoDisable: settings.RacAutoDisable && (role != models.SuperAdminRole && role != models.AdminRole),
UserName: username,
Role: role,
TokenType: models.UserIDTokenType,
RegisteredClaims: jwt.RegisteredClaims{
Issuer: "Netmaker",
Subject: fmt.Sprintf("user|%s", username),

7
logic/settings.go
View file

@ -62,7 +62,6 @@ func GetServerSettingsFromEnv() (s models.ServerSettings) {
Telemetry: servercfg.Telemetry(),
BasicAuth: servercfg.IsBasicAuthEnabled(),
JwtValidityDuration: servercfg.GetJwtValidityDurationFromEnv() / 60,
RacAutoDisable: servercfg.GetRacAutoDisable(),
RacRestrictToSingleNetwork: servercfg.GetRacRestrictToSingleNetwork(),
EndpointDetection: servercfg.IsEndpointDetectionEnabled(),
AllowedEmailDomains: servercfg.GetAllowedEmailDomains(),
@ -140,7 +139,6 @@ func GetServerConfig() config.ServerConfig {
cfg.IsPro = "yes"
}
cfg.JwtValidityDuration = time.Duration(settings.JwtValidityDuration) * time.Minute
cfg.RacAutoDisable = settings.RacAutoDisable
cfg.RacRestrictToSingleNetwork = settings.RacRestrictToSingleNetwork
cfg.MetricInterval = settings.MetricInterval
cfg.ManageDNS = settings.ManageDNS
@ -206,11 +204,6 @@ func GetJwtValidityDuration() time.Duration {
return GetServerConfig().JwtValidityDuration
}
// GetRacAutoDisable - returns whether the feature to autodisable RAC is enabled
func GetRacAutoDisable() bool {
return GetServerSettings().RacAutoDisable
}
// GetRacRestrictToSingleNetwork - returns whether the feature to allow simultaneous network connections via RAC is enabled
func GetRacRestrictToSingleNetwork() bool {
return GetServerSettings().RacRestrictToSingleNetwork

1
models/settings.go
View file

@ -25,7 +25,6 @@ type ServerSettings struct {
Telemetry string `json:"telemetry"`
BasicAuth bool `json:"basic_auth"`
JwtValidityDuration int `json:"jwt_validity_duration"`
RacAutoDisable bool `json:"rac_auto_disable"`
RacRestrictToSingleNetwork bool `json:"rac_restrict_to_single_network"`
EndpointDetection bool `json:"endpoint_detection"`
AllowedEmailDomains string `json:"allowed_email_domains"`

4
pro/initialize.go
View file

@ -81,9 +81,7 @@ func InitPro() {
addTrialLicenseHook()
}
if logic.GetRacAutoDisable() {
AddRacHooks()
}
AddUnauthorisedUserNodeHooks()
var authProvider = auth.InitializeAuthProvider()
if authProvider != "" {

24
pro/remote_access_client.go
View file

@ -13,20 +13,20 @@ import (
"golang.org/x/exp/slog"
)
const racAutoDisableCheckInterval = 3 * time.Minute
const unauthorisedUserNodeCheckInterval = 3 * time.Minute
// AddRacHooks - adds hooks for Remote Access Client
func AddRacHooks() {
slog.Debug("adding RAC autodisable hook")
// AddUnauthorisedUserNodeHooks - adds hook to prevent access from unauthorised (expired) user nodes
func AddUnauthorisedUserNodeHooks() {
slog.Debug("adding unauthorisedUserNode hook")
logic.HookManagerCh <- models.HookDetails{
Hook: racAutoDisableHook,
Interval: racAutoDisableCheckInterval,
Hook: unauthorisedUserNodeHook,
Interval: unauthorisedUserNodeCheckInterval,
}
}
// racAutoDisableHook - checks if RAC is enabled and if it is, checks if it should be disabled
func racAutoDisableHook() error {
slog.Debug("running RAC autodisable hook")
// unauthorisedUserNodeHook - checks if a user node should be disabled, using the user's last login time
func unauthorisedUserNodeHook() error {
slog.Debug("running unauthorisedUserNode hook")
users, err := logic.GetUsers()
if err != nil {
@ -55,16 +55,16 @@ func racAutoDisableHook() error {
}
if (client.OwnerID == user.UserName) &&
client.Enabled {
slog.Info(fmt.Sprintf("disabling ext client %s for user %s due to RAC autodisabling", client.ClientID, client.OwnerID))
slog.Info(fmt.Sprintf("disabling user node %s for user %s: auth token expired", client.ClientID, client.OwnerID))
if err := disableExtClient(&client); err != nil {
slog.Error("error disabling ext client in RAC autodisable hook", "error", err)
slog.Error("error disabling user node", "error", err)
continue // dont return but try for other clients
}
}
}
}
slog.Debug("finished running RAC autodisable hook")
slog.Debug("finished running unauthorisedUserNode hook")
return nil
}

2
scripts/netmaker.default.env
View file

@ -71,8 +71,6 @@ AZURE_TENANT=
OIDC_ISSUER=
# Duration of JWT token validity in seconds
JWT_VALIDITY_DURATION=43200
# Auto disable a user's connecteds clients bassed on JWT token expiration
RAC_AUTO_DISABLE=false
# Allow a user to connect to multiple networks simultaneously
RAC_RESTRICT_TO_SINGLE_NETWORK=false
# if turned on data will be cached on to improve performance significantly (IMPORTANT: If HA set to `false` )

2
scripts/nm-quick.sh
View file

@ -257,7 +257,7 @@ save_config() { (
"INSTALL_TYPE" "NODE_ID" "DNS_MODE" "NETCLIENT_AUTO_UPDATE" "API_PORT" "MANAGE_DNS" "DEFAULT_DOMAIN"
"CORS_ALLOWED_ORIGIN" "DISPLAY_KEYS" "DATABASE" "SERVER_BROKER_ENDPOINT" "VERBOSITY"
"DEBUG_MODE" "REST_BACKEND" "DISABLE_REMOTE_IP_CHECK" "TELEMETRY" "ALLOWED_EMAIL_DOMAINS" "AUTH_PROVIDER" "CLIENT_ID" "CLIENT_SECRET"
"FRONTEND_URL" "AZURE_TENANT" "OIDC_ISSUER" "EXPORTER_API_PORT" "JWT_VALIDITY_DURATION" "RAC_AUTO_DISABLE" "RAC_RESTRICT_TO_SINGLE_NETWORK" "CACHING_ENABLED" "ENDPOINT_DETECTION"
"FRONTEND_URL" "AZURE_TENANT" "OIDC_ISSUER" "EXPORTER_API_PORT" "JWT_VALIDITY_DURATION" "RAC_RESTRICT_TO_SINGLE_NETWORK" "CACHING_ENABLED" "ENDPOINT_DETECTION"
"SMTP_HOST" "SMTP_PORT" "EMAIL_SENDER_ADDR" "EMAIL_SENDER_USER" "EMAIL_SENDER_PASSWORD")
for name in "${toCopy[@]}"; do
save_config_item $name "${!name}"

2
scripts/nm-upgrade.sh
View file

@ -179,7 +179,7 @@ save_config() { (
"CORS_ALLOWED_ORIGIN" "DISPLAY_KEYS" "DATABASE" "SERVER_BROKER_ENDPOINT" "STUN_PORT" "VERBOSITY"
"TURN_PORT" "USE_TURN" "DEBUG_MODE" "TURN_API_PORT" "REST_BACKEND"
"DISABLE_REMOTE_IP_CHECK" "TELEMETRY" "AUTH_PROVIDER" "CLIENT_ID" "CLIENT_SECRET"
"FRONTEND_URL" "AZURE_TENANT" "OIDC_ISSUER" "EXPORTER_API_PORT" "JWT_VALIDITY_DURATION" "RAC_AUTO_DISABLE" "RAC_RESTRICT_TO_SINGLE_NETWORK")
"FRONTEND_URL" "AZURE_TENANT" "OIDC_ISSUER" "EXPORTER_API_PORT" "JWT_VALIDITY_DURATION" "RAC_RESTRICT_TO_SINGLE_NETWORK")
for name in "${toCopy[@]}"; do
save_config_item $name "${!name}"
done

6
servercfg/serverconf.go
View file

@ -91,7 +91,6 @@ func GetServerConfig() config.ServerConfig {
cfg.IsPro = "yes"
}
cfg.JwtValidityDuration = GetJwtValidityDuration()
cfg.RacAutoDisable = GetRacAutoDisable()
cfg.RacRestrictToSingleNetwork = GetRacRestrictToSingleNetwork()
cfg.MetricInterval = GetMetricInterval()
cfg.ManageDNS = GetManageDNS()
@ -126,11 +125,6 @@ func GetJwtValidityDurationFromEnv() int {
return defaultDuration
}
// GetRacAutoDisable - returns whether the feature to autodisable RAC is enabled
func GetRacAutoDisable() bool {
return os.Getenv("RAC_AUTO_DISABLE") == "true"
}
// GetRacRestrictToSingleNetwork - returns whether the feature to allow simultaneous network connections via RAC is enabled
func GetRacRestrictToSingleNetwork() bool {
return os.Getenv("RAC_RESTRICT_TO_SINGLE_NETWORK") == "true"