gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-02-25 16:44:01 +08:00
Code Issues Projects Releases Packages Wiki Activity

added acl logic to affect peers

Browse source
This commit is contained in:
0xdcarns 2022-03-10 12:37:52 -05:00
parent 03d35528cc
commit af8918e35f
4 changed files with 31 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
controllers/network.go
View file

@ -251,6 +251,20 @@ func updateNetworkACL(w http.ResponseWriter, r *http.Request) {
returnErrorResponse(w, r, formatError(err, "badrequest"))
return
}
logger.Log(1, r.Header.Get("user"), "updated ACLs for network", netname)
// send peer updates
if servercfg.IsMessageQueueBackend() {
serverNode, err := logic.GetNetworkServerLeader(netname)
if err != nil {
logger.Log(1, "failed to find server node after ACL update on", netname)
} else {
if err = mq.PublishPeerUpdate(&serverNode); err != nil {
logger.Log(0, "failed to publish peer update after ACL update on", netname)
}
}
}
w.WriteHeader(http.StatusOK)
json.NewEncoder(w).Encode(newNetACL)
}
@ -265,6 +279,7 @@ func getNetworkACL(w http.ResponseWriter, r *http.Request) {
returnErrorResponse(w, r, formatError(err, "internal"))
return
}
logger.Log(2, r.Header.Get("user"), "fetched acl for network", netname)
w.WriteHeader(http.StatusOK)
json.NewEncoder(w).Encode(networkACL)
}

29
controllers/node.go
View file

@ -11,8 +11,6 @@ import (
"github.com/gravitl/netmaker/functions"
"github.com/gravitl/netmaker/logger"
"github.com/gravitl/netmaker/logic"
"github.com/gravitl/netmaker/logic/acls"
nodeacls "github.com/gravitl/netmaker/logic/acls/node-acls"
"github.com/gravitl/netmaker/models"
"github.com/gravitl/netmaker/mq"
"github.com/gravitl/netmaker/servercfg"
@ -36,8 +34,6 @@ func nodeHandlers(r *mux.Router) {
r.HandleFunc("/api/nodes/{network}", createNode).Methods("POST")
r.HandleFunc("/api/nodes/adm/{network}/lastmodified", authorize(true, "network", http.HandlerFunc(getLastModified))).Methods("GET")
r.HandleFunc("/api/nodes/adm/{network}/authenticate", authenticate).Methods("POST")
// ACLs
r.HandleFunc("/api/nodes/{network}/{nodeid}/acls", authorize(true, "node", http.HandlerFunc(updateNodeACL))).Methods("PUT")
}
func authenticate(response http.ResponseWriter, request *http.Request) {
@ -626,31 +622,6 @@ func deleteNode(w http.ResponseWriter, r *http.Request) {
runForceServerUpdate(&node)
}
func updateNodeACL(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
var params = mux.Vars(r)
var nodeID = params["nodeid"]
var networkID = params["network"]
var newNodeACL acls.ACL
// we decode our body request params
err := json.NewDecoder(r.Body).Decode(&newNodeACL)
if err != nil {
returnErrorResponse(w, r, formatError(err, "badrequest"))
return
}
newNodeACL, err = nodeacls.UpdateNodeACL(nodeacls.NetworkID(networkID), nodeacls.NodeID(nodeID), newNodeACL)
if err != nil {
returnErrorResponse(w, r, formatError(err, "internal"))
return
}
logger.Log(1, r.Header.Get("user"), "updated node ACL for", nodeID, "on network", networkID)
w.WriteHeader(http.StatusOK)
json.NewEncoder(w).Encode(newNodeACL)
}
func runUpdates(node *models.Node, ifaceDelta bool) {
go func() { // don't block http response
// publish node update if not server

5
logic/acls/common.go
View file

@ -33,6 +33,11 @@ func (acl ACL) IsAllowed(ID AclID) bool {
return acl[ID] == Allowed
}
// ACLContainer.IsAllowed - returns if the current ACL container contains allowed ACLs between two IDs
func (aclContainer ACLContainer) IsAllowed(ID1, ID2 AclID) bool {
return aclContainer[ID1].IsAllowed(ID2) && aclContainer[ID2].IsAllowed(ID1)
}
// ACLContainer.UpdateACL - saves the state of a ACL in the ACLContainer in memory
func (aclContainer ACLContainer) UpdateACL(ID AclID, acl ACL) ACLContainer {
aclContainer[ID] = acl

15
logic/peers.go
View file

@ -10,6 +10,8 @@ import (
"github.com/gravitl/netmaker/database"
"github.com/gravitl/netmaker/logger"
"github.com/gravitl/netmaker/logic/acls"
nodeacls "github.com/gravitl/netmaker/logic/acls/node-acls"
"github.com/gravitl/netmaker/models"
"github.com/gravitl/netmaker/netclient/ncutils"
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
@ -33,7 +35,7 @@ func GetHubPeer(networkName string) []models.Node {
*/
// GetNodePeers - fetches peers for a given node
func GetNodePeers(networkName string, excludeRelayed bool, isP2S bool) ([]models.Node, error) {
func GetNodePeers(networkName, nodeid string, excludeRelayed bool, isP2S bool) ([]models.Node, error) {
var peers []models.Node
var networkNodes, egressNetworkNodes, err = getNetworkEgressAndNodes(networkName)
if err != nil {
@ -45,6 +47,11 @@ func GetNodePeers(networkName string, excludeRelayed bool, isP2S bool) ([]models
logger.Log(2, errN.Error())
}
currentNetworkACLs, aclErr := nodeacls.FetchAllACLs(nodeacls.NetworkID(networkName))
if aclErr != nil {
return peers, aclErr
}
for _, node := range networkNodes {
var peer = models.Node{}
if node.IsEgressGateway == "yes" { // handle egress stuff
@ -79,7 +86,7 @@ func GetNodePeers(networkName string, excludeRelayed bool, isP2S bool) ([]models
}
}
}
if !isP2S || peer.IsHub == "yes" {
if !isP2S || peer.IsHub == "yes" && currentNetworkACLs.IsAllowed(acls.AclID(nodeid), acls.AclID(node.ID)) {
peers = append(peers, peer)
}
}
@ -107,7 +114,7 @@ func GetPeersList(refnode *models.Node) ([]models.Node, error) {
isP2S = true
}
if relayedNodeAddr == "" {
peers, err = GetNodePeers(networkName, excludeRelayed, isP2S)
peers, err = GetNodePeers(networkName, refnode.ID, excludeRelayed, isP2S)
} else {
var relayNode models.Node
relayNode, err = GetNodeRelay(networkName, relayedNodeAddr)
@ -127,7 +134,7 @@ func GetPeersList(refnode *models.Node) ([]models.Node, error) {
} else {
peerNode.AllowedIPs = append(peerNode.AllowedIPs, peerNode.RelayAddrs...)
}
nodepeers, err := GetNodePeers(networkName, false, isP2S)
nodepeers, err := GetNodePeers(networkName, refnode.ID, false, isP2S)
if err == nil && peerNode.UDPHolePunch == "yes" {
for _, nodepeer := range nodepeers {
if nodepeer.Address == peerNode.Address {