From af8918e35fc8fb02c2f6b2b550f053fda6f131a2 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Thu, 10 Mar 2022 12:37:52 -0500 Subject: [PATCH] added acl logic to affect peers --- controllers/network.go | 15 +++++++++++++++ controllers/node.go | 29 ----------------------------- logic/acls/common.go | 5 +++++ logic/peers.go | 15 +++++++++++---- 4 files changed, 31 insertions(+), 33 deletions(-) diff --git a/controllers/network.go b/controllers/network.go index c19d060b..74182a44 100644 --- a/controllers/network.go +++ b/controllers/network.go @@ -251,6 +251,20 @@ func updateNetworkACL(w http.ResponseWriter, r *http.Request) { returnErrorResponse(w, r, formatError(err, "badrequest")) return } + logger.Log(1, r.Header.Get("user"), "updated ACLs for network", netname) + + // send peer updates + if servercfg.IsMessageQueueBackend() { + serverNode, err := logic.GetNetworkServerLeader(netname) + if err != nil { + logger.Log(1, "failed to find server node after ACL update on", netname) + } else { + if err = mq.PublishPeerUpdate(&serverNode); err != nil { + logger.Log(0, "failed to publish peer update after ACL update on", netname) + } + } + } + w.WriteHeader(http.StatusOK) json.NewEncoder(w).Encode(newNetACL) } @@ -265,6 +279,7 @@ func getNetworkACL(w http.ResponseWriter, r *http.Request) { returnErrorResponse(w, r, formatError(err, "internal")) return } + logger.Log(2, r.Header.Get("user"), "fetched acl for network", netname) w.WriteHeader(http.StatusOK) json.NewEncoder(w).Encode(networkACL) } diff --git a/controllers/node.go b/controllers/node.go index d1afa119..5f47a63f 100644 --- a/controllers/node.go +++ b/controllers/node.go @@ -11,8 +11,6 @@ import ( "github.com/gravitl/netmaker/functions" "github.com/gravitl/netmaker/logger" "github.com/gravitl/netmaker/logic" - "github.com/gravitl/netmaker/logic/acls" - nodeacls "github.com/gravitl/netmaker/logic/acls/node-acls" "github.com/gravitl/netmaker/models" "github.com/gravitl/netmaker/mq" "github.com/gravitl/netmaker/servercfg" @@ -36,8 +34,6 @@ func nodeHandlers(r *mux.Router) { r.HandleFunc("/api/nodes/{network}", createNode).Methods("POST") r.HandleFunc("/api/nodes/adm/{network}/lastmodified", authorize(true, "network", http.HandlerFunc(getLastModified))).Methods("GET") r.HandleFunc("/api/nodes/adm/{network}/authenticate", authenticate).Methods("POST") - // ACLs - r.HandleFunc("/api/nodes/{network}/{nodeid}/acls", authorize(true, "node", http.HandlerFunc(updateNodeACL))).Methods("PUT") } func authenticate(response http.ResponseWriter, request *http.Request) { @@ -626,31 +622,6 @@ func deleteNode(w http.ResponseWriter, r *http.Request) { runForceServerUpdate(&node) } -func updateNodeACL(w http.ResponseWriter, r *http.Request) { - w.Header().Set("Content-Type", "application/json") - - var params = mux.Vars(r) - var nodeID = params["nodeid"] - var networkID = params["network"] - var newNodeACL acls.ACL - // we decode our body request params - err := json.NewDecoder(r.Body).Decode(&newNodeACL) - if err != nil { - returnErrorResponse(w, r, formatError(err, "badrequest")) - return - } - - newNodeACL, err = nodeacls.UpdateNodeACL(nodeacls.NetworkID(networkID), nodeacls.NodeID(nodeID), newNodeACL) - if err != nil { - returnErrorResponse(w, r, formatError(err, "internal")) - return - } - - logger.Log(1, r.Header.Get("user"), "updated node ACL for", nodeID, "on network", networkID) - w.WriteHeader(http.StatusOK) - json.NewEncoder(w).Encode(newNodeACL) -} - func runUpdates(node *models.Node, ifaceDelta bool) { go func() { // don't block http response // publish node update if not server diff --git a/logic/acls/common.go b/logic/acls/common.go index 08bf17a0..7298c137 100644 --- a/logic/acls/common.go +++ b/logic/acls/common.go @@ -33,6 +33,11 @@ func (acl ACL) IsAllowed(ID AclID) bool { return acl[ID] == Allowed } +// ACLContainer.IsAllowed - returns if the current ACL container contains allowed ACLs between two IDs +func (aclContainer ACLContainer) IsAllowed(ID1, ID2 AclID) bool { + return aclContainer[ID1].IsAllowed(ID2) && aclContainer[ID2].IsAllowed(ID1) +} + // ACLContainer.UpdateACL - saves the state of a ACL in the ACLContainer in memory func (aclContainer ACLContainer) UpdateACL(ID AclID, acl ACL) ACLContainer { aclContainer[ID] = acl diff --git a/logic/peers.go b/logic/peers.go index 289bb612..e78c7294 100644 --- a/logic/peers.go +++ b/logic/peers.go @@ -10,6 +10,8 @@ import ( "github.com/gravitl/netmaker/database" "github.com/gravitl/netmaker/logger" + "github.com/gravitl/netmaker/logic/acls" + nodeacls "github.com/gravitl/netmaker/logic/acls/node-acls" "github.com/gravitl/netmaker/models" "github.com/gravitl/netmaker/netclient/ncutils" "golang.zx2c4.com/wireguard/wgctrl/wgtypes" @@ -33,7 +35,7 @@ func GetHubPeer(networkName string) []models.Node { */ // GetNodePeers - fetches peers for a given node -func GetNodePeers(networkName string, excludeRelayed bool, isP2S bool) ([]models.Node, error) { +func GetNodePeers(networkName, nodeid string, excludeRelayed bool, isP2S bool) ([]models.Node, error) { var peers []models.Node var networkNodes, egressNetworkNodes, err = getNetworkEgressAndNodes(networkName) if err != nil { @@ -45,6 +47,11 @@ func GetNodePeers(networkName string, excludeRelayed bool, isP2S bool) ([]models logger.Log(2, errN.Error()) } + currentNetworkACLs, aclErr := nodeacls.FetchAllACLs(nodeacls.NetworkID(networkName)) + if aclErr != nil { + return peers, aclErr + } + for _, node := range networkNodes { var peer = models.Node{} if node.IsEgressGateway == "yes" { // handle egress stuff @@ -79,7 +86,7 @@ func GetNodePeers(networkName string, excludeRelayed bool, isP2S bool) ([]models } } } - if !isP2S || peer.IsHub == "yes" { + if !isP2S || peer.IsHub == "yes" && currentNetworkACLs.IsAllowed(acls.AclID(nodeid), acls.AclID(node.ID)) { peers = append(peers, peer) } } @@ -107,7 +114,7 @@ func GetPeersList(refnode *models.Node) ([]models.Node, error) { isP2S = true } if relayedNodeAddr == "" { - peers, err = GetNodePeers(networkName, excludeRelayed, isP2S) + peers, err = GetNodePeers(networkName, refnode.ID, excludeRelayed, isP2S) } else { var relayNode models.Node relayNode, err = GetNodeRelay(networkName, relayedNodeAddr) @@ -127,7 +134,7 @@ func GetPeersList(refnode *models.Node) ([]models.Node, error) { } else { peerNode.AllowedIPs = append(peerNode.AllowedIPs, peerNode.RelayAddrs...) } - nodepeers, err := GetNodePeers(networkName, false, isP2S) + nodepeers, err := GetNodePeers(networkName, refnode.ID, false, isP2S) if err == nil && peerNode.UDPHolePunch == "yes" { for _, nodepeer := range nodepeers { if nodepeer.Address == peerNode.Address {