gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-09-14 00:54:21 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #3251 from gravitl/NET-1784-latest

Browse source 
NET-1784: add allowed network cidr to acl rules
This commit is contained in:
Abhishek K 2024-12-15 10:43:57 +04:00 • committed by GitHub
commit b0f09e3517
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 37 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
logic/peers.go
View file

@ -85,6 +85,24 @@ func GetPeerUpdateForHost(network string, host *models.Host, allNodes []models.N
HostNetworkInfo: models.HostInfoMap{},
EndpointDetection: servercfg.IsEndpointDetectionEnabled(),
}
defer func() {
if !hostPeerUpdate.FwUpdate.AllowAll {
aclRule := models.AclRule{
ID: "allowed-network-rules",
AllowedProtocol: models.ALL,
Direction: models.TrafficDirectionBi,
Allowed: true,
}
for _, allowedNet := range hostPeerUpdate.FwUpdate.AllowedNetworks {
if allowedNet.IP.To4() != nil {
aclRule.IPList = append(aclRule.IPList, allowedNet)
} else {
aclRule.IP6List = append(aclRule.IP6List, allowedNet)
}
}
hostPeerUpdate.FwUpdate.AclRules["allowed-network-rules"] = aclRule
}
}()
slog.Debug("peer update for host", "hostId", host.ID.String())
peerIndexMap := make(map[string]int)
@ -158,17 +176,20 @@ func GetPeerUpdateForHost(network string, host *models.Host, allNodes []models.N
}
defaultUserPolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.UserPolicy)
defaultDevicePolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.DevicePolicy)
if node.NetworkRange.IP != nil {
hostPeerUpdate.FwUpdate.Networks = append(hostPeerUpdate.FwUpdate.Networks, node.NetworkRange)
}
if node.NetworkRange6.IP != nil {
hostPeerUpdate.FwUpdate.Networks = append(hostPeerUpdate.FwUpdate.Networks, node.NetworkRange6)
if defaultDevicePolicy.Enabled && defaultUserPolicy.Enabled {
if node.NetworkRange.IP != nil {
hostPeerUpdate.FwUpdate.AllowedNetworks = append(hostPeerUpdate.FwUpdate.AllowedNetworks, node.NetworkRange)
}
if node.NetworkRange6.IP != nil {
hostPeerUpdate.FwUpdate.AllowedNetworks = append(hostPeerUpdate.FwUpdate.AllowedNetworks, node.NetworkRange6)
}
} else {
hostPeerUpdate.FwUpdate.AllowAll = false
hostPeerUpdate.FwUpdate.AclRules = GetAclRulesForNode(&node)
}
if !defaultDevicePolicy.Enabled || !defaultUserPolicy.Enabled {
hostPeerUpdate.FwUpdate.AllowAll = false
}
hostPeerUpdate.FwUpdate.AclRules = GetAclRulesForNode(&node)
currentPeers := GetNetworkNodesMemory(allNodes, node.Network)
for _, peer := range currentPeers {
peer := peer

14
models/mqtt.go
View file

@ -94,13 +94,13 @@ type KeyUpdate struct {
// FwUpdate - struct for firewall updates
type FwUpdate struct {
AllowAll bool `json:"allow_all"`
Networks []net.IPNet `json:"networks"`
IsEgressGw bool `json:"is_egress_gw"`
IsIngressGw bool `json:"is_ingress_gw"`
EgressInfo map[string]EgressInfo `json:"egress_info"`
IngressInfo map[string]IngressInfo `json:"ingress_info"`
AclRules map[string]AclRule `json:"acl_rules"`
AllowAll bool `json:"allow_all"`
AllowedNetworks []net.IPNet `json:"networks"`
IsEgressGw bool `json:"is_egress_gw"`
IsIngressGw bool `json:"is_ingress_gw"`
EgressInfo map[string]EgressInfo `json:"egress_info"`
IngressInfo map[string]IngressInfo `json:"ingress_info"`
AclRules map[string]AclRule `json:"acl_rules"`
}
// FailOverMeReq - struct for failover req