gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-09-08 22:24:17 +08:00
Code Issues Projects Releases Packages Wiki Activity

remove userips usage, add allow all to fwupdate

Browse source
This commit is contained in:
abhishek9686 2024-10-23 14:15:13 +04:00
parent ffb75fa6c1
commit c0f107b302
5 changed files with 24 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
logic/acls.go
View file

@ -457,6 +457,9 @@ func IsUserAllowedToCommunicate(userName string, peer models.Node) bool {
continue
}
dstMap := convAclTagToValueMap(policy.Dst)
if _, ok := dstMap["*"]; ok {
return true
}
for tagID := range peer.Tags {
if _, ok := dstMap[tagID.String()]; ok {
return true

9
logic/extpeers.go
View file

@ -417,6 +417,7 @@ func GetStaticNodeIps(node models.Node) (ips []net.IP) {
func GetFwRulesOnIngressGateway(node models.Node) (rules []models.FwRule) {
// fetch user access to static clients via policies
nodes, _ := GetNetworkNodes(node.Network)
nodes = append(nodes, GetStaticNodesByNetwork(models.NetworkID(node.Network), true)...)
userNodes := GetStaticUserNodesByNetwork(models.NetworkID(node.Network))
@ -521,18 +522,18 @@ func GetFwRulesOnIngressGateway(node models.Node) (rules []models.FwRule) {
return
}
func GetExtPeers(node, peer *models.Node) ([]wgtypes.PeerConfig, []models.IDandAddr, []models.EgressNetworkRoutes, []net.IP, error) {
func GetExtPeers(node, peer *models.Node) ([]wgtypes.PeerConfig, []models.IDandAddr, []models.EgressNetworkRoutes, error) {
var peers []wgtypes.PeerConfig
var idsAndAddr []models.IDandAddr
var egressRoutes []models.EgressNetworkRoutes
var extUserIps []net.IP
extPeers, err := GetNetworkExtClients(node.Network)
if err != nil {
return peers, idsAndAddr, egressRoutes, extUserIps, err
return peers, idsAndAddr, egressRoutes, err
}
host, err := GetHost(node.HostID.String())
if err != nil {
return peers, idsAndAddr, egressRoutes, extUserIps, err
return peers, idsAndAddr, egressRoutes, err
}
for _, extPeer := range extPeers {
extPeer := extPeer
@ -613,7 +614,7 @@ func GetExtPeers(node, peer *models.Node) ([]wgtypes.PeerConfig, []models.IDandA
IsExtClient: true,
})
}
return peers, idsAndAddr, egressRoutes, extUserIps, nil
return peers, idsAndAddr, egressRoutes, nil
}

24
logic/peers.go
View file

@ -288,19 +288,23 @@ func GetPeerUpdateForHost(network string, host *models.Host, allNodes []models.N
var extPeers []wgtypes.PeerConfig
var extPeerIDAndAddrs []models.IDandAddr
var egressRoutes []models.EgressNetworkRoutes
var extUserIps []net.IP
if node.IsIngressGateway {
hostPeerUpdate.FwUpdate.IsIngressGw = true
extPeers, extPeerIDAndAddrs, egressRoutes, extUserIps, err = GetExtPeers(&node, &node)
extPeers, extPeerIDAndAddrs, egressRoutes, err = GetExtPeers(&node, &node)
if err == nil {
hostPeerUpdate.FwUpdate.IngressInfo[node.ID.String()] = models.IngressInfo{
IngressID: node.ID.String(),
UserIps: extUserIps,
Network: node.NetworkRange,
Network6: node.NetworkRange6,
Rules: GetFwRulesOnIngressGateway(node),
StaticNodeIps: GetStaticNodeIps(node),
defaultUserPolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.UserPolicy)
defaultDevicePolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.DevicePolicy)
ingFwUpdate := models.IngressInfo{
IngressID: node.ID.String(),
Network: node.NetworkRange,
Network6: node.NetworkRange6,
AllowAll: defaultDevicePolicy.Enabled && defaultUserPolicy.Default,
}
if !ingFwUpdate.AllowAll {
ingFwUpdate.StaticNodeIps = GetStaticNodeIps(node)
ingFwUpdate.Rules = GetFwRulesOnIngressGateway(node)
}
hostPeerUpdate.FwUpdate.IngressInfo[node.ID.String()] = ingFwUpdate
hostPeerUpdate.EgressRoutes = append(hostPeerUpdate.EgressRoutes, egressRoutes...)
hostPeerUpdate.Peers = append(hostPeerUpdate.Peers, extPeers...)
for _, extPeerIdAndAddr := range extPeerIDAndAddrs {
@ -432,7 +436,7 @@ func GetAllowedIPs(node, peer *models.Node, metrics *models.Metrics) []net.IPNet
// handle ingress gateway peers
if peer.IsIngressGateway {
extPeers, _, _, _, err := GetExtPeers(peer, node)
extPeers, _, _, err := GetExtPeers(peer, node)
if err != nil {
logger.Log(2, "could not retrieve ext peers for ", peer.ID.String(), err.Error())
}

2
models/mqtt.go
View file

@ -37,9 +37,9 @@ type IngressInfo struct {
IngressID string `json:"ingress_id"`
Network net.IPNet `json:"network"`
Network6 net.IPNet `json:"network6"`
UserIps []net.IP `json:"user_ips"`
StaticNodeIps []net.IP `json:"static_node_ips"`
Rules []FwRule `json:"rules"`
AllowAll bool `json:"allow_all"`
}
// EgressInfo - struct for egress info

2
pro/logic/failover.go
View file

@ -148,7 +148,7 @@ func GetFailOverPeerIps(peer, node *models.Node) []net.IPNet {
}
// handle ingress gateway peers
if failOverpeer.IsIngressGateway {
extPeers, _, _, _, err := logic.GetExtPeers(&failOverpeer, node)
extPeers, _, _, err := logic.GetExtPeers(&failOverpeer, node)
if err != nil {
logger.Log(2, "could not retrieve ext peers for ", peer.ID.String(), err.Error())
}