gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-09-06 21:24:16 +08:00
Code Issues Projects Releases Packages Wiki Activity

fix egress policies acls comms (#3420)

Browse source
This commit is contained in:
Abhishek K 2025-04-14 15:21:06 +04:00 • committed by GitHub
parent b5842b7b06
commit e2a0ceccf6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 47 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
logic/acls.go
View file

@ -1334,6 +1334,51 @@ func getUserAclRulesForNode(targetnode *models.Node,
return rules
}
func checkIfAnyActiveEgressPolicy(targetNode models.Node) bool {
if !targetNode.IsEgressGateway {
return false
}
var targetNodeTags = make(map[models.TagID]struct{})
if targetNode.Mutex != nil {
targetNode.Mutex.Lock()
targetNodeTags = maps.Clone(targetNode.Tags)
targetNode.Mutex.Unlock()
} else {
targetNodeTags = maps.Clone(targetNode.Tags)
}
if targetNodeTags == nil {
targetNodeTags = make(map[models.TagID]struct{})
}
targetNodeTags[models.TagID(targetNode.ID.String())] = struct{}{}
targetNodeTags["*"] = struct{}{}
acls, _ := ListAclsByNetwork(models.NetworkID(targetNode.Network))
for _, acl := range acls {
if !acl.Enabled {
continue
}
srcTags := convAclTagToValueMap(acl.Src)
dstTags := convAclTagToValueMap(acl.Dst)
for nodeTag := range targetNodeTags {
if acl.RuleType == models.DevicePolicy {
if _, ok := srcTags[nodeTag.String()]; ok {
return true
}
if _, ok := srcTags[targetNode.ID.String()]; ok {
return true
}
}
if _, ok := dstTags[nodeTag.String()]; ok {
return true
}
if _, ok := dstTags[targetNode.ID.String()]; ok {
return true
}
}
}
return false
}
func checkIfAnyPolicyisUniDirectional(targetNode models.Node) bool {
var targetNodeTags = make(map[models.TagID]struct{})
if targetNode.Mutex != nil {
@ -1617,7 +1662,7 @@ func GetEgressRulesForNode(targetnode models.Node) (rules map[string]models.AclR
/*
if target node is egress gateway
if acl policy has egress route and it is present in target node egress ranges
fetches all the nodes in that policy and add rules
fetch all the nodes in that policy and add rules
*/
for _, rangeI := range targetnode.EgressGatewayRanges {

2
logic/peers.go
View file

@ -204,7 +204,7 @@ func GetPeerUpdateForHost(network string, host *models.Host, allNodes []models.N
defaultUserPolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.UserPolicy)
defaultDevicePolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.DevicePolicy)
if (defaultDevicePolicy.Enabled && defaultUserPolicy.Enabled) || !checkIfAnyPolicyisUniDirectional(node) {
if (defaultDevicePolicy.Enabled && defaultUserPolicy.Enabled) || (!checkIfAnyPolicyisUniDirectional(node) && !checkIfAnyActiveEgressPolicy(node)) {
if node.NetworkRange.IP != nil {
hostPeerUpdate.FwUpdate.AllowedNetworks = append(hostPeerUpdate.FwUpdate.AllowedNetworks, node.NetworkRange)
}