gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-09-11 15:44:52 +08:00
Code Issues Projects Releases Packages Wiki Activity

NET-2061: Fix egress user policies (#3484)

Browse source 
* revert inet gws from acl policies

* add egress range with metric for inet gw

* link pro inet funcs

* fix extclient comms with users

* remove TODO comments

* add backwards compatibility to egress ranges

* remove all resources check

* remove device policy check on pro
This commit is contained in:
Abhishek K 2025-06-06 07:36:49 +05:30 • committed by GitHub
parent fcc558e792
commit fdc8ea4320
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
logic/peers.go
View file

@ -207,8 +207,7 @@ func GetPeerUpdateForHost(network string, host *models.Host, allNodes []models.N
defaultUserPolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.UserPolicy) defaultUserPolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.UserPolicy)
defaultDevicePolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.DevicePolicy) defaultDevicePolicy, _ := GetDefaultPolicy(models.NetworkID(node.Network), models.DevicePolicy)
if (defaultDevicePolicy.Enabled && defaultUserPolicy.Enabled) || if (defaultDevicePolicy.Enabled && defaultUserPolicy.Enabled) ||
(!CheckIfAnyPolicyisUniDirectional(node, acls) && !CheckIfAnyActiveEgressPolicy(node, acls)) || (!CheckIfAnyPolicyisUniDirectional(node, acls) && !CheckIfAnyActiveEgressPolicy(node, acls)) {
CheckIfNodeHasAccessToAllResources(&node, acls) {
aclRule := models.AclRule{ aclRule := models.AclRule{
ID: fmt.Sprintf("%s-allowed-network-rules", node.ID.String()), ID: fmt.Sprintf("%s-allowed-network-rules", node.ID.String()),
AllowedProtocol: models.ALL, AllowedProtocol: models.ALL,

2
pro/logic/acls.go
View file

@ -1153,7 +1153,7 @@ func CheckIfAnyActiveEgressPolicy(targetNode models.Node, acls []models.Acl) boo
targetNodeTags[models.TagID(targetNode.ID.String())] = struct{}{} targetNodeTags[models.TagID(targetNode.ID.String())] = struct{}{}
targetNodeTags["*"] = struct{}{} targetNodeTags["*"] = struct{}{}
for _, acl := range acls { for _, acl := range acls {
if !acl.Enabled || acl.RuleType != models.DevicePolicy { if !acl.Enabled {
continue continue
} }
srcTags := logic.ConvAclTagToValueMap(acl.Src) srcTags := logic.ConvAclTagToValueMap(acl.Src)