mirror of
https://github.com/gravitl/netmaker.git
synced 2025-09-05 20:54:18 +08:00
* feat: api access tokens
* revoke all user tokens
* redefine access token api routes, add auto egress option to enrollment keys
* add server settings apis, add db table for settigs
* handle server settings updates
* switch to using settings from DB
* fix sever settings migration
* revet force migration for settings
* fix server settings database write
* egress model
* fix revoked tokens to be unauthorized
* update egress model
* remove unused functions
* convert access token to sql schema
* switch access token to sql schema
* fix merge conflicts
* fix server settings types
* bypass basic auth setting for super admin
* add TODO comment
* setup api handlers for egress revamp
* use single DB, fix update nat boolean field
* extend validaiton checks for egress ranges
* add migration to convert to new egress model
* fix panic interface conversion
* publish peer update on settings update
* revoke token generated by an user
* add user token creation restriction by user role
* add forbidden check for access token creation
* revoke user token when group or role is changed
* add default group to admin users on update
* chore(go): import style changes from migration branch;
1. Singular file names for table schema.
2. No table name method.
3. Use .Model instead of .Table.
4. No unnecessary tagging.
* remove nat check on egress gateway request
* Revert "remove nat check on egress gateway request"
This reverts commit 0aff12a189
.
* remove nat check on egress gateway request
* feat(go): add db middleware;
* feat(go): restore method;
* feat(go): add user access token schema;
* add inet gw status to egress model
* fetch node ids in the tag, add inet gw info clients
* add inet gw info to node from egress list
* add migration logic internet gws
* create default acl policies
* add egress info
* add egress TODO
* add egress TODO
* fix user auth api:
* add reference id to acl policy
* add egress response from DB
* publish peer update on egress changes
* re initalise oauth and email config
* set verbosity
* normalise cidr on egress req
* add egress id to acl group
* change acls to use egress id
* resolve merge conflicts
* fix egress reference errors
* move egress model to schema
* add api context to DB
* sync auto update settings with hosts
* sync auto update settings with hosts
* check acl for egress node
* check for egress policy in the acl dst groups
* fix acl rules for egress policies with new models
* add status to egress model
* fix inet node func
* mask secret and convert jwt duration to minutes
* enable egress policies on creation
* convert jwt duration to minutes
* add relevant ranges to inet egress
* skip non active egress routes
* resolve merge conflicts
* fix static check
* update gorm tag for primary key on egress model
* create user policies for egress resources
* resolve merge conflicts
* get egress info on failover apis, add egress src validation for inet gws
* add additional validation checks on egress req
* add additional validation checks on egress req
* skip all resources for inet policy
* delete associated egress acl policies
* fix failover of inetclient
* avoid setting inet client asd inet gw
* fix all resource egress policy
* fix inet gw egress rule
* check for node egress on relay req
* fix egress acl rules comms
* add new field for egress info on node
* check acl policy in failover ctx
* avoid default host to be set as inet client
* fix relayed egress node
* add valid error messaging for egress validate func
* return if inet default host
* jump port detection to 51821
* check host ports on pull
* check user access gws via acls
* add validation check for default host and failover for inet clients
* add error messaging for acl policy check
* fix inet gw status
* ignore failover req for peer using inet gw
* check for allowed egress ranges for a peer
* add egress routes to static nodes by access
* avoid setting failvoer as inet client
* fix egress error messaging
* fix extclients egress comms
* fix inet gw acting as inet client
* return formatted error on update acl validation
* add default route for static nodes on inetclient
* check relay node acting as inetclient
* move inet node info to separate field, fix all resouces policy
* remove debug logs
---------
Co-authored-by: Vishal Dalwadi <dalwadivishal26@gmail.com>
121 lines
5 KiB
Go
121 lines
5 KiB
Go
package models
|
|
|
|
import (
|
|
"net"
|
|
|
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
|
)
|
|
|
|
type HostPeerInfo struct {
|
|
NetworkPeerIDs map[NetworkID]PeerMap `json:"network_peers"`
|
|
}
|
|
|
|
// HostPeerUpdate - struct for host peer updates
|
|
type HostPeerUpdate struct {
|
|
Host Host `json:"host"`
|
|
ChangeDefaultGw bool `json:"change_default_gw"`
|
|
DefaultGwIp net.IP `json:"default_gw_ip"`
|
|
IsInternetGw bool `json:"is_inet_gw"`
|
|
NodeAddrs []net.IPNet `json:"nodes_addrs"`
|
|
Server string `json:"server"`
|
|
ServerVersion string `json:"serverversion"`
|
|
ServerAddrs []ServerAddr `json:"serveraddrs"`
|
|
NodePeers []wgtypes.PeerConfig `json:"node_peers"`
|
|
Peers []wgtypes.PeerConfig `json:"host_peers"`
|
|
PeerIDs PeerMap `json:"peerids"`
|
|
HostNetworkInfo HostInfoMap `json:"host_network_info,omitempty"`
|
|
EgressRoutes []EgressNetworkRoutes `json:"egress_network_routes"`
|
|
FwUpdate FwUpdate `json:"fw_update"`
|
|
ReplacePeers bool `json:"replace_peers"`
|
|
NameServers []string `json:"name_servers"`
|
|
ServerConfig
|
|
OldPeerUpdateFields
|
|
}
|
|
|
|
type OldPeerUpdateFields struct {
|
|
NodePeers []wgtypes.PeerConfig `json:"peers" bson:"peers" yaml:"peers"`
|
|
OldPeers []wgtypes.PeerConfig `json:"Peers"`
|
|
EndpointDetection bool `json:"endpoint_detection"`
|
|
}
|
|
|
|
type FwRule struct {
|
|
SrcIP net.IPNet `json:"src_ip"`
|
|
DstIP net.IPNet `json:"dst_ip"`
|
|
AllowedProtocol Protocol `json:"allowed_protocols"` // tcp, udp, etc.
|
|
AllowedPorts []string `json:"allowed_ports"`
|
|
Allow bool `json:"allow"`
|
|
}
|
|
|
|
// IngressInfo - struct for ingress info
|
|
type IngressInfo struct {
|
|
IngressID string `json:"ingress_id"`
|
|
Network net.IPNet `json:"network"`
|
|
Network6 net.IPNet `json:"network6"`
|
|
StaticNodeIps []net.IP `json:"static_node_ips"`
|
|
Rules []FwRule `json:"rules"`
|
|
EgressRanges []net.IPNet `json:"egress_ranges"`
|
|
EgressRanges6 []net.IPNet `json:"egress_ranges6"`
|
|
}
|
|
|
|
// EgressInfo - struct for egress info
|
|
type EgressInfo struct {
|
|
EgressID string `json:"egress_id" yaml:"egress_id"`
|
|
Network net.IPNet `json:"network" yaml:"network"`
|
|
EgressGwAddr net.IPNet `json:"egress_gw_addr" yaml:"egress_gw_addr"`
|
|
Network6 net.IPNet `json:"network6" yaml:"network6"`
|
|
EgressGwAddr6 net.IPNet `json:"egress_gw_addr6" yaml:"egress_gw_addr6"`
|
|
EgressGWCfg EgressGatewayRequest `json:"egress_gateway_cfg" yaml:"egress_gateway_cfg"`
|
|
EgressFwRules map[string]AclRule `json:"egress_fw_rules"`
|
|
}
|
|
|
|
// EgressNetworkRoutes - struct for egress network routes for adding routes to peer's interface
|
|
type EgressNetworkRoutes struct {
|
|
PeerKey string `json:"peer_key"`
|
|
EgressGwAddr net.IPNet `json:"egress_gw_addr" yaml:"egress_gw_addr"`
|
|
EgressGwAddr6 net.IPNet `json:"egress_gw_addr6" yaml:"egress_gw_addr6"`
|
|
NodeAddr net.IPNet `json:"node_addr"`
|
|
NodeAddr6 net.IPNet `json:"node_addr6"`
|
|
EgressRanges []string `json:"egress_ranges"`
|
|
EgressRangesWithMetric []EgressRangeMetric `json:"egress_ranges_metric"`
|
|
Network string `json:"network"`
|
|
}
|
|
|
|
// PeerRouteInfo - struct for peer info for an ext. client
|
|
type PeerRouteInfo struct {
|
|
PeerAddr net.IPNet `json:"peer_addr" yaml:"peer_addr"`
|
|
PeerKey string `json:"peer_key" yaml:"peer_key"`
|
|
Allow bool `json:"allow" yaml:"allow"`
|
|
ID string `json:"id,omitempty" yaml:"id,omitempty"`
|
|
}
|
|
|
|
// ExtClientInfo - struct for ext. client and it's peers
|
|
type ExtClientInfo struct {
|
|
IngGwAddr net.IPNet `json:"ingress_gw_addr" yaml:"ingress_gw_addr"`
|
|
Network net.IPNet `json:"network" yaml:"network"`
|
|
Masquerade bool `json:"masquerade" yaml:"masquerade"`
|
|
ExtPeerAddr net.IPNet `json:"ext_peer_addr" yaml:"ext_peer_addr"`
|
|
ExtPeerKey string `json:"ext_peer_key" yaml:"ext_peer_key"`
|
|
Peers map[string]PeerRouteInfo `json:"peers" yaml:"peers"`
|
|
}
|
|
|
|
// KeyUpdate - key update struct
|
|
type KeyUpdate struct {
|
|
Network string `json:"network" bson:"network"`
|
|
Interface string `json:"interface" bson:"interface"`
|
|
}
|
|
|
|
// FwUpdate - struct for firewall updates
|
|
type FwUpdate struct {
|
|
AllowAll bool `json:"allow_all"`
|
|
AllowedNetworks []AclRule `json:"networks"`
|
|
IsEgressGw bool `json:"is_egress_gw"`
|
|
IsIngressGw bool `json:"is_ingress_gw"`
|
|
EgressInfo map[string]EgressInfo `json:"egress_info"`
|
|
IngressInfo map[string]IngressInfo `json:"ingress_info"`
|
|
AclRules map[string]AclRule `json:"acl_rules"`
|
|
}
|
|
|
|
// FailOverMeReq - struct for failover req
|
|
type FailOverMeReq struct {
|
|
NodeID string `json:"node_id"`
|
|
}
|