mirror of
https://github.com/gravitl/netmaker.git
synced 2024-09-20 23:36:18 +08:00
719 lines
23 KiB
Go
719 lines
23 KiB
Go
package logic
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
"net/netip"
|
|
|
|
"github.com/gravitl/netmaker/database"
|
|
"github.com/gravitl/netmaker/logger"
|
|
"github.com/gravitl/netmaker/logic/acls/nodeacls"
|
|
"github.com/gravitl/netmaker/models"
|
|
"github.com/gravitl/netmaker/servercfg"
|
|
"golang.org/x/exp/slices"
|
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
|
)
|
|
|
|
var (
|
|
// PeerUpdateCtx context to send to host peer updates
|
|
PeerUpdateCtx context.Context
|
|
// PeerUpdateStop - the cancel for PeerUpdateCtx
|
|
PeerUpdateStop context.CancelFunc
|
|
)
|
|
|
|
// GetProxyUpdateForHost - gets the proxy update for host
|
|
func GetProxyUpdateForHost(ctx context.Context, host *models.Host) (models.ProxyManagerPayload, error) {
|
|
proxyPayload := models.ProxyManagerPayload{
|
|
Action: models.ProxyUpdate,
|
|
}
|
|
peerConfMap := make(map[string]models.PeerConf)
|
|
if host.IsRelayed {
|
|
relayHost, err := GetHost(host.RelayedBy)
|
|
if err == nil {
|
|
relayEndpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayHost.EndpointIP, GetPeerListenPort(relayHost)))
|
|
if err != nil {
|
|
logger.Log(1, "failed to resolve relay node endpoint: ", err.Error())
|
|
}
|
|
proxyPayload.IsRelayed = true
|
|
proxyPayload.RelayedTo = relayEndpoint
|
|
} else {
|
|
logger.Log(0, "couldn't find relay host for: ", host.ID.String())
|
|
}
|
|
}
|
|
if host.IsRelay {
|
|
relayedHosts := GetRelayedHosts(host)
|
|
relayPeersMap := make(map[string]models.RelayedConf)
|
|
for _, relayedHost := range relayedHosts {
|
|
relayedHost := relayedHost
|
|
payload, err := GetPeerUpdateForHost(ctx, "", &relayedHost, nil, nil)
|
|
if err == nil {
|
|
relayedEndpoint, udpErr := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayedHost.EndpointIP, GetPeerListenPort(&relayedHost)))
|
|
if udpErr == nil {
|
|
relayPeersMap[relayedHost.PublicKey.String()] = models.RelayedConf{
|
|
RelayedPeerEndpoint: relayedEndpoint,
|
|
RelayedPeerPubKey: relayedHost.PublicKey.String(),
|
|
Peers: payload.Peers,
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
proxyPayload.IsRelay = true
|
|
proxyPayload.RelayedPeerConf = relayPeersMap
|
|
|
|
}
|
|
var ingressStatus bool
|
|
for _, nodeID := range host.Nodes {
|
|
|
|
node, err := GetNodeByID(nodeID)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
if !node.Connected || node.PendingDelete || node.Action == models.NODE_DELETE {
|
|
continue
|
|
}
|
|
currentPeers, err := GetNetworkNodes(node.Network)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
for _, peer := range currentPeers {
|
|
if peer.ID == node.ID {
|
|
//skip yourself
|
|
continue
|
|
}
|
|
if !peer.Connected || peer.PendingDelete || peer.Action == models.NODE_DELETE {
|
|
continue
|
|
}
|
|
peerHost, err := GetHost(peer.HostID.String())
|
|
if err != nil {
|
|
continue
|
|
}
|
|
var currPeerConf models.PeerConf
|
|
var found bool
|
|
if currPeerConf, found = peerConfMap[peerHost.PublicKey.String()]; !found {
|
|
currPeerConf = models.PeerConf{
|
|
Proxy: peerHost.ProxyEnabled,
|
|
PublicListenPort: int32(GetPeerListenPort(peerHost)),
|
|
ProxyListenPort: GetProxyListenPort(peerHost),
|
|
}
|
|
}
|
|
|
|
if peerHost.IsRelayed && peerHost.RelayedBy != host.ID.String() {
|
|
relayHost, err := GetHost(peerHost.RelayedBy)
|
|
if err == nil {
|
|
relayTo, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayHost.EndpointIP, GetPeerListenPort(relayHost)))
|
|
if err == nil {
|
|
currPeerConf.IsRelayed = true
|
|
currPeerConf.RelayedTo = relayTo
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
peerConfMap[peerHost.PublicKey.String()] = currPeerConf
|
|
}
|
|
if node.IsIngressGateway {
|
|
ingressStatus = true
|
|
_, peerConfMap, err = getExtPeersForProxy(&node, peerConfMap)
|
|
if err == nil {
|
|
|
|
} else if !database.IsEmptyRecord(err) {
|
|
logger.Log(1, "error retrieving external clients:", err.Error())
|
|
}
|
|
}
|
|
|
|
}
|
|
proxyPayload.IsIngress = ingressStatus
|
|
proxyPayload.PeerMap = peerConfMap
|
|
return proxyPayload, nil
|
|
}
|
|
|
|
// ResetPeerUpdateContext - kills any current peer updates and resets the context
|
|
func ResetPeerUpdateContext() {
|
|
if PeerUpdateCtx != nil && PeerUpdateStop != nil {
|
|
PeerUpdateStop() // tell any current peer updates to stop
|
|
}
|
|
|
|
PeerUpdateCtx, PeerUpdateStop = context.WithCancel(context.Background())
|
|
}
|
|
|
|
// GetPeerUpdateForHost - gets the consolidated peer update for the host from all networks
|
|
func GetPeerUpdateForHost(ctx context.Context, network string, host *models.Host, deletedNode *models.Node, deletedClients []models.ExtClient) (models.HostPeerUpdate, error) {
|
|
if host == nil {
|
|
return models.HostPeerUpdate{}, errors.New("host is nil")
|
|
}
|
|
allNodes, err := GetAllNodes()
|
|
if err != nil {
|
|
return models.HostPeerUpdate{}, err
|
|
}
|
|
// track which nodes are deleted
|
|
// after peer calculation, if peer not in list, add delete config of peer
|
|
hostPeerUpdate := models.HostPeerUpdate{
|
|
Host: *host,
|
|
Server: servercfg.GetServer(),
|
|
HostPeerIDs: make(models.HostPeerMap, 0),
|
|
ServerVersion: servercfg.GetVersion(),
|
|
ServerAddrs: []models.ServerAddr{},
|
|
IngressInfo: models.IngressInfo{
|
|
ExtPeers: make(map[string]models.ExtClientInfo),
|
|
},
|
|
EgressInfo: make(map[string]models.EgressInfo),
|
|
PeerIDs: make(models.PeerMap, 0),
|
|
Peers: []wgtypes.PeerConfig{},
|
|
NodePeers: []wgtypes.PeerConfig{},
|
|
HostNetworkInfo: models.HostInfoMap{},
|
|
}
|
|
|
|
logger.Log(1, "peer update for host", host.ID.String())
|
|
peerIndexMap := make(map[string]int)
|
|
for _, nodeID := range host.Nodes {
|
|
nodeID := nodeID
|
|
node, err := GetNodeByID(nodeID)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
if !node.Connected || node.PendingDelete || node.Action == models.NODE_DELETE {
|
|
continue
|
|
}
|
|
currentPeers := GetNetworkNodesMemory(allNodes, node.Network)
|
|
var nodePeerMap map[string]models.PeerRouteInfo
|
|
if node.IsIngressGateway || node.IsEgressGateway {
|
|
nodePeerMap = make(map[string]models.PeerRouteInfo)
|
|
}
|
|
for _, peer := range currentPeers {
|
|
select {
|
|
case <-ctx.Done():
|
|
logger.Log(2, "cancelled peer update for host", host.Name, host.ID.String())
|
|
return models.HostPeerUpdate{}, fmt.Errorf("peer update cancelled")
|
|
default:
|
|
peer := peer
|
|
if peer.ID.String() == node.ID.String() {
|
|
logger.Log(2, "peer update, skipping self")
|
|
//skip yourself
|
|
continue
|
|
}
|
|
var peerConfig wgtypes.PeerConfig
|
|
peerHost, err := GetHost(peer.HostID.String())
|
|
if err != nil {
|
|
logger.Log(1, "no peer host", peer.HostID.String(), err.Error())
|
|
return models.HostPeerUpdate{}, err
|
|
}
|
|
|
|
peerConfig.PublicKey = peerHost.PublicKey
|
|
peerConfig.PersistentKeepaliveInterval = &peer.PersistentKeepalive
|
|
peerConfig.ReplaceAllowedIPs = true
|
|
uselocal := false
|
|
if host.EndpointIP.String() == peerHost.EndpointIP.String() {
|
|
// peer is on same network
|
|
// set to localaddress
|
|
uselocal = true
|
|
if node.LocalAddress.IP == nil {
|
|
// use public endpint
|
|
uselocal = false
|
|
}
|
|
if node.LocalAddress.String() == peer.LocalAddress.String() {
|
|
uselocal = false
|
|
}
|
|
}
|
|
peerConfig.Endpoint = &net.UDPAddr{
|
|
IP: peerHost.EndpointIP,
|
|
Port: peerHost.ListenPort,
|
|
}
|
|
|
|
if uselocal {
|
|
peerConfig.Endpoint.IP = peer.LocalAddress.IP
|
|
}
|
|
allowedips := GetAllowedIPs(&node, &peer, nil)
|
|
if peer.IsIngressGateway {
|
|
for _, entry := range peer.IngressGatewayRange {
|
|
_, cidr, err := net.ParseCIDR(string(entry))
|
|
if err == nil {
|
|
allowedips = append(allowedips, *cidr)
|
|
}
|
|
}
|
|
}
|
|
if peer.IsEgressGateway {
|
|
allowedips = append(allowedips, getEgressIPs(&node, &peer)...)
|
|
}
|
|
if peer.Action != models.NODE_DELETE &&
|
|
!peer.PendingDelete &&
|
|
peer.Connected &&
|
|
nodeacls.AreNodesAllowed(nodeacls.NetworkID(node.Network), nodeacls.NodeID(node.ID.String()), nodeacls.NodeID(peer.ID.String())) &&
|
|
(deletedNode == nil || (deletedNode != nil && peer.ID.String() != deletedNode.ID.String())) {
|
|
peerConfig.AllowedIPs = allowedips // only append allowed IPs if valid connection
|
|
}
|
|
|
|
if node.IsIngressGateway || node.IsEgressGateway {
|
|
if peer.IsIngressGateway {
|
|
_, extPeerIDAndAddrs, err := getExtPeers(&peer)
|
|
if err == nil {
|
|
for _, extPeerIdAndAddr := range extPeerIDAndAddrs {
|
|
extPeerIdAndAddr := extPeerIdAndAddr
|
|
nodePeerMap[extPeerIdAndAddr.ID] = models.PeerRouteInfo{
|
|
PeerAddr: net.IPNet{
|
|
IP: net.ParseIP(extPeerIdAndAddr.Address),
|
|
Mask: getCIDRMaskFromAddr(extPeerIdAndAddr.Address),
|
|
},
|
|
PeerKey: extPeerIdAndAddr.ID,
|
|
Allow: true,
|
|
ID: extPeerIdAndAddr.ID,
|
|
}
|
|
}
|
|
}
|
|
}
|
|
if node.IsIngressGateway && peer.IsEgressGateway {
|
|
hostPeerUpdate.IngressInfo.EgressRanges = append(hostPeerUpdate.IngressInfo.EgressRanges,
|
|
peer.EgressGatewayRanges...)
|
|
}
|
|
nodePeerMap[peerHost.PublicKey.String()] = models.PeerRouteInfo{
|
|
PeerAddr: net.IPNet{
|
|
IP: net.ParseIP(peer.PrimaryAddress()),
|
|
Mask: getCIDRMaskFromAddr(peer.PrimaryAddress()),
|
|
},
|
|
PeerKey: peerHost.PublicKey.String(),
|
|
Allow: true,
|
|
ID: peer.ID.String(),
|
|
}
|
|
}
|
|
|
|
peerProxyPort := GetProxyListenPort(peerHost)
|
|
var nodePeer wgtypes.PeerConfig
|
|
if _, ok := hostPeerUpdate.HostPeerIDs[peerHost.PublicKey.String()]; !ok {
|
|
hostPeerUpdate.HostPeerIDs[peerHost.PublicKey.String()] = make(map[string]models.IDandAddr)
|
|
hostPeerUpdate.Peers = append(hostPeerUpdate.Peers, peerConfig)
|
|
peerIndexMap[peerHost.PublicKey.String()] = len(hostPeerUpdate.Peers) - 1
|
|
hostPeerUpdate.HostPeerIDs[peerHost.PublicKey.String()][peer.ID.String()] = models.IDandAddr{
|
|
ID: peer.ID.String(),
|
|
Address: peer.PrimaryAddress(),
|
|
Name: peerHost.Name,
|
|
Network: peer.Network,
|
|
ProxyListenPort: peerProxyPort,
|
|
}
|
|
hostPeerUpdate.HostNetworkInfo[peerHost.PublicKey.String()] = models.HostNetworkInfo{
|
|
Interfaces: peerHost.Interfaces,
|
|
ProxyListenPort: peerProxyPort,
|
|
}
|
|
nodePeer = peerConfig
|
|
} else {
|
|
peerAllowedIPs := hostPeerUpdate.Peers[peerIndexMap[peerHost.PublicKey.String()]].AllowedIPs
|
|
peerAllowedIPs = append(peerAllowedIPs, allowedips...)
|
|
hostPeerUpdate.Peers[peerIndexMap[peerHost.PublicKey.String()]].AllowedIPs = peerAllowedIPs
|
|
hostPeerUpdate.HostPeerIDs[peerHost.PublicKey.String()][peer.ID.String()] = models.IDandAddr{
|
|
ID: peer.ID.String(),
|
|
Address: peer.PrimaryAddress(),
|
|
Name: peerHost.Name,
|
|
Network: peer.Network,
|
|
ProxyListenPort: GetProxyListenPort(peerHost),
|
|
}
|
|
hostPeerUpdate.HostNetworkInfo[peerHost.PublicKey.String()] = models.HostNetworkInfo{
|
|
Interfaces: peerHost.Interfaces,
|
|
ProxyListenPort: peerProxyPort,
|
|
}
|
|
nodePeer = hostPeerUpdate.Peers[peerIndexMap[peerHost.PublicKey.String()]]
|
|
}
|
|
|
|
if node.Network == network { // add to peers map for metrics
|
|
hostPeerUpdate.PeerIDs[peerHost.PublicKey.String()] = models.IDandAddr{
|
|
ID: peer.ID.String(),
|
|
Address: peer.PrimaryAddress(),
|
|
Name: peerHost.Name,
|
|
Network: peer.Network,
|
|
ProxyListenPort: peerHost.ProxyListenPort,
|
|
}
|
|
hostPeerUpdate.NodePeers = append(hostPeerUpdate.NodePeers, nodePeer)
|
|
}
|
|
}
|
|
}
|
|
var extPeers []wgtypes.PeerConfig
|
|
var extPeerIDAndAddrs []models.IDandAddr
|
|
if node.IsIngressGateway {
|
|
extPeers, extPeerIDAndAddrs, err = getExtPeers(&node)
|
|
if err == nil {
|
|
for _, extPeerIdAndAddr := range extPeerIDAndAddrs {
|
|
extPeerIdAndAddr := extPeerIdAndAddr
|
|
nodePeerMap[extPeerIdAndAddr.ID] = models.PeerRouteInfo{
|
|
PeerAddr: net.IPNet{
|
|
IP: net.ParseIP(extPeerIdAndAddr.Address),
|
|
Mask: getCIDRMaskFromAddr(extPeerIdAndAddr.Address),
|
|
},
|
|
PeerKey: extPeerIdAndAddr.ID,
|
|
Allow: true,
|
|
ID: extPeerIdAndAddr.ID,
|
|
}
|
|
}
|
|
hostPeerUpdate.Peers = append(hostPeerUpdate.Peers, extPeers...)
|
|
for _, extPeerIdAndAddr := range extPeerIDAndAddrs {
|
|
extPeerIdAndAddr := extPeerIdAndAddr
|
|
hostPeerUpdate.HostPeerIDs[extPeerIdAndAddr.ID] = make(map[string]models.IDandAddr)
|
|
hostPeerUpdate.HostPeerIDs[extPeerIdAndAddr.ID][extPeerIdAndAddr.ID] = models.IDandAddr{
|
|
ID: extPeerIdAndAddr.ID,
|
|
Address: extPeerIdAndAddr.Address,
|
|
Name: extPeerIdAndAddr.Name,
|
|
Network: node.Network,
|
|
}
|
|
|
|
hostPeerUpdate.IngressInfo.ExtPeers[extPeerIdAndAddr.ID] = models.ExtClientInfo{
|
|
Masquerade: true,
|
|
IngGwAddr: net.IPNet{
|
|
IP: net.ParseIP(node.PrimaryAddress()),
|
|
Mask: getCIDRMaskFromAddr(node.PrimaryAddress()),
|
|
},
|
|
Network: node.PrimaryNetworkRange(),
|
|
ExtPeerAddr: net.IPNet{
|
|
IP: net.ParseIP(extPeerIdAndAddr.Address),
|
|
Mask: getCIDRMaskFromAddr(extPeerIdAndAddr.Address),
|
|
},
|
|
ExtPeerKey: extPeerIdAndAddr.ID,
|
|
Peers: filterNodeMapForClientACLs(extPeerIdAndAddr.ID, node.Network, nodePeerMap),
|
|
}
|
|
if node.Network == network {
|
|
hostPeerUpdate.PeerIDs[extPeerIdAndAddr.ID] = extPeerIdAndAddr
|
|
hostPeerUpdate.NodePeers = append(hostPeerUpdate.NodePeers, extPeers...)
|
|
}
|
|
}
|
|
} else if !database.IsEmptyRecord(err) {
|
|
logger.Log(1, "error retrieving external clients:", err.Error())
|
|
}
|
|
}
|
|
if node.IsEgressGateway {
|
|
hostPeerUpdate.EgressInfo[node.ID.String()] = models.EgressInfo{
|
|
EgressID: node.ID.String(),
|
|
Network: node.PrimaryNetworkRange(),
|
|
EgressGwAddr: net.IPNet{
|
|
IP: net.ParseIP(node.PrimaryAddress()),
|
|
Mask: getCIDRMaskFromAddr(node.PrimaryAddress()),
|
|
},
|
|
GwPeers: nodePeerMap,
|
|
EgressGWCfg: node.EgressGatewayRequest,
|
|
}
|
|
}
|
|
}
|
|
// == post peer calculations ==
|
|
// indicate removal if no allowed IPs were calculated
|
|
for i := range hostPeerUpdate.Peers {
|
|
peer := hostPeerUpdate.Peers[i]
|
|
if len(peer.AllowedIPs) == 0 {
|
|
peer.Remove = true
|
|
}
|
|
hostPeerUpdate.Peers[i] = peer
|
|
}
|
|
|
|
for i := range hostPeerUpdate.NodePeers {
|
|
peer := hostPeerUpdate.NodePeers[i]
|
|
if len(peer.AllowedIPs) == 0 {
|
|
peer.Remove = true
|
|
}
|
|
hostPeerUpdate.NodePeers[i] = peer
|
|
}
|
|
|
|
if len(deletedClients) > 0 {
|
|
for i := range deletedClients {
|
|
deletedClient := deletedClients[i]
|
|
key, err := wgtypes.ParseKey(deletedClient.PublicKey)
|
|
if err == nil {
|
|
hostPeerUpdate.Peers = append(hostPeerUpdate.Peers, wgtypes.PeerConfig{
|
|
PublicKey: key,
|
|
Remove: true,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|
|
return hostPeerUpdate, nil
|
|
}
|
|
|
|
// GetPeerListenPort - given a host, retrieve it's appropriate listening port
|
|
func GetPeerListenPort(host *models.Host) int {
|
|
peerPort := host.ListenPort
|
|
if host.ProxyEnabled {
|
|
if host.PublicListenPort != 0 {
|
|
peerPort = host.PublicListenPort
|
|
} else if host.ProxyListenPort != 0 {
|
|
peerPort = host.ProxyListenPort
|
|
}
|
|
}
|
|
return peerPort
|
|
}
|
|
|
|
// GetProxyListenPort - fetches the proxy listen port
|
|
func GetProxyListenPort(host *models.Host) int {
|
|
proxyPort := host.ProxyListenPort
|
|
if host.PublicListenPort != 0 {
|
|
proxyPort = host.PublicListenPort
|
|
}
|
|
return proxyPort
|
|
}
|
|
|
|
func getExtPeers(node *models.Node) ([]wgtypes.PeerConfig, []models.IDandAddr, error) {
|
|
var peers []wgtypes.PeerConfig
|
|
var idsAndAddr []models.IDandAddr
|
|
extPeers, err := GetNetworkExtClients(node.Network)
|
|
if err != nil {
|
|
return peers, idsAndAddr, err
|
|
}
|
|
host, err := GetHost(node.HostID.String())
|
|
if err != nil {
|
|
return peers, idsAndAddr, err
|
|
}
|
|
for _, extPeer := range extPeers {
|
|
extPeer := extPeer
|
|
pubkey, err := wgtypes.ParseKey(extPeer.PublicKey)
|
|
if err != nil {
|
|
logger.Log(1, "error parsing ext pub key:", err.Error())
|
|
continue
|
|
}
|
|
|
|
if host.PublicKey.String() == extPeer.PublicKey ||
|
|
extPeer.IngressGatewayID != node.ID.String() || !extPeer.Enabled {
|
|
continue
|
|
}
|
|
|
|
var allowedips []net.IPNet
|
|
var peer wgtypes.PeerConfig
|
|
if extPeer.Address != "" {
|
|
var peeraddr = net.IPNet{
|
|
IP: net.ParseIP(extPeer.Address),
|
|
Mask: net.CIDRMask(32, 32),
|
|
}
|
|
if peeraddr.IP != nil && peeraddr.Mask != nil {
|
|
allowedips = append(allowedips, peeraddr)
|
|
}
|
|
}
|
|
|
|
if extPeer.Address6 != "" {
|
|
var addr6 = net.IPNet{
|
|
IP: net.ParseIP(extPeer.Address6),
|
|
Mask: net.CIDRMask(128, 128),
|
|
}
|
|
if addr6.IP != nil && addr6.Mask != nil {
|
|
allowedips = append(allowedips, addr6)
|
|
}
|
|
}
|
|
|
|
primaryAddr := extPeer.Address
|
|
if primaryAddr == "" {
|
|
primaryAddr = extPeer.Address6
|
|
}
|
|
peer = wgtypes.PeerConfig{
|
|
PublicKey: pubkey,
|
|
ReplaceAllowedIPs: true,
|
|
AllowedIPs: allowedips,
|
|
}
|
|
peers = append(peers, peer)
|
|
idsAndAddr = append(idsAndAddr, models.IDandAddr{
|
|
ID: peer.PublicKey.String(),
|
|
Name: extPeer.ClientID,
|
|
Address: primaryAddr,
|
|
})
|
|
}
|
|
return peers, idsAndAddr, nil
|
|
|
|
}
|
|
|
|
func getExtPeersForProxy(node *models.Node, proxyPeerConf map[string]models.PeerConf) ([]wgtypes.PeerConfig, map[string]models.PeerConf, error) {
|
|
var peers []wgtypes.PeerConfig
|
|
host, err := GetHost(node.HostID.String())
|
|
if err != nil {
|
|
logger.Log(0, "error retrieving host for node", node.ID.String(), err.Error())
|
|
}
|
|
|
|
extPeers, err := GetNetworkExtClients(node.Network)
|
|
if err != nil {
|
|
return peers, proxyPeerConf, err
|
|
}
|
|
for _, extPeer := range extPeers {
|
|
pubkey, err := wgtypes.ParseKey(extPeer.PublicKey)
|
|
if err != nil {
|
|
logger.Log(1, "error parsing ext pub key:", err.Error())
|
|
continue
|
|
}
|
|
|
|
if host.PublicKey.String() == extPeer.PublicKey ||
|
|
extPeer.IngressGatewayID != node.ID.String() || !extPeer.Enabled {
|
|
continue
|
|
}
|
|
|
|
var allowedips []net.IPNet
|
|
var peer wgtypes.PeerConfig
|
|
if extPeer.Address != "" {
|
|
var peeraddr = net.IPNet{
|
|
IP: net.ParseIP(extPeer.Address),
|
|
Mask: net.CIDRMask(32, 32),
|
|
}
|
|
if peeraddr.IP != nil && peeraddr.Mask != nil {
|
|
allowedips = append(allowedips, peeraddr)
|
|
}
|
|
}
|
|
|
|
if extPeer.Address6 != "" {
|
|
var addr6 = net.IPNet{
|
|
IP: net.ParseIP(extPeer.Address6),
|
|
Mask: net.CIDRMask(128, 128),
|
|
}
|
|
if addr6.IP != nil && addr6.Mask != nil {
|
|
allowedips = append(allowedips, addr6)
|
|
}
|
|
}
|
|
|
|
peer = wgtypes.PeerConfig{
|
|
PublicKey: pubkey,
|
|
ReplaceAllowedIPs: true,
|
|
AllowedIPs: allowedips,
|
|
}
|
|
extConf := models.PeerConf{
|
|
IsExtClient: true,
|
|
Address: net.ParseIP(extPeer.Address),
|
|
}
|
|
proxyPeerConf[peer.PublicKey.String()] = extConf
|
|
|
|
peers = append(peers, peer)
|
|
}
|
|
return peers, proxyPeerConf, nil
|
|
|
|
}
|
|
|
|
// GetAllowedIPs - calculates the wireguard allowedip field for a peer of a node based on the peer and node settings
|
|
func GetAllowedIPs(node, peer *models.Node, metrics *models.Metrics) []net.IPNet {
|
|
var allowedips []net.IPNet
|
|
allowedips = getNodeAllowedIPs(peer, node)
|
|
|
|
// handle ingress gateway peers
|
|
if peer.IsIngressGateway {
|
|
extPeers, _, err := getExtPeers(peer)
|
|
if err != nil {
|
|
logger.Log(2, "could not retrieve ext peers for ", peer.ID.String(), err.Error())
|
|
}
|
|
for _, extPeer := range extPeers {
|
|
allowedips = append(allowedips, extPeer.AllowedIPs...)
|
|
}
|
|
// if node is a failover node, add allowed ips from nodes it is handling
|
|
if metrics != nil && peer.Failover && metrics.FailoverPeers != nil {
|
|
// traverse through nodes that need handling
|
|
logger.Log(3, "peer", peer.ID.String(), "was found to be failover for", node.ID.String(), "checking failover peers...")
|
|
for k := range metrics.FailoverPeers {
|
|
// if FailoverNode is me for this node, add allowedips
|
|
if metrics.FailoverPeers[k] == peer.ID.String() {
|
|
// get original node so we can traverse the allowed ips
|
|
nodeToFailover, err := GetNodeByID(k)
|
|
if err == nil {
|
|
failoverNodeMetrics, err := GetMetrics(nodeToFailover.ID.String())
|
|
if err == nil && failoverNodeMetrics != nil {
|
|
if len(failoverNodeMetrics.NodeName) > 0 {
|
|
allowedips = append(allowedips, getNodeAllowedIPs(&nodeToFailover, peer)...)
|
|
logger.Log(0, "failing over node", nodeToFailover.ID.String(), nodeToFailover.PrimaryAddress(), "to failover node", peer.ID.String())
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return allowedips
|
|
}
|
|
|
|
func getEgressIPs(node, peer *models.Node) []net.IPNet {
|
|
host, err := GetHost(node.HostID.String())
|
|
if err != nil {
|
|
logger.Log(0, "error retrieving host for node", node.ID.String(), err.Error())
|
|
}
|
|
peerHost, err := GetHost(peer.HostID.String())
|
|
if err != nil {
|
|
logger.Log(0, "error retrieving host for peer", peer.ID.String(), err.Error())
|
|
}
|
|
|
|
//check for internet gateway
|
|
internetGateway := false
|
|
if slices.Contains(peer.EgressGatewayRanges, "0.0.0.0/0") || slices.Contains(peer.EgressGatewayRanges, "::/0") {
|
|
internetGateway = true
|
|
}
|
|
allowedips := []net.IPNet{}
|
|
for _, iprange := range peer.EgressGatewayRanges { // go through each cidr for egress gateway
|
|
_, ipnet, err := net.ParseCIDR(iprange) // confirming it's valid cidr
|
|
if err != nil {
|
|
logger.Log(1, "could not parse gateway IP range. Not adding ", iprange)
|
|
continue // if can't parse CIDR
|
|
}
|
|
// getting the public ip of node
|
|
if ipnet.Contains(peerHost.EndpointIP) && !internetGateway { // ensuring egress gateway range does not contain endpoint of node
|
|
logger.Log(2, "egress IP range of ", iprange, " overlaps with ", host.EndpointIP.String(), ", omitting")
|
|
continue // skip adding egress range if overlaps with node's ip
|
|
}
|
|
// TODO: Could put in a lot of great logic to avoid conflicts / bad routes
|
|
if ipnet.Contains(node.LocalAddress.IP) && !internetGateway { // ensuring egress gateway range does not contain public ip of node
|
|
logger.Log(2, "egress IP range of ", iprange, " overlaps with ", node.LocalAddress.String(), ", omitting")
|
|
continue // skip adding egress range if overlaps with node's local ip
|
|
}
|
|
if err != nil {
|
|
logger.Log(1, "error encountered when setting egress range", err.Error())
|
|
} else {
|
|
allowedips = append(allowedips, *ipnet)
|
|
}
|
|
}
|
|
return allowedips
|
|
}
|
|
|
|
func getNodeAllowedIPs(peer, node *models.Node) []net.IPNet {
|
|
var allowedips = []net.IPNet{}
|
|
if peer.Address.IP != nil {
|
|
allowed := net.IPNet{
|
|
IP: peer.Address.IP,
|
|
Mask: net.CIDRMask(32, 32),
|
|
}
|
|
allowedips = append(allowedips, allowed)
|
|
}
|
|
if peer.Address6.IP != nil {
|
|
allowed := net.IPNet{
|
|
IP: peer.Address6.IP,
|
|
Mask: net.CIDRMask(128, 128),
|
|
}
|
|
allowedips = append(allowedips, allowed)
|
|
}
|
|
// handle egress gateway peers
|
|
if peer.IsEgressGateway {
|
|
//hasGateway = true
|
|
egressIPs := getEgressIPs(node, peer)
|
|
allowedips = append(allowedips, egressIPs...)
|
|
}
|
|
return allowedips
|
|
}
|
|
|
|
func getCIDRMaskFromAddr(addr string) net.IPMask {
|
|
cidr := net.CIDRMask(32, 32)
|
|
ipAddr, err := netip.ParseAddr(addr)
|
|
if err != nil {
|
|
return cidr
|
|
}
|
|
if ipAddr.Is6() {
|
|
cidr = net.CIDRMask(128, 128)
|
|
}
|
|
return cidr
|
|
}
|
|
|
|
// accounts for ext client ACLs
|
|
func filterNodeMapForClientACLs(publicKey, network string, nodePeerMap map[string]models.PeerRouteInfo) map[string]models.PeerRouteInfo {
|
|
if !isEE {
|
|
return nodePeerMap
|
|
}
|
|
if nodePeerMap == nil {
|
|
return map[string]models.PeerRouteInfo{}
|
|
}
|
|
|
|
if len(publicKey) == 0 || len(network) == 0 {
|
|
return nodePeerMap
|
|
}
|
|
|
|
client, err := GetExtClientByPubKey(publicKey, network)
|
|
if err != nil {
|
|
return nodePeerMap
|
|
}
|
|
for k := range nodePeerMap {
|
|
currNodePeer := nodePeerMap[k]
|
|
if _, ok := client.ACLs[currNodePeer.ID]; ok {
|
|
delete(nodePeerMap, k)
|
|
}
|
|
}
|
|
return nodePeerMap
|
|
}
|