Skip to content

Commit a741f8f

Browse files
abhishek9686abhishek9686
authored
Merge pull request #3658 from gravitl/master
Master
2 parents 3126b2d + fbc0f69 commit a741f8f

File tree

12 files changed

+404
-86
lines changed

12 files changed

+404
-86
lines changed

‎controllers/ext_client.go‎

Lines changed: 6 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -466,23 +466,6 @@ func getExtClientHAConf(w http.ResponseWriter, r *http.Request) {
466466
extclient.IngressGatewayID = targetGwID
467467
extclient.Network = networkid
468468
extclient.Tags = make(map[models.TagID]struct{})
469-
// extclient.Tags[models.TagID(fmt.Sprintf("%s.%s", extclient.Network,
470-
// models.RemoteAccessTagName))] = struct{}{}
471-
// set extclient dns to ingressdns if extclient dns is not explicitly set
472-
if (extclient.DNS == "") && (gwnode.IngressDNS != "") {
473-
network, _ := logic.GetNetwork(gwnode.Network)
474-
dns := gwnode.IngressDNS
475-
if len(network.NameServers) > 0 {
476-
if dns == "" {
477-
dns = strings.Join(network.NameServers, ",")
478-
} else {
479-
dns += "," + strings.Join(network.NameServers, ",")
480-
}
481-
482-
}
483-
extclient.DNS = dns
484-
485-
}
486469

487470
listenPort := logic.GetPeerListenPort(host)
488471
extclient.IngressGatewayEndpoint = fmt.Sprintf("%s:%d", host.EndpointIP.String(), listenPort)
@@ -506,6 +489,11 @@ func getExtClientHAConf(w http.ResponseWriter, r *http.Request) {
506489
logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
507490
return
508491
}
492+
logic.SetDNSOnWgConfig(&gwnode, &client)
493+
defaultDNS := ""
494+
if client.DNS != "" {
495+
defaultDNS = "DNS = " + client.DNS
496+
}
509497
addrString := client.Address
510498
if addrString != "" {
511499
addrString += "/32"
@@ -551,13 +539,6 @@ func getExtClientHAConf(w http.ResponseWriter, r *http.Request) {
551539
} else {
552540
gwendpoint = fmt.Sprintf("%s:%d", host.EndpointIP.String(), host.ListenPort)
553541
}
554-
defaultDNS := ""
555-
if client.DNS != "" {
556-
defaultDNS = "DNS = " + client.DNS
557-
} else if gwnode.IngressDNS != "" {
558-
defaultDNS = "DNS = " + gwnode.IngressDNS
559-
}
560-
561542
defaultMTU := 1420
562543
if host.MTU != 0 {
563544
defaultMTU = host.MTU
@@ -630,6 +611,7 @@ Endpoint = %s
630611

631612
name := client.ClientID + ".conf"
632613
w.Header().Set("Content-Type", "application/config")
614+
w.Header().Set("Client-ID", client.ClientID)
633615
w.Header().Set("Content-Disposition", "attachment; filename=\""+name+"\"")
634616
w.WriteHeader(http.StatusOK)
635617
_, err = fmt.Fprint(w, config)

‎controllers/middleware.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ func userMiddleWare(handler http.Handler) http.Handler {
7171
if strings.Contains(route, "tags") {
7272
r.Header.Set("TARGET_RSRC", models.TagRsrc.String())
7373
}
74-
if strings.Contains(route, "extclients") {
74+
if strings.Contains(route, "extclients") || strings.Contains(route, "client_conf") {
7575
r.Header.Set("TARGET_RSRC", models.ExtClientsRsrc.String())
7676
}
7777
if strings.Contains(route, "enrollment-keys") {

‎controllers/network.go‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -575,21 +575,40 @@ func createNetwork(w http.ResponseWriter, r *http.Request) {
575575

576576
// validate address ranges: must be private
577577
if network.AddressRange != "" {
578-
_, _, err := net.ParseCIDR(network.AddressRange)
578+
_, cidr, err := net.ParseCIDR(network.AddressRange)
579579
if err != nil {
580580
logger.Log(0, r.Header.Get("user"), "failed to create network: ",
581581
err.Error())
582582
logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
583583
return
584+
} else {
585+
ones, bits := cidr.Mask.Size()
586+
if bits-ones <= 1 {
587+
err = fmt.Errorf("cannot create network with /31 or /32 cidr")
588+
logger.Log(0, r.Header.Get("user"), "failed to create network: ",
589+
err.Error())
590+
logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
591+
return
592+
}
584593
}
585594
}
595+
586596
if network.AddressRange6 != "" {
587-
_, _, err := net.ParseCIDR(network.AddressRange6)
597+
_, cidr, err := net.ParseCIDR(network.AddressRange6)
588598
if err != nil {
589599
logger.Log(0, r.Header.Get("user"), "failed to create network: ",
590600
err.Error())
591601
logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
592602
return
603+
} else {
604+
ones, bits := cidr.Mask.Size()
605+
if bits-ones <= 1 {
606+
err = fmt.Errorf("cannot create network with /127 or /128 cidr")
607+
logger.Log(0, r.Header.Get("user"), "failed to create network: ",
608+
err.Error())
609+
logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
610+
return
611+
}
593612
}
594613
}
595614

‎logic/acls.go‎

Lines changed: 47 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,16 +50,31 @@ func GetFwRulesOnIngressGateway(node models.Node) (rules []models.FwRule) {
5050
if defaultDevicePolicy.Enabled {
5151
return
5252
}
53+
defer func() {
54+
if len(rules) == 0 && IsNodeAllowedToCommunicateWithAllRsrcs(node) {
55+
if node.NetworkRange.IP != nil {
56+
rules = append(rules, models.FwRule{
57+
SrcIP: node.NetworkRange,
58+
Allow: true,
59+
})
60+
}
61+
if node.NetworkRange6.IP != nil {
62+
rules = append(rules, models.FwRule{
63+
SrcIP: node.NetworkRange6,
64+
Allow: true,
65+
})
66+
}
67+
return
68+
}
69+
}()
70+
5371
for _, nodeI := range nodes {
5472
if !nodeI.IsStatic || nodeI.IsUserNode {
5573
continue
5674
}
57-
if !node.StaticNode.Enabled {
75+
if !nodeI.StaticNode.Enabled {
5876
continue
5977
}
60-
// if nodeI.StaticNode.IngressGatewayID != node.ID.String() {
61-
// continue
62-
// }
6378
if IsNodeAllowedToCommunicateWithAllRsrcs(nodeI) {
6479
if nodeI.Address.IP != nil {
6580
rules = append(rules, models.FwRule{
@@ -525,7 +540,18 @@ func GetAclRulesForNode(targetnodeI *models.Node) (rules map[string]models.AclRu
525540
continue
526541
}
527542
if _, ok := eI.Nodes[targetnode.ID.String()]; ok {
528-
if eI.Range != "" {
543+
if servercfg.IsPro && eI.Domain != "" && len(eI.DomainAns) > 0 {
544+
for _, domainAnsI := range eI.DomainAns {
545+
ip, cidr, err := net.ParseCIDR(domainAnsI)
546+
if err == nil {
547+
if ip.To4() != nil {
548+
egressRanges4 = append(egressRanges4, *cidr)
549+
} else {
550+
egressRanges6 = append(egressRanges6, *cidr)
551+
}
552+
}
553+
}
554+
} else if eI.Range != "" {
529555
_, cidr, err := net.ParseCIDR(eI.Range)
530556
if err == nil {
531557
if cidr.IP.To4() != nil {
@@ -535,6 +561,7 @@ func GetAclRulesForNode(targetnodeI *models.Node) (rules map[string]models.AclRu
535561
}
536562
}
537563
}
564+
dstTags[targetnode.ID.String()] = struct{}{}
538565
}
539566
}
540567
break
@@ -544,7 +571,18 @@ func GetAclRulesForNode(targetnodeI *models.Node) (rules map[string]models.AclRu
544571
err := e.Get(db.WithContext(context.TODO()))
545572
if err == nil && e.Status && len(e.Nodes) > 0 {
546573
if _, ok := e.Nodes[targetnode.ID.String()]; ok {
547-
if e.Range != "" {
574+
if servercfg.IsPro && e.Domain != "" && len(e.DomainAns) > 0 {
575+
for _, domainAnsI := range e.DomainAns {
576+
ip, cidr, err := net.ParseCIDR(domainAnsI)
577+
if err == nil {
578+
if ip.To4() != nil {
579+
egressRanges4 = append(egressRanges4, *cidr)
580+
} else {
581+
egressRanges6 = append(egressRanges6, *cidr)
582+
}
583+
}
584+
}
585+
} else if e.Range != "" {
548586
_, cidr, err := net.ParseCIDR(e.Range)
549587
if err == nil {
550588
if cidr.IP.To4() != nil {
@@ -554,6 +592,7 @@ func GetAclRulesForNode(targetnodeI *models.Node) (rules map[string]models.AclRu
554592
}
555593
}
556594
}
595+
dstTags[targetnode.ID.String()] = struct{}{}
557596
}
558597

559598
}
@@ -800,10 +839,10 @@ func GetEgressRulesForNode(targetnode models.Node) (rules map[string]models.AclR
800839
if node.ID == targetnode.ID {
801840
continue
802841
}
803-
if node.Address.IP != nil {
842+
if !node.IsStatic && node.Address.IP != nil {
804843
aclRule.IPList = append(aclRule.IPList, node.AddressIPNet4())
805844
}
806-
if node.Address6.IP != nil {
845+
if !node.IsStatic && node.Address6.IP != nil {
807846
aclRule.IP6List = append(aclRule.IP6List, node.AddressIPNet6())
808847
}
809848
if node.IsStatic && node.StaticNode.Address != "" {

‎logic/dns.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -434,6 +434,25 @@ func validateNameserverReq(ns schema.Nameserver) error {
434434
if len(ns.Servers) == 0 {
435435
return errors.New("atleast one nameserver should be specified")
436436
}
437+
network, err := GetNetwork(ns.NetworkID)
438+
if err != nil {
439+
return errors.New("invalid network id")
440+
}
441+
_, cidr, err4 := net.ParseCIDR(network.AddressRange)
442+
_, cidr6, err6 := net.ParseCIDR(network.AddressRange6)
443+
for _, nsIPStr := range ns.Servers {
444+
nsIP := net.ParseIP(nsIPStr)
445+
if nsIP == nil {
446+
return errors.New("invalid nameserver " + nsIPStr)
447+
}
448+
if err4 == nil && nsIP.To4() != nil {
449+
if cidr.Contains(nsIP) {
450+
return errors.New("cannot use netmaker IP as nameserver")
451+
}
452+
} else if err6 == nil && cidr6.Contains(nsIP) {
453+
return errors.New("cannot use netmaker IP as nameserver")
454+
}
455+
}
437456
if !ns.MatchAll && len(ns.MatchDomains) == 0 {
438457
return errors.New("atleast one match domain is required")
439458
}

‎logic/extpeers.go‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -70,23 +70,12 @@ func storeExtClientInCache(key string, extclient models.ExtClient) {
7070
func GetEgressRangesOnNetwork(client *models.ExtClient) ([]string, error) {
7171

7272
var result []string
73-
networkNodes, err := GetNetworkNodes(client.Network)
74-
if err != nil {
75-
return []string{}, err
76-
}
7773
eli, _ := (&schema.Egress{Network: client.Network}).ListByNetwork(db.WithContext(context.TODO()))
78-
acls, _ := ListAclsByNetwork(models.NetworkID(client.Network))
79-
// clientNode := client.ConvertToStaticNode()
80-
for _, currentNode := range networkNodes {
81-
if currentNode.Network != client.Network {
74+
for _, eI := range eli {
75+
if !eI.Status || eI.Range == "" {
8276
continue
8377
}
84-
GetNodeEgressInfo(&currentNode, eli, acls)
85-
if currentNode.EgressDetails.IsEgressGateway { // add the egress gateway range(s) to the result
86-
if len(currentNode.EgressDetails.EgressGatewayRanges) > 0 {
87-
result = append(result, currentNode.EgressDetails.EgressGatewayRanges...)
88-
}
89-
}
78+
result = append(result, eI.Range)
9079
}
9180
extclients, _ := GetNetworkExtClients(client.Network)
9281
for _, extclient := range extclients {

‎logic/peers.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -149,10 +149,11 @@ func GetPeerUpdateForHost(network string, host *models.Host, allNodes []models.N
149149
}
150150
defer func() {
151151
if !hostPeerUpdate.FwUpdate.AllowAll {
152-
153-
hostPeerUpdate.FwUpdate.EgressInfo["allowed-network-rules"] = models.EgressInfo{
154-
EgressID: "allowed-network-rules",
155-
EgressFwRules: make(map[string]models.AclRule),
152+
if len(hostPeerUpdate.FwUpdate.AllowedNetworks) > 0 {
153+
hostPeerUpdate.FwUpdate.EgressInfo["allowed-network-rules"] = models.EgressInfo{
154+
EgressID: "allowed-network-rules",
155+
EgressFwRules: make(map[string]models.AclRule),
156+
}
156157
}
157158
for _, aclRule := range hostPeerUpdate.FwUpdate.AllowedNetworks {
158159
hostPeerUpdate.FwUpdate.AclRules[aclRule.ID] = aclRule

‎migrate/migrate.go‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"encoding/json"
66
"fmt"
77
"log"
8+
"net"
89
"os"
910
"time"
1011

@@ -63,6 +64,10 @@ func migrateNameservers() {
6364
}
6465

6566
for _, netI := range nets {
67+
_, cidr, err := net.ParseCIDR(netI.AddressRange)
68+
if err != nil {
69+
continue
70+
}
6671
if len(netI.NameServers) > 0 {
6772
ns := schema.Nameserver{
6873
ID: uuid.NewString(),
@@ -78,8 +83,14 @@ func migrateNameservers() {
7883
Status: true,
7984
CreatedBy: user.UserName,
8085
}
81-
for _, ip := range netI.NameServers {
82-
ns.Servers = append(ns.Servers, ip)
86+
87+
for _, nsIP := range netI.NameServers {
88+
if net.ParseIP(nsIP) == nil {
89+
continue
90+
}
91+
if !cidr.Contains(net.ParseIP(nsIP)) {
92+
ns.Servers = append(ns.Servers, nsIP)
93+
}
8394
}
8495
ns.Create(db.WithContext(context.TODO()))
8596
netI.NameServers = []string{}

‎pro/controllers/users.go‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1498,6 +1498,10 @@ func getUserRemoteAccessGwsV1(w http.ResponseWriter, r *http.Request) {
14981498
continue
14991499
}
15001500

1501+
if extClient.RemoteAccessClientID == "" {
1502+
continue
1503+
}
1504+
15011505
_, ok := userExtClients[extClient.IngressGatewayID]
15021506
if !ok {
15031507
userExtClients[extClient.IngressGatewayID] = []models.ExtClient{}
@@ -1526,13 +1530,21 @@ func getUserRemoteAccessGwsV1(w http.ResponseWriter, r *http.Request) {
15261530
}
15271531
}
15281532

1529-
if !found {
1530-
// TODO: prevent ip clashes.
1531-
if len(extClients) > 0 {
1532-
gwClient = extClients[0]
1533+
if !found && req.RemoteAccessClientID != "" {
1534+
for _, extClient := range extClients {
1535+
if extClient.RemoteAccessClientID == req.RemoteAccessClientID {
1536+
gwClient = extClient
1537+
found = true
1538+
break
1539+
}
15331540
}
15341541
}
15351542

1543+
if !found && len(extClients) > 0 {
1544+
// TODO: prevent ip clashes.
1545+
gwClient = extClients[0]
1546+
}
1547+
15361548
host, err := logic.GetHost(node.HostID.String())
15371549
if err != nil {
15381550
continue

0 commit comments

Comments
 (0)