2022-05-03 16:02:51 +02:00
|
|
|
package server
|
|
|
|
|
2023-01-02 15:11:32 +01:00
|
|
|
import (
|
2023-07-14 20:45:40 +02:00
|
|
|
"fmt"
|
|
|
|
|
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
|
|
2023-01-02 15:11:32 +01:00
|
|
|
"github.com/netbirdio/netbird/management/server/activity"
|
|
|
|
"github.com/netbirdio/netbird/management/server/status"
|
|
|
|
)
|
2022-05-03 16:02:51 +02:00
|
|
|
|
2023-07-14 20:45:40 +02:00
|
|
|
type GroupLinkError struct {
|
|
|
|
Resource string
|
|
|
|
Name string
|
|
|
|
}
|
|
|
|
|
|
|
|
func (e *GroupLinkError) Error() string {
|
|
|
|
return fmt.Sprintf("group has been linked to %s: %s", e.Resource, e.Name)
|
|
|
|
}
|
|
|
|
|
2022-05-03 16:02:51 +02:00
|
|
|
// Group of the peers for ACL
|
|
|
|
type Group struct {
|
|
|
|
// ID of the group
|
|
|
|
ID string
|
|
|
|
|
|
|
|
// Name visible in the UI
|
|
|
|
Name string
|
|
|
|
|
2023-06-27 16:51:05 +02:00
|
|
|
// Issued of the group
|
|
|
|
Issued string
|
|
|
|
|
2022-05-03 16:02:51 +02:00
|
|
|
// Peers list of the group
|
|
|
|
Peers []string
|
|
|
|
}
|
|
|
|
|
2023-01-02 15:11:32 +01:00
|
|
|
// EventMeta returns activity event meta related to the group
|
|
|
|
func (g *Group) EventMeta() map[string]any {
|
|
|
|
return map[string]any{"name": g.Name}
|
|
|
|
}
|
|
|
|
|
2022-05-21 15:21:39 +02:00
|
|
|
func (g *Group) Copy() *Group {
|
2023-08-22 17:56:39 +02:00
|
|
|
group := &Group{
|
2023-06-27 16:51:05 +02:00
|
|
|
ID: g.ID,
|
|
|
|
Name: g.Name,
|
|
|
|
Issued: g.Issued,
|
2023-08-22 17:56:39 +02:00
|
|
|
Peers: make([]string, len(g.Peers)),
|
2022-05-21 15:21:39 +02:00
|
|
|
}
|
2023-08-22 17:56:39 +02:00
|
|
|
copy(group.Peers, g.Peers)
|
|
|
|
return group
|
2022-05-21 15:21:39 +02:00
|
|
|
}
|
|
|
|
|
2022-05-03 16:02:51 +02:00
|
|
|
// GetGroup object of the peers
|
|
|
|
func (am *DefaultAccountManager) GetGroup(accountID, groupID string) (*Group, error) {
|
2022-11-07 17:52:23 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
2022-05-03 16:02:51 +02:00
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, err
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
group, ok := account.Groups[groupID]
|
|
|
|
if ok {
|
|
|
|
return group, nil
|
|
|
|
}
|
|
|
|
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.NotFound, "group with ID %s not found", groupID)
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// SaveGroup object of the peers
|
2023-01-02 15:11:32 +01:00
|
|
|
func (am *DefaultAccountManager) SaveGroup(accountID, userID string, newGroup *Group) error {
|
2022-11-07 17:52:23 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
2022-05-03 16:02:51 +02:00
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return err
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
2023-01-02 15:11:32 +01:00
|
|
|
oldGroup, exists := account.Groups[newGroup.ID]
|
|
|
|
account.Groups[newGroup.ID] = newGroup
|
2022-06-04 22:02:22 +02:00
|
|
|
|
|
|
|
account.Network.IncSerial()
|
|
|
|
if err = am.Store.SaveAccount(account); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2023-02-03 10:33:28 +01:00
|
|
|
err = am.updateAccountPeers(account)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// the following snippet tracks the activity and stores the group events in the event store.
|
|
|
|
// It has to happen after all the operations have been successfully performed.
|
2023-01-02 15:11:32 +01:00
|
|
|
addedPeers := make([]string, 0)
|
|
|
|
removedPeers := make([]string, 0)
|
2023-01-24 10:17:24 +01:00
|
|
|
if exists {
|
2023-01-02 15:11:32 +01:00
|
|
|
addedPeers = difference(newGroup.Peers, oldGroup.Peers)
|
|
|
|
removedPeers = difference(oldGroup.Peers, newGroup.Peers)
|
2023-01-24 10:17:24 +01:00
|
|
|
} else {
|
|
|
|
addedPeers = append(addedPeers, newGroup.Peers...)
|
|
|
|
am.storeEvent(userID, newGroup.ID, accountID, activity.GroupCreated, newGroup.EventMeta())
|
2023-01-02 15:11:32 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, p := range addedPeers {
|
|
|
|
peer := account.Peers[p]
|
|
|
|
if peer == nil {
|
|
|
|
log.Errorf("peer %s not found under account %s while saving group", p, accountID)
|
|
|
|
continue
|
|
|
|
}
|
2023-02-03 10:33:28 +01:00
|
|
|
am.storeEvent(userID, peer.ID, accountID, activity.GroupAddedToPeer,
|
2023-03-13 15:14:18 +01:00
|
|
|
map[string]any{
|
|
|
|
"group": newGroup.Name, "group_id": newGroup.ID, "peer_ip": peer.IP.String(),
|
|
|
|
"peer_fqdn": peer.FQDN(am.GetDNSDomain()),
|
|
|
|
})
|
2023-01-02 15:11:32 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, p := range removedPeers {
|
|
|
|
peer := account.Peers[p]
|
|
|
|
if peer == nil {
|
|
|
|
log.Errorf("peer %s not found under account %s while saving group", p, accountID)
|
|
|
|
continue
|
|
|
|
}
|
2023-02-03 10:33:28 +01:00
|
|
|
am.storeEvent(userID, peer.ID, accountID, activity.GroupRemovedFromPeer,
|
2023-03-13 15:14:18 +01:00
|
|
|
map[string]any{
|
|
|
|
"group": newGroup.Name, "group_id": newGroup.ID, "peer_ip": peer.IP.String(),
|
|
|
|
"peer_fqdn": peer.FQDN(am.GetDNSDomain()),
|
|
|
|
})
|
2023-01-02 15:11:32 +01:00
|
|
|
}
|
|
|
|
|
2023-02-03 10:33:28 +01:00
|
|
|
return nil
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
2023-01-02 15:11:32 +01:00
|
|
|
// difference returns the elements in `a` that aren't in `b`.
|
|
|
|
func difference(a, b []string) []string {
|
|
|
|
mb := make(map[string]struct{}, len(b))
|
|
|
|
for _, x := range b {
|
|
|
|
mb[x] = struct{}{}
|
|
|
|
}
|
|
|
|
var diff []string
|
|
|
|
for _, x := range a {
|
|
|
|
if _, found := mb[x]; !found {
|
|
|
|
diff = append(diff, x)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return diff
|
|
|
|
}
|
|
|
|
|
2022-05-03 16:02:51 +02:00
|
|
|
// DeleteGroup object of the peers
|
2023-07-14 20:45:40 +02:00
|
|
|
func (am *DefaultAccountManager) DeleteGroup(accountId, userId, groupID string) error {
|
|
|
|
unlock := am.Store.AcquireAccountLock(accountId)
|
2022-11-07 17:52:23 +01:00
|
|
|
defer unlock()
|
2022-05-03 16:02:51 +02:00
|
|
|
|
2023-07-14 20:45:40 +02:00
|
|
|
account, err := am.Store.GetAccount(accountId)
|
2022-05-03 16:02:51 +02:00
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return err
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
2023-07-14 20:45:40 +02:00
|
|
|
g, ok := account.Groups[groupID]
|
|
|
|
if !ok {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// check route links
|
|
|
|
for _, r := range account.Routes {
|
|
|
|
for _, g := range r.Groups {
|
|
|
|
if g == groupID {
|
|
|
|
return &GroupLinkError{"route", r.NetID}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// check DNS links
|
|
|
|
for _, dns := range account.NameServerGroups {
|
|
|
|
for _, g := range dns.Groups {
|
|
|
|
if g == groupID {
|
|
|
|
return &GroupLinkError{"name server groups", dns.Name}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// check ACL links
|
|
|
|
for _, policy := range account.Policies {
|
|
|
|
for _, rule := range policy.Rules {
|
|
|
|
for _, src := range rule.Sources {
|
|
|
|
if src == groupID {
|
|
|
|
return &GroupLinkError{"policy", policy.Name}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, dst := range rule.Destinations {
|
|
|
|
if dst == groupID {
|
|
|
|
return &GroupLinkError{"policy", policy.Name}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// check setup key links
|
|
|
|
for _, setupKey := range account.SetupKeys {
|
|
|
|
for _, grp := range setupKey.AutoGroups {
|
|
|
|
if grp == groupID {
|
|
|
|
return &GroupLinkError{"setup key", setupKey.Name}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// check user links
|
|
|
|
for _, user := range account.Users {
|
|
|
|
for _, grp := range user.AutoGroups {
|
|
|
|
if grp == groupID {
|
|
|
|
return &GroupLinkError{"user", user.Id}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// check DisabledManagementGroups
|
|
|
|
for _, disabledMgmGrp := range account.DNSSettings.DisabledManagementGroups {
|
|
|
|
if disabledMgmGrp == groupID {
|
|
|
|
return &GroupLinkError{"disabled DNS management groups", g.Name}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-03 16:02:51 +02:00
|
|
|
delete(account.Groups, groupID)
|
|
|
|
|
2022-06-04 22:02:22 +02:00
|
|
|
account.Network.IncSerial()
|
|
|
|
if err = am.Store.SaveAccount(account); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2023-07-14 20:45:40 +02:00
|
|
|
am.storeEvent(userId, groupID, accountId, activity.GroupDeleted, g.EventMeta())
|
|
|
|
|
2022-06-04 22:02:22 +02:00
|
|
|
return am.updateAccountPeers(account)
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// ListGroups objects of the peers
|
|
|
|
func (am *DefaultAccountManager) ListGroups(accountID string) ([]*Group, error) {
|
2022-11-07 17:52:23 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
2022-05-03 16:02:51 +02:00
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, err
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
groups := make([]*Group, 0, len(account.Groups))
|
|
|
|
for _, item := range account.Groups {
|
|
|
|
groups = append(groups, item)
|
|
|
|
}
|
|
|
|
|
|
|
|
return groups, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GroupAddPeer appends peer to the group
|
2023-02-03 10:33:28 +01:00
|
|
|
func (am *DefaultAccountManager) GroupAddPeer(accountID, groupID, peerID string) error {
|
2022-11-07 17:52:23 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
2022-05-03 16:02:51 +02:00
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return err
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
group, ok := account.Groups[groupID]
|
|
|
|
if !ok {
|
2022-11-11 20:36:45 +01:00
|
|
|
return status.Errorf(status.NotFound, "group with ID %s not found", groupID)
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
add := true
|
|
|
|
for _, itemID := range group.Peers {
|
2023-02-03 10:33:28 +01:00
|
|
|
if itemID == peerID {
|
2022-05-03 16:02:51 +02:00
|
|
|
add = false
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if add {
|
2023-02-03 10:33:28 +01:00
|
|
|
group.Peers = append(group.Peers, peerID)
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
2022-06-04 22:02:22 +02:00
|
|
|
account.Network.IncSerial()
|
|
|
|
if err = am.Store.SaveAccount(account); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return am.updateAccountPeers(account)
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// GroupDeletePeer removes peer from the group
|
2023-09-28 14:32:36 +02:00
|
|
|
func (am *DefaultAccountManager) GroupDeletePeer(accountID, groupID, peerID string) error {
|
2022-11-07 17:52:23 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
2022-05-03 16:02:51 +02:00
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return err
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
group, ok := account.Groups[groupID]
|
|
|
|
if !ok {
|
2022-11-11 20:36:45 +01:00
|
|
|
return status.Errorf(status.NotFound, "group with ID %s not found", groupID)
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
2022-06-04 22:02:22 +02:00
|
|
|
account.Network.IncSerial()
|
2022-05-03 16:02:51 +02:00
|
|
|
for i, itemID := range group.Peers {
|
2023-09-28 14:32:36 +02:00
|
|
|
if itemID == peerID {
|
2022-05-03 16:02:51 +02:00
|
|
|
group.Peers = append(group.Peers[:i], group.Peers[i+1:]...)
|
2022-06-04 22:02:22 +02:00
|
|
|
if err := am.Store.SaveAccount(account); err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return err
|
2022-06-04 22:02:22 +02:00
|
|
|
}
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-06-04 22:02:22 +02:00
|
|
|
return am.updateAccountPeers(account)
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// GroupListPeers returns list of the peers from the group
|
|
|
|
func (am *DefaultAccountManager) GroupListPeers(accountID, groupID string) ([]*Peer, error) {
|
2022-11-07 17:52:23 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
2022-05-03 16:02:51 +02:00
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.NotFound, "account not found")
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
group, ok := account.Groups[groupID]
|
|
|
|
if !ok {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.NotFound, "group with ID %s not found", groupID)
|
2022-05-03 16:02:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
peers := make([]*Peer, 0, len(account.Groups))
|
|
|
|
for _, peerID := range group.Peers {
|
|
|
|
p, ok := account.Peers[peerID]
|
|
|
|
if ok {
|
|
|
|
peers = append(peers, p)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return peers, nil
|
|
|
|
}
|