2022-08-18 18:22:15 +02:00
|
|
|
package server
|
|
|
|
|
|
|
|
import (
|
2024-07-03 11:33:02 +02:00
|
|
|
"context"
|
2024-06-20 13:52:32 +02:00
|
|
|
"fmt"
|
2023-09-04 17:03:44 +02:00
|
|
|
"net/netip"
|
2024-10-02 13:41:00 +02:00
|
|
|
"slices"
|
|
|
|
"strconv"
|
|
|
|
"strings"
|
2023-09-04 17:03:44 +02:00
|
|
|
"unicode/utf8"
|
|
|
|
|
2023-11-08 11:35:37 +01:00
|
|
|
"github.com/rs/xid"
|
2024-10-02 13:41:00 +02:00
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
|
|
|
|
|
nbpeer "github.com/netbirdio/netbird/management/server/peer"
|
2023-11-08 11:35:37 +01:00
|
|
|
|
2024-06-13 13:24:24 +02:00
|
|
|
"github.com/netbirdio/netbird/management/domain"
|
2022-08-18 18:22:15 +02:00
|
|
|
"github.com/netbirdio/netbird/management/proto"
|
2023-01-25 16:29:59 +01:00
|
|
|
"github.com/netbirdio/netbird/management/server/activity"
|
2022-11-11 20:36:45 +01:00
|
|
|
"github.com/netbirdio/netbird/management/server/status"
|
2022-08-18 18:22:15 +02:00
|
|
|
"github.com/netbirdio/netbird/route"
|
|
|
|
)
|
|
|
|
|
2024-10-02 13:41:00 +02:00
|
|
|
// RouteFirewallRule a firewall rule applicable for a routed network.
|
|
|
|
type RouteFirewallRule struct {
|
|
|
|
// SourceRanges IP ranges of the routing peers.
|
|
|
|
SourceRanges []string
|
|
|
|
|
|
|
|
// Action of the traffic when the rule is applicable
|
|
|
|
Action string
|
|
|
|
|
|
|
|
// Destination a network prefix for the routed traffic
|
|
|
|
Destination string
|
|
|
|
|
|
|
|
// Protocol of the traffic
|
|
|
|
Protocol string
|
|
|
|
|
|
|
|
// Port of the traffic
|
|
|
|
Port uint16
|
|
|
|
|
|
|
|
// PortRange represents the range of ports for a firewall rule
|
|
|
|
PortRange RulePortRange
|
|
|
|
|
|
|
|
// isDynamic indicates whether the rule is for DNS routing
|
|
|
|
IsDynamic bool
|
|
|
|
}
|
|
|
|
|
2022-08-18 18:22:15 +02:00
|
|
|
// GetRoute gets a route object from account and route IDs
|
2024-07-03 11:33:02 +02:00
|
|
|
func (am *DefaultAccountManager) GetRoute(ctx context.Context, accountID string, routeID route.ID, userID string) (*route.Route, error) {
|
2024-09-27 16:10:50 +02:00
|
|
|
user, err := am.Store.GetUserByUserID(ctx, LockingStrengthShare, userID)
|
2022-08-18 18:22:15 +02:00
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, err
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
2024-09-27 16:10:50 +02:00
|
|
|
if !user.IsAdminOrServiceUser() || user.AccountID != accountID {
|
2023-12-01 17:24:57 +01:00
|
|
|
return nil, status.Errorf(status.PermissionDenied, "only users with admin power can view Network Routes")
|
2022-11-05 10:24:50 +01:00
|
|
|
}
|
|
|
|
|
2024-09-27 16:10:50 +02:00
|
|
|
return am.Store.GetRouteByID(ctx, LockingStrengthShare, string(routeID), accountID)
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
2024-06-13 13:24:24 +02:00
|
|
|
// checkRoutePrefixOrDomainsExistForPeers checks if a route with a given prefix exists for a single peer or multiple peer groups.
|
|
|
|
func (am *DefaultAccountManager) checkRoutePrefixOrDomainsExistForPeers(account *Account, peerID string, routeID route.ID, peerGroupIDs []string, prefix netip.Prefix, domains domain.List) error {
|
2023-09-28 14:32:36 +02:00
|
|
|
// routes can have both peer and peer_groups
|
2024-06-13 13:24:24 +02:00
|
|
|
routesWithPrefix := account.GetRoutesByPrefixOrDomains(prefix, domains)
|
2023-09-28 14:32:36 +02:00
|
|
|
|
|
|
|
// lets remember all the peers and the peer groups from routesWithPrefix
|
|
|
|
seenPeers := make(map[string]bool)
|
|
|
|
seenPeerGroups := make(map[string]bool)
|
|
|
|
|
|
|
|
for _, prefixRoute := range routesWithPrefix {
|
|
|
|
// we skip route(s) with the same network ID as we want to allow updating of the existing route
|
2024-06-20 13:52:32 +02:00
|
|
|
// when creating a new route routeID is newly generated so nothing will be skipped
|
2023-09-28 14:32:36 +02:00
|
|
|
if routeID == prefixRoute.ID {
|
|
|
|
continue
|
|
|
|
}
|
2022-08-23 11:09:56 +02:00
|
|
|
|
2023-09-28 14:32:36 +02:00
|
|
|
if prefixRoute.Peer != "" {
|
2024-05-06 14:47:49 +02:00
|
|
|
seenPeers[string(prefixRoute.ID)] = true
|
2023-09-28 14:32:36 +02:00
|
|
|
}
|
|
|
|
for _, groupID := range prefixRoute.PeerGroups {
|
|
|
|
seenPeerGroups[groupID] = true
|
|
|
|
|
|
|
|
group := account.GetGroup(groupID)
|
|
|
|
if group == nil {
|
|
|
|
return status.Errorf(
|
2024-06-20 13:52:32 +02:00
|
|
|
status.InvalidArgument, "failed to add route with %s - peer group %s doesn't exist",
|
|
|
|
getRouteDescriptor(prefix, domains), groupID,
|
|
|
|
)
|
2023-09-28 14:32:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, pID := range group.Peers {
|
|
|
|
seenPeers[pID] = true
|
|
|
|
}
|
|
|
|
}
|
2022-08-23 11:09:56 +02:00
|
|
|
}
|
|
|
|
|
2023-09-28 14:32:36 +02:00
|
|
|
if peerID != "" {
|
|
|
|
// check that peerID exists and is not in any route as single peer or part of the group
|
|
|
|
peer := account.GetPeer(peerID)
|
|
|
|
if peer == nil {
|
|
|
|
return status.Errorf(status.InvalidArgument, "peer with ID %s not found", peerID)
|
|
|
|
}
|
|
|
|
if _, ok := seenPeers[peerID]; ok {
|
|
|
|
return status.Errorf(status.AlreadyExists,
|
2024-06-20 13:52:32 +02:00
|
|
|
"failed to add route with %s - peer %s already has this route", getRouteDescriptor(prefix, domains), peerID)
|
2023-09-28 14:32:36 +02:00
|
|
|
}
|
2022-11-07 12:10:56 +01:00
|
|
|
}
|
|
|
|
|
2023-09-28 14:32:36 +02:00
|
|
|
// check that peerGroupIDs are not in any route peerGroups list
|
|
|
|
for _, groupID := range peerGroupIDs {
|
2024-06-20 13:52:32 +02:00
|
|
|
group := account.GetGroup(groupID) // we validated the group existence before entering this function, no need to check again.
|
2022-08-18 18:22:15 +02:00
|
|
|
|
2023-09-28 14:32:36 +02:00
|
|
|
if _, ok := seenPeerGroups[groupID]; ok {
|
|
|
|
return status.Errorf(
|
2024-06-20 13:52:32 +02:00
|
|
|
status.AlreadyExists, "failed to add route with %s - peer group %s already has this route",
|
|
|
|
getRouteDescriptor(prefix, domains), group.Name)
|
2023-09-28 14:32:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// check that the peers from peerGroupIDs groups are not the same peers we saw in routesWithPrefix
|
|
|
|
for _, id := range group.Peers {
|
|
|
|
if _, ok := seenPeers[id]; ok {
|
2023-10-09 14:39:41 +02:00
|
|
|
peer := account.GetPeer(id)
|
2023-09-28 14:32:36 +02:00
|
|
|
if peer == nil {
|
|
|
|
return status.Errorf(status.InvalidArgument, "peer with ID %s not found", peerID)
|
|
|
|
}
|
|
|
|
return status.Errorf(status.AlreadyExists,
|
2024-06-20 13:52:32 +02:00
|
|
|
"failed to add route with %s - peer %s from the group %s already has this route",
|
|
|
|
getRouteDescriptor(prefix, domains), peer.Name, group.Name)
|
2023-09-28 14:32:36 +02:00
|
|
|
}
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
}
|
2023-09-28 14:32:36 +02:00
|
|
|
|
2022-08-18 18:22:15 +02:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2024-06-20 13:52:32 +02:00
|
|
|
func getRouteDescriptor(prefix netip.Prefix, domains domain.List) string {
|
|
|
|
if len(domains) > 0 {
|
|
|
|
return fmt.Sprintf("domains [%s]", domains.SafeString())
|
|
|
|
}
|
|
|
|
return fmt.Sprintf("prefix %s", prefix.String())
|
|
|
|
}
|
|
|
|
|
2022-08-18 18:22:15 +02:00
|
|
|
// CreateRoute creates and saves a new route
|
2024-10-02 13:41:00 +02:00
|
|
|
func (am *DefaultAccountManager) CreateRoute(ctx context.Context, accountID string, prefix netip.Prefix, networkType route.NetworkType, domains domain.List, peerID string, peerGroupIDs []string, description string, netID route.NetID, masquerade bool, metric int, groups, accessControlGroupIDs []string, enabled bool, userID string, keepRoute bool) (*route.Route, error) {
|
2024-07-31 14:53:32 +02:00
|
|
|
unlock := am.Store.AcquireWriteLockByUID(ctx, accountID)
|
2022-11-07 17:52:23 +01:00
|
|
|
defer unlock()
|
2022-08-18 18:22:15 +02:00
|
|
|
|
2024-07-03 11:33:02 +02:00
|
|
|
account, err := am.Store.GetAccount(ctx, accountID)
|
2022-08-18 18:22:15 +02:00
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, err
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
2024-09-27 16:10:50 +02:00
|
|
|
// Do not allow non-Linux peers
|
|
|
|
if peer := account.GetPeer(peerID); peer != nil {
|
|
|
|
if peer.Meta.GoOS != "linux" {
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "non-linux peers are not supported as network routes")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-06-13 13:24:24 +02:00
|
|
|
if len(domains) > 0 && prefix.IsValid() {
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "domains and network should not be provided at the same time")
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(domains) == 0 && !prefix.IsValid() {
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "invalid Prefix")
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(domains) > 0 {
|
|
|
|
prefix = getPlaceholderIP()
|
|
|
|
}
|
|
|
|
|
2023-09-28 14:32:36 +02:00
|
|
|
if peerID != "" && len(peerGroupIDs) != 0 {
|
|
|
|
return nil, status.Errorf(
|
|
|
|
status.InvalidArgument,
|
|
|
|
"peer with ID %s and peers group %s should not be provided at the same time",
|
|
|
|
peerID, peerGroupIDs)
|
2023-01-25 16:29:59 +01:00
|
|
|
}
|
|
|
|
|
2022-08-18 18:22:15 +02:00
|
|
|
var newRoute route.Route
|
2024-05-06 14:47:49 +02:00
|
|
|
newRoute.ID = route.ID(xid.New().String())
|
2023-09-28 14:32:36 +02:00
|
|
|
|
|
|
|
if len(peerGroupIDs) > 0 {
|
|
|
|
err = validateGroups(peerGroupIDs, account.Groups)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-10-02 13:41:00 +02:00
|
|
|
if len(accessControlGroupIDs) > 0 {
|
|
|
|
err = validateGroups(accessControlGroupIDs, account.Groups)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-06-13 13:24:24 +02:00
|
|
|
err = am.checkRoutePrefixOrDomainsExistForPeers(account, peerID, newRoute.ID, peerGroupIDs, prefix, domains)
|
2022-08-18 18:22:15 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if metric < route.MinMetric || metric > route.MaxMetric {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.InvalidArgument, "metric should be between %d and %d", route.MinMetric, route.MaxMetric)
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
2024-05-06 14:47:49 +02:00
|
|
|
if utf8.RuneCountInString(string(netID)) > route.MaxNetIDChar || netID == "" {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.InvalidArgument, "identifier should be between 1 and %d", route.MaxNetIDChar)
|
2022-08-22 14:10:24 +02:00
|
|
|
}
|
|
|
|
|
2022-12-06 10:11:57 +01:00
|
|
|
err = validateGroups(groups, account.Groups)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-02-03 10:33:28 +01:00
|
|
|
newRoute.Peer = peerID
|
2023-09-28 14:32:36 +02:00
|
|
|
newRoute.PeerGroups = peerGroupIDs
|
2024-06-13 13:24:24 +02:00
|
|
|
newRoute.Network = prefix
|
|
|
|
newRoute.Domains = domains
|
|
|
|
newRoute.NetworkType = networkType
|
2022-08-18 18:22:15 +02:00
|
|
|
newRoute.Description = description
|
2022-08-22 14:10:24 +02:00
|
|
|
newRoute.NetID = netID
|
2022-08-18 18:22:15 +02:00
|
|
|
newRoute.Masquerade = masquerade
|
|
|
|
newRoute.Metric = metric
|
|
|
|
newRoute.Enabled = enabled
|
2022-12-06 10:11:57 +01:00
|
|
|
newRoute.Groups = groups
|
2024-06-13 13:24:24 +02:00
|
|
|
newRoute.KeepRoute = keepRoute
|
2024-10-02 13:41:00 +02:00
|
|
|
newRoute.AccessControlGroups = accessControlGroupIDs
|
2022-08-18 18:22:15 +02:00
|
|
|
|
|
|
|
if account.Routes == nil {
|
2024-05-06 14:47:49 +02:00
|
|
|
account.Routes = make(map[route.ID]*route.Route)
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
account.Routes[newRoute.ID] = &newRoute
|
|
|
|
|
|
|
|
account.Network.IncSerial()
|
2024-07-03 11:33:02 +02:00
|
|
|
if err = am.Store.SaveAccount(ctx, account); err != nil {
|
2022-08-18 18:22:15 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2024-11-25 16:26:24 +01:00
|
|
|
if am.isRouteChangeAffectPeers(account, &newRoute) {
|
2024-11-15 18:09:32 +01:00
|
|
|
am.updateAccountPeers(ctx, accountID)
|
2024-10-23 12:05:02 +02:00
|
|
|
}
|
2023-01-25 16:29:59 +01:00
|
|
|
|
2024-07-03 11:33:02 +02:00
|
|
|
am.StoreEvent(ctx, userID, string(newRoute.ID), accountID, activity.RouteCreated, newRoute.EventMeta())
|
2023-01-25 16:29:59 +01:00
|
|
|
|
2022-08-18 18:22:15 +02:00
|
|
|
return &newRoute, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// SaveRoute saves route
|
2024-07-03 11:33:02 +02:00
|
|
|
func (am *DefaultAccountManager) SaveRoute(ctx context.Context, accountID, userID string, routeToSave *route.Route) error {
|
2024-07-31 14:53:32 +02:00
|
|
|
unlock := am.Store.AcquireWriteLockByUID(ctx, accountID)
|
2022-11-07 17:52:23 +01:00
|
|
|
defer unlock()
|
2022-08-18 18:22:15 +02:00
|
|
|
|
|
|
|
if routeToSave == nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return status.Errorf(status.InvalidArgument, "route provided is nil")
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if routeToSave.Metric < route.MinMetric || routeToSave.Metric > route.MaxMetric {
|
2022-11-11 20:36:45 +01:00
|
|
|
return status.Errorf(status.InvalidArgument, "metric should be between %d and %d", route.MinMetric, route.MaxMetric)
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
2024-05-06 14:47:49 +02:00
|
|
|
if utf8.RuneCountInString(string(routeToSave.NetID)) > route.MaxNetIDChar || routeToSave.NetID == "" {
|
2022-11-11 20:36:45 +01:00
|
|
|
return status.Errorf(status.InvalidArgument, "identifier should be between 1 and %d", route.MaxNetIDChar)
|
2022-08-22 14:10:24 +02:00
|
|
|
}
|
|
|
|
|
2024-07-03 11:33:02 +02:00
|
|
|
account, err := am.Store.GetAccount(ctx, accountID)
|
2022-08-18 18:22:15 +02:00
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return err
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
2024-09-27 16:10:50 +02:00
|
|
|
// Do not allow non-Linux peers
|
|
|
|
if peer := account.GetPeer(routeToSave.Peer); peer != nil {
|
|
|
|
if peer.Meta.GoOS != "linux" {
|
|
|
|
return status.Errorf(status.InvalidArgument, "non-linux peers are not supported as network routes")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-06-13 13:24:24 +02:00
|
|
|
if len(routeToSave.Domains) > 0 && routeToSave.Network.IsValid() {
|
|
|
|
return status.Errorf(status.InvalidArgument, "domains and network should not be provided at the same time")
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(routeToSave.Domains) == 0 && !routeToSave.Network.IsValid() {
|
|
|
|
return status.Errorf(status.InvalidArgument, "invalid Prefix")
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(routeToSave.Domains) > 0 {
|
|
|
|
routeToSave.Network = getPlaceholderIP()
|
|
|
|
}
|
|
|
|
|
2023-09-28 14:32:36 +02:00
|
|
|
if routeToSave.Peer != "" && len(routeToSave.PeerGroups) != 0 {
|
|
|
|
return status.Errorf(status.InvalidArgument, "peer with ID and peer groups should not be provided at the same time")
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(routeToSave.PeerGroups) > 0 {
|
|
|
|
err = validateGroups(routeToSave.PeerGroups, account.Groups)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-10-02 13:41:00 +02:00
|
|
|
if len(routeToSave.AccessControlGroups) > 0 {
|
|
|
|
err = validateGroups(routeToSave.AccessControlGroups, account.Groups)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-06-13 13:24:24 +02:00
|
|
|
err = am.checkRoutePrefixOrDomainsExistForPeers(account, routeToSave.Peer, routeToSave.ID, routeToSave.Copy().PeerGroups, routeToSave.Network, routeToSave.Domains)
|
2023-09-28 14:32:36 +02:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-12-06 10:11:57 +01:00
|
|
|
err = validateGroups(routeToSave.Groups, account.Groups)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2024-10-23 12:05:02 +02:00
|
|
|
oldRoute := account.Routes[routeToSave.ID]
|
2022-08-18 18:22:15 +02:00
|
|
|
account.Routes[routeToSave.ID] = routeToSave
|
|
|
|
|
|
|
|
account.Network.IncSerial()
|
2024-07-03 11:33:02 +02:00
|
|
|
if err = am.Store.SaveAccount(ctx, account); err != nil {
|
2022-08-18 18:22:15 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2024-11-25 16:26:24 +01:00
|
|
|
if am.isRouteChangeAffectPeers(account, oldRoute) || am.isRouteChangeAffectPeers(account, routeToSave) {
|
2024-11-15 18:09:32 +01:00
|
|
|
am.updateAccountPeers(ctx, accountID)
|
2024-10-23 12:05:02 +02:00
|
|
|
}
|
2023-02-03 10:33:28 +01:00
|
|
|
|
2024-07-03 11:33:02 +02:00
|
|
|
am.StoreEvent(ctx, userID, string(routeToSave.ID), accountID, activity.RouteUpdated, routeToSave.EventMeta())
|
2023-01-25 16:29:59 +01:00
|
|
|
|
2023-02-03 10:33:28 +01:00
|
|
|
return nil
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// DeleteRoute deletes route with routeID
|
2024-07-03 11:33:02 +02:00
|
|
|
func (am *DefaultAccountManager) DeleteRoute(ctx context.Context, accountID string, routeID route.ID, userID string) error {
|
2024-07-31 14:53:32 +02:00
|
|
|
unlock := am.Store.AcquireWriteLockByUID(ctx, accountID)
|
2022-11-07 17:52:23 +01:00
|
|
|
defer unlock()
|
2022-08-18 18:22:15 +02:00
|
|
|
|
2024-07-03 11:33:02 +02:00
|
|
|
account, err := am.Store.GetAccount(ctx, accountID)
|
2022-08-18 18:22:15 +02:00
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return err
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
2023-01-25 16:29:59 +01:00
|
|
|
routy := account.Routes[routeID]
|
|
|
|
if routy == nil {
|
|
|
|
return status.Errorf(status.NotFound, "route with ID %s doesn't exist", routeID)
|
|
|
|
}
|
2022-08-18 18:22:15 +02:00
|
|
|
delete(account.Routes, routeID)
|
|
|
|
|
|
|
|
account.Network.IncSerial()
|
2024-07-03 11:33:02 +02:00
|
|
|
if err = am.Store.SaveAccount(ctx, account); err != nil {
|
2022-08-18 18:22:15 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2024-07-03 11:33:02 +02:00
|
|
|
am.StoreEvent(ctx, userID, string(routy.ID), accountID, activity.RouteRemoved, routy.EventMeta())
|
2023-01-25 16:29:59 +01:00
|
|
|
|
2024-11-25 16:26:24 +01:00
|
|
|
if am.isRouteChangeAffectPeers(account, routy) {
|
2024-11-15 18:09:32 +01:00
|
|
|
am.updateAccountPeers(ctx, accountID)
|
2024-10-23 12:05:02 +02:00
|
|
|
}
|
2023-10-04 15:08:50 +02:00
|
|
|
|
|
|
|
return nil
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// ListRoutes returns a list of routes from account
|
2024-07-03 11:33:02 +02:00
|
|
|
func (am *DefaultAccountManager) ListRoutes(ctx context.Context, accountID, userID string) ([]*route.Route, error) {
|
2024-09-27 16:10:50 +02:00
|
|
|
user, err := am.Store.GetUserByUserID(ctx, LockingStrengthShare, userID)
|
2022-08-18 18:22:15 +02:00
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, err
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
2024-09-27 16:10:50 +02:00
|
|
|
if !user.IsAdminOrServiceUser() || user.AccountID != accountID {
|
2023-12-01 17:24:57 +01:00
|
|
|
return nil, status.Errorf(status.PermissionDenied, "only users with admin power can view Network Routes")
|
2022-11-05 10:24:50 +01:00
|
|
|
}
|
|
|
|
|
2024-09-27 16:10:50 +02:00
|
|
|
return am.Store.GetAccountRoutes(ctx, LockingStrengthShare, accountID)
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
func toProtocolRoute(route *route.Route) *proto.Route {
|
|
|
|
return &proto.Route{
|
2024-05-06 14:47:49 +02:00
|
|
|
ID: string(route.ID),
|
|
|
|
NetID: string(route.NetID),
|
2022-08-22 14:10:24 +02:00
|
|
|
Network: route.Network.String(),
|
2024-06-13 13:24:24 +02:00
|
|
|
Domains: route.Domains.ToPunycodeList(),
|
2022-08-22 14:10:24 +02:00
|
|
|
NetworkType: int64(route.NetworkType),
|
|
|
|
Peer: route.Peer,
|
|
|
|
Metric: int64(route.Metric),
|
|
|
|
Masquerade: route.Masquerade,
|
2024-06-13 13:24:24 +02:00
|
|
|
KeepRoute: route.KeepRoute,
|
2022-08-18 18:22:15 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func toProtocolRoutes(routes []*route.Route) []*proto.Route {
|
|
|
|
protoRoutes := make([]*proto.Route, 0)
|
|
|
|
for _, r := range routes {
|
|
|
|
protoRoutes = append(protoRoutes, toProtocolRoute(r))
|
|
|
|
}
|
|
|
|
return protoRoutes
|
|
|
|
}
|
2024-06-13 13:24:24 +02:00
|
|
|
|
|
|
|
// getPlaceholderIP returns a placeholder IP address for the route if domains are used
|
|
|
|
func getPlaceholderIP() netip.Prefix {
|
|
|
|
// Using an IP from the documentation range to minimize impact in case older clients try to set a route
|
|
|
|
return netip.PrefixFrom(netip.AddrFrom4([4]byte{192, 0, 2, 0}), 32)
|
|
|
|
}
|
2024-10-02 13:41:00 +02:00
|
|
|
|
|
|
|
// getPeerRoutesFirewallRules gets the routes firewall rules associated with a routing peer ID for the account.
|
|
|
|
func (a *Account) getPeerRoutesFirewallRules(ctx context.Context, peerID string, validatedPeersMap map[string]struct{}) []*RouteFirewallRule {
|
|
|
|
routesFirewallRules := make([]*RouteFirewallRule, 0, len(a.Routes))
|
|
|
|
|
|
|
|
enabledRoutes, _ := a.getRoutingPeerRoutes(ctx, peerID)
|
|
|
|
for _, route := range enabledRoutes {
|
|
|
|
// If no access control groups are specified, accept all traffic.
|
|
|
|
if len(route.AccessControlGroups) == 0 {
|
|
|
|
defaultPermit := getDefaultPermit(route)
|
|
|
|
routesFirewallRules = append(routesFirewallRules, defaultPermit...)
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
policies := getAllRoutePoliciesFromGroups(a, route.AccessControlGroups)
|
|
|
|
for _, policy := range policies {
|
|
|
|
if !policy.Enabled {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, rule := range policy.Rules {
|
|
|
|
if !rule.Enabled {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
distributionGroupPeers, _ := a.getAllPeersFromGroups(ctx, route.Groups, peerID, nil, validatedPeersMap)
|
|
|
|
rules := generateRouteFirewallRules(ctx, route, rule, distributionGroupPeers, firewallRuleDirectionIN)
|
|
|
|
routesFirewallRules = append(routesFirewallRules, rules...)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return routesFirewallRules
|
|
|
|
}
|
|
|
|
|
|
|
|
func getDefaultPermit(route *route.Route) []*RouteFirewallRule {
|
|
|
|
var rules []*RouteFirewallRule
|
|
|
|
|
|
|
|
sources := []string{"0.0.0.0/0"}
|
|
|
|
if route.Network.Addr().Is6() {
|
|
|
|
sources = []string{"::/0"}
|
|
|
|
}
|
|
|
|
rule := RouteFirewallRule{
|
|
|
|
SourceRanges: sources,
|
|
|
|
Action: string(PolicyTrafficActionAccept),
|
|
|
|
Destination: route.Network.String(),
|
|
|
|
Protocol: string(PolicyRuleProtocolALL),
|
|
|
|
IsDynamic: route.IsDynamic(),
|
|
|
|
}
|
|
|
|
|
|
|
|
rules = append(rules, &rule)
|
|
|
|
|
|
|
|
// dynamic routes always contain an IPv4 placeholder as destination, hence we must add IPv6 rules additionally
|
|
|
|
if route.IsDynamic() {
|
|
|
|
ruleV6 := rule
|
|
|
|
ruleV6.SourceRanges = []string{"::/0"}
|
|
|
|
rules = append(rules, &ruleV6)
|
|
|
|
}
|
|
|
|
|
|
|
|
return rules
|
|
|
|
}
|
|
|
|
|
|
|
|
// getAllRoutePoliciesFromGroups retrieves route policies associated with the specified access control groups
|
|
|
|
// and returns a list of policies that have rules with destinations matching the specified groups.
|
|
|
|
func getAllRoutePoliciesFromGroups(account *Account, accessControlGroups []string) []*Policy {
|
|
|
|
routePolicies := make([]*Policy, 0)
|
|
|
|
for _, groupID := range accessControlGroups {
|
|
|
|
group, ok := account.Groups[groupID]
|
|
|
|
if !ok {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, policy := range account.Policies {
|
|
|
|
for _, rule := range policy.Rules {
|
|
|
|
exist := slices.ContainsFunc(rule.Destinations, func(groupID string) bool {
|
|
|
|
return groupID == group.ID
|
|
|
|
})
|
|
|
|
if exist {
|
|
|
|
routePolicies = append(routePolicies, policy)
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return routePolicies
|
|
|
|
}
|
|
|
|
|
|
|
|
// generateRouteFirewallRules generates a list of firewall rules for a given route.
|
|
|
|
func generateRouteFirewallRules(ctx context.Context, route *route.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int) []*RouteFirewallRule {
|
|
|
|
rulesExists := make(map[string]struct{})
|
|
|
|
rules := make([]*RouteFirewallRule, 0)
|
|
|
|
|
|
|
|
sourceRanges := make([]string, 0, len(groupPeers))
|
|
|
|
for _, peer := range groupPeers {
|
|
|
|
if peer == nil {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
sourceRanges = append(sourceRanges, fmt.Sprintf(AllowedIPsFormat, peer.IP))
|
|
|
|
}
|
|
|
|
|
|
|
|
baseRule := RouteFirewallRule{
|
|
|
|
SourceRanges: sourceRanges,
|
|
|
|
Action: string(rule.Action),
|
|
|
|
Destination: route.Network.String(),
|
|
|
|
Protocol: string(rule.Protocol),
|
|
|
|
IsDynamic: route.IsDynamic(),
|
|
|
|
}
|
|
|
|
|
|
|
|
// generate rule for port range
|
|
|
|
if len(rule.Ports) == 0 {
|
|
|
|
rules = append(rules, generateRulesWithPortRanges(baseRule, rule, rulesExists)...)
|
|
|
|
} else {
|
|
|
|
rules = append(rules, generateRulesWithPorts(ctx, baseRule, rule, rulesExists)...)
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
// TODO: generate IPv6 rules for dynamic routes
|
|
|
|
|
|
|
|
return rules
|
|
|
|
}
|
|
|
|
|
|
|
|
// generateRuleIDBase generates the base rule ID for checking duplicates.
|
|
|
|
func generateRuleIDBase(rule *PolicyRule, baseRule RouteFirewallRule) string {
|
|
|
|
return rule.ID + strings.Join(baseRule.SourceRanges, ",") + strconv.Itoa(firewallRuleDirectionIN) + baseRule.Protocol + baseRule.Action
|
|
|
|
}
|
|
|
|
|
|
|
|
// generateRulesForPeer generates rules for a given peer based on ports and port ranges.
|
|
|
|
func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
|
|
|
|
rules := make([]*RouteFirewallRule, 0)
|
|
|
|
|
|
|
|
ruleIDBase := generateRuleIDBase(rule, baseRule)
|
|
|
|
if len(rule.Ports) == 0 {
|
|
|
|
if len(rule.PortRanges) == 0 {
|
|
|
|
if _, ok := rulesExists[ruleIDBase]; !ok {
|
|
|
|
rulesExists[ruleIDBase] = struct{}{}
|
|
|
|
rules = append(rules, &baseRule)
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
for _, portRange := range rule.PortRanges {
|
|
|
|
ruleID := fmt.Sprintf("%s%d-%d", ruleIDBase, portRange.Start, portRange.End)
|
|
|
|
if _, ok := rulesExists[ruleID]; !ok {
|
|
|
|
rulesExists[ruleID] = struct{}{}
|
|
|
|
pr := baseRule
|
|
|
|
pr.PortRange = portRange
|
|
|
|
rules = append(rules, &pr)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return rules
|
|
|
|
}
|
|
|
|
|
|
|
|
return rules
|
|
|
|
}
|
|
|
|
|
|
|
|
// generateRulesWithPorts generates rules when specific ports are provided.
|
|
|
|
func generateRulesWithPorts(ctx context.Context, baseRule RouteFirewallRule, rule *PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
|
|
|
|
rules := make([]*RouteFirewallRule, 0)
|
|
|
|
ruleIDBase := generateRuleIDBase(rule, baseRule)
|
|
|
|
|
|
|
|
for _, port := range rule.Ports {
|
|
|
|
ruleID := ruleIDBase + port
|
|
|
|
if _, ok := rulesExists[ruleID]; ok {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
rulesExists[ruleID] = struct{}{}
|
|
|
|
|
|
|
|
pr := baseRule
|
|
|
|
p, err := strconv.ParseUint(port, 10, 16)
|
|
|
|
if err != nil {
|
|
|
|
log.WithContext(ctx).Errorf("failed to parse port %s for rule: %s", port, rule.ID)
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
pr.Port = uint16(p)
|
|
|
|
rules = append(rules, &pr)
|
|
|
|
}
|
|
|
|
|
|
|
|
return rules
|
|
|
|
}
|
|
|
|
|
|
|
|
func toProtocolRoutesFirewallRules(rules []*RouteFirewallRule) []*proto.RouteFirewallRule {
|
|
|
|
result := make([]*proto.RouteFirewallRule, len(rules))
|
|
|
|
for i := range rules {
|
|
|
|
rule := rules[i]
|
|
|
|
result[i] = &proto.RouteFirewallRule{
|
|
|
|
SourceRanges: rule.SourceRanges,
|
|
|
|
Action: getProtoAction(rule.Action),
|
|
|
|
Destination: rule.Destination,
|
|
|
|
Protocol: getProtoProtocol(rule.Protocol),
|
|
|
|
PortInfo: getProtoPortInfo(rule),
|
|
|
|
IsDynamic: rule.IsDynamic,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return result
|
|
|
|
}
|
|
|
|
|
|
|
|
// getProtoDirection converts the direction to proto.RuleDirection.
|
|
|
|
func getProtoDirection(direction int) proto.RuleDirection {
|
|
|
|
if direction == firewallRuleDirectionOUT {
|
|
|
|
return proto.RuleDirection_OUT
|
|
|
|
}
|
|
|
|
return proto.RuleDirection_IN
|
|
|
|
}
|
|
|
|
|
|
|
|
// getProtoAction converts the action to proto.RuleAction.
|
|
|
|
func getProtoAction(action string) proto.RuleAction {
|
|
|
|
if action == string(PolicyTrafficActionDrop) {
|
|
|
|
return proto.RuleAction_DROP
|
|
|
|
}
|
|
|
|
return proto.RuleAction_ACCEPT
|
|
|
|
}
|
|
|
|
|
|
|
|
// getProtoProtocol converts the protocol to proto.RuleProtocol.
|
|
|
|
func getProtoProtocol(protocol string) proto.RuleProtocol {
|
|
|
|
switch PolicyRuleProtocolType(protocol) {
|
|
|
|
case PolicyRuleProtocolALL:
|
|
|
|
return proto.RuleProtocol_ALL
|
|
|
|
case PolicyRuleProtocolTCP:
|
|
|
|
return proto.RuleProtocol_TCP
|
|
|
|
case PolicyRuleProtocolUDP:
|
|
|
|
return proto.RuleProtocol_UDP
|
|
|
|
case PolicyRuleProtocolICMP:
|
|
|
|
return proto.RuleProtocol_ICMP
|
|
|
|
default:
|
|
|
|
return proto.RuleProtocol_UNKNOWN
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// getProtoPortInfo converts the port info to proto.PortInfo.
|
|
|
|
func getProtoPortInfo(rule *RouteFirewallRule) *proto.PortInfo {
|
|
|
|
var portInfo proto.PortInfo
|
|
|
|
if rule.Port != 0 {
|
|
|
|
portInfo.PortSelection = &proto.PortInfo_Port{Port: uint32(rule.Port)}
|
|
|
|
} else if portRange := rule.PortRange; portRange.Start != 0 && portRange.End != 0 {
|
|
|
|
portInfo.PortSelection = &proto.PortInfo_Range_{
|
|
|
|
Range: &proto.PortInfo_Range{
|
|
|
|
Start: uint32(portRange.Start),
|
|
|
|
End: uint32(portRange.End),
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return &portInfo
|
|
|
|
}
|
2024-10-23 12:05:02 +02:00
|
|
|
|
|
|
|
// isRouteChangeAffectPeers checks if a given route affects peers by determining
|
|
|
|
// if it has a routing peer, distribution, or peer groups that include peers
|
2024-11-25 16:26:24 +01:00
|
|
|
func (am *DefaultAccountManager) isRouteChangeAffectPeers(account *Account, route *route.Route) bool {
|
|
|
|
return am.anyGroupHasPeers(account, route.Groups) || am.anyGroupHasPeers(account, route.PeerGroups) || route.Peer != ""
|
2024-10-23 12:05:02 +02:00
|
|
|
}
|