* Add method to retrieve peer's applied posture checks
* Add posture checks in server response and update proto messages
* Refactor
* Extends peer metadata synchronization through SyncRequest and propagate posture changes on syncResponse
* Remove account lock
* Pass system info on sync
* Fix tests
* Refactor
* resolve merge
* Evaluate process check on client (#1749)
* implement server and client sync peer meta alongside mocks
* wip: add check file and process
* Add files to peer metadata for process check
* wip: update peer meta on first sync
* Add files to peer's metadata
* Evaluate process check using files from peer metadata
* Fix panic and append windows path to files
* Fix check network address and files equality
* Evaluate active process on darwin
* Evaluate active process on linux
* Skip processing processes if no paths are set
* Return network map on peer meta-sync and update account peer's
* Update client network map on meta sync
* Get system info with applied checks
* Add windows package
* Remove a network map from sync meta-response
* Update checks proto message
* Keep client checks state and sync meta on checks change
* Evaluate a running process
* skip build for android and ios
* skip check file and process for android and ios
* bump gopsutil version
* fix tests
* move process check to separate os file
* refactor
* evaluate info with checks on receiving management events
* skip meta-update for an old client with no meta-sync support
* Check if peer meta is empty without reflection
Now that we have the latency between peers available we can use this data to consider when choosing the best route. This way the route with the routing peer with the lower latency will be preferred over others with the same target network.
* Add Linux legacy routing if ip rule functionality is not available
* Ignore exclusion route errors if host has no route
* Exclude iOS from route manager
* Also retrieve IPv6 routes
* Ignore loopback addresses not being in the main table
* Ignore "not supported" errors on cleanup
* Fix regression in ListenUDP not using fwmarks
All routes are now installed in a custom netbird routing table.
Management and wireguard traffic is now marked with a custom fwmark.
When the mark is present the traffic is routed via the main routing table, bypassing the VPN.
When the mark is absent the traffic is routed via the netbird routing table, if:
- there's no match in the main routing table
- it would match the default route in the routing table
IPv6 traffic is blocked when a default route IPv4 route is configured to avoid leakage.
* adding peer healthcheck
* generate proto file
* fix return in udp mux and replace with continue
* use ice agent for latency checks
* fix status output
* remove some logs
* fix status test
* revert bind and ebpf code
* fix error handling on binding response callback
* extend error handling on binding response callback
---------
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
this handles virtualized systems without Win32_ComputerSystemProduct entries by returning 'unknown' for system product name
Co-authored-by: Bjoern Brauer <zaubernerd@zaubernerd.de>
* Fix using wrong array index in log to avoid potential panic
* Increase gRPC connection timeout and add the timeout resolv.conf option
This makes sure the dns client is able to failover to a second
configured nameserver, if present. That is the case then when using the
dns `file` manager and a resolv.conf file generated for netbird.
* On file backup restore, remove the first NS if it's the netbird NS
* Bump dns mangager discovery message from debug to info to ease debugging
This PR updates the system tray icons to reflect both connection status and availability of updates. Now, the tray will show distinct icons for the following states: connected, disconnected, update available while connected, and update available while disconnected. This change improves user experience by providing a clear visual status indicator.
- Add new icons for connected and disconnected states with update available.
- Implement logic to switch icons based on connection status and update availability.
- Remove old icon references for default and update states.
* wip: add posture checks structs
* add netbird version check
* Refactor posture checks and add version checks
* Add posture check activities (#1445)
* Integrate Endpoints for Posture Checks (#1432)
* wip: add posture checks structs
* add netbird version check
* Refactor posture checks and add version checks
* Implement posture and version checks in API models
* Refactor API models and enhance posture check functionality
* wip: add posture checks endpoints
* go mod tidy
* Reference the posture checks by id's in policy
* Add posture checks management to server
* Add posture checks management mocks
* implement posture checks handlers
* Add posture checks to account copy and fix tests
* Refactor posture checks validation
* wip: Add posture checks handler tests
* Add JSON encoding support to posture checks
* Encode posture checks to correct api response object
* Refactored posture checks implementation to align with the new API schema
* Refactor structure of `Checks` from slice to map
* Cleanup
* Add posture check activities (#1445)
* Revert map to use list of checks
* Add posture check activity events
* Refactor posture check initialization in account test
* Improve the handling of version range in posture check
* Fix tests and linter
* Remove max_version from NBVersionCheck
* Added unit tests for NBVersionCheck
* go mod tidy
* Extend policy endpoint with posture checks (#1450)
* Implement posture and version checks in API models
* go mod tidy
* Allow attaching posture checks to policy
* Update error message for linked posture check on deleting
* Refactor PostureCheck and Checks structures
* go mod tidy
* Add validation for non-existing posture checks
* fix unit tests
* use Wt version
* Remove the enabled field, as posture check will now automatically be activated by default when attaching to a policy
* wip: add posture checks structs
* add netbird version check
* Refactor posture checks and add version checks
* Add posture check activities (#1445)
* Integrate Endpoints for Posture Checks (#1432)
* wip: add posture checks structs
* add netbird version check
* Refactor posture checks and add version checks
* Implement posture and version checks in API models
* Refactor API models and enhance posture check functionality
* wip: add posture checks endpoints
* go mod tidy
* Reference the posture checks by id's in policy
* Add posture checks management to server
* Add posture checks management mocks
* implement posture checks handlers
* Add posture checks to account copy and fix tests
* Refactor posture checks validation
* wip: Add posture checks handler tests
* Add JSON encoding support to posture checks
* Encode posture checks to correct api response object
* Refactored posture checks implementation to align with the new API schema
* Refactor structure of `Checks` from slice to map
* Cleanup
* Add posture check activities (#1445)
* Revert map to use list of checks
* Add posture check activity events
* Refactor posture check initialization in account test
* Improve the handling of version range in posture check
* Fix tests and linter
* Remove max_version from NBVersionCheck
* Added unit tests for NBVersionCheck
* go mod tidy
* Extend policy endpoint with posture checks (#1450)
* Implement posture and version checks in API models
* go mod tidy
* Allow attaching posture checks to policy
* Update error message for linked posture check on deleting
* Refactor PostureCheck and Checks structures
* go mod tidy
* Add validation for non-existing posture checks
* fix unit tests
* use Wt version
* Remove the enabled field, as posture check will now automatically be activated by default when attaching to a policy
* Extend network map generation with posture checks (#1466)
* Apply posture checks to network map generation
* run policy posture checks on peers to connect
* Refactor and streamline policy posture check process for peers to connect.
* Add posture checks testing in a network map
* Remove redundant nil check in policy.go
* Refactor peer validation check in policy.go
* Update 'Check' function signature and use logger for version check
* Refactor posture checks run on sources and updated the validation func
* Update peer validation
* fix tests
* improved test coverage for policy posture check
* Refactoring
* Extend NetBird agent to collect kernel version (#1495)
* Add KernelVersion field to LoginRequest
* Add KernelVersion to system info retrieval
* Fix tests
* Remove Core field from system info
* Replace Core field with new OSVersion field in system info
* Added WMI dependency to info_windows.go
* Add OS Version posture checks (#1479)
* Initial support of Geolocation service (#1491)
* Add Geo Location posture check (#1500)
* wip: implement geolocation check
* add geo location posture checks to posture api
* Merge branch 'feature/posture-checks' into geo-posture-check
* Remove CityGeoNameID and update required fields in API
* Add geoLocation checks to posture checks handler tests
* Implement geo location-based checks for peers
* Update test values and embed location struct in peer system
* add support for country wide checks
* initialize country code regex once
* Fix peer meta core compability with older clients (#1515)
* Refactor extraction of OSVersion in grpcserver
* Ignore lint check
* Fix peer meta core compability with older management (#1532)
* Revert core field deprecation
* fix tests
* Extend peer meta with location information (#1517)
This PR uses the geolocation service to resolve IP to location.
The lookup happens once on the first connection - when a client calls the Sync func.
The location is stored as part of the peer:
* Add Locations endpoints (#1516)
* add locations endpoints
* Add sqlite3 check and database generation in geolite script
* Add SQLite storage for geolocation data
* Refactor file existence check into a separate function
* Integrate geolocation services into management application
* Refactoring
* Refactor city retrieval to include Geonames ID
* Add signature verification for GeoLite2 database download
* Change to in-memory database for geolocation store
* Merge manager to geolocation
* Update GetAllCountries to return Country name and iso code
* fix tests
* Add reload to SqliteStore
* Add geoname indexes
* move db file check to connectDB
* Add concurrency safety to SQL queries and database reloading
The commit adds mutex locks to the GetAllCountries and GetCitiesByCountry functions to ensure thread-safety during database queries. Additionally, it introduces a mechanism to safely close the old database connection before a new connection is established upon reloading, which improves the reliability of database operations. Lastly, it moves the checking of database file existence to the connectDB function.
* Add sha256 sum check to geolocation store before reload
* Use read lock
* Check SHA256 twice when reload geonames db
---------
Co-authored-by: Yury Gargay <yury.gargay@gmail.com>
* Add tests and validation for empty peer location in GeoLocationCheck (#1546)
* Disallow Geo check creation/update without configured Geo DB (#1548)
* Fix shared access to in memory copy of geonames.db (#1550)
* Trim suffix in when evaluate Min Kernel Version in OS check
* Add Valid Peer Windows Kernel version test
* Add Geolocation handler tests (#1556)
* Implement user admin checks in posture checks
* Add geolocation handler tests
* Mark initGeolocationTestData as helper func
* Add error handling to geolocation database closure
* Add cleanup function to close geolocation resources
* Simplify checks definition serialisation (#1555)
* Regenerate network map on posture check update (#1563)
* change network state and generate map on posture check update
* Refactoring
* Make city name optional (#1575)
* Do not return empty city name
* Validate action param of geo location checks (#1577)
We only support allow and deny
* Switch realip middleware to upstream (#1578)
* Be more silent in download-geolite2.sh script
* Fix geonames db reload (#1580)
* Ensure posture check name uniqueness when create (#1594)
* Enhance the management of posture checks (#1595)
* add a correct min version and kernel for os posture check example
* handle error when geo or location db is nil
* expose all peer location details in api response
* Check for nil geolocation manager only
* Validate posture check before save
* bump open api version
* add peer location fields to toPeerListItemResponse
* Feautre/extend sys meta (#1536)
* Collect network addresses
* Add Linux sys product info
* Fix peer meta comparison
* Collect sys info on mac
* Add windows sys info
* Fix test
* Fix test
* Fix grpc client
* Ignore test
* Fix test
* Collect IPv6 addresses
* Change the IP to IP + net
* fix tests
* Use netip on server side
* Serialize netip to json
* Extend Peer metadata with cloud detection (#1552)
* add cloud detection + test binary
* test windows exe
* Collect IPv6 addresses
* Change the IP to IP + net
* switch to forked cloud detect lib
* new test builds
* new GCE build
* discontinue using library but local copy instead
* fix imports
* remove openstack check
* add hierarchy to cloud check
* merge IBM and SoftLayer
* close resp bodies and use os lib for file reading
* close more resp bodies
* fix error check logic
* parallelize IBM checks
* fix response value
* go mod tidy
* include context + change kubernetes detection
* add context in info functions
* extract platform into separate field
* fix imports
* add missing wmi import
---------
Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com>
---------
Co-authored-by: pascal-fischer <32096965+pascal-fischer@users.noreply.github.com>
* generate proto
* remove test binaries
---------
Co-authored-by: bcmmbaga <bethuelmbaga12@gmail.com>
Co-authored-by: Yury Gargay <yury.gargay@gmail.com>
Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com>
This changes the default behavior for new peers, by requiring the agent to be executed with allow-server-ssh set to true in order for the management configuration to take effect.
With these changes, the command up supports the flag --disable-auto-connect that allows users to disable auto connection on the client after a computer restart or when the daemon restarts.
This PR implements the following posture checks:
* Agent minimum version allowed
* OS minimum version allowed
* Geo-location based on connection IP
For the geo-based location, we rely on GeoLite2 databases which are free IP geolocation databases. MaxMind was tested and we provide a script that easily allows to download of all necessary files, see infrastructure_files/download-geolite2.sh.
The OpenAPI spec should extensively cover the life cycle of current version posture checks.
* Make sure our iOS dialer does not get overwritten
* set dial timeout for both clients on ios
---------
Co-authored-by: Pascal Fischer <pascal@netbird.io>
sends an extra server reflexive candidate to the remote peer with our related port (usually the Wireguard port)
this is useful when a network has an existing port forwarding rule for the Wireguard port and the local peer and avoids creating a 1:1 NAT on the local network.
