Skip to content

Commit 05cbead

Browse files
pascal-fischerpascal-fischer
authored
[management] Fix direct peer networks route (#4802)
1 parent 60f4d5f commit 05cbead

File tree

2 files changed

+131
-34
lines changed

2 files changed

+131
-34
lines changed

‎management/server/types/account.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1242,6 +1242,13 @@ func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID
12421242
}
12431243
}
12441244
}
1245+
if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
1246+
_, distPeer := distributionPeers[rule.SourceResource.ID]
1247+
_, valid := validatedPeersMap[rule.SourceResource.ID]
1248+
if distPeer && valid && a.validatePostureChecksOnPeer(context.Background(), postureChecks, rule.SourceResource.ID) {
1249+
distPeersWithPolicy[rule.SourceResource.ID] = struct{}{}
1250+
}
1251+
}
12451252

12461253
distributionGroupPeers := make([]*nbpeer.Peer, 0, len(distPeersWithPolicy))
12471254
for pID := range distPeersWithPolicy {
@@ -1587,6 +1594,10 @@ func getPoliciesSourcePeers(policies []*Policy, groups map[string]*Group) map[st
15871594
sourcePeers[peer] = struct{}{}
15881595
}
15891596
}
1597+
1598+
if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
1599+
sourcePeers[rule.SourceResource.ID] = struct{}{}
1600+
}
15901601
}
15911602
}
15921603

‎management/server/types/networkmapbuilder.go‎

Lines changed: 120 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -858,6 +858,14 @@ func (b *NetworkMapBuilder) getRulePeers(
858858
}
859859
}
860860

861+
if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
862+
_, distPeer := distributionPeers[rule.SourceResource.ID]
863+
_, valid := validatedPeersMap[rule.SourceResource.ID]
864+
if distPeer && valid && account.validatePostureChecksOnPeer(context.Background(), postureChecks, rule.SourceResource.ID) {
865+
distPeersWithPolicy[rule.SourceResource.ID] = struct{}{}
866+
}
867+
}
868+
861869
distributionGroupPeers := make([]*nbpeer.Peer, 0, len(distPeersWithPolicy))
862870
for pID := range distPeersWithPolicy {
863871
peer := b.cache.globalPeers[pID]
@@ -1287,24 +1295,54 @@ func (b *NetworkMapBuilder) calculateIncrementalUpdates(account *Account, newPee
12871295
if !rule.Enabled {
12881296
continue
12891297
}
1298+
var peerInSources, peerInDestinations bool
1299+
1300+
if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID == newPeerID {
1301+
peerInSources = true
1302+
} else {
1303+
peerInSources = b.isPeerInGroups(rule.Sources, peerGroups)
1304+
}
12901305

1291-
peerInSources := b.isPeerInGroups(rule.Sources, peerGroups)
1292-
peerInDestinations := b.isPeerInGroups(rule.Destinations, peerGroups)
1306+
if rule.DestinationResource.Type == ResourceTypePeer && rule.DestinationResource.ID == newPeerID {
1307+
peerInDestinations = true
1308+
} else {
1309+
peerInDestinations = b.isPeerInGroups(rule.Destinations, peerGroups)
1310+
}
12931311

12941312
if peerInSources {
1295-
b.addUpdateForPeersInGroups(updates, rule.Destinations, newPeerID, rule, FirewallRuleDirectionIN, groupAllLn)
1313+
if len(rule.Destinations) > 0 {
1314+
b.addUpdateForPeersInGroups(updates, rule.Destinations, newPeerID, rule, FirewallRuleDirectionIN, groupAllLn)
1315+
}
1316+
if rule.DestinationResource.Type == ResourceTypePeer && rule.DestinationResource.ID != "" {
1317+
b.addUpdateForDirectPeerResource(updates, rule.DestinationResource.ID, newPeerID, rule, FirewallRuleDirectionIN)
1318+
}
12961319
}
12971320

12981321
if peerInDestinations {
1299-
b.addUpdateForPeersInGroups(updates, rule.Sources, newPeerID, rule, FirewallRuleDirectionOUT, groupAllLn)
1322+
if len(rule.Sources) > 0 {
1323+
b.addUpdateForPeersInGroups(updates, rule.Sources, newPeerID, rule, FirewallRuleDirectionOUT, groupAllLn)
1324+
}
1325+
if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
1326+
b.addUpdateForDirectPeerResource(updates, rule.SourceResource.ID, newPeerID, rule, FirewallRuleDirectionOUT)
1327+
}
13001328
}
13011329

13021330
if rule.Bidirectional {
13031331
if peerInSources {
1304-
b.addUpdateForPeersInGroups(updates, rule.Destinations, newPeerID, rule, FirewallRuleDirectionOUT, groupAllLn)
1332+
if len(rule.Destinations) > 0 {
1333+
b.addUpdateForPeersInGroups(updates, rule.Destinations, newPeerID, rule, FirewallRuleDirectionOUT, groupAllLn)
1334+
}
1335+
if rule.DestinationResource.Type == ResourceTypePeer && rule.DestinationResource.ID != "" {
1336+
b.addUpdateForDirectPeerResource(updates, rule.DestinationResource.ID, newPeerID, rule, FirewallRuleDirectionOUT)
1337+
}
13051338
}
13061339
if peerInDestinations {
1307-
b.addUpdateForPeersInGroups(updates, rule.Sources, newPeerID, rule, FirewallRuleDirectionIN, groupAllLn)
1340+
if len(rule.Sources) > 0 {
1341+
b.addUpdateForPeersInGroups(updates, rule.Sources, newPeerID, rule, FirewallRuleDirectionIN, groupAllLn)
1342+
}
1343+
if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
1344+
b.addUpdateForDirectPeerResource(updates, rule.SourceResource.ID, newPeerID, rule, FirewallRuleDirectionIN)
1345+
}
13081346
}
13091347
}
13101348
}
@@ -1566,39 +1604,87 @@ func (b *NetworkMapBuilder) addUpdateForPeersInGroups(
15661604
if _, ok := b.validatedPeers[peerID]; !ok {
15671605
continue
15681606
}
1569-
delta := updates[peerID]
1570-
if delta == nil {
1571-
delta = &PeerUpdateDelta{
1572-
PeerID: peerID,
1573-
AddConnectedPeer: newPeerID,
1574-
AddFirewallRules: make([]*FirewallRuleDelta, 0),
1575-
}
1576-
updates[peerID] = delta
1607+
targetPeer := b.cache.globalPeers[peerID]
1608+
if targetPeer == nil {
1609+
continue
15771610
}
15781611

1612+
peerIPForRule := fr.PeerIP
15791613
if all {
1580-
fr.PeerIP = allPeers
1581-
}
1582-
1583-
if len(rule.Ports) > 0 || len(rule.PortRanges) > 0 {
1584-
expandedRules := expandPortsAndRanges(*fr, rule, b.cache.globalPeers[peerID])
1585-
for _, expandedRule := range expandedRules {
1586-
ruleID := b.generateFirewallRuleID(expandedRule)
1587-
delta.AddFirewallRules = append(delta.AddFirewallRules, &FirewallRuleDelta{
1588-
Rule: expandedRule,
1589-
RuleID: ruleID,
1590-
Direction: direction,
1591-
})
1592-
}
1593-
} else {
1594-
ruleID := b.generateFirewallRuleID(fr)
1595-
delta.AddFirewallRules = append(delta.AddFirewallRules, &FirewallRuleDelta{
1596-
Rule: fr,
1597-
RuleID: ruleID,
1598-
Direction: direction,
1599-
})
1614+
peerIPForRule = allPeers
16001615
}
1616+
1617+
b.addOrUpdateFirewallRuleInDelta(updates, peerID, newPeerID, rule, direction, fr, peerIPForRule, targetPeer)
1618+
}
1619+
}
1620+
}
1621+
1622+
func (b *NetworkMapBuilder) addUpdateForDirectPeerResource(
1623+
updates map[string]*PeerUpdateDelta, targetPeerID string, newPeerID string,
1624+
rule *PolicyRule, direction int,
1625+
) {
1626+
if targetPeerID == newPeerID {
1627+
return
1628+
}
1629+
1630+
if _, ok := b.validatedPeers[targetPeerID]; !ok {
1631+
return
1632+
}
1633+
1634+
newPeer := b.cache.globalPeers[newPeerID]
1635+
if newPeer == nil {
1636+
return
1637+
}
1638+
1639+
targetPeer := b.cache.globalPeers[targetPeerID]
1640+
if targetPeer == nil {
1641+
return
1642+
}
1643+
1644+
fr := &FirewallRule{
1645+
PolicyID: rule.ID,
1646+
PeerIP: newPeer.IP.String(),
1647+
Direction: direction,
1648+
Action: string(rule.Action),
1649+
Protocol: string(rule.Protocol),
1650+
}
1651+
1652+
b.addOrUpdateFirewallRuleInDelta(updates, targetPeerID, newPeerID, rule, direction, fr, fr.PeerIP, targetPeer)
1653+
}
1654+
1655+
func (b *NetworkMapBuilder) addOrUpdateFirewallRuleInDelta(
1656+
updates map[string]*PeerUpdateDelta, targetPeerID string, newPeerID string,
1657+
rule *PolicyRule, direction int, baseRule *FirewallRule, peerIP string, targetPeer *nbpeer.Peer,
1658+
) {
1659+
delta := updates[targetPeerID]
1660+
if delta == nil {
1661+
delta = &PeerUpdateDelta{
1662+
PeerID: targetPeerID,
1663+
AddConnectedPeer: newPeerID,
1664+
AddFirewallRules: make([]*FirewallRuleDelta, 0),
16011665
}
1666+
updates[targetPeerID] = delta
1667+
}
1668+
1669+
baseRule.PeerIP = peerIP
1670+
1671+
if len(rule.Ports) > 0 || len(rule.PortRanges) > 0 {
1672+
expandedRules := expandPortsAndRanges(*baseRule, rule, targetPeer)
1673+
for _, expandedRule := range expandedRules {
1674+
ruleID := b.generateFirewallRuleID(expandedRule)
1675+
delta.AddFirewallRules = append(delta.AddFirewallRules, &FirewallRuleDelta{
1676+
Rule: expandedRule,
1677+
RuleID: ruleID,
1678+
Direction: direction,
1679+
})
1680+
}
1681+
} else {
1682+
ruleID := b.generateFirewallRuleID(baseRule)
1683+
delta.AddFirewallRules = append(delta.AddFirewallRules, &FirewallRuleDelta{
1684+
Rule: baseRule,
1685+
RuleID: ruleID,
1686+
Direction: direction,
1687+
})
16021688
}
16031689
}
16041690

0 commit comments

Comments
 (0)