peers.go 38 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217
  1. package logic
  2. import (
  3. "errors"
  4. "fmt"
  5. "log"
  6. "net"
  7. "sort"
  8. "strconv"
  9. "strings"
  10. "time"
  11. "github.com/c-robinson/iplib"
  12. proxy_models "github.com/gravitl/netclient/nmproxy/models"
  13. "github.com/gravitl/netmaker/database"
  14. "github.com/gravitl/netmaker/logger"
  15. "github.com/gravitl/netmaker/logic/acls/nodeacls"
  16. "github.com/gravitl/netmaker/models"
  17. "github.com/gravitl/netmaker/netclient/ncutils"
  18. "github.com/gravitl/netmaker/servercfg"
  19. "golang.org/x/exp/slices"
  20. "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
  21. )
  22. // GetPeersforProxy calculates the peers for a proxy
  23. // TODO ==========================
  24. // TODO ==========================
  25. // TODO ==========================
  26. // TODO ==========================
  27. // TODO ==========================
  28. // revisit this logic with new host/node models.
  29. func GetPeersForProxy(node *models.Node, onlyPeers bool) (proxy_models.ProxyManagerPayload, error) {
  30. proxyPayload := proxy_models.ProxyManagerPayload{}
  31. var peers []wgtypes.PeerConfig
  32. peerConfMap := make(map[string]proxy_models.PeerConf)
  33. var err error
  34. currentPeers, err := GetNetworkNodes(node.Network)
  35. if err != nil {
  36. return proxyPayload, err
  37. }
  38. if !onlyPeers {
  39. if node.IsRelayed {
  40. relayNode := FindRelay(node)
  41. relayHost, err := GetHost(relayNode.HostID.String())
  42. if err != nil {
  43. return proxyPayload, err
  44. }
  45. if relayNode != nil {
  46. host, err := GetHost(relayNode.HostID.String())
  47. if err != nil {
  48. logger.Log(0, "error retrieving host for relay node", relayNode.HostID.String(), err.Error())
  49. }
  50. relayEndpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayHost.EndpointIP, host.LocalListenPort))
  51. if err != nil {
  52. logger.Log(1, "failed to resolve relay node endpoint: ", err.Error())
  53. }
  54. proxyPayload.IsRelayed = true
  55. proxyPayload.RelayedTo = relayEndpoint
  56. } else {
  57. logger.Log(0, "couldn't find relay node for: ", node.ID.String())
  58. }
  59. }
  60. if node.IsRelay {
  61. host, err := GetHost(node.HostID.String())
  62. if err != nil {
  63. logger.Log(0, "error retrieving host for relay node", node.ID.String(), err.Error())
  64. }
  65. relayedNodes, err := GetRelayedNodes(node)
  66. if err != nil {
  67. logger.Log(1, "failed to relayed nodes: ", node.ID.String(), err.Error())
  68. proxyPayload.IsRelay = false
  69. } else {
  70. relayPeersMap := make(map[string]proxy_models.RelayedConf)
  71. for _, relayedNode := range relayedNodes {
  72. payload, err := GetPeersForProxy(&relayedNode, true)
  73. if err == nil {
  74. relayedHost, err := GetHost(relayedNode.HostID.String())
  75. if err != nil {
  76. logger.Log(0, "error retrieving host for relayNode", relayedNode.ID.String(), err.Error())
  77. }
  78. relayedEndpoint, udpErr := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayedHost.EndpointIP, host.LocalListenPort))
  79. if udpErr == nil {
  80. relayPeersMap[host.PublicKey.String()] = proxy_models.RelayedConf{
  81. RelayedPeerEndpoint: relayedEndpoint,
  82. RelayedPeerPubKey: relayedHost.PublicKey.String(),
  83. Peers: payload.Peers,
  84. }
  85. }
  86. }
  87. }
  88. proxyPayload.IsRelay = true
  89. proxyPayload.RelayedPeerConf = relayPeersMap
  90. }
  91. }
  92. }
  93. for _, peer := range currentPeers {
  94. if peer.ID == node.ID {
  95. //skip yourself
  96. continue
  97. }
  98. host, err := GetHost(peer.HostID.String())
  99. if err != nil {
  100. continue
  101. }
  102. proxyStatus := host.ProxyEnabled
  103. listenPort := host.LocalListenPort
  104. if proxyStatus {
  105. listenPort = host.ProxyListenPort
  106. if listenPort == 0 {
  107. listenPort = proxy_models.NmProxyPort
  108. }
  109. } else if listenPort == 0 {
  110. listenPort = host.ListenPort
  111. }
  112. endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", host.EndpointIP, listenPort))
  113. if err != nil {
  114. logger.Log(1, "failed to resolve udp addr for node: ", peer.ID.String(), host.EndpointIP.String(), err.Error())
  115. continue
  116. }
  117. allowedips := GetAllowedIPs(node, &peer, nil, false)
  118. var keepalive time.Duration
  119. if node.PersistentKeepalive != 0 {
  120. // set_keepalive
  121. keepalive = node.PersistentKeepalive
  122. }
  123. peers = append(peers, wgtypes.PeerConfig{
  124. PublicKey: host.PublicKey,
  125. Endpoint: endpoint,
  126. AllowedIPs: allowedips,
  127. PersistentKeepaliveInterval: &keepalive,
  128. ReplaceAllowedIPs: true,
  129. })
  130. peerConfMap[host.PublicKey.String()] = proxy_models.PeerConf{
  131. Address: net.ParseIP(peer.PrimaryAddress()),
  132. Proxy: proxyStatus,
  133. PublicListenPort: int32(listenPort),
  134. }
  135. if !onlyPeers && peer.IsRelayed {
  136. relayNode := FindRelay(&peer)
  137. if relayNode != nil {
  138. relayHost, err := GetHost(relayNode.HostID.String())
  139. if err != nil {
  140. logger.Log(0, "error retrieving host for relayNode", relayNode.ID.String(), err.Error())
  141. continue
  142. }
  143. relayTo, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayHost.EndpointIP, relayHost.LocalListenPort))
  144. if err == nil {
  145. peerConfMap[host.PublicKey.String()] = proxy_models.PeerConf{
  146. IsRelayed: true,
  147. RelayedTo: relayTo,
  148. Address: net.ParseIP(peer.PrimaryAddress()),
  149. Proxy: proxyStatus,
  150. PublicListenPort: int32(listenPort),
  151. }
  152. }
  153. }
  154. }
  155. }
  156. if node.IsIngressGateway {
  157. var extPeers []wgtypes.PeerConfig
  158. extPeers, peerConfMap, err = getExtPeersForProxy(node, peerConfMap)
  159. if err == nil {
  160. peers = append(peers, extPeers...)
  161. } else if !database.IsEmptyRecord(err) {
  162. logger.Log(1, "error retrieving external clients:", err.Error())
  163. }
  164. }
  165. proxyPayload.IsIngress = node.IsIngressGateway
  166. addr := node.Address
  167. if addr.String() == "" {
  168. addr = node.Address6
  169. }
  170. proxyPayload.WgAddr = addr.String()
  171. proxyPayload.Peers = peers
  172. proxyPayload.PeerMap = peerConfMap
  173. //proxyPayload.Network = node.Network
  174. //proxyPayload.InterfaceName = node.Interface
  175. //hardcode or read from host ??
  176. proxyPayload.InterfaceName = models.WIREGUARD_INTERFACE
  177. return proxyPayload, nil
  178. }
  179. // GetProxyUpdateForHost - gets the proxy update for host
  180. func GetProxyUpdateForHost(host *models.Host) (proxy_models.ProxyManagerPayload, error) {
  181. proxyPayload := proxy_models.ProxyManagerPayload{
  182. Action: proxy_models.ProxyUpdate,
  183. }
  184. peerConfMap := make(map[string]proxy_models.PeerConf)
  185. if host.IsRelayed {
  186. relayHost, err := GetHost(host.RelayedBy)
  187. if err == nil {
  188. listenPort := relayHost.LocalListenPort
  189. if relayHost.ProxyEnabled {
  190. listenPort = relayHost.ProxyListenPort
  191. if listenPort == 0 {
  192. listenPort = proxy_models.NmProxyPort
  193. }
  194. } else if listenPort == 0 {
  195. listenPort = relayHost.ListenPort
  196. }
  197. relayEndpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayHost.EndpointIP, listenPort))
  198. if err != nil {
  199. logger.Log(1, "failed to resolve relay node endpoint: ", err.Error())
  200. }
  201. proxyPayload.IsRelayed = true
  202. proxyPayload.RelayedTo = relayEndpoint
  203. } else {
  204. logger.Log(0, "couldn't find relay host for: ", host.ID.String())
  205. }
  206. }
  207. if host.IsRelay {
  208. relayedHosts := GetRelayedHosts(host)
  209. relayPeersMap := make(map[string]proxy_models.RelayedConf)
  210. for _, relayedHost := range relayedHosts {
  211. payload, err := GetPeerUpdateForHost(&relayedHost)
  212. if err == nil {
  213. listenPort := relayedHost.LocalListenPort
  214. if relayedHost.ProxyEnabled {
  215. listenPort = relayedHost.ProxyListenPort
  216. if listenPort == 0 {
  217. listenPort = proxy_models.NmProxyPort
  218. }
  219. } else if listenPort == 0 {
  220. listenPort = relayedHost.ListenPort
  221. }
  222. relayedEndpoint, udpErr := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayedHost.EndpointIP, listenPort))
  223. if udpErr == nil {
  224. relayPeersMap[relayedHost.PublicKey.String()] = proxy_models.RelayedConf{
  225. RelayedPeerEndpoint: relayedEndpoint,
  226. RelayedPeerPubKey: relayedHost.PublicKey.String(),
  227. Peers: payload.Peers,
  228. }
  229. }
  230. }
  231. }
  232. proxyPayload.IsRelay = true
  233. proxyPayload.RelayedPeerConf = relayPeersMap
  234. }
  235. for _, nodeID := range host.Nodes {
  236. node, err := GetNodeByID(nodeID)
  237. if err != nil {
  238. continue
  239. }
  240. currentPeers, err := GetNetworkNodes(node.Network)
  241. if err != nil {
  242. continue
  243. }
  244. for _, peer := range currentPeers {
  245. if peer.ID == node.ID {
  246. //skip yourself
  247. continue
  248. }
  249. peerHost, err := GetHost(peer.HostID.String())
  250. if err != nil {
  251. continue
  252. }
  253. proxyStatus := peerHost.ProxyEnabled
  254. listenPort := peerHost.LocalListenPort
  255. if proxyStatus {
  256. listenPort = peerHost.ProxyListenPort
  257. if listenPort == 0 {
  258. listenPort = proxy_models.NmProxyPort
  259. }
  260. } else if listenPort == 0 {
  261. listenPort = peerHost.ListenPort
  262. }
  263. var currPeerConf proxy_models.PeerConf
  264. var found bool
  265. if currPeerConf, found = peerConfMap[peerHost.PublicKey.String()]; !found {
  266. currPeerConf = proxy_models.PeerConf{
  267. Proxy: proxyStatus,
  268. PublicListenPort: int32(listenPort),
  269. NetworkInfo: make(map[string]proxy_models.NetworkInfo),
  270. }
  271. }
  272. currPeerConf.NetworkInfo[peer.Network] = proxy_models.NetworkInfo{
  273. Address: net.ParseIP(peer.PrimaryAddress()),
  274. }
  275. if peerHost.IsRelayed && peerHost.RelayedBy != host.ID.String() {
  276. relayHost, err := GetHost(peerHost.RelayedBy)
  277. if err == nil {
  278. listenPort := peerHost.LocalListenPort
  279. if proxyStatus {
  280. listenPort = peerHost.ProxyListenPort
  281. if listenPort == 0 {
  282. listenPort = proxy_models.NmProxyPort
  283. }
  284. } else if listenPort == 0 {
  285. listenPort = peerHost.ListenPort
  286. }
  287. relayTo, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", relayHost.EndpointIP, listenPort))
  288. if err == nil {
  289. currPeerConf.IsRelayed = true
  290. currPeerConf.RelayedTo = relayTo
  291. }
  292. }
  293. }
  294. peerConfMap[peerHost.PublicKey.String()] = currPeerConf
  295. }
  296. }
  297. proxyPayload.PeerMap = peerConfMap
  298. proxyPayload.InterfaceName = models.WIREGUARD_INTERFACE
  299. return proxyPayload, nil
  300. }
  301. // GetPeerUpdateForHost - gets the consolidated peer update for the host from all networks
  302. func GetPeerUpdateForHost(host *models.Host) (models.HostPeerUpdate, error) {
  303. if host == nil {
  304. return models.HostPeerUpdate{}, errors.New("host is nil")
  305. }
  306. hostPeerUpdate := models.HostPeerUpdate{
  307. Host: *host,
  308. Network: make(map[string]models.NetworkInfo),
  309. PeerIDs: make(models.HostPeerMap),
  310. ServerVersion: servercfg.GetVersion(),
  311. ServerAddrs: []models.ServerAddr{},
  312. }
  313. log.Println("peer update for host ", host.ID.String())
  314. peerIndexMap := make(map[string]int)
  315. for _, nodeID := range host.Nodes {
  316. node, err := GetNodeByID(nodeID)
  317. if err != nil {
  318. continue
  319. }
  320. if !node.Connected {
  321. continue
  322. }
  323. hostPeerUpdate.Network[node.Network] = models.NetworkInfo{
  324. DNS: getPeerDNS(node.Network),
  325. }
  326. currentPeers, err := GetNetworkNodes(node.Network)
  327. if err != nil {
  328. log.Println("no network nodes")
  329. return models.HostPeerUpdate{}, err
  330. }
  331. for _, peer := range currentPeers {
  332. if peer.ID == node.ID {
  333. log.Println("peer update, skipping self")
  334. //skip yourself
  335. continue
  336. }
  337. var peerConfig wgtypes.PeerConfig
  338. peerHost, err := GetHost(peer.HostID.String())
  339. if err != nil {
  340. log.Println("no peer host", err)
  341. return models.HostPeerUpdate{}, err
  342. }
  343. if !peer.Connected {
  344. log.Println("peer update, skipping unconnected node")
  345. //skip unconnected nodes
  346. continue
  347. }
  348. if !nodeacls.AreNodesAllowed(nodeacls.NetworkID(node.Network), nodeacls.NodeID(node.ID.String()), nodeacls.NodeID(peer.ID.String())) {
  349. log.Println("peer update, skipping node for acl")
  350. //skip if not permitted by acl
  351. continue
  352. }
  353. peerConfig.PublicKey = peerHost.PublicKey
  354. peerConfig.PersistentKeepaliveInterval = &peer.PersistentKeepalive
  355. peerConfig.ReplaceAllowedIPs = true
  356. uselocal := false
  357. if host.EndpointIP.String() == peerHost.EndpointIP.String() {
  358. //peer is on same network
  359. // set to localaddress
  360. uselocal = true
  361. if node.LocalAddress.IP == nil {
  362. // use public endpint
  363. uselocal = false
  364. }
  365. if node.LocalAddress.String() == peer.LocalAddress.String() {
  366. uselocal = false
  367. }
  368. }
  369. peerConfig.Endpoint = &net.UDPAddr{
  370. IP: peerHost.EndpointIP,
  371. Port: peerHost.ListenPort,
  372. }
  373. if !host.ProxyEnabled && peerHost.ProxyEnabled {
  374. if peerHost.ProxyListenPort == 0 {
  375. peerConfig.Endpoint.Port = proxy_models.NmProxyPort
  376. } else {
  377. peerConfig.Endpoint.Port = peerHost.ProxyListenPort
  378. }
  379. }
  380. if uselocal {
  381. peerConfig.Endpoint.IP = peer.LocalAddress.IP
  382. }
  383. allowedips := getNodeAllowedIPs(&peer, &node)
  384. if peer.IsIngressGateway {
  385. for _, entry := range peer.IngressGatewayRange {
  386. _, cidr, err := net.ParseCIDR(string(entry))
  387. if err == nil {
  388. allowedips = append(allowedips, *cidr)
  389. }
  390. }
  391. }
  392. if peer.IsRelay {
  393. allowedips = append(allowedips, getRelayAllowedIPs(&node, &peer)...)
  394. }
  395. if peer.IsEgressGateway {
  396. allowedips = append(allowedips, getEgressIPs(&node, &peer)...)
  397. }
  398. peerConfig.AllowedIPs = allowedips
  399. if _, ok := hostPeerUpdate.PeerIDs[peerHost.PublicKey.String()]; !ok {
  400. hostPeerUpdate.PeerIDs[peerHost.PublicKey.String()] = make(map[string]models.IDandAddr)
  401. hostPeerUpdate.Peers = append(hostPeerUpdate.Peers, peerConfig)
  402. peerIndexMap[peerHost.PublicKey.String()] = len(hostPeerUpdate.Peers) - 1
  403. hostPeerUpdate.PeerIDs[peerHost.PublicKey.String()][peer.ID.String()] = models.IDandAddr{
  404. ID: peer.ID.String(),
  405. Address: peer.PrimaryAddress(),
  406. Name: peerHost.Name,
  407. Network: peer.Network,
  408. }
  409. } else {
  410. peerAllowedIPs := hostPeerUpdate.Peers[peerIndexMap[peerHost.PublicKey.String()]].AllowedIPs
  411. peerAllowedIPs = append(peerAllowedIPs, allowedips...)
  412. hostPeerUpdate.Peers[peerIndexMap[peerHost.PublicKey.String()]].AllowedIPs = peerAllowedIPs
  413. hostPeerUpdate.PeerIDs[peerHost.PublicKey.String()][peer.ID.String()] = models.IDandAddr{
  414. ID: peer.ID.String(),
  415. Address: peer.PrimaryAddress(),
  416. Name: peerHost.Name,
  417. Network: peer.Network,
  418. }
  419. }
  420. }
  421. }
  422. return hostPeerUpdate, nil
  423. }
  424. // GetPeerUpdate - gets a wireguard peer config for each peer of a node
  425. func GetPeerUpdate(node *models.Node, host *models.Host) (models.PeerUpdate, error) {
  426. log.Println("peer update for node ", node.ID)
  427. peerUpdate := models.PeerUpdate{
  428. Network: node.Network,
  429. ServerVersion: ncutils.Version,
  430. DNS: getPeerDNS(node.Network),
  431. }
  432. currentPeers, err := GetNetworkNodes(node.Network)
  433. if err != nil {
  434. log.Println("no network nodes")
  435. return models.PeerUpdate{}, err
  436. }
  437. for _, peer := range currentPeers {
  438. var peerConfig wgtypes.PeerConfig
  439. peerHost, err := GetHost(peer.HostID.String())
  440. if err != nil {
  441. log.Println("no peer host", err)
  442. return models.PeerUpdate{}, err
  443. }
  444. if peer.ID == node.ID {
  445. log.Println("peer update, skipping self")
  446. //skip yourself
  447. continue
  448. }
  449. if !peer.Connected {
  450. log.Println("peer update, skipping unconnected node")
  451. //skip unconnected nodes
  452. continue
  453. }
  454. if !nodeacls.AreNodesAllowed(nodeacls.NetworkID(node.Network), nodeacls.NodeID(node.ID.String()), nodeacls.NodeID(peer.ID.String())) {
  455. log.Println("peer update, skipping node for acl")
  456. //skip if not permitted by acl
  457. continue
  458. }
  459. peerConfig.PublicKey = peerHost.PublicKey
  460. peerConfig.PersistentKeepaliveInterval = &peer.PersistentKeepalive
  461. peerConfig.ReplaceAllowedIPs = true
  462. uselocal := false
  463. if host.EndpointIP.String() == peerHost.EndpointIP.String() {
  464. //peer is on same network
  465. // set to localaddress
  466. uselocal = true
  467. if node.LocalAddress.IP == nil {
  468. // use public endpint
  469. uselocal = false
  470. }
  471. if node.LocalAddress.String() == peer.LocalAddress.String() {
  472. uselocal = false
  473. }
  474. }
  475. peerConfig.Endpoint = &net.UDPAddr{
  476. IP: peerHost.EndpointIP,
  477. Port: peerHost.ListenPort,
  478. }
  479. if !host.ProxyEnabled && peerHost.ProxyEnabled {
  480. peerConfig.Endpoint.Port = peerHost.ProxyListenPort
  481. }
  482. if uselocal {
  483. peerConfig.Endpoint.IP = peer.LocalAddress.IP
  484. }
  485. allowedips := getNodeAllowedIPs(&peer, node)
  486. if peer.IsIngressGateway {
  487. for _, entry := range peer.IngressGatewayRange {
  488. _, cidr, err := net.ParseCIDR(string(entry))
  489. if err == nil {
  490. allowedips = append(allowedips, *cidr)
  491. }
  492. }
  493. }
  494. if peer.IsRelay {
  495. allowedips = append(allowedips, getRelayAllowedIPs(node, &peer)...)
  496. }
  497. if peer.IsEgressGateway {
  498. allowedips = append(allowedips, getEgressIPs(node, &peer)...)
  499. }
  500. peerConfig.AllowedIPs = allowedips
  501. peerUpdate.Peers = append(peerUpdate.Peers, peerConfig)
  502. }
  503. return peerUpdate, nil
  504. }
  505. func getRelayAllowedIPs(node, peer *models.Node) []net.IPNet {
  506. var allowedips []net.IPNet
  507. var allowedip net.IPNet
  508. for _, addr := range peer.RelayAddrs {
  509. if node.Address.IP.String() == addr {
  510. continue
  511. }
  512. if node.Address6.IP.String() == addr {
  513. continue
  514. }
  515. allowedip.IP = net.ParseIP(addr)
  516. allowedips = append(allowedips, allowedip)
  517. }
  518. return allowedips
  519. }
  520. // GetPeerUpdateLegacy - gets a wireguard peer config for each peer of a node
  521. func GetPeerUpdateLegacy(node *models.Node) (models.PeerUpdate, error) {
  522. var peerUpdate models.PeerUpdate
  523. var peers []wgtypes.PeerConfig
  524. var serverNodeAddresses = []models.ServerAddr{}
  525. var peerMap = make(models.PeerMap)
  526. var metrics *models.Metrics
  527. if servercfg.Is_EE {
  528. metrics, _ = GetMetrics(node.ID.String())
  529. }
  530. if metrics == nil {
  531. metrics = &models.Metrics{}
  532. }
  533. if metrics.FailoverPeers == nil {
  534. metrics.FailoverPeers = make(map[string]string)
  535. }
  536. // udppeers = the peers parsed from the local interface
  537. // gives us correct port to reach
  538. udppeers, errN := database.GetPeers(node.Network)
  539. if errN != nil {
  540. logger.Log(2, errN.Error())
  541. }
  542. currentPeers, err := GetNetworkNodes(node.Network)
  543. if err != nil {
  544. return models.PeerUpdate{}, err
  545. }
  546. host, err := GetHost(node.HostID.String())
  547. if err != nil {
  548. return peerUpdate, err
  549. }
  550. if node.IsRelayed && !host.ProxyEnabled {
  551. return GetPeerUpdateForRelayedNode(node, udppeers)
  552. }
  553. // #1 Set Keepalive values: set_keepalive
  554. // #2 Set local address: set_local - could be a LOT BETTER and fix some bugs with additional logic
  555. // #3 Set allowedips: set_allowedips
  556. for _, peer := range currentPeers {
  557. peerHost, err := GetHost(peer.HostID.String())
  558. if err != nil {
  559. logger.Log(0, "error retrieving host for peer", node.ID.String(), err.Error())
  560. return models.PeerUpdate{}, err
  561. }
  562. if peer.ID == node.ID {
  563. //skip yourself
  564. continue
  565. }
  566. if node.Connected {
  567. //skip unconnected nodes
  568. continue
  569. }
  570. // if the node is not a server, set the endpoint
  571. var setEndpoint = true
  572. if peer.IsRelayed {
  573. if !peerHost.ProxyEnabled && !(node.IsRelay && ncutils.StringSliceContains(node.RelayAddrs, peer.PrimaryAddress())) {
  574. //skip -- will be added to relay
  575. continue
  576. } else if node.IsRelay && ncutils.StringSliceContains(node.RelayAddrs, peer.PrimaryAddress()) {
  577. // dont set peer endpoint if it's relayed by node
  578. setEndpoint = false
  579. }
  580. }
  581. if !nodeacls.AreNodesAllowed(nodeacls.NetworkID(node.Network), nodeacls.NodeID(node.ID.String()), nodeacls.NodeID(peer.ID.String())) {
  582. //skip if not permitted by acl
  583. continue
  584. }
  585. if len(metrics.FailoverPeers[peer.ID.String()]) > 0 && IsFailoverPresent(node.Network) {
  586. logger.Log(2, "peer", peer.ID.String(), peer.PrimaryAddress(), "was found to be in failover peers list for node", node.ID.String(), node.PrimaryAddress())
  587. continue
  588. }
  589. if err != nil {
  590. return models.PeerUpdate{}, err
  591. }
  592. host, err := GetHost(node.HostID.String())
  593. if err != nil {
  594. logger.Log(0, "error retrieving host for node", node.ID.String(), err.Error())
  595. return models.PeerUpdate{}, err
  596. }
  597. if host.EndpointIP.String() == peerHost.EndpointIP.String() {
  598. //peer is on same network
  599. // set_local
  600. if node.LocalAddress.String() != peer.LocalAddress.String() && peer.LocalAddress.IP != nil {
  601. peerHost.EndpointIP = peer.LocalAddress.IP
  602. if peerHost.LocalListenPort != 0 {
  603. peerHost.ListenPort = peerHost.LocalListenPort
  604. }
  605. } else {
  606. continue
  607. }
  608. }
  609. // set address if setEndpoint is true
  610. // otherwise, will get inserted as empty value
  611. var address *net.UDPAddr
  612. // Sets ListenPort to UDP Hole Punching Port assuming:
  613. // - UDP Hole Punching is enabled
  614. // - udppeers retrieval did not return an error
  615. // - the endpoint is valid
  616. if setEndpoint {
  617. var setUDPPort = false
  618. if CheckEndpoint(udppeers[peerHost.PublicKey.String()]) {
  619. endpointstring := udppeers[peerHost.PublicKey.String()]
  620. endpointarr := strings.Split(endpointstring, ":")
  621. if len(endpointarr) == 2 {
  622. port, err := strconv.Atoi(endpointarr[1])
  623. if err == nil {
  624. setUDPPort = true
  625. peerHost.ListenPort = port
  626. }
  627. }
  628. }
  629. // if udp hole punching is on, but udp hole punching did not set it, use the LocalListenPort instead
  630. // or, if port is for some reason zero use the LocalListenPort
  631. // but only do this if LocalListenPort is not zero
  632. if ((!setUDPPort) || peerHost.ListenPort == 0) && peerHost.LocalListenPort != 0 {
  633. peerHost.ListenPort = peerHost.LocalListenPort
  634. }
  635. endpoint := peerHost.EndpointIP.String() + ":" + strconv.FormatInt(int64(peerHost.ListenPort), 10)
  636. address, err = net.ResolveUDPAddr("udp", endpoint)
  637. if err != nil {
  638. return models.PeerUpdate{}, err
  639. }
  640. }
  641. fetchRelayedIps := true
  642. if host.ProxyEnabled {
  643. fetchRelayedIps = false
  644. }
  645. allowedips := GetAllowedIPs(node, &peer, metrics, fetchRelayedIps)
  646. var keepalive time.Duration
  647. if node.PersistentKeepalive != 0 {
  648. // set_keepalive
  649. keepalive = node.PersistentKeepalive
  650. }
  651. var peerData = wgtypes.PeerConfig{
  652. PublicKey: peerHost.PublicKey,
  653. Endpoint: address,
  654. ReplaceAllowedIPs: true,
  655. AllowedIPs: allowedips,
  656. PersistentKeepaliveInterval: &keepalive,
  657. }
  658. peers = append(peers, peerData)
  659. peerMap[peerHost.PublicKey.String()] = models.IDandAddr{
  660. Name: peerHost.Name,
  661. ID: peer.ID.String(),
  662. Address: peer.PrimaryAddress(),
  663. IsServer: "no",
  664. }
  665. }
  666. if node.IsIngressGateway {
  667. extPeers, idsAndAddr, err := getExtPeers(node, true)
  668. if err == nil {
  669. peers = append(peers, extPeers...)
  670. for i := range idsAndAddr {
  671. peerMap[idsAndAddr[i].ID] = idsAndAddr[i]
  672. }
  673. } else if !database.IsEmptyRecord(err) {
  674. logger.Log(1, "error retrieving external clients:", err.Error())
  675. }
  676. }
  677. peerUpdate.Network = node.Network
  678. peerUpdate.ServerVersion = servercfg.Version
  679. sort.SliceStable(peers[:], func(i, j int) bool {
  680. return peers[i].PublicKey.String() < peers[j].PublicKey.String()
  681. })
  682. peerUpdate.Peers = peers
  683. peerUpdate.ServerAddrs = serverNodeAddresses
  684. peerUpdate.DNS = getPeerDNS(node.Network)
  685. peerUpdate.PeerIDs = peerMap
  686. return peerUpdate, nil
  687. }
  688. func getExtPeers(node *models.Node, forIngressNode bool) ([]wgtypes.PeerConfig, []models.IDandAddr, error) {
  689. var peers []wgtypes.PeerConfig
  690. var idsAndAddr []models.IDandAddr
  691. extPeers, err := GetNetworkExtClients(node.Network)
  692. if err != nil {
  693. return peers, idsAndAddr, err
  694. }
  695. host, err := GetHost(node.HostID.String())
  696. if err != nil {
  697. return peers, idsAndAddr, err
  698. }
  699. for _, extPeer := range extPeers {
  700. pubkey, err := wgtypes.ParseKey(extPeer.PublicKey)
  701. if err != nil {
  702. logger.Log(1, "error parsing ext pub key:", err.Error())
  703. continue
  704. }
  705. if host.PublicKey.String() == extPeer.PublicKey {
  706. continue
  707. }
  708. var allowedips []net.IPNet
  709. var peer wgtypes.PeerConfig
  710. if forIngressNode && extPeer.Address != "" {
  711. var peeraddr = net.IPNet{
  712. IP: net.ParseIP(extPeer.Address),
  713. Mask: net.CIDRMask(32, 32),
  714. }
  715. if peeraddr.IP != nil && peeraddr.Mask != nil {
  716. allowedips = append(allowedips, peeraddr)
  717. }
  718. }
  719. if forIngressNode && extPeer.Address6 != "" {
  720. var addr6 = net.IPNet{
  721. IP: net.ParseIP(extPeer.Address6),
  722. Mask: net.CIDRMask(128, 128),
  723. }
  724. if addr6.IP != nil && addr6.Mask != nil {
  725. allowedips = append(allowedips, addr6)
  726. }
  727. }
  728. if !forIngressNode {
  729. if extPeer.InternalIPAddr != "" {
  730. peerInternalAddr := net.IPNet{
  731. IP: net.ParseIP(extPeer.InternalIPAddr),
  732. Mask: net.CIDRMask(32, 32),
  733. }
  734. if peerInternalAddr.IP != nil && peerInternalAddr.Mask != nil {
  735. allowedips = append(allowedips, peerInternalAddr)
  736. }
  737. }
  738. if extPeer.InternalIPAddr6 != "" {
  739. peerInternalAddr6 := net.IPNet{
  740. IP: net.ParseIP(extPeer.InternalIPAddr6),
  741. Mask: net.CIDRMask(32, 32),
  742. }
  743. if peerInternalAddr6.IP != nil && peerInternalAddr6.Mask != nil {
  744. allowedips = append(allowedips, peerInternalAddr6)
  745. }
  746. }
  747. }
  748. primaryAddr := extPeer.Address
  749. if primaryAddr == "" {
  750. primaryAddr = extPeer.Address6
  751. }
  752. peer = wgtypes.PeerConfig{
  753. PublicKey: pubkey,
  754. ReplaceAllowedIPs: true,
  755. AllowedIPs: allowedips,
  756. }
  757. peers = append(peers, peer)
  758. idsAndAddr = append(idsAndAddr, models.IDandAddr{
  759. ID: peer.PublicKey.String(),
  760. Address: primaryAddr,
  761. })
  762. }
  763. return peers, idsAndAddr, nil
  764. }
  765. func getExtPeersForProxy(node *models.Node, proxyPeerConf map[string]proxy_models.PeerConf) ([]wgtypes.PeerConfig, map[string]proxy_models.PeerConf, error) {
  766. var peers []wgtypes.PeerConfig
  767. host, err := GetHost(node.HostID.String())
  768. if err != nil {
  769. logger.Log(0, "error retrieving host for node", node.ID.String(), err.Error())
  770. }
  771. extPeers, err := GetNetworkExtClients(node.Network)
  772. if err != nil {
  773. return peers, proxyPeerConf, err
  774. }
  775. for _, extPeer := range extPeers {
  776. pubkey, err := wgtypes.ParseKey(extPeer.PublicKey)
  777. if err != nil {
  778. logger.Log(1, "error parsing ext pub key:", err.Error())
  779. continue
  780. }
  781. if host.PublicKey.String() == extPeer.PublicKey {
  782. continue
  783. }
  784. var allowedips []net.IPNet
  785. var peer wgtypes.PeerConfig
  786. if extPeer.Address != "" {
  787. var peeraddr = net.IPNet{
  788. IP: net.ParseIP(extPeer.Address),
  789. Mask: net.CIDRMask(32, 32),
  790. }
  791. if peeraddr.IP != nil && peeraddr.Mask != nil {
  792. allowedips = append(allowedips, peeraddr)
  793. }
  794. }
  795. if extPeer.Address6 != "" {
  796. var addr6 = net.IPNet{
  797. IP: net.ParseIP(extPeer.Address6),
  798. Mask: net.CIDRMask(128, 128),
  799. }
  800. if addr6.IP != nil && addr6.Mask != nil {
  801. allowedips = append(allowedips, addr6)
  802. }
  803. }
  804. peer = wgtypes.PeerConfig{
  805. PublicKey: pubkey,
  806. ReplaceAllowedIPs: true,
  807. AllowedIPs: allowedips,
  808. }
  809. extInternalPrimaryAddr := extPeer.InternalIPAddr
  810. if extInternalPrimaryAddr == "" {
  811. extInternalPrimaryAddr = extPeer.InternalIPAddr6
  812. }
  813. extConf := proxy_models.PeerConf{
  814. IsExtClient: true,
  815. Address: net.ParseIP(extPeer.Address),
  816. ExtInternalIp: net.ParseIP(extInternalPrimaryAddr),
  817. }
  818. if extPeer.IngressGatewayID == node.ID.String() {
  819. extConf.IsAttachedExtClient = true
  820. }
  821. ingGatewayUdpAddr, err := net.ResolveUDPAddr("udp", extPeer.IngressGatewayEndpoint)
  822. if err == nil {
  823. extConf.IngressGatewayEndPoint = ingGatewayUdpAddr
  824. }
  825. proxyPeerConf[peer.PublicKey.String()] = extConf
  826. peers = append(peers, peer)
  827. }
  828. return peers, proxyPeerConf, nil
  829. }
  830. // GetAllowedIPs - calculates the wireguard allowedip field for a peer of a node based on the peer and node settings
  831. func GetAllowedIPs(node, peer *models.Node, metrics *models.Metrics, fetchRelayedIps bool) []net.IPNet {
  832. var allowedips []net.IPNet
  833. allowedips = getNodeAllowedIPs(peer, node)
  834. // handle ingress gateway peers
  835. if peer.IsIngressGateway {
  836. extPeers, _, err := getExtPeers(peer, false)
  837. if err != nil {
  838. logger.Log(2, "could not retrieve ext peers for ", peer.ID.String(), err.Error())
  839. }
  840. for _, extPeer := range extPeers {
  841. allowedips = append(allowedips, extPeer.AllowedIPs...)
  842. }
  843. // if node is a failover node, add allowed ips from nodes it is handling
  844. if metrics != nil && peer.Failover && metrics.FailoverPeers != nil {
  845. // traverse through nodes that need handling
  846. logger.Log(3, "peer", peer.ID.String(), "was found to be failover for", node.ID.String(), "checking failover peers...")
  847. for k := range metrics.FailoverPeers {
  848. // if FailoverNode is me for this node, add allowedips
  849. if metrics.FailoverPeers[k] == peer.ID.String() {
  850. // get original node so we can traverse the allowed ips
  851. nodeToFailover, err := GetNodeByID(k)
  852. if err == nil {
  853. failoverNodeMetrics, err := GetMetrics(nodeToFailover.ID.String())
  854. if err == nil && failoverNodeMetrics != nil {
  855. if len(failoverNodeMetrics.NodeName) > 0 {
  856. allowedips = append(allowedips, getNodeAllowedIPs(&nodeToFailover, peer)...)
  857. logger.Log(0, "failing over node", nodeToFailover.ID.String(), nodeToFailover.PrimaryAddress(), "to failover node", peer.ID.String())
  858. }
  859. }
  860. }
  861. }
  862. }
  863. }
  864. }
  865. // handle relay gateway peers
  866. if fetchRelayedIps && peer.IsRelay {
  867. for _, ip := range peer.RelayAddrs {
  868. //find node ID of relayed peer
  869. relayedPeer, err := findNode(ip)
  870. if err != nil {
  871. logger.Log(0, "failed to find node for ip ", ip, err.Error())
  872. continue
  873. }
  874. if relayedPeer == nil {
  875. continue
  876. }
  877. if relayedPeer.ID == node.ID {
  878. //skip self
  879. continue
  880. }
  881. //check if acl permits comms
  882. if !nodeacls.AreNodesAllowed(nodeacls.NetworkID(node.Network), nodeacls.NodeID(node.ID.String()), nodeacls.NodeID(relayedPeer.ID.String())) {
  883. continue
  884. }
  885. if iplib.Version(net.ParseIP(ip)) == 4 {
  886. relayAddr := net.IPNet{
  887. IP: net.ParseIP(ip),
  888. Mask: net.CIDRMask(32, 32),
  889. }
  890. allowedips = append(allowedips, relayAddr)
  891. }
  892. if iplib.Version(net.ParseIP(ip)) == 6 {
  893. relayAddr := net.IPNet{
  894. IP: net.ParseIP(ip),
  895. Mask: net.CIDRMask(128, 128),
  896. }
  897. allowedips = append(allowedips, relayAddr)
  898. }
  899. relayedNode, err := findNode(ip)
  900. if err != nil {
  901. logger.Log(1, "unable to find node for relayed address", ip, err.Error())
  902. continue
  903. }
  904. if relayedNode.IsEgressGateway {
  905. extAllowedIPs := getEgressIPs(node, relayedNode)
  906. allowedips = append(allowedips, extAllowedIPs...)
  907. }
  908. if relayedNode.IsIngressGateway {
  909. extPeers, _, err := getExtPeers(relayedNode, false)
  910. if err == nil {
  911. for _, extPeer := range extPeers {
  912. allowedips = append(allowedips, extPeer.AllowedIPs...)
  913. }
  914. } else {
  915. logger.Log(0, "failed to retrieve extclients from relayed ingress", err.Error())
  916. }
  917. }
  918. }
  919. }
  920. return allowedips
  921. }
  922. func getPeerDNS(network string) string {
  923. var dns string
  924. if nodes, err := GetNetworkNodes(network); err == nil {
  925. for i, node := range nodes {
  926. host, err := GetHost(node.HostID.String())
  927. if err != nil {
  928. logger.Log(0, "error retrieving host for node", node.ID.String(), err.Error())
  929. continue
  930. }
  931. dns = dns + fmt.Sprintf("%s %s.%s\n", nodes[i].Address, host.Name, nodes[i].Network)
  932. }
  933. }
  934. if customDNSEntries, err := GetCustomDNS(network); err == nil {
  935. for _, entry := range customDNSEntries {
  936. // TODO - filter entries based on ACLs / given peers vs nodes in network
  937. dns = dns + fmt.Sprintf("%s %s.%s\n", entry.Address, entry.Name, entry.Network)
  938. }
  939. }
  940. return dns
  941. }
  942. // GetPeerUpdateForRelayedNode - calculates peer update for a relayed node by getting the relay
  943. // copying the relay node's allowed ips and making appropriate substitutions
  944. func GetPeerUpdateForRelayedNode(node *models.Node, udppeers map[string]string) (models.PeerUpdate, error) {
  945. var peerUpdate models.PeerUpdate
  946. var peers []wgtypes.PeerConfig
  947. var serverNodeAddresses = []models.ServerAddr{}
  948. var allowedips []net.IPNet
  949. //find node that is relaying us
  950. relay := FindRelay(node)
  951. if relay == nil {
  952. return models.PeerUpdate{}, errors.New("not found")
  953. }
  954. //add relay to lists of allowed ip
  955. if relay.Address.IP != nil {
  956. relayIP := relay.Address
  957. allowedips = append(allowedips, relayIP)
  958. }
  959. if relay.Address6.IP != nil {
  960. relayIP6 := relay.Address6
  961. allowedips = append(allowedips, relayIP6)
  962. }
  963. //get PeerUpdate for relayed node
  964. relayHost, err := GetHost(relay.HostID.String())
  965. if err != nil {
  966. return models.PeerUpdate{}, err
  967. }
  968. relayPeerUpdate, err := GetPeerUpdate(relay, relayHost)
  969. if err != nil {
  970. return models.PeerUpdate{}, err
  971. }
  972. //add the relays allowed ips from all of the relay's peers
  973. for _, peer := range relayPeerUpdate.Peers {
  974. allowedips = append(allowedips, peer.AllowedIPs...)
  975. }
  976. //delete any ips not permitted by acl
  977. for i := len(allowedips) - 1; i >= 0; i-- {
  978. target, err := findNode(allowedips[i].IP.String())
  979. if err != nil {
  980. logger.Log(0, "failed to find node for ip", allowedips[i].IP.String(), err.Error())
  981. continue
  982. }
  983. if target == nil {
  984. logger.Log(0, "failed to find node for ip", allowedips[i].IP.String())
  985. continue
  986. }
  987. if !nodeacls.AreNodesAllowed(nodeacls.NetworkID(node.Network), nodeacls.NodeID(node.ID.String()), nodeacls.NodeID(target.ID.String())) {
  988. logger.Log(0, "deleting node from relayednode per acl", node.ID.String(), target.ID.String())
  989. allowedips = append(allowedips[:i], allowedips[i+1:]...)
  990. }
  991. }
  992. //delete self from allowed ips
  993. for i := len(allowedips) - 1; i >= 0; i-- {
  994. if allowedips[i].IP.String() == node.Address.IP.String() || allowedips[i].IP.String() == node.Address6.IP.String() {
  995. allowedips = append(allowedips[:i], allowedips[i+1:]...)
  996. }
  997. }
  998. //delete egressrange from allowedip if we are egress gateway
  999. if node.IsEgressGateway {
  1000. for i := len(allowedips) - 1; i >= 0; i-- {
  1001. if StringSliceContains(node.EgressGatewayRanges, allowedips[i].String()) {
  1002. allowedips = append(allowedips[:i], allowedips[i+1:]...)
  1003. }
  1004. }
  1005. }
  1006. //delete extclients from allowedip if we are ingress gateway
  1007. if node.IsIngressGateway {
  1008. for i := len(allowedips) - 1; i >= 0; i-- {
  1009. if strings.Contains(node.IngressGatewayRange, allowedips[i].IP.String()) {
  1010. allowedips = append(allowedips[:i], allowedips[i+1:]...)
  1011. }
  1012. }
  1013. }
  1014. //add egress range if relay is egress
  1015. if relay.IsEgressGateway {
  1016. var ip *net.IPNet
  1017. for _, cidr := range relay.EgressGatewayRanges {
  1018. _, ip, err = net.ParseCIDR(cidr)
  1019. if err != nil {
  1020. continue
  1021. }
  1022. }
  1023. allowedips = append(allowedips, *ip)
  1024. }
  1025. var setUDPPort = false
  1026. var listenPort int
  1027. if CheckEndpoint(udppeers[relayHost.PublicKey.String()]) {
  1028. endpointstring := udppeers[relayHost.PublicKey.String()]
  1029. endpointarr := strings.Split(endpointstring, ":")
  1030. if len(endpointarr) == 2 {
  1031. port, err := strconv.Atoi(endpointarr[1])
  1032. if err == nil {
  1033. setUDPPort = true
  1034. listenPort = port
  1035. }
  1036. }
  1037. }
  1038. // if udp hole punching is on, but udp hole punching did not set it, use the LocalListenPort instead
  1039. // or, if port is for some reason zero use the LocalListenPort
  1040. // but only do this if LocalListenPort is not zero
  1041. if ((!setUDPPort) || relayHost.ListenPort == 0) && relayHost.LocalListenPort != 0 {
  1042. listenPort = relayHost.LocalListenPort
  1043. }
  1044. endpoint := relayHost.EndpointIP.String() + ":" + strconv.FormatInt(int64(listenPort), 10)
  1045. address, err := net.ResolveUDPAddr("udp", endpoint)
  1046. if err != nil {
  1047. return models.PeerUpdate{}, err
  1048. }
  1049. var keepalive time.Duration
  1050. if node.PersistentKeepalive != 0 {
  1051. // set_keepalive
  1052. keepalive = node.PersistentKeepalive
  1053. }
  1054. var peerData = wgtypes.PeerConfig{
  1055. PublicKey: relayHost.PublicKey,
  1056. Endpoint: address,
  1057. ReplaceAllowedIPs: true,
  1058. AllowedIPs: allowedips,
  1059. PersistentKeepaliveInterval: &keepalive,
  1060. }
  1061. peers = append(peers, peerData)
  1062. //if ingress add extclients
  1063. if node.IsIngressGateway {
  1064. extPeers, _, err := getExtPeers(node, true)
  1065. if err == nil {
  1066. peers = append(peers, extPeers...)
  1067. } else {
  1068. logger.Log(2, "could not retrieve ext peers for ", node.ID.String(), err.Error())
  1069. }
  1070. }
  1071. peerUpdate.Network = node.Network
  1072. peerUpdate.ServerVersion = servercfg.Version
  1073. sort.SliceStable(peers[:], func(i, j int) bool {
  1074. return peers[i].PublicKey.String() < peers[j].PublicKey.String()
  1075. })
  1076. peerUpdate.Peers = peers
  1077. peerUpdate.ServerAddrs = serverNodeAddresses
  1078. peerUpdate.DNS = getPeerDNS(node.Network)
  1079. return peerUpdate, nil
  1080. }
  1081. func getEgressIPs(node, peer *models.Node) []net.IPNet {
  1082. host, err := GetHost(node.HostID.String())
  1083. if err != nil {
  1084. logger.Log(0, "error retrieving host for node", node.ID.String(), err.Error())
  1085. }
  1086. peerHost, err := GetHost(peer.HostID.String())
  1087. if err != nil {
  1088. logger.Log(0, "error retrieving host for peer", peer.ID.String(), err.Error())
  1089. }
  1090. //check for internet gateway
  1091. internetGateway := false
  1092. if slices.Contains(peer.EgressGatewayRanges, "0.0.0.0/0") || slices.Contains(peer.EgressGatewayRanges, "::/0") {
  1093. internetGateway = true
  1094. }
  1095. allowedips := []net.IPNet{}
  1096. for _, iprange := range peer.EgressGatewayRanges { // go through each cidr for egress gateway
  1097. _, ipnet, err := net.ParseCIDR(iprange) // confirming it's valid cidr
  1098. if err != nil {
  1099. logger.Log(1, "could not parse gateway IP range. Not adding ", iprange)
  1100. continue // if can't parse CIDR
  1101. }
  1102. nodeEndpointArr := strings.Split(peerHost.EndpointIP.String(), ":") // getting the public ip of node
  1103. if ipnet.Contains(net.ParseIP(nodeEndpointArr[0])) && !internetGateway { // ensuring egress gateway range does not contain endpoint of node
  1104. logger.Log(2, "egress IP range of ", iprange, " overlaps with ", host.EndpointIP.String(), ", omitting")
  1105. continue // skip adding egress range if overlaps with node's ip
  1106. }
  1107. // TODO: Could put in a lot of great logic to avoid conflicts / bad routes
  1108. if ipnet.Contains(net.ParseIP(node.LocalAddress.String())) && !internetGateway { // ensuring egress gateway range does not contain public ip of node
  1109. logger.Log(2, "egress IP range of ", iprange, " overlaps with ", node.LocalAddress.String(), ", omitting")
  1110. continue // skip adding egress range if overlaps with node's local ip
  1111. }
  1112. if err != nil {
  1113. logger.Log(1, "error encountered when setting egress range", err.Error())
  1114. } else {
  1115. allowedips = append(allowedips, *ipnet)
  1116. }
  1117. }
  1118. return allowedips
  1119. }
  1120. func getNodeAllowedIPs(peer, node *models.Node) []net.IPNet {
  1121. var allowedips = []net.IPNet{}
  1122. if peer.Address.IP != nil {
  1123. allowed := net.IPNet{
  1124. IP: peer.Address.IP,
  1125. Mask: net.CIDRMask(32, 32),
  1126. }
  1127. allowedips = append(allowedips, allowed)
  1128. }
  1129. if peer.Address6.IP != nil {
  1130. allowed := net.IPNet{
  1131. IP: peer.Address6.IP,
  1132. Mask: net.CIDRMask(128, 128),
  1133. }
  1134. allowedips = append(allowedips, allowed)
  1135. }
  1136. // handle egress gateway peers
  1137. if peer.IsEgressGateway {
  1138. //hasGateway = true
  1139. egressIPs := getEgressIPs(node, peer)
  1140. allowedips = append(allowedips, egressIPs...)
  1141. }
  1142. return allowedips
  1143. }