extpeers.go 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744
  1. package logic
  2. import (
  3. "context"
  4. "encoding/json"
  5. "errors"
  6. "fmt"
  7. "net"
  8. "reflect"
  9. "sort"
  10. "strings"
  11. "sync"
  12. "time"
  13. "github.com/goombaio/namegenerator"
  14. "github.com/gravitl/netmaker/database"
  15. "github.com/gravitl/netmaker/db"
  16. "github.com/gravitl/netmaker/logger"
  17. "github.com/gravitl/netmaker/logic/acls"
  18. "github.com/gravitl/netmaker/models"
  19. "github.com/gravitl/netmaker/schema"
  20. "github.com/gravitl/netmaker/servercfg"
  21. "golang.org/x/exp/slog"
  22. "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
  23. )
  24. var (
  25. extClientCacheMutex = &sync.RWMutex{}
  26. extClientCacheMap = make(map[string]models.ExtClient)
  27. )
  28. func getAllExtClientsFromCache() (extClients []models.ExtClient) {
  29. extClientCacheMutex.RLock()
  30. for _, extclient := range extClientCacheMap {
  31. if extclient.Mutex == nil {
  32. extclient.Mutex = &sync.Mutex{}
  33. }
  34. extClients = append(extClients, extclient)
  35. }
  36. extClientCacheMutex.RUnlock()
  37. return
  38. }
  39. func deleteExtClientFromCache(key string) {
  40. extClientCacheMutex.Lock()
  41. delete(extClientCacheMap, key)
  42. extClientCacheMutex.Unlock()
  43. }
  44. func getExtClientFromCache(key string) (extclient models.ExtClient, ok bool) {
  45. extClientCacheMutex.RLock()
  46. extclient, ok = extClientCacheMap[key]
  47. if extclient.Mutex == nil {
  48. extclient.Mutex = &sync.Mutex{}
  49. }
  50. extClientCacheMutex.RUnlock()
  51. return
  52. }
  53. func storeExtClientInCache(key string, extclient models.ExtClient) {
  54. extClientCacheMutex.Lock()
  55. if extclient.Mutex == nil {
  56. extclient.Mutex = &sync.Mutex{}
  57. }
  58. extClientCacheMap[key] = extclient
  59. extClientCacheMutex.Unlock()
  60. }
  61. // ExtClient.GetEgressRangesOnNetwork - returns the egress ranges on network of ext client
  62. func GetEgressRangesOnNetwork(client *models.ExtClient) ([]string, error) {
  63. var result []string
  64. eli, _ := (&schema.Egress{Network: client.Network}).ListByNetwork(db.WithContext(context.TODO()))
  65. staticNode := client.ConvertToStaticNode()
  66. userPolicies := ListUserPolicies(models.NetworkID(client.Network))
  67. defaultUserPolicy, _ := GetDefaultPolicy(models.NetworkID(client.Network), models.UserPolicy)
  68. for _, eI := range eli {
  69. if !eI.Status {
  70. continue
  71. }
  72. if eI.Domain == "" && eI.Range == "" {
  73. continue
  74. }
  75. if eI.Domain != "" && len(eI.DomainAns) == 0 {
  76. continue
  77. }
  78. rangesToBeAdded := []string{}
  79. if eI.Domain != "" {
  80. rangesToBeAdded = append(rangesToBeAdded, eI.DomainAns...)
  81. } else {
  82. rangesToBeAdded = append(rangesToBeAdded, eI.Range)
  83. }
  84. if defaultUserPolicy.Enabled {
  85. result = append(result, rangesToBeAdded...)
  86. } else {
  87. if staticNode.IsUserNode && staticNode.StaticNode.OwnerID != "" {
  88. user, err := GetUser(staticNode.StaticNode.OwnerID)
  89. if err != nil {
  90. return []string{}, errors.New("user not found")
  91. }
  92. if DoesUserHaveAccessToEgress(user, &eI, userPolicies) {
  93. result = append(result, rangesToBeAdded...)
  94. }
  95. } else {
  96. result = append(result, rangesToBeAdded...)
  97. }
  98. }
  99. }
  100. extclients, _ := GetNetworkExtClients(client.Network)
  101. for _, extclient := range extclients {
  102. if extclient.ClientID == client.ClientID {
  103. continue
  104. }
  105. result = append(result, extclient.ExtraAllowedIPs...)
  106. }
  107. return UniqueIPNetStrList(result), nil
  108. }
  109. // UniqueIPNetList deduplicates and sorts a list of CIDR strings.
  110. func UniqueIPNetStrList(ipnets []string) []string {
  111. uniqueMap := make(map[string]struct{})
  112. for _, cidr := range ipnets {
  113. _, ipnet, err := net.ParseCIDR(cidr)
  114. if err != nil {
  115. continue // skip invalid CIDR strings
  116. }
  117. key := ipnet.String() // normalized CIDR
  118. uniqueMap[key] = struct{}{}
  119. }
  120. // Convert map keys to slice
  121. uniqueList := make([]string, 0, len(uniqueMap))
  122. for cidr := range uniqueMap {
  123. uniqueList = append(uniqueList, cidr)
  124. }
  125. sort.Strings(uniqueList)
  126. return uniqueList
  127. }
  128. // DeleteExtClient - deletes an existing ext client
  129. func DeleteExtClient(network string, clientid string, isUpdate bool) error {
  130. key, err := GetRecordKey(clientid, network)
  131. if err != nil {
  132. return err
  133. }
  134. extClient, err := GetExtClient(clientid, network)
  135. if err != nil {
  136. return err
  137. }
  138. err = database.DeleteRecord(database.EXT_CLIENT_TABLE_NAME, key)
  139. if err != nil {
  140. return err
  141. }
  142. if servercfg.CacheEnabled() {
  143. // recycle ip address
  144. if extClient.Address != "" {
  145. RemoveIpFromAllocatedIpMap(network, extClient.Address)
  146. }
  147. if extClient.Address6 != "" {
  148. RemoveIpFromAllocatedIpMap(network, extClient.Address6)
  149. }
  150. deleteExtClientFromCache(key)
  151. }
  152. if !isUpdate && extClient.RemoteAccessClientID != "" {
  153. LogEvent(&models.Event{
  154. Action: models.Disconnect,
  155. Source: models.Subject{
  156. ID: extClient.OwnerID,
  157. Name: extClient.OwnerID,
  158. Type: models.UserSub,
  159. },
  160. TriggeredBy: extClient.OwnerID,
  161. Target: models.Subject{
  162. ID: extClient.Network,
  163. Name: extClient.Network,
  164. Type: models.NetworkSub,
  165. Info: extClient,
  166. },
  167. NetworkID: models.NetworkID(extClient.Network),
  168. Origin: models.ClientApp,
  169. })
  170. }
  171. go RemoveNodeFromAclPolicy(extClient.ConvertToStaticNode())
  172. return nil
  173. }
  174. // DeleteExtClientAndCleanup - deletes an existing ext client and update ACLs
  175. func DeleteExtClientAndCleanup(extClient models.ExtClient) error {
  176. //delete extClient record
  177. err := DeleteExtClient(extClient.Network, extClient.ClientID, false)
  178. if err != nil {
  179. slog.Error("DeleteExtClientAndCleanup-remove extClient record: ", "Error", err.Error())
  180. return err
  181. }
  182. //update ACLs
  183. var networkAcls acls.ACLContainer
  184. networkAcls, err = networkAcls.Get(acls.ContainerID(extClient.Network))
  185. if err != nil {
  186. slog.Error("DeleteExtClientAndCleanup-update network acls: ", "Error", err.Error())
  187. return err
  188. }
  189. for objId := range networkAcls {
  190. delete(networkAcls[objId], acls.AclID(extClient.ClientID))
  191. }
  192. delete(networkAcls, acls.AclID(extClient.ClientID))
  193. if _, err = networkAcls.Save(acls.ContainerID(extClient.Network)); err != nil {
  194. slog.Error("DeleteExtClientAndCleanup-update network acls:", "Error", err.Error())
  195. return err
  196. }
  197. return nil
  198. }
  199. //TODO - enforce extclient-to-extclient on ingress gw
  200. /* 1. fetch all non-user static nodes
  201. a. check against each user node, if allowed add rule
  202. */
  203. // GetNetworkExtClients - gets the ext clients of given network
  204. func GetNetworkExtClients(network string) ([]models.ExtClient, error) {
  205. var extclients []models.ExtClient
  206. if servercfg.CacheEnabled() {
  207. allextclients := getAllExtClientsFromCache()
  208. if len(allextclients) != 0 {
  209. for _, extclient := range allextclients {
  210. if extclient.Network == network {
  211. extclients = append(extclients, extclient)
  212. }
  213. }
  214. return extclients, nil
  215. }
  216. }
  217. records, err := database.FetchRecords(database.EXT_CLIENT_TABLE_NAME)
  218. if err != nil {
  219. if database.IsEmptyRecord(err) {
  220. return extclients, nil
  221. }
  222. return extclients, err
  223. }
  224. for _, value := range records {
  225. var extclient models.ExtClient
  226. err = json.Unmarshal([]byte(value), &extclient)
  227. if err != nil {
  228. continue
  229. }
  230. key, err := GetRecordKey(extclient.ClientID, extclient.Network)
  231. if err == nil {
  232. if servercfg.CacheEnabled() {
  233. storeExtClientInCache(key, extclient)
  234. }
  235. }
  236. if extclient.Network == network {
  237. extclients = append(extclients, extclient)
  238. }
  239. }
  240. return extclients, err
  241. }
  242. // GetExtClient - gets a single ext client on a network
  243. func GetExtClient(clientid string, network string) (models.ExtClient, error) {
  244. var extclient models.ExtClient
  245. key, err := GetRecordKey(clientid, network)
  246. if err != nil {
  247. return extclient, err
  248. }
  249. if servercfg.CacheEnabled() {
  250. if extclient, ok := getExtClientFromCache(key); ok {
  251. return extclient, nil
  252. }
  253. }
  254. data, err := database.FetchRecord(database.EXT_CLIENT_TABLE_NAME, key)
  255. if err != nil {
  256. return extclient, err
  257. }
  258. err = json.Unmarshal([]byte(data), &extclient)
  259. if servercfg.CacheEnabled() {
  260. storeExtClientInCache(key, extclient)
  261. }
  262. return extclient, err
  263. }
  264. // GetGwExtclients - return all ext clients attached to the passed gw id
  265. func GetGwExtclients(nodeID, network string) []models.ExtClient {
  266. gwClients := []models.ExtClient{}
  267. clients, err := GetNetworkExtClients(network)
  268. if err != nil {
  269. return gwClients
  270. }
  271. for _, client := range clients {
  272. if client.IngressGatewayID == nodeID {
  273. gwClients = append(gwClients, client)
  274. }
  275. }
  276. return gwClients
  277. }
  278. // GetExtClient - gets a single ext client on a network
  279. func GetExtClientByPubKey(publicKey string, network string) (*models.ExtClient, error) {
  280. netClients, err := GetNetworkExtClients(network)
  281. if err != nil {
  282. return nil, err
  283. }
  284. for i := range netClients {
  285. ec := netClients[i]
  286. if ec.PublicKey == publicKey {
  287. return &ec, nil
  288. }
  289. }
  290. return nil, fmt.Errorf("no client found")
  291. }
  292. // CreateExtClient - creates and saves an extclient
  293. func CreateExtClient(extclient *models.ExtClient) error {
  294. // lock because we may need unique IPs and having it concurrent makes parallel calls result in same "unique" IPs
  295. addressLock.Lock()
  296. defer addressLock.Unlock()
  297. if len(extclient.PublicKey) == 0 {
  298. privateKey, err := wgtypes.GeneratePrivateKey()
  299. if err != nil {
  300. return err
  301. }
  302. extclient.PrivateKey = privateKey.String()
  303. extclient.PublicKey = privateKey.PublicKey().String()
  304. } else if len(extclient.PrivateKey) == 0 && len(extclient.PublicKey) > 0 {
  305. extclient.PrivateKey = "[ENTER PRIVATE KEY]"
  306. }
  307. if extclient.ExtraAllowedIPs == nil {
  308. extclient.ExtraAllowedIPs = []string{}
  309. }
  310. parentNetwork, err := GetNetwork(extclient.Network)
  311. if err != nil {
  312. return err
  313. }
  314. if extclient.Address == "" {
  315. if parentNetwork.IsIPv4 == "yes" {
  316. newAddress, err := UniqueAddress(extclient.Network, true)
  317. if err != nil {
  318. return err
  319. }
  320. extclient.Address = newAddress.String()
  321. }
  322. }
  323. if extclient.Address6 == "" {
  324. if parentNetwork.IsIPv6 == "yes" {
  325. addr6, err := UniqueAddress6(extclient.Network, true)
  326. if err != nil {
  327. return err
  328. }
  329. extclient.Address6 = addr6.String()
  330. }
  331. }
  332. if extclient.ClientID == "" {
  333. extclient.ClientID, err = GenerateNodeName(extclient.Network)
  334. if err != nil {
  335. return err
  336. }
  337. }
  338. extclient.LastModified = time.Now().Unix()
  339. return SaveExtClient(extclient)
  340. }
  341. // GenerateNodeName - generates a random node name
  342. func GenerateNodeName(network string) (string, error) {
  343. seed := time.Now().UTC().UnixNano()
  344. nameGenerator := namegenerator.NewNameGenerator(seed)
  345. var name string
  346. cnt := 0
  347. for {
  348. if cnt > 10 {
  349. return "", errors.New("couldn't generate random name, try again")
  350. }
  351. cnt += 1
  352. name = nameGenerator.Generate()
  353. if len(name) > 15 {
  354. continue
  355. }
  356. _, err := GetExtClient(name, network)
  357. if err == nil {
  358. // config exists with same name
  359. continue
  360. }
  361. break
  362. }
  363. return name, nil
  364. }
  365. // SaveExtClient - saves an ext client to database
  366. func SaveExtClient(extclient *models.ExtClient) error {
  367. key, err := GetRecordKey(extclient.ClientID, extclient.Network)
  368. if err != nil {
  369. return err
  370. }
  371. data, err := json.Marshal(&extclient)
  372. if err != nil {
  373. return err
  374. }
  375. if err = database.Insert(key, string(data), database.EXT_CLIENT_TABLE_NAME); err != nil {
  376. return err
  377. }
  378. if servercfg.CacheEnabled() {
  379. storeExtClientInCache(key, *extclient)
  380. if _, ok := allocatedIpMap[extclient.Network]; ok {
  381. if extclient.Address != "" {
  382. AddIpToAllocatedIpMap(extclient.Network, net.ParseIP(extclient.Address))
  383. }
  384. if extclient.Address6 != "" {
  385. AddIpToAllocatedIpMap(extclient.Network, net.ParseIP(extclient.Address6))
  386. }
  387. }
  388. }
  389. return SetNetworkNodesLastModified(extclient.Network)
  390. }
  391. // UpdateExtClient - updates an ext client with new values
  392. func UpdateExtClient(old *models.ExtClient, update *models.CustomExtClient) models.ExtClient {
  393. new := *old
  394. new.ClientID = update.ClientID
  395. if update.PublicKey != "" && old.PublicKey != update.PublicKey {
  396. new.PublicKey = update.PublicKey
  397. }
  398. if update.DNS != old.DNS {
  399. new.DNS = update.DNS
  400. }
  401. if update.Enabled != old.Enabled {
  402. new.Enabled = update.Enabled
  403. }
  404. new.ExtraAllowedIPs = update.ExtraAllowedIPs
  405. if update.DeniedACLs != nil && !reflect.DeepEqual(old.DeniedACLs, update.DeniedACLs) {
  406. new.DeniedACLs = update.DeniedACLs
  407. }
  408. // replace any \r\n with \n in postup and postdown from HTTP request
  409. new.PostUp = strings.Replace(update.PostUp, "\r\n", "\n", -1)
  410. new.PostDown = strings.Replace(update.PostDown, "\r\n", "\n", -1)
  411. new.Tags = update.Tags
  412. if update.Location != "" && update.Location != old.Location {
  413. new.Location = update.Location
  414. }
  415. if update.Country != "" && update.Country != old.Country {
  416. new.Country = update.Country
  417. }
  418. if update.DeviceID != "" && old.DeviceID == "" {
  419. new.DeviceID = update.DeviceID
  420. }
  421. return new
  422. }
  423. // GetExtClientsByID - gets the clients of attached gateway
  424. func GetExtClientsByID(nodeid, network string) ([]models.ExtClient, error) {
  425. var result []models.ExtClient
  426. currentClients, err := GetNetworkExtClients(network)
  427. if err != nil {
  428. return result, err
  429. }
  430. for i := range currentClients {
  431. if currentClients[i].IngressGatewayID == nodeid {
  432. result = append(result, currentClients[i])
  433. }
  434. }
  435. return result, nil
  436. }
  437. // GetAllExtClients - gets all ext clients from DB
  438. func GetAllExtClients() ([]models.ExtClient, error) {
  439. var clients = []models.ExtClient{}
  440. currentNetworks, err := GetNetworks()
  441. if err != nil && database.IsEmptyRecord(err) {
  442. return clients, nil
  443. } else if err != nil {
  444. return clients, err
  445. }
  446. for i := range currentNetworks {
  447. netName := currentNetworks[i].NetID
  448. netClients, err := GetNetworkExtClients(netName)
  449. if err != nil {
  450. continue
  451. }
  452. clients = append(clients, netClients...)
  453. }
  454. return clients, nil
  455. }
  456. // GetAllExtClientsWithStatus - returns all external clients with
  457. // given status.
  458. func GetAllExtClientsWithStatus(status models.NodeStatus) ([]models.ExtClient, error) {
  459. extClients, err := GetAllExtClients()
  460. if err != nil {
  461. return nil, err
  462. }
  463. var validExtClients []models.ExtClient
  464. for _, extClient := range extClients {
  465. node := extClient.ConvertToStaticNode()
  466. GetNodeStatus(&node, false)
  467. if node.Status == status {
  468. validExtClients = append(validExtClients, extClient)
  469. }
  470. }
  471. return validExtClients, nil
  472. }
  473. // ToggleExtClientConnectivity - enables or disables an ext client
  474. func ToggleExtClientConnectivity(client *models.ExtClient, enable bool) (models.ExtClient, error) {
  475. update := models.CustomExtClient{
  476. Enabled: enable,
  477. ClientID: client.ClientID,
  478. PublicKey: client.PublicKey,
  479. DNS: client.DNS,
  480. ExtraAllowedIPs: client.ExtraAllowedIPs,
  481. DeniedACLs: client.DeniedACLs,
  482. RemoteAccessClientID: client.RemoteAccessClientID,
  483. }
  484. // update in DB
  485. newClient := UpdateExtClient(client, &update)
  486. if err := DeleteExtClient(client.Network, client.ClientID, true); err != nil {
  487. slog.Error("failed to delete ext client during update", "id", client.ClientID, "network", client.Network, "error", err)
  488. return newClient, err
  489. }
  490. if err := SaveExtClient(&newClient); err != nil {
  491. slog.Error("failed to save updated ext client during update", "id", newClient.ClientID, "network", newClient.Network, "error", err)
  492. return newClient, err
  493. }
  494. return newClient, nil
  495. }
  496. func GetExtPeers(node, peer *models.Node) ([]wgtypes.PeerConfig, []models.IDandAddr, []models.EgressNetworkRoutes, error) {
  497. var peers []wgtypes.PeerConfig
  498. var idsAndAddr []models.IDandAddr
  499. var egressRoutes []models.EgressNetworkRoutes
  500. extPeers, err := GetNetworkExtClients(node.Network)
  501. if err != nil {
  502. return peers, idsAndAddr, egressRoutes, err
  503. }
  504. host, err := GetHost(node.HostID.String())
  505. if err != nil {
  506. return peers, idsAndAddr, egressRoutes, err
  507. }
  508. for _, extPeer := range extPeers {
  509. extPeer := extPeer
  510. if !IsClientNodeAllowed(&extPeer, peer.ID.String()) {
  511. continue
  512. }
  513. if extPeer.RemoteAccessClientID == "" {
  514. if ok := IsPeerAllowed(extPeer.ConvertToStaticNode(), *peer, true); !ok {
  515. continue
  516. }
  517. } else {
  518. if ok, _ := IsUserAllowedToCommunicate(extPeer.OwnerID, *peer); !ok {
  519. continue
  520. }
  521. }
  522. pubkey, err := wgtypes.ParseKey(extPeer.PublicKey)
  523. if err != nil {
  524. logger.Log(1, "error parsing ext pub key:", err.Error())
  525. continue
  526. }
  527. if host.PublicKey.String() == extPeer.PublicKey ||
  528. extPeer.IngressGatewayID != node.ID.String() || !extPeer.Enabled {
  529. continue
  530. }
  531. var allowedips []net.IPNet
  532. var peer wgtypes.PeerConfig
  533. if extPeer.Address != "" {
  534. var peeraddr = net.IPNet{
  535. IP: net.ParseIP(extPeer.Address),
  536. Mask: net.CIDRMask(32, 32),
  537. }
  538. if peeraddr.IP != nil && peeraddr.Mask != nil {
  539. allowedips = append(allowedips, peeraddr)
  540. }
  541. }
  542. if extPeer.Address6 != "" {
  543. var addr6 = net.IPNet{
  544. IP: net.ParseIP(extPeer.Address6),
  545. Mask: net.CIDRMask(128, 128),
  546. }
  547. if addr6.IP != nil && addr6.Mask != nil {
  548. allowedips = append(allowedips, addr6)
  549. }
  550. }
  551. for _, extraAllowedIP := range extPeer.ExtraAllowedIPs {
  552. _, cidr, err := net.ParseCIDR(extraAllowedIP)
  553. if err == nil {
  554. allowedips = append(allowedips, *cidr)
  555. }
  556. }
  557. egressRoutes = append(egressRoutes, getExtPeerEgressRoute(*node, extPeer)...)
  558. primaryAddr := extPeer.Address
  559. if primaryAddr == "" {
  560. primaryAddr = extPeer.Address6
  561. }
  562. peer = wgtypes.PeerConfig{
  563. PublicKey: pubkey,
  564. ReplaceAllowedIPs: true,
  565. AllowedIPs: allowedips,
  566. }
  567. peers = append(peers, peer)
  568. idsAndAddr = append(idsAndAddr, models.IDandAddr{
  569. ID: peer.PublicKey.String(),
  570. Name: extPeer.ClientID,
  571. Address: primaryAddr,
  572. IsExtClient: true,
  573. })
  574. }
  575. return peers, idsAndAddr, egressRoutes, nil
  576. }
  577. func getExtPeerEgressRoute(node models.Node, extPeer models.ExtClient) (egressRoutes []models.EgressNetworkRoutes) {
  578. r := models.EgressNetworkRoutes{
  579. PeerKey: extPeer.PublicKey,
  580. EgressGwAddr: extPeer.AddressIPNet4(),
  581. EgressGwAddr6: extPeer.AddressIPNet6(),
  582. NodeAddr: node.Address,
  583. NodeAddr6: node.Address6,
  584. EgressRanges: extPeer.ExtraAllowedIPs,
  585. }
  586. for _, extraAllowedIP := range extPeer.ExtraAllowedIPs {
  587. r.EgressRangesWithMetric = append(r.EgressRangesWithMetric, models.EgressRangeMetric{
  588. Network: extraAllowedIP,
  589. RouteMetric: 256,
  590. })
  591. }
  592. egressRoutes = append(egressRoutes, r)
  593. return
  594. }
  595. func getExtpeerEgressRanges(node models.Node) (ranges, ranges6 []net.IPNet) {
  596. extPeers, err := GetNetworkExtClients(node.Network)
  597. if err != nil {
  598. return
  599. }
  600. for _, extPeer := range extPeers {
  601. if len(extPeer.ExtraAllowedIPs) == 0 {
  602. continue
  603. }
  604. if ok, _ := IsNodeAllowedToCommunicate(extPeer.ConvertToStaticNode(), node, true); !ok {
  605. continue
  606. }
  607. for _, allowedRange := range extPeer.ExtraAllowedIPs {
  608. _, ipnet, err := net.ParseCIDR(allowedRange)
  609. if err == nil {
  610. if ipnet.IP.To4() != nil {
  611. ranges = append(ranges, *ipnet)
  612. } else {
  613. ranges6 = append(ranges6, *ipnet)
  614. }
  615. }
  616. }
  617. }
  618. return
  619. }
  620. func getExtpeersExtraRoutes(node models.Node) (egressRoutes []models.EgressNetworkRoutes) {
  621. extPeers, err := GetNetworkExtClients(node.Network)
  622. if err != nil {
  623. return
  624. }
  625. for _, extPeer := range extPeers {
  626. if len(extPeer.ExtraAllowedIPs) == 0 {
  627. continue
  628. }
  629. if ok, _ := IsNodeAllowedToCommunicate(extPeer.ConvertToStaticNode(), node, true); !ok {
  630. continue
  631. }
  632. egressRoutes = append(egressRoutes, getExtPeerEgressRoute(node, extPeer)...)
  633. }
  634. return
  635. }
  636. func GetExtclientAllowedIPs(client models.ExtClient) (allowedIPs []string) {
  637. gwnode, err := GetNodeByID(client.IngressGatewayID)
  638. if err != nil {
  639. logger.Log(0,
  640. fmt.Sprintf("failed to get ingress gateway node [%s] info: %v", client.IngressGatewayID, err))
  641. return
  642. }
  643. network, err := GetParentNetwork(client.Network)
  644. if err != nil {
  645. logger.Log(1, "Could not retrieve Ingress Gateway Network", client.Network)
  646. return
  647. }
  648. if IsInternetGw(gwnode) {
  649. egressrange := "0.0.0.0/0"
  650. if gwnode.Address6.IP != nil && client.Address6 != "" {
  651. egressrange += "," + "::/0"
  652. }
  653. allowedIPs = []string{egressrange}
  654. } else {
  655. allowedIPs = []string{network.AddressRange}
  656. if network.AddressRange6 != "" {
  657. allowedIPs = append(allowedIPs, network.AddressRange6)
  658. }
  659. if egressGatewayRanges, err := GetEgressRangesOnNetwork(&client); err == nil {
  660. allowedIPs = append(allowedIPs, egressGatewayRanges...)
  661. }
  662. }
  663. return
  664. }
  665. func GetStaticNodesByNetwork(network models.NetworkID, onlyWg bool) (staticNode []models.Node) {
  666. extClients, err := GetAllExtClients()
  667. if err != nil {
  668. return
  669. }
  670. SortExtClient(extClients[:])
  671. for _, extI := range extClients {
  672. if extI.Network == network.String() {
  673. if onlyWg && extI.RemoteAccessClientID != "" {
  674. continue
  675. }
  676. staticNode = append(staticNode, extI.ConvertToStaticNode())
  677. }
  678. }
  679. return
  680. }