Skip to content

Commit

Permalink
Merge pull request #3349 from gravitl/release-v0.30.0
Browse files Browse the repository at this point in the history 
Release v0.30.0
  • Loading branch information
@abhishek9686
abhishek9686 authored Feb 28, 2025
2 parents 68345bb + 225bf37 commit 06484ad
Show file tree
Hide file tree
Showing 11 changed files with 293 additions and 71 deletions.
2 changes: 1 addition & 1 deletion controllers/network.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -558,7 +558,7 @@ func createNetwork(w http.ResponseWriter, r *http.Request) {
logic.CreateDefaultNetworkRolesAndGroups(models.NetworkID(network.NetID))
logic.CreateDefaultAclNetworkPolicies(models.NetworkID(network.NetID))
logic.CreateDefaultTags(models.NetworkID(network.NetID))
//add new network to allocated ip map

go logic.AddNetworkToAllocatedIpMap(network.NetID)

go func() {
Expand Down
64 changes: 52 additions & 12 deletions logic/acls.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ import (
var (
aclCacheMutex = &sync.RWMutex{}
aclCacheMap = make(map[string]models.Acl)
aclTagsMutex = &sync.RWMutex{}
)

func MigrateAclPolicies() {
Expand Down Expand Up @@ -577,10 +576,22 @@ func IsPeerAllowed(node, peer models.Node, checkDefaultPolicy bool) bool {
if peer.IsStatic {
peer = peer.StaticNode.ConvertToStaticNode()
}
aclTagsMutex.RLock()
peerTags := maps.Clone(peer.Tags)
nodeTags := maps.Clone(node.Tags)
aclTagsMutex.RUnlock()
var nodeTags, peerTags map[models.TagID]struct{}
if node.Mutex != nil {
node.Mutex.Lock()
nodeTags = maps.Clone(node.Tags)
node.Mutex.Unlock()
} else {
nodeTags = node.Tags
}
if peer.Mutex != nil {
peer.Mutex.Lock()
peerTags = maps.Clone(peer.Tags)
peer.Mutex.Unlock()
} else {
peerTags = peer.Tags
}

if checkDefaultPolicy {
// check default policy if all allowed return true
defaultPolicy, err := GetDefaultPolicy(models.NetworkID(node.Network), models.DevicePolicy)
Expand Down Expand Up @@ -663,10 +674,21 @@ func IsNodeAllowedToCommunicate(node, peer models.Node, checkDefaultPolicy bool)
if peer.IsStatic {
peer = peer.StaticNode.ConvertToStaticNode()
}
aclTagsMutex.RLock()
peerTags := maps.Clone(peer.Tags)
nodeTags := maps.Clone(node.Tags)
aclTagsMutex.RUnlock()
var nodeTags, peerTags map[models.TagID]struct{}
if node.Mutex != nil {
node.Mutex.Lock()
nodeTags = maps.Clone(node.Tags)
node.Mutex.Unlock()
} else {
nodeTags = node.Tags
}
if peer.Mutex != nil {
peer.Mutex.Lock()
peerTags = maps.Clone(peer.Tags)
peer.Mutex.Unlock()
} else {
peerTags = peer.Tags
}
if checkDefaultPolicy {
// check default policy if all allowed return true
defaultPolicy, err := GetDefaultPolicy(models.NetworkID(node.Network), models.DevicePolicy)
Expand Down Expand Up @@ -864,7 +886,15 @@ func getUserAclRulesForNode(targetnode *models.Node,
userGrpMap := GetUserGrpMap()
allowedUsers := make(map[string][]models.Acl)
acls := listUserPolicies(models.NetworkID(targetnode.Network))
for nodeTag := range targetnode.Tags {
var targetNodeTags = make(map[models.TagID]struct{})
if targetnode.Mutex != nil {
targetnode.Mutex.Lock()
targetNodeTags = maps.Clone(targetnode.Tags)
targetnode.Mutex.Unlock()
} else {
targetNodeTags = maps.Clone(targetnode.Tags)
}
for nodeTag := range targetNodeTags {
for _, acl := range acls {
if !acl.Enabled {
continue
Expand All @@ -888,6 +918,7 @@ func getUserAclRulesForNode(targetnode *models.Node,
}
}
}

for _, userNode := range userNodes {
if !userNode.StaticNode.Enabled {
continue
Expand Down Expand Up @@ -944,8 +975,17 @@ func GetAclRulesForNode(targetnode *models.Node) (rules map[string]models.AclRul
}

acls := listDevicePolicies(models.NetworkID(targetnode.Network))
targetnode.Tags["*"] = struct{}{}
for nodeTag := range targetnode.Tags {

var targetNodeTags = make(map[models.TagID]struct{})
if targetnode.Mutex != nil {
targetnode.Mutex.Lock()
targetNodeTags = maps.Clone(targetnode.Tags)
targetnode.Mutex.Unlock()
} else {
targetNodeTags = maps.Clone(targetnode.Tags)
}
targetNodeTags["*"] = struct{}{}
for nodeTag := range targetNodeTags {
for _, acl := range acls {
if !acl.Enabled {
continue
Expand Down
38 changes: 24 additions & 14 deletions logic/extpeers.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@ var (
func getAllExtClientsFromCache() (extClients []models.ExtClient) {
extClientCacheMutex.RLock()
for _, extclient := range extClientCacheMap {
if extclient.Mutex == nil {
extclient.Mutex = &sync.Mutex{}
}
extClients = append(extClients, extclient)
}
extClientCacheMutex.RUnlock()
Expand All @@ -43,12 +46,18 @@ func deleteExtClientFromCache(key string) {
func getExtClientFromCache(key string) (extclient models.ExtClient, ok bool) {
extClientCacheMutex.RLock()
extclient, ok = extClientCacheMap[key]
if extclient.Mutex == nil {
extclient.Mutex = &sync.Mutex{}
}
extClientCacheMutex.RUnlock()
return
}

func storeExtClientInCache(key string, extclient models.ExtClient) {
extClientCacheMutex.Lock()
if extclient.Mutex == nil {
extclient.Mutex = &sync.Mutex{}
}
extClientCacheMap[key] = extclient
extClientCacheMutex.Unlock()
}
Expand Down Expand Up @@ -96,14 +105,14 @@ func DeleteExtClient(network string, clientid string) error {
if err != nil {
return err
}
//recycle ip address
if extClient.Address != "" {
RemoveIpFromAllocatedIpMap(network, extClient.Address)
}
if extClient.Address6 != "" {
RemoveIpFromAllocatedIpMap(network, extClient.Address6)
}
if servercfg.CacheEnabled() {
// recycle ip address
if extClient.Address != "" {
RemoveIpFromAllocatedIpMap(network, extClient.Address)
}
if extClient.Address6 != "" {
RemoveIpFromAllocatedIpMap(network, extClient.Address6)
}
deleteExtClientFromCache(key)
}
return nil
Expand Down Expand Up @@ -333,15 +342,16 @@ func SaveExtClient(extclient *models.ExtClient) error {
}
if servercfg.CacheEnabled() {
storeExtClientInCache(key, *extclient)
}
if _, ok := allocatedIpMap[extclient.Network]; ok {
if extclient.Address != "" {
AddIpToAllocatedIpMap(extclient.Network, net.ParseIP(extclient.Address))
}
if extclient.Address6 != "" {
AddIpToAllocatedIpMap(extclient.Network, net.ParseIP(extclient.Address6))
if _, ok := allocatedIpMap[extclient.Network]; ok {
if extclient.Address != "" {
AddIpToAllocatedIpMap(extclient.Network, net.ParseIP(extclient.Address))
}
if extclient.Address6 != "" {
AddIpToAllocatedIpMap(extclient.Network, net.ParseIP(extclient.Address6))
}
}
}

return SetNetworkNodesLastModified(extclient.Network)
}

Expand Down
124 changes: 122 additions & 2 deletions logic/networks.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,9 @@ var (

// SetAllocatedIpMap - set allocated ip map for networks
func SetAllocatedIpMap() error {
if !servercfg.CacheEnabled() {
return nil
}
logger.Log(0, "start setting up allocated ip map")
if allocatedIpMap == nil {
allocatedIpMap = map[string]map[string]net.IP{}
Expand Down Expand Up @@ -84,30 +87,46 @@ func SetAllocatedIpMap() error {

// ClearAllocatedIpMap - set allocatedIpMap to nil
func ClearAllocatedIpMap() {
if !servercfg.CacheEnabled() {
return
}
allocatedIpMap = nil
}

func AddIpToAllocatedIpMap(networkName string, ip net.IP) {
if !servercfg.CacheEnabled() {
return
}
networkCacheMutex.Lock()
allocatedIpMap[networkName][ip.String()] = ip
networkCacheMutex.Unlock()
}

func RemoveIpFromAllocatedIpMap(networkName string, ip string) {
if !servercfg.CacheEnabled() {
return
}
networkCacheMutex.Lock()
delete(allocatedIpMap[networkName], ip)
networkCacheMutex.Unlock()
}

// AddNetworkToAllocatedIpMap - add network to allocated ip map when network is added
func AddNetworkToAllocatedIpMap(networkName string) {
//add new network to allocated ip map
if !servercfg.CacheEnabled() {
return
}
networkCacheMutex.Lock()
allocatedIpMap[networkName] = make(map[string]net.IP)
networkCacheMutex.Unlock()
}

// RemoveNetworkFromAllocatedIpMap - remove network from allocated ip map when network is deleted
func RemoveNetworkFromAllocatedIpMap(networkName string) {
if !servercfg.CacheEnabled() {
return
}
networkCacheMutex.Lock()
delete(allocatedIpMap, networkName)
networkCacheMutex.Unlock()
Expand Down Expand Up @@ -354,7 +373,7 @@ func GetNetworkSettings(networkname string) (models.Network, error) {
}

// UniqueAddress - get a unique ipv4 address
func UniqueAddress(networkName string, reverse bool) (net.IP, error) {
func UniqueAddressCache(networkName string, reverse bool) (net.IP, error) {
add := net.IP{}
var network models.Network
network, err := GetParentNetwork(networkName)
Expand Down Expand Up @@ -396,6 +415,49 @@ func UniqueAddress(networkName string, reverse bool) (net.IP, error) {
return add, errors.New("ERROR: No unique addresses available. Check network subnet")
}

// UniqueAddress - get a unique ipv4 address
func UniqueAddressDB(networkName string, reverse bool) (net.IP, error) {
add := net.IP{}
var network models.Network
network, err := GetParentNetwork(networkName)
if err != nil {
logger.Log(0, "UniqueAddressServer encountered an error")
return add, err
}

if network.IsIPv4 == "no" {
return add, fmt.Errorf("IPv4 not active on network " + networkName)
}
//ensure AddressRange is valid
if _, _, err := net.ParseCIDR(network.AddressRange); err != nil {
logger.Log(0, "UniqueAddress encountered an error")
return add, err
}
net4 := iplib.Net4FromStr(network.AddressRange)
newAddrs := net4.FirstAddress()

if reverse {
newAddrs = net4.LastAddress()
}

for {
if IsIPUnique(networkName, newAddrs.String(), database.NODES_TABLE_NAME, false) &&
IsIPUnique(networkName, newAddrs.String(), database.EXT_CLIENT_TABLE_NAME, false) {
return newAddrs, nil
}
if reverse {
newAddrs, err = net4.PreviousIP(newAddrs)
} else {
newAddrs, err = net4.NextIP(newAddrs)
}
if err != nil {
break
}
}

return add, errors.New("ERROR: No unique addresses available. Check network subnet")
}

// IsIPUnique - checks if an IP is unique
func IsIPUnique(network string, ip string, tableName string, isIpv6 bool) bool {

Expand Down Expand Up @@ -439,9 +501,67 @@ func IsIPUnique(network string, ip string, tableName string, isIpv6 bool) bool {

return isunique
}
func UniqueAddress(networkName string, reverse bool) (net.IP, error) {
if servercfg.CacheEnabled() {
return UniqueAddressCache(networkName, reverse)
}
return UniqueAddressDB(networkName, reverse)
}

// UniqueAddress6 - see if ipv6 address is unique
func UniqueAddress6(networkName string, reverse bool) (net.IP, error) {
if servercfg.CacheEnabled() {
return UniqueAddress6Cache(networkName, reverse)
}
return UniqueAddress6DB(networkName, reverse)
}

// UniqueAddress6DB - see if ipv6 address is unique
func UniqueAddress6DB(networkName string, reverse bool) (net.IP, error) {
add := net.IP{}
var network models.Network
network, err := GetParentNetwork(networkName)
if err != nil {
fmt.Println("Network Not Found")
return add, err
}
if network.IsIPv6 == "no" {
return add, fmt.Errorf("IPv6 not active on network " + networkName)
}

//ensure AddressRange is valid
if _, _, err := net.ParseCIDR(network.AddressRange6); err != nil {
return add, err
}
net6 := iplib.Net6FromStr(network.AddressRange6)

newAddrs, err := net6.NextIP(net6.FirstAddress())
if reverse {
newAddrs, err = net6.PreviousIP(net6.LastAddress())
}
if err != nil {
return add, err
}

for {
if IsIPUnique(networkName, newAddrs.String(), database.NODES_TABLE_NAME, true) &&
IsIPUnique(networkName, newAddrs.String(), database.EXT_CLIENT_TABLE_NAME, true) {
return newAddrs, nil
}
if reverse {
newAddrs, err = net6.PreviousIP(newAddrs)
} else {
newAddrs, err = net6.NextIP(newAddrs)
}
if err != nil {
break
}
}

return add, errors.New("ERROR: No unique IPv6 addresses available. Check network subnet")
}

// UniqueAddress6Cache - see if ipv6 address is unique using cache
func UniqueAddress6Cache(networkName string, reverse bool) (net.IP, error) {
add := net.IP{}
var network models.Network
network, err := GetParentNetwork(networkName)
Expand Down
Loading

0 comments on commit 06484ad

Please sign in to comment.