sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-28 01:29:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add policy IDs to firewall rules (#3440)

Browse Source
This commit is contained in:
Viktor Liu
2025-03-05 14:12:14 +01:00
committed by GitHub
parent 2d4fcaf186
commit 89a55bcf4e
9 changed files with 152 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
management/server/policy.go
+1
View File
@@ -262,6 +262,7 @@ func toProtocolFirewallRules(rules []*types.FirewallRule) []*proto.FirewallRule
Protocol: getProtoProtocol(rule.Protocol),
Port: rule.Port,
PortInfo: rule.PortRange.ToProto(),
PolicyID: []byte(rule.PolicyID),
}
}
return result
management/server/policy_test.go
+28 -2
View File
@@ -4,11 +4,11 @@ import (
"context"
"fmt"
"net"
"slices"
"testing"
"time"
"github.com/stretchr/testify/assert"
"golang.org/x/exp/slices"
nbpeer "github.com/netbirdio/netbird/management/server/peer"
"github.com/netbirdio/netbird/management/server/posture"
@@ -182,6 +182,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleDefault",
},
{
PeerIP: "0.0.0.0",
@@ -189,6 +190,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleDefault",
},
{
PeerIP: "100.65.14.88",
@@ -196,6 +198,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.14.88",
@@ -203,6 +206,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.62.5",
@@ -210,6 +214,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.62.5",
@@ -217,6 +222,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
@@ -225,6 +231,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.32.206",
@@ -232,6 +239,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
@@ -240,6 +248,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.250.202",
@@ -247,6 +256,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
@@ -255,6 +265,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.13.186",
@@ -262,6 +273,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
@@ -270,6 +282,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.29.55",
@@ -277,6 +290,7 @@ func TestAccount_getPeersByPolicy(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
}
assert.Len(t, firewallRules, len(epectedFirewallRules))
@@ -404,6 +418,7 @@ func TestAccount_getPeersByPolicyDirect(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.254.139",
@@ -411,6 +426,7 @@ func TestAccount_getPeersByPolicyDirect(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
}
assert.Len(t, firewallRules, len(epectedFirewallRules))
@@ -432,6 +448,7 @@ func TestAccount_getPeersByPolicyDirect(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.80.39",
@@ -439,6 +456,7 @@ func TestAccount_getPeersByPolicyDirect(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
}
assert.Len(t, firewallRules, len(epectedFirewallRules))
@@ -462,6 +480,7 @@ func TestAccount_getPeersByPolicyDirect(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
}
assert.Len(t, firewallRules, len(epectedFirewallRules))
@@ -483,6 +502,7 @@ func TestAccount_getPeersByPolicyDirect(t *testing.T) {
Action: "accept",
Protocol: "all",
Port: "",
PolicyID: "RuleSwarm",
},
}
assert.Len(t, firewallRules, len(epectedFirewallRules))
@@ -493,7 +513,6 @@ func TestAccount_getPeersByPolicyDirect(t *testing.T) {
}
})
}
func TestAccount_getPeersByPolicyPostureChecks(t *testing.T) {
account := &types.Account{
Peers: map[string]*nbpeer.Peer{
@@ -690,6 +709,7 @@ func TestAccount_getPeersByPolicyPostureChecks(t *testing.T) {
Action: "accept",
Protocol: "tcp",
Port: "80",
PolicyID: "RuleSwarm",
},
}
assert.ElementsMatch(t, firewallRules, expectedFirewallRules)
@@ -773,6 +793,7 @@ func TestAccount_getPeersByPolicyPostureChecks(t *testing.T) {
Action: "accept",
Protocol: "tcp",
Port: "80",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.32.206",
@@ -780,6 +801,7 @@ func TestAccount_getPeersByPolicyPostureChecks(t *testing.T) {
Action: "accept",
Protocol: "tcp",
Port: "80",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.13.186",
@@ -787,6 +809,7 @@ func TestAccount_getPeersByPolicyPostureChecks(t *testing.T) {
Action: "accept",
Protocol: "tcp",
Port: "80",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.29.55",
@@ -794,6 +817,7 @@ func TestAccount_getPeersByPolicyPostureChecks(t *testing.T) {
Action: "accept",
Protocol: "tcp",
Port: "80",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.254.139",
@@ -801,6 +825,7 @@ func TestAccount_getPeersByPolicyPostureChecks(t *testing.T) {
Action: "accept",
Protocol: "tcp",
Port: "80",
PolicyID: "RuleSwarm",
},
{
PeerIP: "100.65.62.5",
@@ -808,6 +833,7 @@ func TestAccount_getPeersByPolicyPostureChecks(t *testing.T) {
Action: "accept",
Protocol: "tcp",
Port: "80",
PolicyID: "RuleSwarm",
},
}
assert.Len(t, firewallRules, len(expectedFirewallRules))
management/server/route.go
+1
View File
@@ -388,6 +388,7 @@ func toProtocolRoutesFirewallRules(rules []*types.RouteFirewallRule) []*proto.Ro
Protocol: getProtoProtocol(rule.Protocol),
PortInfo: getProtoPortInfo(rule),
IsDynamic: rule.IsDynamic,
PolicyID: []byte(rule.PolicyID),
}
}
management/server/types/account.go
+1
View File
@@ -1012,6 +1012,7 @@ func (a *Account) connResourcesGenerator(ctx context.Context) (func(*PolicyRule,
}
fr := FirewallRule{
PolicyID: rule.ID,
PeerIP: peer.IP.String(),
Direction: direction,
Action: string(rule.Action),
management/server/types/firewall_rule.go
+4
View File
@@ -20,6 +20,9 @@ const (
// FirewallRule is a rule of the firewall.
type FirewallRule struct {
// PolicyID is the ID of the policy this rule is derived from
PolicyID string
// PeerIP of the peer
PeerIP string
@@ -58,6 +61,7 @@ func generateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule
}
baseRule := RouteFirewallRule{
PolicyID: rule.PolicyID,
SourceRanges: sourceRanges,
Action: string(rule.Action),
Destination: route.Network.String(),
management/server/types/route_firewall_rule.go
+3
View File
@@ -6,6 +6,9 @@ import (
// RouteFirewallRule a firewall rule applicable for a routed network.
type RouteFirewallRule struct {
// PolicyID is the ID of the policy this rule is derived from
PolicyID string
// SourceRanges IP ranges of the routing peers.
SourceRanges []string