sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-30 18:49:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add support for IPv6 networks (on Linux clients) (#1459)

Browse Source 
* Feat add basic support for IPv6 networks

Newly generated networks automatically generate an IPv6 prefix of size
64 within the ULA address range, devices obtain a randomly generated
address within this prefix.

Currently, this is Linux only and does not yet support all features
(routes currently cause an error).

* Fix firewall configuration for IPv6 networks

* Fix routing configuration for IPv6 networks

* Feat provide info on IPv6 support for specific client to mgmt server

* Feat allow configuration of IPv6 support through API, improve stability

* Feat add IPv6 support to new firewall implementation

* Fix peer list item response not containing IPv6 address

* Fix nftables breaking on IPv6 address change

* Fix build issues for non-linux systems

* Fix intermittent disconnections when IPv6 is enabled

* Fix test issues and make some minor revisions

* Fix some more testing issues

* Fix more CI issues due to IPv6

* Fix more testing issues

* Add inheritance of IPv6 enablement status from groups

* Fix IPv6 events not having associated messages

* Address first review comments regarding IPv6 support

* Fix IPv6 table being created even when IPv6 is disabled

Also improved stability of IPv6 route and firewall handling on client side

* Fix IPv6 routes not being removed

* Fix DNS IPv6 issues, limit IPv6 nameservers to IPv6 peers

* Improve code for IPv6 DNS server selection, add AAAA custom records

* Ensure IPv6 routes can only exist for IPv6 routing peers

* Fix IPv6 network generation randomness

* Fix a bunch of compilation issues and test failures

* Replace method calls that are unavailable in Go 1.21

* Fix nil dereference in cleanUpDefaultForwardRules6

* Fix nil pointer dereference when persisting IPv6 network in sqlite

* Clean up of client-side code changes for IPv6

* Fix nil dereference in rule mangling and compilation issues

* Add a bunch of client-side test cases for IPv6

* Fix IPv6 tests running on unsupported environments

* Fix import cycle in tests

* Add missing method SupportsIPv6() for windows

* Require IPv6 default route for IPv6 tests

* Fix panics in routemanager tests on non-linux

* Fix some more route manager tests concerning IPv6

* Add some final client-side tests

* Add IPv6 tests for management code, small fixes

* Fix linting issues

* Fix small test suite issues

* Fix linter issues and builds on macOS and Windows again

* fix builds for iOS because of IPv6 breakage
This commit is contained in:
Hugo Hakim Damer
2024-08-13 17:26:27 +02:00
committed by GitHub
parent 4da29451d0
commit 8b0398c0db
85 changed files with 4311 additions and 795 deletions
Download Patch File Download Diff File Expand all files Collapse all files
management/server/http/accounts_handler_test.go
+1 -1
View File
@@ -62,7 +62,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
handler := initAccountsTestData(&server.Account{
Id: accountID,
Domain: "hotmail.com",
Network: server.NewNetwork(),
Network: server.NewNetwork(true),
Users: map[string]*server.User{
adminUser.Id: adminUser,
},
management/server/http/api/openapi.yml
+28
View File
@@ -247,10 +247,15 @@ components:
description: (Cloud only) Indicates whether peer needs approval
type: boolean
example: true
ipv6_enabled:
type: string
enum: [enabled, disabled, auto]
example: auto
required:
- name
- ssh_enabled
- login_expiration_enabled
- ipv6_enabled
PeerBase:
allOf:
- $ref: '#/components/schemas/PeerMinimum'
@@ -264,6 +269,10 @@ components:
description: Peer's public connection IP address
type: string
example: 35.64.0.1
ip6:
description: Peer's IPv6 address
type: string
example: 2001:db8::0123:4567:890a:bcde
connected:
description: Peer to Management connection status
type: boolean
@@ -310,6 +319,15 @@ components:
description: Peer's desktop UI version
type: string
example: 0.14.0
ipv6_supported:
description: Whether this peer supports IPv6
type: boolean
example: true
ipv6_enabled:
description: Whether IPv6 is enabled for this peer.
type: string
enum: [enabled, disabled, auto]
example: auto
dns_label:
description: Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud
type: string
@@ -352,6 +370,8 @@ components:
- kernel_version
- last_login
- last_seen
- ipv6_supported
- ipv6_enabled
- login_expiration_enabled
- login_expired
- os
@@ -627,8 +647,12 @@ components:
items:
type: string
example: "ch8i4ug6lnn4g9hqv7m1"
ipv6_enabled:
description: Whether IPv6 should be enabled for all members with IPv6 set to "auto"
type: boolean
required:
- name
- ipv6_enabled
Group:
allOf:
- $ref: '#/components/schemas/GroupMinimum'
@@ -639,8 +663,12 @@ components:
type: array
items:
$ref: '#/components/schemas/PeerMinimum'
ipv6_enabled:
description: Whether IPv6 should be enabled for all members with IPv6 set to "auto"
type: boolean
required:
- peers
- ipv6_enabled
PolicyRuleMinimum:
type: object
properties:
management/server/http/api/types.gen.go
+78 -4
View File
@@ -88,12 +88,40 @@ const (
NameserverNsTypeUdp NameserverNsType = "udp"
)
// Defines values for PeerIpv6Enabled.
const (
PeerIpv6EnabledAuto PeerIpv6Enabled = "auto"
PeerIpv6EnabledDisabled PeerIpv6Enabled = "disabled"
PeerIpv6EnabledEnabled PeerIpv6Enabled = "enabled"
)
// Defines values for PeerBaseIpv6Enabled.
const (
PeerBaseIpv6EnabledAuto PeerBaseIpv6Enabled = "auto"
PeerBaseIpv6EnabledDisabled PeerBaseIpv6Enabled = "disabled"
PeerBaseIpv6EnabledEnabled PeerBaseIpv6Enabled = "enabled"
)
// Defines values for PeerBatchIpv6Enabled.
const (
PeerBatchIpv6EnabledAuto PeerBatchIpv6Enabled = "auto"
PeerBatchIpv6EnabledDisabled PeerBatchIpv6Enabled = "disabled"
PeerBatchIpv6EnabledEnabled PeerBatchIpv6Enabled = "enabled"
)
// Defines values for PeerNetworkRangeCheckAction.
const (
PeerNetworkRangeCheckActionAllow PeerNetworkRangeCheckAction = "allow"
PeerNetworkRangeCheckActionDeny PeerNetworkRangeCheckAction = "deny"
)
// Defines values for PeerRequestIpv6Enabled.
const (
PeerRequestIpv6EnabledAuto PeerRequestIpv6Enabled = "auto"
PeerRequestIpv6EnabledDisabled PeerRequestIpv6Enabled = "disabled"
PeerRequestIpv6EnabledEnabled PeerRequestIpv6Enabled = "enabled"
)
// Defines values for PolicyRuleAction.
const (
PolicyRuleActionAccept PolicyRuleAction = "accept"
@@ -307,6 +335,9 @@ type Group struct {
// Id Group ID
Id string `json:"id"`
// Ipv6Enabled Whether IPv6 should be enabled for all members with IPv6 set to "auto"
Ipv6Enabled bool `json:"ipv6_enabled"`
// Issued How the group was issued (api, integration, jwt)
Issued *GroupIssued `json:"issued,omitempty"`
@@ -343,6 +374,9 @@ type GroupMinimumIssued string
// GroupRequest defines model for GroupRequest.
type GroupRequest struct {
// Ipv6Enabled Whether IPv6 should be enabled for all members with IPv6 set to "auto"
Ipv6Enabled bool `json:"ipv6_enabled"`
// Name Group name identifier
Name string `json:"name"`
@@ -502,6 +536,15 @@ type Peer struct {
// Ip Peer's IP address
Ip string `json:"ip"`
// Ip6 Peer's IPv6 address
Ip6 *string `json:"ip6,omitempty"`
// Ipv6Enabled Whether IPv6 is enabled for this peer.
Ipv6Enabled PeerIpv6Enabled `json:"ipv6_enabled"`
// Ipv6Supported Whether this peer supports IPv6
Ipv6Supported bool `json:"ipv6_supported"`
// KernelVersion Peer's operating system kernel version
KernelVersion string `json:"kernel_version"`
@@ -539,6 +582,9 @@ type Peer struct {
Version string `json:"version"`
}
// PeerIpv6Enabled Whether IPv6 is enabled for this peer.
type PeerIpv6Enabled string
// PeerBase defines model for PeerBase.
type PeerBase struct {
// ApprovalRequired (Cloud only) Indicates whether peer needs approval
@@ -574,6 +620,15 @@ type PeerBase struct {
// Ip Peer's IP address
Ip string `json:"ip"`
// Ip6 Peer's IPv6 address
Ip6 *string `json:"ip6,omitempty"`
// Ipv6Enabled Whether IPv6 is enabled for this peer.
Ipv6Enabled PeerBaseIpv6Enabled `json:"ipv6_enabled"`
// Ipv6Supported Whether this peer supports IPv6
Ipv6Supported bool `json:"ipv6_supported"`
// KernelVersion Peer's operating system kernel version
KernelVersion string `json:"kernel_version"`
@@ -611,6 +666,9 @@ type PeerBase struct {
Version string `json:"version"`
}
// PeerBaseIpv6Enabled Whether IPv6 is enabled for this peer.
type PeerBaseIpv6Enabled string
// PeerBatch defines model for PeerBatch.
type PeerBatch struct {
// AccessiblePeersCount Number of accessible peers
@@ -649,6 +707,15 @@ type PeerBatch struct {
// Ip Peer's IP address
Ip string `json:"ip"`
// Ip6 Peer's IPv6 address
Ip6 *string `json:"ip6,omitempty"`
// Ipv6Enabled Whether IPv6 is enabled for this peer.
Ipv6Enabled PeerBatchIpv6Enabled `json:"ipv6_enabled"`
// Ipv6Supported Whether this peer supports IPv6
Ipv6Supported bool `json:"ipv6_supported"`
// KernelVersion Peer's operating system kernel version
KernelVersion string `json:"kernel_version"`
@@ -686,6 +753,9 @@ type PeerBatch struct {
Version string `json:"version"`
}
// PeerBatchIpv6Enabled Whether IPv6 is enabled for this peer.
type PeerBatchIpv6Enabled string
// PeerMinimum defines model for PeerMinimum.
type PeerMinimum struct {
// Id Peer ID
@@ -710,12 +780,16 @@ type PeerNetworkRangeCheckAction string
// PeerRequest defines model for PeerRequest.
type PeerRequest struct {
// ApprovalRequired (Cloud only) Indicates whether peer needs approval
ApprovalRequired *bool `json:"approval_required,omitempty"`
LoginExpirationEnabled bool `json:"login_expiration_enabled"`
Name string `json:"name"`
SshEnabled bool `json:"ssh_enabled"`
ApprovalRequired *bool `json:"approval_required,omitempty"`
Ipv6Enabled PeerRequestIpv6Enabled `json:"ipv6_enabled"`
LoginExpirationEnabled bool `json:"login_expiration_enabled"`
Name string `json:"name"`
SshEnabled bool `json:"ssh_enabled"`
}
// PeerRequestIpv6Enabled defines model for PeerRequest.Ipv6Enabled.
type PeerRequestIpv6Enabled string
// PersonalAccessToken defines model for PersonalAccessToken.
type PersonalAccessToken struct {
// CreatedAt Date the token was created
management/server/http/groups_handler.go
+32 -10
View File
@@ -3,6 +3,7 @@ package http
import (
"encoding/json"
"net/http"
"slices"
"github.com/gorilla/mux"
log "github.com/sirupsen/logrus"
@@ -82,16 +83,6 @@ func (h *GroupsHandler) UpdateGroup(w http.ResponseWriter, r *http.Request) {
return
}
allGroup, err := account.GetGroupAll()
if err != nil {
util.WriteError(err, w)
return
}
if allGroup.ID == groupID {
util.WriteError(status.Errorf(status.InvalidArgument, "updating group ALL is not allowed"), w)
return
}
var req api.PutApiGroupsGroupIdJSONRequestBody
err = json.NewDecoder(r.Body).Decode(&req)
if err != nil {
@@ -110,12 +101,42 @@ func (h *GroupsHandler) UpdateGroup(w http.ResponseWriter, r *http.Request) {
} else {
peers = *req.Peers
}
allGroup, err := account.GetGroupAll()
if err != nil {
util.WriteError(err, w)
return
}
if allGroup.ID == groupID {
if len(peers) != len(allGroup.Peers) || req.Name != allGroup.Name {
util.WriteError(status.Errorf(status.InvalidArgument, "updating group ALL is not allowed"), w)
return
}
deduplicatedPeers := make(map[string]struct{})
for _, peer := range peers {
deduplicatedPeers[peer] = struct{}{}
}
if len(deduplicatedPeers) != len(peers) {
util.WriteError(status.Errorf(status.InvalidArgument, "updating group ALL is not allowed"), w)
return
}
for peer := range deduplicatedPeers {
if slices.Contains(allGroup.Peers, peer) {
continue
}
util.WriteError(status.Errorf(status.InvalidArgument, "updating group ALL is not allowed"), w)
return
}
}
group := nbgroup.Group{
ID: groupID,
Name: req.Name,
Peers: peers,
Issued: eg.Issued,
IntegrationReference: eg.IntegrationReference,
IPv6Enabled: req.Ipv6Enabled,
}
if err := h.accountManager.SaveGroup(account.Id, user.Id, &group); err != nil {
@@ -246,6 +267,7 @@ func toGroupResponse(account *server.Account, group *nbgroup.Group) *api.Group {
Id: group.ID,
Name: group.Name,
Issued: (*api.GroupIssued)(&group.Issued),
Ipv6Enabled: group.IPv6Enabled,
}
for _, pid := range group.Peers {
management/server/http/peers_handler.go
+31
View File
@@ -85,11 +85,17 @@ func (h *PeersHandler) updatePeer(account *server.Account, user *server.User, pe
return
}
v6Status := nbpeer.V6Auto
if req.Ipv6Enabled != api.PeerRequestIpv6EnabledAuto {
v6Status = nbpeer.V6Status(req.Ipv6Enabled)
}
update := &nbpeer.Peer{
ID: peerID,
SSHEnabled: req.SshEnabled,
Name: req.Name,
LoginExpirationEnabled: req.LoginExpirationEnabled,
V6Setting: v6Status,
}
if req.ApprovalRequired != nil {
@@ -284,11 +290,22 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
osVersion = peer.Meta.Core
}
var ip6 *string
if peer.IP6 != nil {
ip6string := peer.IP6.String()
ip6 = &ip6string
}
v6Status := api.PeerIpv6EnabledAuto
if peer.V6Setting != nbpeer.V6Auto {
v6Status = api.PeerIpv6Enabled(peer.V6Setting)
}
return &api.Peer{
Id: peer.ID,
Name: peer.Name,
Ip: peer.IP.String(),
ConnectionIp: peer.Location.ConnectionIP.String(),
Ip6: ip6,
Connected: peer.Status.Connected,
LastSeen: peer.Status.LastSeen,
Os: fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
@@ -300,6 +317,8 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
Hostname: peer.Meta.Hostname,
UserId: peer.UserID,
UiVersion: peer.Meta.UIVersion,
Ipv6Supported: peer.Meta.Ipv6Supported,
Ipv6Enabled: v6Status,
DnsLabel: fqdn(peer, dnsDomain),
LoginExpirationEnabled: peer.LoginExpirationEnabled,
LastLogin: peer.LastLogin,
@@ -317,12 +336,22 @@ func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dn
if osVersion == "" {
osVersion = peer.Meta.Core
}
var ip6 *string
if peer.IP6 != nil {
ip6string := peer.IP6.String()
ip6 = &ip6string
}
v6Status := api.PeerBatchIpv6EnabledAuto
if peer.V6Setting != nbpeer.V6Auto {
v6Status = api.PeerBatchIpv6Enabled(peer.V6Setting)
}
return &api.PeerBatch{
Id: peer.ID,
Name: peer.Name,
Ip: peer.IP.String(),
ConnectionIp: peer.Location.ConnectionIP.String(),
Ip6: ip6,
Connected: peer.Status.Connected,
LastSeen: peer.Status.LastSeen,
Os: fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
@@ -334,6 +363,8 @@ func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dn
Hostname: peer.Meta.Hostname,
UserId: peer.UserID,
UiVersion: peer.Meta.UIVersion,
Ipv6Supported: peer.Meta.Ipv6Supported,
Ipv6Enabled: v6Status,
DnsLabel: fqdn(peer, dnsDomain),
LoginExpirationEnabled: peer.LoginExpirationEnabled,
LastLogin: peer.LastLogin,
management/server/http/peers_handler_test.go
+6
View File
@@ -37,6 +37,12 @@ func initTestMetaData(peers ...*nbpeer.Peer) *PeersHandler {
break
}
}
if p.V6Setting == nbpeer.V6Enabled && p.IP6 == nil {
ip6 := net.ParseIP("2001:db8::dead:beef")
p.IP6 = &ip6
} else {
p.IP6 = nil
}
p.SSHEnabled = update.SSHEnabled
p.LoginExpirationEnabled = update.LoginExpirationEnabled
p.Name = update.Name