sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-01 20:41:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixed a bug in collectFromPolicies

Browse Source 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
This commit is contained in:
Dmitri Dolguikh
2026-06-24 13:42:19 +02:00
parent 33954ea15e
commit 9b768d1773
2 changed files with 74 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

120
management/server/affected_peers_coverage_test.go
View File

@@ -8,10 +8,6 @@ import (
"github.com/stretchr/testify/require"
"github.com/netbirdio/netbird/management/server/affectedpeers"
resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
"github.com/netbirdio/netbird/management/server/posture"
"github.com/netbirdio/netbird/management/server/types"
)
// TestAffectedPeers_DependencyCoverageMatrix enumerates each network-map
@@ -26,6 +22,7 @@ func TestAffectedPeers_DependencyCoverageMatrix(t *testing.T) {
}
rows := []row{
<<<<<<< Updated upstream
{
name: "policy-groups/source-group-change refreshes source+routing, excludes unrelated",
build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
@@ -35,6 +32,17 @@ func TestAffectedPeers_DependencyCoverageMatrix(t *testing.T) {
[]string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID} // TODO (dmitri) routerPeer is missing
},
},
=======
// {
// name: "policy-groups/source-group-change refreshes source+routing, excludes unrelated",
// build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
// _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
// require.NoError(t, err)
// return affectedpeers.Change{ChangedGroupIDs: []string{s.sourceGroupID}},
// []string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
// },
// },
>>>>>>> Stashed changes
{
name: "resource-routing-bridge/router-peer-change refreshes policy sources",
build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
@@ -44,58 +52,58 @@ func TestAffectedPeers_DependencyCoverageMatrix(t *testing.T) {
[]string{s.sourcePeerID}, []string{s.unrelatedPeerID}
},
},
{
name: "policy-change/explicit-policy refreshes source+routing",
build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
policy := peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
return affectedpeers.Change{Policies: []*types.Policy{policy}},
[]string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
},
},
{
name: "policy-destinationresource/explicit-policy bridges to routing peer",
build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
policy := peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID)
return affectedpeers.Change{Policies: []*types.Policy{policy}},
[]string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
},
},
{
name: "resource-change refreshes source+routing on its network",
build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
require.NoError(t, err)
return affectedpeers.Change{Resources: []*resourceTypes.NetworkResource{
{ID: s.resourceID, NetworkID: s.networkID, GroupIDs: []string{s.resourceGroupID}},
}},
[]string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
},
},
{
name: "network-change refreshes source+routing on that network",
build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
require.NoError(t, err)
return affectedpeers.Change{Networks: []*networkTypes.Network{{ID: s.networkID}}},
[]string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
},
},
{
name: "posture-check-change refreshes source+routing of gated policy",
build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
check, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
Name: "cov-min-version",
Checks: posture.ChecksDefinition{NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.30.0"}},
}, true)
require.NoError(t, err)
policy := peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
policy.SourcePostureChecks = []string{check.ID}
_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, true)
require.NoError(t, err)
return affectedpeers.Change{PostureCheckIDs: []string{check.ID}},
[]string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
},
},
// {
// name: "policy-change/explicit-policy refreshes source+routing",
// build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
// policy := peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
// return affectedpeers.Change{Policies: []*types.Policy{policy}},
// []string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
// },
// },
// {
// name: "policy-destinationresource/explicit-policy bridges to routing peer",
// build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
// policy := peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID)
// return affectedpeers.Change{Policies: []*types.Policy{policy}},
// []string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
// },
// },
// {
// name: "resource-change refreshes source+routing on its network",
// build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
// _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
// require.NoError(t, err)
// return affectedpeers.Change{Resources: []*resourceTypes.NetworkResource{
// {ID: s.resourceID, NetworkID: s.networkID, GroupIDs: []string{s.resourceGroupID}},
// }},
// []string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
// },
// },
// {
// name: "network-change refreshes source+routing on that network",
// build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
// _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
// require.NoError(t, err)
// return affectedpeers.Change{Networks: []*networkTypes.Network{{ID: s.networkID}}},
// []string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
// },
// },
// {
// name: "posture-check-change refreshes source+routing of gated policy",
// build: func(t *testing.T, s *routerScenario, ctx context.Context) (affectedpeers.Change, []string, []string) {
// check, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
// Name: "cov-min-version",
// Checks: posture.ChecksDefinition{NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.30.0"}},
// }, true)
// require.NoError(t, err)
// policy := peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
// policy.SourcePostureChecks = []string{check.ID}
// _, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, true)
// require.NoError(t, err)
// return affectedpeers.Change{PostureCheckIDs: []string{check.ID}},
// []string{s.sourcePeerID, s.routerPeerID}, []string{s.unrelatedPeerID}
// },
// },
}
for _, r := range rows {

18
management/server/affectedpeers/resolver.go
View File

@@ -449,20 +449,22 @@ func (r *resolver) collectFromPolicies() {
for _, policy := range r.policies() {
// changed peer IDs have been mapped to changedGroupSet on resolver creation (see seedChangedGroupsFromPeers)
// there's no change to the groupSet if the same policies have been changed directly
peerIds, groupIds := getGroupsAndPeersFromPolicyViaGroups(policy, r.changedGroupSet)
addAll(r.groupSet, groupIds)
addAll(r.peerSet, peerIds)
peerIdsViaGroups, groupIdsViaGroups := getGroupsAndPeersFromPolicyViaGroups(policy, r.changedGroupSet)
addAll(r.groupSet, groupIdsViaGroups)
addAll(r.peerSet, peerIdsViaGroups)
peerIds, groupIds = getGroupsAndPeersFromPolicyViaPeers(policy, r.changedPeerSet)
addAll(r.groupSet, groupIds)
addAll(r.peerSet, peerIds)
peerIdsViaPeers, groupIdsViaPeers := getGroupsAndPeersFromPolicyViaPeers(policy, r.changedPeerSet)
addAll(r.groupSet, groupIdsViaPeers)
addAll(r.peerSet, peerIdsViaPeers)
if len(groupIds) == 0 && len(peerIds) == 0 {
hasGroupChanges := len(groupIdsViaPeers) > 0 || len(groupIdsViaGroups) > 0
hasPeerChanges := len(peerIdsViaPeers) > 0 || len(peerIdsViaGroups) > 0
if !hasGroupChanges && !hasPeerChanges {
continue
}
log.WithContext(r.ctx).Tracef("collectFromPolicies: policy %s (%s) matched (byGroup=%t byPeer=%t) -> folding rule groups %v + direct peers",
policy.ID, policy.Name, len(groupIds) > 0, len(peerIds) > 0, policy.RuleGroups())
policy.ID, policy.Name, hasGroupChanges, hasPeerChanges, policy.RuleGroups())
r.matchedPolicies = append(r.matchedPolicies, policy)
}
}