sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-01 20:41:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add docstrings to mdm_integration

Browse Source
This commit is contained in:
riccardom
2026-06-09 10:49:57 +00:00
parent d7f00b3beb
commit bd9fed41ad
13 changed files with 129 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
client/server/mdm.go
View File

@@ -174,7 +174,9 @@ type conflictCheck struct {
// conflictBool builds a conflictCheck for a boolean MDM key.
// If p is nil the returned check treats the field as matching; otherwise the
// check returns true only when the policy contains the key and its boolean
// value equals *p.
// conflictBool constructs a conflictCheck that verifies a boolean MDM policy key matches a desired value.
// If p is nil the produced check treats the field as matching by definition. Otherwise the check returns
// true only if the policy has the key and its boolean value equals *p.
func conflictBool(key string, p *bool) conflictCheck {
return conflictCheck{
key: key,
@@ -191,7 +193,9 @@ func conflictBool(key string, p *bool) conflictCheck {
// conflictString builds a check for a string field. Empty string ("")
// conflictString returns a conflictCheck for the MDM string key identified by `key`.
// If `got` is empty the field is treated as unset and will not be considered a conflict.
// Otherwise the check succeeds only when the policy contains `key` and its value equals `got`.
// conflictString constructs a conflictCheck for a string policy key.
// The check treats an empty requested value as matching. Otherwise it
// succeeds only when the policy contains the key and its value equals got.
func conflictString(key, got string) conflictCheck {
return conflictCheck{
key: key,
@@ -206,7 +210,8 @@ func conflictString(key, got string) conflictCheck {
}
// conflictInt64 builds a conflictCheck that verifies an *int64 field against the MDM policy key.
// If p is nil the check always matches; otherwise the check requires the policy to contain the key and its integer value to equal *p.
// conflictInt64 builds a conflictCheck that validates an int64 MDM policy key.
// If p is nil, the check always matches; otherwise the policy must contain the key and its integer value must equal *p.
func conflictInt64(key string, p *int64) conflictCheck {
return conflictCheck{
key: key,
@@ -226,7 +231,9 @@ func conflictInt64(key string, p *int64) conflictCheck {
// skipped silently (the gate fires only for keys the admin has actually
// resolveConflicts identifies MDM-managed policy keys whose values differ from the provided checks.
// If the policy is empty, it returns nil. Only keys present in the policy are considered; for each
// check whose predicate returns false the corresponding key is included in the returned slice.
// resolveConflicts evaluates each conflictCheck against the provided MDM policy and returns
// a slice of policy keys whose checks report a mismatch. If the policy is empty, it returns nil.
// Checks whose key is not present in the policy are skipped.
func resolveConflicts(policy *mdm.Policy, checks []conflictCheck) []string {
if policy.IsEmpty() {
return nil
@@ -258,7 +265,11 @@ func resolveConflicts(policy *mdm.Policy, checks []conflictCheck) []string {
// If msg is nil, it returns nil. The function treats the PSK redaction sentinel
// ("**********") as an intentional no-op (equivalent to field not set). Only keys
// present in the supplied policy are considered; returned slice contains the policy
// key names that conflict with the values in msg.
// mdmManagedFieldConflicts reports MDM-managed policy keys that would conflict with a SetConfigRequest.
//
// If msg is nil, it returns nil. The pre-shared key redaction sentinel ("**********") is treated as unset
// so it does not produce a false conflict. The returned slice contains policy key names whose values in
// the request differ from the active policy; an empty or nil slice indicates no conflicts.
func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) []string {
if msg == nil {
return nil
@@ -297,7 +308,10 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
// field is present (for example: management/admin URLs, pre-shared key, DNS/NAT lists and
// cleaning flags, interface/port/MTU settings, auto-connect and routing toggles, DNS/firewall/IPv6
// controls, SSH-related flags, notification/lazy-connection options, or other persistent config
// toggles).
// setConfigRequestHasConfigOverrides reports whether msg contains any fields that would modify persisted daemon configuration.
// It returns false for a nil message. The check includes management/admin URLs, pre-shared key, DNS/NAT lists and cleanup flags,
// interface and WireGuard settings, MTU, auto-connect, routing, DNS/firewall/IPv6 controls, SSH-related flags, notification and
// lazy-connection options, and other persistent network/security fields.
func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
if msg == nil {
return false
@@ -343,7 +357,8 @@ func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
// loginRequestHasConfigOverrides reports whether a LoginRequest includes any fields that would change persisted daemon configuration.
// It returns true when the request carries any configuration-related values (for example: management/admin URLs, pre-shared key,
// DNS or NAT lists/cleanup flags, interface or WireGuard port, connection and policy toggles, route/DNS/firewall/notification flags,
// Rosenpass settings, lazy-connection or block-inbound), and false when the request is nil or contains only authentication/identity fields.
// loginRequestHasConfigOverrides reports whether the given LoginRequest contains any fields that would modify the daemon's persisted configuration.
// It returns true when the request sets any configuration-related fields (management/admin URLs, pre-shared key, DNS/NAT settings, Rosenpass options, interface/WireGuard settings, auto-connect, routing/SSH/firewall/DNS controls, notifications, lazy-connection, block-inbound, or similar persistent toggles); it returns false if msg is nil or contains only authentication/identity fields.
func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
if msg == nil {
return false
@@ -385,7 +400,13 @@ func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
// It returns a slice of policy keys that are managed by the given policy and whose values in the request
// differ from the policy. If msg is nil or the policy has no managed keys, it returns nil. The function
// prefers OptionalPreSharedKey over the legacy PreSharedKey when both are present and treats the redaction
// sentinel "**********" as an absent pre-shared key.
// loginRequestMDMConflicts reports MDM-managed configuration keys that would
// conflict between a LoginRequest and the active MDM policy.
//
// It returns a slice of policy key names whose requested values differ from the
// policy. If msg is nil it returns nil. For pre-shared keys, OptionalPreSharedKey
// takes precedence over the deprecated PreSharedKey; a value equal to
// preSharedKeyRedactedSentinel ("**********") is treated as unset.
func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []string {
if msg == nil {
return nil
@@ -427,7 +448,19 @@ func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []str
// rejectMDMManagedFieldConflicts returns a gRPC FailedPrecondition error when any MDM-managed fields conflict.
// If `conflicts` is empty this function returns nil. When conflicts exist it produces a FailedPrecondition status
// whose message lists the conflicting fields and attempts to attach a `proto.MDMManagedFieldsViolation` detail;
// if attaching details fails the base status error is returned. A warning is logged listing the rejected keys.
// rejectMDMManagedFieldConflicts rejects requests that attempt to modify fields managed by MDM.
// If `conflicts` is empty, it does nothing. Otherwise it logs a warning and returns a gRPC
// FailedPrecondition error whose message lists the conflicting keys and which carries a
// `proto.MDMManagedFieldsViolation` detail with the `Fields` set to `conflicts`. If attaching
// the detail fails, the base FailedPrecondition status is returned.
//
// Parameters:
// - policy: the active MDM policy (unused here, present for call-site symmetry).
// - conflicts: list of MDM-managed keys that the request attempted to modify.
//
// Returns:
// - a gRPC error indicating the request was rejected due to MDM-managed fields, or nil when
// there are no conflicts.
func rejectMDMManagedFieldConflicts(policy *mdm.Policy, conflicts []string) error {
if len(conflicts) == 0 {
return nil

11
client/server/server.go
View File

@@ -363,7 +363,16 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
// fields (DNS labels, NAT external IPs). Extracted from SetConfig to
// keep the handler's cognitive complexity below the SonarCube
// threshold; the body of this function is intentionally linear and
// branchy because each proto field is its own optional case.
// setConfigInputFromRequest builds a profilemanager.ConfigInput from a SetConfigRequest proto.
//
// It translates each provided proto field into the corresponding ConfigInput field,
// preserving the request's semantics for "clean" vs explicit-empty slices/bytes and
// converting optional numeric fields into typed pointers where applicable.
//
// msg: the incoming SetConfigRequest whose fields are mapped into the returned ConfigInput.
//
// Returns the constructed ConfigInput and a non-nil error if the active profile file path
// cannot be determined.
func setConfigInputFromRequest(msg *proto.SetConfigRequest) (profilemanager.ConfigInput, error) {
var config profilemanager.ConfigInput