mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-23 07:09:08 +02:00
[client] Move MDM enforcement logic into a shared Go layer (#7319)
The mobile bridges only carried the policy fetcher, leaving every enforcement decision to the native apps: the desktop derived its UI restrictions in the Wails service layer, the daemon kept the conflict machinery in the server package, and both mobile bridges duplicated the JSON fetch adapter. Anything the native side had to reimplement was a place for iOS and Android to drift apart. Enforcement now lives in client/mdm and is consumed identically by all three platforms: - conflicts.go holds the value-aware conflict checks lifted out of the daemon, so the same normalization (canonical URLs, PSK sentinel echo) applies wherever a config change is validated. - restrictions.go derives the UI enforcement snapshot from a policy and renders it in the JSON shape the desktop frontend already consumes. The service-layer types become aliases, keeping one source of truth. - jsonloader.go replaces the adapter that was copy-pasted into both bridges. - changedetector.go moves change detection off the native side: the caller forwards the OS notification and asks whether the managed configuration actually changed, instead of diffing dictionaries itself. The mobile bridges gain the enforcement the daemon already had. The Preferences getters resolve managed keys from the policy, so a naive UI shows the enforced value; Commit rejects a staged change that diverges from a managed key; NewAuth resolves the managed management URL before persisting the config and overlays the policy on it, so a login can no longer run against a URL the policy forbids. Android's profile mutations fail closed when disableProfiles is set. NewAuth takes the fetcher as a required argument rather than keeping a policy-blind overload: the apps consume this code as a submodule, so a compile error at the bump is the point. The mobile PSK getter is replaced by a presence check — the key has no reason to cross the bridge, and not returning it means the native side needs no redaction sentinel of its own.
This commit is contained in:
Zoltan Papp
@@ -0,0 +1,47 @@
|
||||
package mdm
|
||||
|
||||
import (
|
||||
"sync"
|
||||
|
||||
log "github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
// ChangeDetector tracks the last observed policy of a Loader so an
|
||||
// OS-notification-driven caller can ask whether the managed configuration
|
||||
// actually changed before restarting anything.
|
||||
type ChangeDetector struct {
|
||||
mu sync.Mutex
|
||||
loader *Loader
|
||||
prev *Policy
|
||||
}
|
||||
|
||||
// NewChangeDetector constructs a ChangeDetector seeded with the loader's
|
||||
// current policy, so only a later change reports as changed.
|
||||
func NewChangeDetector(loader *Loader) *ChangeDetector {
|
||||
return &ChangeDetector{
|
||||
loader: loader,
|
||||
prev: loader.Load(),
|
||||
}
|
||||
}
|
||||
|
||||
// Changed re-reads the policy, logs the per-key diff, and reports whether it
|
||||
// diverged from the last observation; the new snapshot becomes the baseline.
|
||||
func (d *ChangeDetector) Changed() bool {
|
||||
d.mu.Lock()
|
||||
defer d.mu.Unlock()
|
||||
curr := d.loader.Load()
|
||||
if policiesEqual(d.prev, curr) {
|
||||
return false
|
||||
}
|
||||
added, removed, changed := diffPolicies(d.prev, curr)
|
||||
log.Infof("MDM policy changed: added=%v removed=%v changed=%v", added, removed, changed)
|
||||
d.prev = curr
|
||||
return true
|
||||
}
|
||||
|
||||
// Current returns the last observed policy snapshot.
|
||||
func (d *ChangeDetector) Current() *Policy {
|
||||
d.mu.Lock()
|
||||
defer d.mu.Unlock()
|
||||
return d.prev
|
||||
}
|
||||
@@ -0,0 +1,108 @@
|
||||
package mdm
|
||||
|
||||
import "net/url"
|
||||
|
||||
// PreSharedKeyRedactedSentinel is the redaction mask returned in place of a
|
||||
// real pre-shared key; an incoming value equal to it is a round-trip echo,
|
||||
// never an override.
|
||||
const PreSharedKeyRedactedSentinel = "**********"
|
||||
|
||||
// ConflictCheck is a value-aware comparison between a single requested field
|
||||
// and the corresponding MDM-enforced value.
|
||||
type ConflictCheck struct {
|
||||
Key string
|
||||
Check func(*Policy) bool
|
||||
}
|
||||
|
||||
// ConflictBool builds a ConflictCheck for a boolean MDM key.
|
||||
func ConflictBool(key string, p *bool) ConflictCheck {
|
||||
return ConflictCheck{
|
||||
Key: key,
|
||||
Check: func(pol *Policy) bool {
|
||||
if p == nil {
|
||||
return true
|
||||
}
|
||||
want, ok := pol.GetBool(key)
|
||||
return ok && want == *p
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// ConflictString builds a ConflictCheck for a string MDM key.
|
||||
func ConflictString(key, got string) ConflictCheck {
|
||||
return ConflictCheck{
|
||||
Key: key,
|
||||
Check: func(pol *Policy) bool {
|
||||
if got == "" {
|
||||
return true
|
||||
}
|
||||
want, ok := pol.GetString(key)
|
||||
return ok && want == got
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// ConflictURL builds a ConflictCheck for a URL-typed MDM key; both sides are
|
||||
// normalized via CanonicalURL before comparison.
|
||||
func ConflictURL(key, got string) ConflictCheck {
|
||||
return ConflictCheck{
|
||||
Key: key,
|
||||
Check: func(pol *Policy) bool {
|
||||
if got == "" {
|
||||
return true
|
||||
}
|
||||
want, ok := pol.GetString(key)
|
||||
return ok && CanonicalURL(want) == CanonicalURL(got)
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// ConflictInt64 builds a ConflictCheck for an integer MDM key.
|
||||
func ConflictInt64(key string, p *int64) ConflictCheck {
|
||||
return ConflictCheck{
|
||||
Key: key,
|
||||
Check: func(pol *Policy) bool {
|
||||
if p == nil {
|
||||
return true
|
||||
}
|
||||
want, ok := pol.GetInt(key)
|
||||
return ok && want == *p
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// ResolveConflicts returns the names of keys whose requested value diverges
|
||||
// from the policy-enforced value; keys the policy does not manage are skipped.
|
||||
func ResolveConflicts(policy *Policy, checks []ConflictCheck) []string {
|
||||
if policy.IsEmpty() {
|
||||
return nil
|
||||
}
|
||||
var conflicts []string
|
||||
for _, c := range checks {
|
||||
if !policy.HasKey(c.Key) {
|
||||
continue
|
||||
}
|
||||
if !c.Check(policy) {
|
||||
conflicts = append(conflicts, c.Key)
|
||||
}
|
||||
}
|
||||
return conflicts
|
||||
}
|
||||
|
||||
// CanonicalURL normalizes a service URL by appending the scheme default port
|
||||
// when none is present; unparseable input is returned unchanged.
|
||||
func CanonicalURL(s string) string {
|
||||
u, err := url.ParseRequestURI(s)
|
||||
if err != nil {
|
||||
return s
|
||||
}
|
||||
if u.Port() == "" {
|
||||
switch u.Scheme {
|
||||
case "https":
|
||||
u.Host += ":443"
|
||||
case "http":
|
||||
u.Host += ":80"
|
||||
}
|
||||
}
|
||||
return u.String()
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
package mdm
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
|
||||
log "github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
type jsonPolicyFetcher struct {
|
||||
fetch func() string
|
||||
}
|
||||
|
||||
// NewJSONLoader constructs a Loader whose policy source is a JSON-encoded
|
||||
// object string, as produced by the mobile native layers; a nil fetch
|
||||
// disables MDM enforcement.
|
||||
func NewJSONLoader(fetch func() string) *Loader {
|
||||
if fetch == nil {
|
||||
return NewLoader(nil)
|
||||
}
|
||||
return NewLoader(&jsonPolicyFetcher{fetch: fetch})
|
||||
}
|
||||
|
||||
func (f *jsonPolicyFetcher) Fetch() map[string]any {
|
||||
raw := f.fetch()
|
||||
if raw == "" {
|
||||
return nil
|
||||
}
|
||||
var out map[string]any
|
||||
if err := json.Unmarshal([]byte(raw), &out); err != nil {
|
||||
log.Warnf("MDM mobile fetcher: invalid JSON payload from native: %v", err)
|
||||
return nil
|
||||
}
|
||||
return out
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
package mdm
|
||||
|
||||
import "encoding/json"
|
||||
|
||||
// Fields carries the per-key MDM enforcement state for a UI: value-typed
|
||||
// fields hold the enforced value, boolean fields report that the key is
|
||||
// managed.
|
||||
type Fields struct {
|
||||
ManagementURL string `json:"managementURL"`
|
||||
PreSharedKey bool `json:"preSharedKey"`
|
||||
WireguardPort bool `json:"wireguardPort"`
|
||||
RosenpassEnabled bool `json:"rosenpassEnabled"`
|
||||
RosenpassPermissive bool `json:"rosenpassPermissive"`
|
||||
DisableClientRoutes bool `json:"disableClientRoutes"`
|
||||
DisableServerRoutes bool `json:"disableServerRoutes"`
|
||||
AllowServerSSH *bool `json:"allowServerSSH"`
|
||||
DisableAutoConnect bool `json:"disableAutoConnect"`
|
||||
DisableAutostart bool `json:"disableAutostart"`
|
||||
BlockInbound bool `json:"blockInbound"`
|
||||
DisableMetricsCollection bool `json:"disableMetricsCollection"`
|
||||
SplitTunnelMode bool `json:"splitTunnelMode"`
|
||||
SplitTunnelApps bool `json:"splitTunnelApps"`
|
||||
DisableAdvancedView bool `json:"disableAdvancedView"`
|
||||
}
|
||||
|
||||
// Features carries the feature gates a UI must honor.
|
||||
type Features struct {
|
||||
DisableProfiles bool `json:"disableProfiles"`
|
||||
DisableNetworks bool `json:"disableNetworks"`
|
||||
DisableUpdateSettings bool `json:"disableUpdateSettings"`
|
||||
}
|
||||
|
||||
// Restrictions is the UI-facing enforcement snapshot; the JSON shape is
|
||||
// shared by the desktop frontend and the mobile bridges.
|
||||
type Restrictions struct {
|
||||
MDM Fields `json:"mdm"`
|
||||
Features Features `json:"features"`
|
||||
}
|
||||
|
||||
// BuildRestrictions derives the UI enforcement snapshot from the active
|
||||
// policy.
|
||||
func BuildRestrictions(policy *Policy) Restrictions {
|
||||
var r Restrictions
|
||||
if policy.IsEmpty() {
|
||||
return r
|
||||
}
|
||||
|
||||
if v, ok := policy.GetString(KeyManagementURL); ok {
|
||||
r.MDM.ManagementURL = CanonicalURL(v)
|
||||
}
|
||||
r.MDM.PreSharedKey = policy.HasKey(KeyPreSharedKey)
|
||||
r.MDM.WireguardPort = policy.HasKey(KeyWireguardPort)
|
||||
r.MDM.RosenpassEnabled = policy.HasKey(KeyRosenpassEnabled)
|
||||
r.MDM.RosenpassPermissive = policy.HasKey(KeyRosenpassPermissive)
|
||||
r.MDM.DisableClientRoutes = policy.HasKey(KeyDisableClientRoutes)
|
||||
r.MDM.DisableServerRoutes = policy.HasKey(KeyDisableServerRoutes)
|
||||
r.MDM.DisableAutoConnect = policy.HasKey(KeyDisableAutoConnect)
|
||||
r.MDM.DisableAutostart = policy.HasKey(KeyDisableAutostart)
|
||||
r.MDM.BlockInbound = policy.HasKey(KeyBlockInbound)
|
||||
r.MDM.DisableMetricsCollection = policy.HasKey(KeyDisableMetricsCollection)
|
||||
r.MDM.SplitTunnelMode = policy.HasKey(KeySplitTunnelMode)
|
||||
r.MDM.SplitTunnelApps = policy.HasKey(KeySplitTunnelApps)
|
||||
if v, ok := policy.GetBool(KeyAllowServerSSH); ok {
|
||||
r.MDM.AllowServerSSH = &v
|
||||
}
|
||||
if v, ok := policy.GetBool(KeyDisableAdvancedView); ok {
|
||||
r.MDM.DisableAdvancedView = v
|
||||
}
|
||||
|
||||
if v, ok := policy.GetBool(KeyDisableProfiles); ok {
|
||||
r.Features.DisableProfiles = v
|
||||
}
|
||||
if v, ok := policy.GetBool(KeyDisableNetworks); ok {
|
||||
r.Features.DisableNetworks = v
|
||||
}
|
||||
if v, ok := policy.GetBool(KeyDisableUpdateSettings); ok {
|
||||
r.Features.DisableUpdateSettings = v
|
||||
}
|
||||
return r
|
||||
}
|
||||
|
||||
// JSON renders the snapshot in the shared UI JSON shape.
|
||||
func (r Restrictions) JSON() (string, error) {
|
||||
b, err := json.Marshal(r)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return string(b), nil
|
||||
}
|
||||
Reference in New Issue
Block a user