sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-23 17:01:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

MDM Name scoping for clarity

Browse Source
This commit is contained in:
riccardom
2026-05-29 16:53:23 +02:00
parent 293a93910e
commit df9e216370
3 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
client/server/mdm.go
View File

@@ -14,10 +14,10 @@ import (
// active MDM policy. Tests override this to inject a fake policy.
var loadMDMPolicy = mdm.LoadPolicy
// requestedManagedKeys returns the names of MDM-managed keys whose
// requestedMDMManagedKeys returns the names of MDM-managed keys whose
// corresponding field is set in the SetConfigRequest. Only keys with an
// MDM mapping are considered; other fields are ignored.
func requestedManagedKeys(msg *proto.SetConfigRequest) []string {
func requestedMDMManagedKeys(msg *proto.SetConfigRequest) []string {
if msg == nil {
return nil
}
@@ -52,12 +52,12 @@ func requestedManagedKeys(msg *proto.SetConfigRequest) []string {
return keys
}
// rejectManagedFieldConflicts returns a FailedPrecondition gRPC error with a
// ManagedFieldsViolation detail when any of the requested keys is MDM-
// enforced, and nil otherwise. The whole request is rejected on any
// conflict; non-conflicting fields in the same request are not applied
// either (no partial apply).
func rejectManagedFieldConflicts(policy *mdm.Policy, requested []string) error {
// rejectMDMManagedFieldConflicts returns a FailedPrecondition gRPC error
// with an MDMManagedFieldsViolation detail when any of the requested keys
// is MDM-enforced, and nil otherwise. The whole request is rejected on
// any conflict; non-conflicting fields in the same request are not
// applied either (no partial apply).
func rejectMDMManagedFieldConflicts(policy *mdm.Policy, requested []string) error {
if policy.IsEmpty() || len(requested) == 0 {
return nil
}
@@ -74,7 +74,7 @@ func rejectManagedFieldConflicts(policy *mdm.Policy, requested []string) error {
codes.FailedPrecondition,
fmt.Sprintf("fields managed by MDM cannot be modified: %v", conflicts),
)
detailed, err := st.WithDetails(&proto.ManagedFieldsViolation{Fields: conflicts})
detailed, err := st.WithDetails(&proto.MDMManagedFieldsViolation{Fields: conflicts})
if err != nil {
// Detail attachment is best-effort; fall back to the plain status
// so the caller still gets a usable FailedPrecondition.

10
client/server/server.go
View File

@@ -309,10 +309,10 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
}
// MDM gate: refuse the whole request if any of its fields is enforced
// by the active MDM policy. The error carries a ManagedFieldsViolation
// detail listing the offending key names. Non-conflicting fields in
// the same request are not applied either.
if err := rejectManagedFieldConflicts(loadMDMPolicy(), requestedManagedKeys(msg)); err != nil {
// by the active MDM policy. The error carries an MDMManagedFields-
// Violation detail listing the offending key names. Non-conflicting
// fields in the same request are not applied either.
if err := rejectMDMManagedFieldConflicts(loadMDMPolicy(), requestedMDMManagedKeys(msg)); err != nil {
return nil, err
}
@@ -1556,7 +1556,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
EnableSSHRemotePortForwarding: enableSSHRemotePortForwarding,
DisableSSHAuth: disableSSHAuth,
SshJWTCacheTTL: sshJWTCacheTTL,
ManagedFields: cfg.Policy().ManagedKeys(),
MDMManagedFields: cfg.Policy().ManagedKeys(),
}, nil
}

8
client/server/setconfig_mdm_test.go
View File

@@ -71,20 +71,20 @@ func setupServerWithProfile(t *testing.T) (s *Server, ctx context.Context, profN
return s, ctx, profName, currUser.Username, cfgPath
}
// extractViolation pulls the ManagedFieldsViolation detail from a
// extractViolation pulls the MDMManagedFieldsViolation detail from a
// FailedPrecondition error. Fails the test if absent or malformed.
func extractViolation(t *testing.T, err error) *proto.ManagedFieldsViolation {
func extractViolation(t *testing.T, err error) *proto.MDMManagedFieldsViolation {
t.Helper()
require.Error(t, err)
st, ok := gstatus.FromError(err)
require.True(t, ok, "error must be a gRPC status: %v", err)
require.Equal(t, codes.FailedPrecondition, st.Code(), "expected FailedPrecondition, got %s", st.Code())
for _, d := range st.Details() {
if v, ok := d.(*proto.ManagedFieldsViolation); ok {
if v, ok := d.(*proto.MDMManagedFieldsViolation); ok {
return v
}
}
t.Fatalf("ManagedFieldsViolation detail not found on status; details: %v", st.Details())
t.Fatalf("MDMManagedFieldsViolation detail not found on status; details: %v", st.Details())
return nil
}