From e35a0f3318803c80ffd2fb446082e0b249b5135f Mon Sep 17 00:00:00 2001 From: Dmitri Dolguikh Date: Mon, 3 Aug 2026 18:04:11 +0200 Subject: [PATCH] added PrivateServiceCandidates Signed-off-by: Dmitri Dolguikh --- .../internals/network_map_db/db_store.go | 2 +- .../network_map_db/pgsql/network_map_data.go | 65 +++++++++++++------ .../network_map_db/pgsql/networks.go | 2 +- .../internals/network_map_db/pgsql/peer.go | 6 +- 4 files changed, 51 insertions(+), 24 deletions(-) diff --git a/management/internals/network_map_db/db_store.go b/management/internals/network_map_db/db_store.go index 197e26c7e..da989d393 100644 --- a/management/internals/network_map_db/db_store.go +++ b/management/internals/network_map_db/db_store.go @@ -22,7 +22,7 @@ const ( type NetworkMapDBStore interface { GetGroups(ctx context.Context, accountId string) ([]nmdata.Group, map[string]map[string]any, error) - GetPeers(ctx context.Context, accountId string) ([]nmdata.Peer, map[string]*nmdata.Peer, error) + GetPeers(ctx context.Context, accountId string) ([]nmdata.Peer, map[string][]*nmdata.Peer, error) GetPolicies(ctx context.Context, accountId string) ([]nmdata.Policy, map[string]map[string]any, map[string]map[string]any, error) GetRoutes(ctx context.Context, accountId string) ([]nmdata.Route, error) GetNameServerGroups(ctx context.Context, accountId string) ([]nmdata.NameServerGroup, error) diff --git a/management/internals/network_map_db/pgsql/network_map_data.go b/management/internals/network_map_db/pgsql/network_map_data.go index a94a52623..f7dc86113 100644 --- a/management/internals/network_map_db/pgsql/network_map_data.go +++ b/management/internals/network_map_db/pgsql/network_map_data.go @@ -5,6 +5,7 @@ import ( "strings" "github.com/jackc/pgx/v5" + "github.com/miekg/dns" "github.com/netbirdio/netbird/shared/management/networkmap" "github.com/netbirdio/netbird/shared/management/networkmap/nmdata" ) @@ -71,10 +72,10 @@ func (pg *PgStore) GetNetworkMapData(ctx context.Context, accountId string) (*ne if err != nil { return rollbackAndReturnError(ctx, tx, err) } - // domains, err := GetDomainsViaPgxConnection(ctx, tx.Conn(), accountId) - // if err != nil { - // return rollbackAndReturnError(ctx, tx, err) - // } + domains, err := GetDomainsViaPgxConnection(ctx, tx.Conn(), accountId) + if err != nil { + return rollbackAndReturnError(ctx, tx, err) + } services, err := GetPrivateServicesViaPgxConnection(ctx, tx.Conn(), accountId) if err != nil { return rollbackAndReturnError(ctx, tx, err) @@ -111,22 +112,23 @@ func (pg *PgStore) GetNetworkMapData(ctx context.Context, accountId string) (*ne } toret := networkmap.NetworkMapData{ - AccountSettings: &acctSettings, - DNSSettings: &dnsSettings, - Network: &network, - Peers: toMap(peers, func(p nmdata.Peer) string { return p.ID }), - Groups: toMap(groups, func(g nmdata.Group) string { return g.PublicID }), - Policies: toSliceOfPtrs(policies), - ResourcePolicies: resourcePolicies, - Routes: toSliceOfPtrs(routes), - Routers: routers, - NameServerGroups: toSliceOfPtrs(nsGroups), - NetworkResources: toSliceOfPtrs(networkResources), - PostureChecks: toMap(postureChecks, func(pc nmdata.PostureChecks) string { return pc.ID }), - AllowedUserIDs: allowedUserIds, - GroupIDToUserIDs: groupsToUserIds, - NetworkXIDToPublicID: networkXIDToPublicID, // TODO (dmitri) maybe we can switch to public ids everywhere? - AppliedZoneCandidates: dnsZones, + AccountSettings: &acctSettings, + DNSSettings: &dnsSettings, + Network: &network, + Peers: toMap(peers, func(p nmdata.Peer) string { return p.ID }), + Groups: toMap(groups, func(g nmdata.Group) string { return g.PublicID }), + Policies: toSliceOfPtrs(policies), + ResourcePolicies: resourcePolicies, + Routes: toSliceOfPtrs(routes), + Routers: routers, + NameServerGroups: toSliceOfPtrs(nsGroups), + NetworkResources: toSliceOfPtrs(networkResources), + PostureChecks: toMap(postureChecks, func(pc nmdata.PostureChecks) string { return pc.ID }), + AllowedUserIDs: allowedUserIds, + GroupIDToUserIDs: groupsToUserIds, + NetworkXIDToPublicID: networkXIDToPublicID, // TODO (dmitri) maybe we can switch to public ids everywhere? + AppliedZoneCandidates: dnsZones, + PrivateServiceCandidates: buildPrivateServiceCandidates(services, domains, proxyPeers), } return &toret, nil @@ -197,10 +199,33 @@ func buildPrivateServiceCandidates(svcs []service, domains []domain, proxyPeersB continue } + var records []nmdata.SimpleRecord for _, proxyPeer := range proxyPeersByCluster[svc.ProxyCluster.String] { if !proxyPeer.IP.IsValid() { continue } + records = append(records, nmdata.SimpleRecord{ + Name: dns.Fqdn(svc.Domain.String), + Type: int(dns.TypeA), + Class: "IN", + TTL: 5, + RData: proxyPeer.IP.String(), + }) } + if len(records) == 0 { + continue + } + + out = append(out, networkmap.PrivateServiceCandidate{ + AccessGroups: svc.AccessGroups, + Zone: nmdata.CustomZone{ + Domain: dns.Fqdn(domainZone), + Records: records, + NonAuthoritative: true, + SearchDomainDisabled: true, + }, + }) } + + return out } diff --git a/management/internals/network_map_db/pgsql/networks.go b/management/internals/network_map_db/pgsql/networks.go index 1b44272cc..2862025f5 100644 --- a/management/internals/network_map_db/pgsql/networks.go +++ b/management/internals/network_map_db/pgsql/networks.go @@ -23,7 +23,7 @@ func (pg *PgStore) GetNetworks(ctx context.Context, accountId string) ([]network } func GetNetworksViaPgxConnection(ctx context.Context, con *pgx.Conn, accountId string) ([]network, error) { - rows, err := con.Query(ctx, GetGroupsQuery, accountId) + rows, err := con.Query(ctx, GetNetworksQuery, accountId) if err != nil { return nil, err } diff --git a/management/internals/network_map_db/pgsql/peer.go b/management/internals/network_map_db/pgsql/peer.go index de6c83cb8..7a4360e74 100644 --- a/management/internals/network_map_db/pgsql/peer.go +++ b/management/internals/network_map_db/pgsql/peer.go @@ -14,7 +14,7 @@ import ( const ( GetPeersQuery = ` select id, key, ssh_key, dns_label, extra_dns_labels, user_id, ssh_enabled, login_expiration_enabled, last_login, ip, ipv6, - peer_status_requires_approval, proxy_meta_embedded, proxy_meta_cluster, + peer_status_requires_approval, peer_status_connected, proxy_meta_embedded, proxy_meta_cluster, meta_wt_version, meta_go_os, meta_os_version, meta_kernel_version, meta_network_addresses, meta_files, meta_capabilities, meta_flags, meta_sync_message_version, location_country_code, location_city_name, location_connection_ip from peers @@ -54,7 +54,8 @@ func GetPeersViaPgxConnection(ctx context.Context, con *pgx.Conn, accountId stri if p.ProxyMetaEmbedded.Valid { dp.ProxyMeta.Embedded = p.ProxyMetaEmbedded.Bool } - if dp.ProxyMeta.Embedded { + // This is only used to build private service candidates, not connected peers are skipped + if dp.ProxyMeta.Embedded && p.PeerStatusConnected.Bool { clusterToPeerIdx[p.ProxyMetaCluster.String] = append(clusterToPeerIdx[p.ProxyMetaCluster.String], &dp) } if p.MetaWtVersion.Valid { @@ -126,6 +127,7 @@ type peer struct { LastLogin sql.NullTime SSHEnabled sql.NullBool LoginExpirationEnabled sql.NullBool + PeerStatusConnected sql.NullBool `nmap:"skip"` PeerStatusRequiresApproval sql.NullBool `nmap:"map_to:RequiresApproval"` ProxyMetaEmbedded sql.NullBool `nmap:"skip"` ProxyMetaCluster sql.NullString `nmap:"skip"`