sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-25 08:09:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Code cleaning in firewall package

Browse Source
This commit is contained in:
Zoltán Papp
2025-01-25 20:29:06 +01:00
parent 8185614362
commit efa8c17d27
42 changed files with 889 additions and 868 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/acl/id/id.go
+6 -6
View File
@@ -7,7 +7,7 @@ import (
"net/netip"
"strconv"
"github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/types"
)
type RuleID string
@@ -19,12 +19,12 @@ func (r RuleID) GetRuleID() string {
func GenerateRouteRuleKey(
sources []netip.Prefix,
destination netip.Prefix,
proto manager.Protocol,
sPort *manager.Port,
dPort *manager.Port,
action manager.Action,
proto types.Protocol,
sPort *types.Port,
dPort *types.Port,
action types.Action,
) RuleID {
manager.SortPrefixes(sources)
types.SortPrefixes(sources)
h := sha256.New()
client/internal/acl/manager.go
+38 -37
View File
@@ -15,7 +15,8 @@ import (
log "github.com/sirupsen/logrus"
nberrors "github.com/netbirdio/netbird/client/errors"
firewall "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/firewall/types"
"github.com/netbirdio/netbird/client/internal/acl/id"
"github.com/netbirdio/netbird/client/ssh"
mgmProto "github.com/netbirdio/netbird/management/proto"
@@ -30,17 +31,17 @@ type Manager interface {
// DefaultManager uses firewall manager to handle
type DefaultManager struct {
firewall firewall.Manager
firewall _interface.Firewall
ipsetCounter int
peerRulesPairs map[id.RuleID][]firewall.Rule
peerRulesPairs map[id.RuleID][]types.Rule
routeRules map[id.RuleID]struct{}
mutex sync.Mutex
}
func NewDefaultManager(fm firewall.Manager) *DefaultManager {
func NewDefaultManager(fm _interface.Firewall) *DefaultManager {
return &DefaultManager{
firewall: fm,
peerRulesPairs: make(map[id.RuleID][]firewall.Rule),
peerRulesPairs: make(map[id.RuleID][]types.Rule),
routeRules: make(map[id.RuleID]struct{}),
}
}
@@ -132,7 +133,7 @@ func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) {
)
}
newRulePairs := make(map[id.RuleID][]firewall.Rule)
newRulePairs := make(map[id.RuleID][]types.Rule)
ipsetByRuleSelectors := make(map[string]string)
for _, r := range rules {
@@ -251,7 +252,7 @@ func (d *DefaultManager) applyRouteACL(rule *mgmProto.RouteFirewallRule) (id.Rul
func (d *DefaultManager) protoRuleToFirewallRule(
r *mgmProto.FirewallRule,
ipsetName string,
) (id.RuleID, []firewall.Rule, error) {
) (id.RuleID, []types.Rule, error) {
ip := net.ParseIP(r.PeerIP)
if ip == nil {
return "", nil, fmt.Errorf("invalid IP address, skipping firewall rule")
@@ -267,13 +268,13 @@ func (d *DefaultManager) protoRuleToFirewallRule(
return "", nil, fmt.Errorf("skipping firewall rule: %s", err)
}
var port *firewall.Port
var port *types.Port
if r.Port != "" {
value, err := strconv.Atoi(r.Port)
if err != nil {
return "", nil, fmt.Errorf("invalid port, skipping firewall rule")
}
port = &firewall.Port{
port = &types.Port{
Values: []int{value},
}
}
@@ -283,7 +284,7 @@ func (d *DefaultManager) protoRuleToFirewallRule(
return ruleID, rulesPair, nil
}
var rules []firewall.Rule
var rules []types.Rule
switch r.Direction {
case mgmProto.RuleDirection_IN:
rules, err = d.addInRules(ip, protocol, port, action, ipsetName, "")
@@ -304,12 +305,12 @@ func (d *DefaultManager) protoRuleToFirewallRule(
func (d *DefaultManager) addInRules(
ip net.IP,
protocol firewall.Protocol,
port *firewall.Port,
action firewall.Action,
protocol types.Protocol,
port *types.Port,
action types.Action,
ipsetName string,
comment string,
) ([]firewall.Rule, error) {
) ([]types.Rule, error) {
rule, err := d.firewall.AddPeerFiltering(ip, protocol, nil, port, action, ipsetName, comment)
if err != nil {
return nil, fmt.Errorf("add firewall rule: %w", err)
@@ -320,12 +321,12 @@ func (d *DefaultManager) addInRules(
func (d *DefaultManager) addOutRules(
ip net.IP,
protocol firewall.Protocol,
port *firewall.Port,
action firewall.Action,
protocol types.Protocol,
port *types.Port,
action types.Action,
ipsetName string,
comment string,
) ([]firewall.Rule, error) {
) ([]types.Rule, error) {
if shouldSkipInvertedRule(protocol, port) {
return nil, nil
}
@@ -341,10 +342,10 @@ func (d *DefaultManager) addOutRules(
// getPeerRuleID() returns unique ID for the rule based on its parameters.
func (d *DefaultManager) getPeerRuleID(
ip net.IP,
proto firewall.Protocol,
proto types.Protocol,
direction int,
port *firewall.Port,
action firewall.Action,
port *types.Port,
action types.Action,
comment string,
) id.RuleID {
idStr := ip.String() + string(proto) + strconv.Itoa(direction) + strconv.Itoa(int(action)) + comment
@@ -491,7 +492,7 @@ func (d *DefaultManager) getRuleGroupingSelector(rule *mgmProto.FirewallRule) st
return fmt.Sprintf("%v:%v:%v:%s", strconv.Itoa(int(rule.Direction)), rule.Action, rule.Protocol, rule.Port)
}
func (d *DefaultManager) rollBack(newRulePairs map[id.RuleID][]firewall.Rule) {
func (d *DefaultManager) rollBack(newRulePairs map[id.RuleID][]types.Rule) {
log.Debugf("rollback ACL to previous state")
for _, rules := range newRulePairs {
for _, rule := range rules {
@@ -502,49 +503,49 @@ func (d *DefaultManager) rollBack(newRulePairs map[id.RuleID][]firewall.Rule) {
}
}
func convertToFirewallProtocol(protocol mgmProto.RuleProtocol) (firewall.Protocol, error) {
func convertToFirewallProtocol(protocol mgmProto.RuleProtocol) (types.Protocol, error) {
switch protocol {
case mgmProto.RuleProtocol_TCP:
return firewall.ProtocolTCP, nil
return types.ProtocolTCP, nil
case mgmProto.RuleProtocol_UDP:
return firewall.ProtocolUDP, nil
return types.ProtocolUDP, nil
case mgmProto.RuleProtocol_ICMP:
return firewall.ProtocolICMP, nil
return types.ProtocolICMP, nil
case mgmProto.RuleProtocol_ALL:
return firewall.ProtocolALL, nil
return types.ProtocolALL, nil
default:
return firewall.ProtocolALL, fmt.Errorf("invalid protocol type: %s", protocol.String())
return types.ProtocolALL, fmt.Errorf("invalid protocol type: %s", protocol.String())
}
}
func shouldSkipInvertedRule(protocol firewall.Protocol, port *firewall.Port) bool {
return protocol == firewall.ProtocolALL || protocol == firewall.ProtocolICMP || port == nil
func shouldSkipInvertedRule(protocol types.Protocol, port *types.Port) bool {
return protocol == types.ProtocolALL || protocol == types.ProtocolICMP || port == nil
}
func convertFirewallAction(action mgmProto.RuleAction) (firewall.Action, error) {
func convertFirewallAction(action mgmProto.RuleAction) (types.Action, error) {
switch action {
case mgmProto.RuleAction_ACCEPT:
return firewall.ActionAccept, nil
return types.ActionAccept, nil
case mgmProto.RuleAction_DROP:
return firewall.ActionDrop, nil
return types.ActionDrop, nil
default:
return firewall.ActionDrop, fmt.Errorf("invalid action type: %d", action)
return types.ActionDrop, fmt.Errorf("invalid action type: %d", action)
}
}
func convertPortInfo(portInfo *mgmProto.PortInfo) *firewall.Port {
func convertPortInfo(portInfo *mgmProto.PortInfo) *types.Port {
if portInfo == nil {
return nil
}
if portInfo.GetPort() != 0 {
return &firewall.Port{
return &types.Port{
Values: []int{int(portInfo.GetPort())},
}
}
if portInfo.GetRange() != nil {
return &firewall.Port{
return &types.Port{
IsRange: true,
Values: []int{int(portInfo.GetRange().Start), int(portInfo.GetRange().End)},
}
client/internal/acl/manager_test.go
+3 -3
View File
@@ -7,7 +7,7 @@ import (
"github.com/golang/mock/gomock"
"github.com/netbirdio/netbird/client/firewall"
"github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/iface"
"github.com/netbirdio/netbird/client/internal/acl/mocks"
mgmProto "github.com/netbirdio/netbird/management/proto"
@@ -56,7 +56,7 @@ func TestDefaultManager(t *testing.T) {
t.Errorf("create firewall: %v", err)
return
}
defer func(fw manager.Manager) {
defer func(fw _interface.Firewall) {
_ = fw.Reset(nil)
}(fw)
acl := NewDefaultManager(fw)
@@ -349,7 +349,7 @@ func TestDefaultManagerEnableSSHRules(t *testing.T) {
t.Errorf("create firewall: %v", err)
return
}
defer func(fw manager.Manager) {
defer func(fw _interface.Firewall) {
_ = fw.Reset(nil)
}(fw)
acl := NewDefaultManager(fw)
client/internal/dnsfwd/manager.go
+7 -6
View File
@@ -9,7 +9,8 @@ import (
log "github.com/sirupsen/logrus"
nberrors "github.com/netbirdio/netbird/client/errors"
firewall "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/firewall/types"
)
const (
@@ -19,13 +20,13 @@ const (
)
type Manager struct {
firewall firewall.Manager
firewall _interface.Firewall
fwRules []firewall.Rule
fwRules []types.Rule
dnsForwarder *DNSForwarder
}
func NewManager(fw firewall.Manager) *Manager {
func NewManager(fw _interface.Firewall) *Manager {
return &Manager{
firewall: fw,
}
@@ -79,7 +80,7 @@ func (m *Manager) Stop(ctx context.Context) error {
}
func (h *Manager) allowDNSFirewall() error {
dport := &firewall.Port{
dport := &types.Port{
IsRange: false,
Values: []int{ListenPort},
}
@@ -88,7 +89,7 @@ func (h *Manager) allowDNSFirewall() error {
return nil
}
dnsRules, err := h.firewall.AddPeerFiltering(net.IP{0, 0, 0, 0}, firewall.ProtocolUDP, nil, dport, firewall.ActionAccept, "", "")
dnsRules, err := h.firewall.AddPeerFiltering(net.IP{0, 0, 0, 0}, types.ProtocolUDP, nil, dport, types.ActionAccept, "", "")
if err != nil {
log.Errorf("failed to add allow DNS router rules, err: %v", err)
return err
client/internal/engine.go
+10 -9
View File
@@ -25,7 +25,8 @@ import (
nberrors "github.com/netbirdio/netbird/client/errors"
"github.com/netbirdio/netbird/client/firewall"
firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/firewall/types"
"github.com/netbirdio/netbird/client/iface"
"github.com/netbirdio/netbird/client/iface/bind"
"github.com/netbirdio/netbird/client/iface/device"
@@ -169,7 +170,7 @@ type Engine struct {
statusRecorder *peer.Status
firewall firewallManager.Manager
firewall _interface.Firewall
routeManager routemanager.Manager
acl acl.Manager
dnsForwardMgr *dnsfwd.Manager
@@ -504,15 +505,15 @@ func (e *Engine) initFirewall() error {
}
rosenpassPort := e.rpManager.GetAddress().Port
port := firewallManager.Port{Values: []int{rosenpassPort}}
port := types.Port{Values: []int{rosenpassPort}}
// this rule is static and will be torn down on engine down by the firewall manager
if _, err := e.firewall.AddPeerFiltering(
net.IP{0, 0, 0, 0},
firewallManager.ProtocolUDP,
types.ProtocolUDP,
nil,
&port,
firewallManager.ActionAccept,
types.ActionAccept,
"",
"",
); err != nil {
@@ -540,10 +541,10 @@ func (e *Engine) blockLanAccess() {
if _, err := e.firewall.AddRouteFiltering(
[]netip.Prefix{v4},
network,
firewallManager.ProtocolALL,
types.ProtocolALL,
nil,
nil,
firewallManager.ActionDrop,
types.ActionDrop,
); err != nil {
merr = multierror.Append(merr, fmt.Errorf("add fw rule for network %s: %w", network, err))
}
@@ -1774,7 +1775,7 @@ func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) error {
}
var merr *multierror.Error
forwardingRules := make([]firewallManager.ForwardRule, 0, len(rules))
forwardingRules := make([]types.ForwardRule, 0, len(rules))
for _, rule := range rules {
proto, err := convertToFirewallProtocol(rule.GetProtocol())
if err != nil {
@@ -1800,7 +1801,7 @@ func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) error {
continue
}
forwardRule := firewallManager.ForwardRule{
forwardRule := types.ForwardRule{
Protocol: proto,
DestinationPort: *dstPortInfo,
TranslatedAddress: translateIP,
client/internal/engine_moc.go
+64 -64
View File
@@ -5,7 +5,7 @@ import (
log "github.com/sirupsen/logrus"
firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/types"
"github.com/netbirdio/netbird/client/internal/ingressgw"
)
@@ -14,192 +14,192 @@ func (e *Engine) mocForwardRules() {
e.ingressGatewayMgr = ingressgw.NewManager(e.firewall)
}
err := e.ingressGatewayMgr.Update(
[]firewallManager.ForwardRule{
[]types.ForwardRule{
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: false, Values: []int{10000}},
DestinationPort: types.Port{IsRange: false, Values: []int{10000}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: false, Values: []int{20000}},
TranslatedPort: types.Port{IsRange: false, Values: []int{20000}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10100, 10199}},
DestinationPort: types.Port{IsRange: true, Values: []int{10100, 10199}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20100, 20199}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20100, 20199}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10200, 10299}},
DestinationPort: types.Port{IsRange: true, Values: []int{10200, 10299}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20200, 20299}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20200, 20299}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10300, 10399}},
DestinationPort: types.Port{IsRange: true, Values: []int{10300, 10399}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20300, 20399}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20300, 20399}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10100, 10199}},
DestinationPort: types.Port{IsRange: true, Values: []int{10100, 10199}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20100, 20199}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20100, 20199}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10400, 10499}},
DestinationPort: types.Port{IsRange: true, Values: []int{10400, 10499}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20400, 20499}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20400, 20499}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10500, 10599}},
DestinationPort: types.Port{IsRange: true, Values: []int{10500, 10599}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20500, 20599}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20500, 20599}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10600, 10699}},
DestinationPort: types.Port{IsRange: true, Values: []int{10600, 10699}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20600, 20699}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20600, 20699}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10700, 10799}},
DestinationPort: types.Port{IsRange: true, Values: []int{10700, 10799}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20700, 20799}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20700, 20799}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10800, 10899}},
DestinationPort: types.Port{IsRange: true, Values: []int{10800, 10899}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20800, 20899}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20800, 20899}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{10900, 10999}},
DestinationPort: types.Port{IsRange: true, Values: []int{10900, 10999}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{20900, 20999}},
TranslatedPort: types.Port{IsRange: true, Values: []int{20900, 20999}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11000, 11099}},
DestinationPort: types.Port{IsRange: true, Values: []int{11000, 11099}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21000, 21099}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21000, 21099}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11100, 11199}},
DestinationPort: types.Port{IsRange: true, Values: []int{11100, 11199}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21100, 21199}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21100, 21199}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11200, 11299}},
DestinationPort: types.Port{IsRange: true, Values: []int{11200, 11299}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21200, 21299}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21200, 21299}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11300, 11399}},
DestinationPort: types.Port{IsRange: true, Values: []int{11300, 11399}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21300, 21399}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21300, 21399}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11400, 11499}},
DestinationPort: types.Port{IsRange: true, Values: []int{11400, 11499}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21400, 21499}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21400, 21499}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11500, 11599}},
DestinationPort: types.Port{IsRange: true, Values: []int{11500, 11599}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21500, 21599}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21500, 21599}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11600, 11699}},
DestinationPort: types.Port{IsRange: true, Values: []int{11600, 11699}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21600, 21699}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21600, 21699}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11700, 11799}},
DestinationPort: types.Port{IsRange: true, Values: []int{11700, 11799}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21700, 21799}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21700, 21799}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11800, 11899}},
DestinationPort: types.Port{IsRange: true, Values: []int{11800, 11899}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21800, 21899}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21800, 21899}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{11900, 11999}},
DestinationPort: types.Port{IsRange: true, Values: []int{11900, 11999}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{21900, 21999}},
TranslatedPort: types.Port{IsRange: true, Values: []int{21900, 21999}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12000, 12099}},
DestinationPort: types.Port{IsRange: true, Values: []int{12000, 12099}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22000, 22099}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22000, 22099}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12100, 12199}},
DestinationPort: types.Port{IsRange: true, Values: []int{12100, 12199}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22100, 22199}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22100, 22199}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12200, 12299}},
DestinationPort: types.Port{IsRange: true, Values: []int{12200, 12299}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22200, 22299}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22200, 22299}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12300, 12399}},
DestinationPort: types.Port{IsRange: true, Values: []int{12300, 12399}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22300, 22399}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22300, 22399}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12400, 12499}},
DestinationPort: types.Port{IsRange: true, Values: []int{12400, 12499}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22400, 22499}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22400, 22499}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12500, 12599}},
DestinationPort: types.Port{IsRange: true, Values: []int{12500, 12599}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22500, 22599}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22500, 22599}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12600, 12699}},
DestinationPort: types.Port{IsRange: true, Values: []int{12600, 12699}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22600, 22699}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22600, 22699}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12700, 12799}},
DestinationPort: types.Port{IsRange: true, Values: []int{12700, 12799}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22700, 22799}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22700, 22799}},
},
{
Protocol: "tcp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12800, 12899}},
DestinationPort: types.Port{IsRange: true, Values: []int{12800, 12899}},
TranslatedAddress: netip.MustParseAddr("100.64.31.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22800, 22899}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22800, 22899}},
},
{
Protocol: "udp",
DestinationPort: firewallManager.Port{IsRange: true, Values: []int{12900, 12999}},
DestinationPort: types.Port{IsRange: true, Values: []int{12900, 12999}},
TranslatedAddress: netip.MustParseAddr("100.64.10.206"),
TranslatedPort: firewallManager.Port{IsRange: true, Values: []int{22900, 22999}},
TranslatedPort: types.Port{IsRange: true, Values: []int{22900, 22999}},
},
},
)
client/internal/ingressgw/manager.go
+14 -13
View File
@@ -8,29 +8,30 @@ import (
log "github.com/sirupsen/logrus"
nberrors "github.com/netbirdio/netbird/client/errors"
firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/firewall/types"
)
type RulePair struct {
firewallManager.ForwardRule
firewallManager.Rule
types.ForwardRule
types.Rule
}
type Manager struct {
firewallManager firewallManager.Manager
firewall _interface.Firewall
rules map[string]RulePair // keys is the ID of the ForwardRule
rulesMu sync.Mutex
}
func NewManager(firewall firewallManager.Manager) *Manager {
func NewManager(firewall _interface.Firewall) *Manager {
return &Manager{
firewallManager: firewall,
rules: make(map[string]RulePair),
firewall: firewall,
rules: make(map[string]RulePair),
}
}
func (h *Manager) Update(forwardRules []firewallManager.ForwardRule) error {
func (h *Manager) Update(forwardRules []types.ForwardRule) error {
h.rulesMu.Lock()
defer h.rulesMu.Unlock()
@@ -48,7 +49,7 @@ func (h *Manager) Update(forwardRules []firewallManager.ForwardRule) error {
continue
}
rule, err := h.firewallManager.AddDNATRule(fwdRule)
rule, err := h.firewall.AddDNATRule(fwdRule)
if err != nil {
mErr = multierror.Append(mErr, fmt.Errorf("failed to add forward rule '%s': %v", fwdRule.String(), err))
continue
@@ -62,7 +63,7 @@ func (h *Manager) Update(forwardRules []firewallManager.ForwardRule) error {
// Remove deleted rules
for id, rulePair := range toDelete {
if err := h.firewallManager.DeleteDNATRule(rulePair.Rule); err != nil {
if err := h.firewall.DeleteDNATRule(rulePair.Rule); err != nil {
mErr = multierror.Append(mErr, fmt.Errorf("failed to delete forward rule '%s': %v", rulePair.ForwardRule.String(), err))
}
delete(h.rules, id)
@@ -78,18 +79,18 @@ func (h *Manager) Close() error {
log.Infof("clean up all forward rules (%d)", len(h.rules))
var mErr *multierror.Error
for _, rule := range h.rules {
if err := h.firewallManager.DeleteDNATRule(rule.Rule); err != nil {
if err := h.firewall.DeleteDNATRule(rule.Rule); err != nil {
mErr = multierror.Append(mErr, fmt.Errorf("failed to delete forward rule '%s': %v", rule, err))
}
}
return nberrors.FormatErrorOrNil(mErr)
}
func (h *Manager) Rules() []firewallManager.ForwardRule {
func (h *Manager) Rules() []types.ForwardRule {
h.rulesMu.Lock()
defer h.rulesMu.Unlock()
rules := make([]firewallManager.ForwardRule, 0, len(h.rules))
rules := make([]types.ForwardRule, 0, len(h.rules))
for _, rulePair := range h.rules {
rules = append(rules, rulePair.ForwardRule)
}
client/internal/message_convert.go
+10 -10
View File
@@ -6,39 +6,39 @@ import (
"net"
"net/netip"
firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/types"
mgmProto "github.com/netbirdio/netbird/management/proto"
)
func convertToFirewallProtocol(protocol mgmProto.RuleProtocol) (firewallManager.Protocol, error) {
func convertToFirewallProtocol(protocol mgmProto.RuleProtocol) (types.Protocol, error) {
switch protocol {
case mgmProto.RuleProtocol_TCP:
return firewallManager.ProtocolTCP, nil
return types.ProtocolTCP, nil
case mgmProto.RuleProtocol_UDP:
return firewallManager.ProtocolUDP, nil
return types.ProtocolUDP, nil
case mgmProto.RuleProtocol_ICMP:
return firewallManager.ProtocolICMP, nil
return types.ProtocolICMP, nil
case mgmProto.RuleProtocol_ALL:
return firewallManager.ProtocolALL, nil
return types.ProtocolALL, nil
default:
return firewallManager.ProtocolALL, fmt.Errorf("invalid protocol type: %s", protocol.String())
return types.ProtocolALL, fmt.Errorf("invalid protocol type: %s", protocol.String())
}
}
// convertPortInfo todo: write validation for portInfo
func convertPortInfo(portInfo *mgmProto.PortInfo) *firewallManager.Port {
func convertPortInfo(portInfo *mgmProto.PortInfo) *types.Port {
if portInfo == nil {
return nil
}
if portInfo.GetPort() != 0 {
return &firewallManager.Port{
return &types.Port{
Values: []int{int(portInfo.GetPort())},
}
}
if portInfo.GetRange() != nil {
return &firewallManager.Port{
return &types.Port{
IsRange: true,
Values: []int{int(portInfo.GetRange().Start), int(portInfo.GetRange().End)},
}
client/internal/peer/status.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
"google.golang.org/grpc/codes"
gstatus "google.golang.org/grpc/status"
firewall "github.com/netbirdio/netbird/client/firewall/manager"
firewall "github.com/netbirdio/netbird/client/firewall/types"
"github.com/netbirdio/netbird/client/iface/configurer"
"github.com/netbirdio/netbird/client/internal/ingressgw"
"github.com/netbirdio/netbird/client/internal/relay"
client/internal/routemanager/manager.go
+3 -3
View File
@@ -14,7 +14,7 @@ import (
log "github.com/sirupsen/logrus"
"golang.org/x/exp/maps"
firewall "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/iface"
"github.com/netbirdio/netbird/client/iface/configurer"
"github.com/netbirdio/netbird/client/iface/netstack"
@@ -44,7 +44,7 @@ type Manager interface {
GetClientRoutesWithNetID() map[route.NetID][]*route.Route
SetRouteChangeListener(listener listener.NetworkChangeListener)
InitialRouteRange() []string
EnableServerRouter(firewall firewall.Manager) error
EnableServerRouter(firewall _interface.Firewall) error
Stop(stateManager *statemanager.Manager)
}
@@ -214,7 +214,7 @@ func (m *DefaultManager) initSelector() *routeselector.RouteSelector {
return routeselector.NewRouteSelector()
}
func (m *DefaultManager) EnableServerRouter(firewall firewall.Manager) error {
func (m *DefaultManager) EnableServerRouter(firewall _interface.Firewall) error {
if m.disableServerRoutes {
log.Info("server routes are disabled")
return nil
client/internal/routemanager/mock.go
+2 -2
View File
@@ -3,7 +3,7 @@ package routemanager
import (
"context"
firewall "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/iface"
"github.com/netbirdio/netbird/client/internal/listener"
"github.com/netbirdio/netbird/client/internal/routeselector"
@@ -78,7 +78,7 @@ func (m *MockManager) SetRouteChangeListener(listener listener.NetworkChangeList
}
func (m *MockManager) EnableServerRouter(firewall firewall.Manager) error {
func (m *MockManager) EnableServerRouter(firewall _interface.Firewall) error {
panic("implement me")
}
client/internal/routemanager/server_android.go
+2 -2
View File
@@ -6,7 +6,7 @@ import (
"context"
"fmt"
firewall "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/iface"
"github.com/netbirdio/netbird/client/internal/peer"
"github.com/netbirdio/netbird/route"
@@ -22,6 +22,6 @@ func (r serverRouter) updateRoutes(map[route.ID]*route.Route) error {
return nil
}
func newServerRouter(context.Context, iface.IWGIface, firewall.Manager, *peer.Status) (*serverRouter, error) {
func newServerRouter(context.Context, iface.IWGIface, _interface.Firewall, *peer.Status) (*serverRouter, error) {
return nil, fmt.Errorf("server route not supported on this os")
}
client/internal/routemanager/server_nonandroid.go
+6 -5
View File
@@ -10,7 +10,8 @@ import (
log "github.com/sirupsen/logrus"
firewall "github.com/netbirdio/netbird/client/firewall/manager"
"github.com/netbirdio/netbird/client/firewall/interface"
"github.com/netbirdio/netbird/client/firewall/types"
"github.com/netbirdio/netbird/client/iface"
"github.com/netbirdio/netbird/client/internal/peer"
"github.com/netbirdio/netbird/client/internal/routemanager/systemops"
@@ -21,12 +22,12 @@ type serverRouter struct {
mux sync.Mutex
ctx context.Context
routes map[route.ID]*route.Route
firewall firewall.Manager
firewall _interface.Firewall
wgInterface iface.IWGIface
statusRecorder *peer.Status
}
func newServerRouter(ctx context.Context, wgInterface iface.IWGIface, firewall firewall.Manager, statusRecorder *peer.Status) (*serverRouter, error) {
func newServerRouter(ctx context.Context, wgInterface iface.IWGIface, firewall _interface.Firewall, statusRecorder *peer.Status) (*serverRouter, error) {
return &serverRouter{
ctx: ctx,
routes: make(map[route.ID]*route.Route),
@@ -167,7 +168,7 @@ func (m *serverRouter) cleanUp() {
m.statusRecorder.UpdateLocalPeerState(state)
}
func routeToRouterPair(route *route.Route) (firewall.RouterPair, error) {
func routeToRouterPair(route *route.Route) (types.RouterPair, error) {
// TODO: add ipv6
source := getDefaultPrefix(route.Network)
@@ -177,7 +178,7 @@ func routeToRouterPair(route *route.Route) (firewall.RouterPair, error) {
destination = getDefaultPrefix(destination)
}
return firewall.RouterPair{
return types.RouterPair{
ID: route.ID,
Source: source,
Destination: destination,