mirror of
https://github.com/netbirdio/netbird.git
synced 2026-04-19 00:36:38 +00:00
[management, reverse proxy] Add reverse proxy feature (#5291)
* implement reverse proxy --------- Co-authored-by: Alisdair MacLeod <git@alisdairmacleod.co.uk> Co-authored-by: mlsmaycon <mlsmaycon@gmail.com> Co-authored-by: Eduard Gert <kontakt@eduardgert.de> Co-authored-by: Viktor Liu <viktor@netbird.io> Co-authored-by: Diego Noguês <diego.sure@gmail.com> Co-authored-by: Diego Noguês <49420+diegocn@users.noreply.github.com> Co-authored-by: Bethuel Mmbaga <bethuelmbaga12@gmail.com> Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com> Co-authored-by: Ashley Mensah <ashleyamo982@gmail.com>
This commit is contained in:
Pascal Fischer
@@ -0,0 +1,105 @@
|
||||
package accesslogs
|
||||
|
||||
import (
|
||||
"net"
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"github.com/netbirdio/netbird/management/server/peer"
|
||||
"github.com/netbirdio/netbird/shared/management/http/api"
|
||||
"github.com/netbirdio/netbird/shared/management/proto"
|
||||
)
|
||||
|
||||
type AccessLogEntry struct {
|
||||
ID string `gorm:"primaryKey"`
|
||||
AccountID string `gorm:"index"`
|
||||
ServiceID string `gorm:"index"`
|
||||
Timestamp time.Time `gorm:"index"`
|
||||
GeoLocation peer.Location `gorm:"embedded;embeddedPrefix:location_"`
|
||||
Method string `gorm:"index"`
|
||||
Host string `gorm:"index"`
|
||||
Path string `gorm:"index"`
|
||||
Duration time.Duration `gorm:"index"`
|
||||
StatusCode int `gorm:"index"`
|
||||
Reason string
|
||||
UserId string `gorm:"index"`
|
||||
AuthMethodUsed string `gorm:"index"`
|
||||
}
|
||||
|
||||
// FromProto creates an AccessLogEntry from a proto.AccessLog
|
||||
func (a *AccessLogEntry) FromProto(serviceLog *proto.AccessLog) {
|
||||
a.ID = serviceLog.GetLogId()
|
||||
a.ServiceID = serviceLog.GetServiceId()
|
||||
a.Timestamp = serviceLog.GetTimestamp().AsTime()
|
||||
a.Method = serviceLog.GetMethod()
|
||||
a.Host = serviceLog.GetHost()
|
||||
a.Path = serviceLog.GetPath()
|
||||
a.Duration = time.Duration(serviceLog.GetDurationMs()) * time.Millisecond
|
||||
a.StatusCode = int(serviceLog.GetResponseCode())
|
||||
a.UserId = serviceLog.GetUserId()
|
||||
a.AuthMethodUsed = serviceLog.GetAuthMechanism()
|
||||
a.AccountID = serviceLog.GetAccountId()
|
||||
|
||||
if sourceIP := serviceLog.GetSourceIp(); sourceIP != "" {
|
||||
if ip, err := netip.ParseAddr(sourceIP); err == nil {
|
||||
a.GeoLocation.ConnectionIP = net.IP(ip.AsSlice())
|
||||
}
|
||||
}
|
||||
|
||||
if !serviceLog.GetAuthSuccess() {
|
||||
a.Reason = "Authentication failed"
|
||||
} else if serviceLog.GetResponseCode() >= 400 {
|
||||
a.Reason = "Request failed"
|
||||
}
|
||||
}
|
||||
|
||||
// ToAPIResponse converts an AccessLogEntry to the API ProxyAccessLog type
|
||||
func (a *AccessLogEntry) ToAPIResponse() *api.ProxyAccessLog {
|
||||
var sourceIP *string
|
||||
if a.GeoLocation.ConnectionIP != nil {
|
||||
ip := a.GeoLocation.ConnectionIP.String()
|
||||
sourceIP = &ip
|
||||
}
|
||||
|
||||
var reason *string
|
||||
if a.Reason != "" {
|
||||
reason = &a.Reason
|
||||
}
|
||||
|
||||
var userID *string
|
||||
if a.UserId != "" {
|
||||
userID = &a.UserId
|
||||
}
|
||||
|
||||
var authMethod *string
|
||||
if a.AuthMethodUsed != "" {
|
||||
authMethod = &a.AuthMethodUsed
|
||||
}
|
||||
|
||||
var countryCode *string
|
||||
if a.GeoLocation.CountryCode != "" {
|
||||
countryCode = &a.GeoLocation.CountryCode
|
||||
}
|
||||
|
||||
var cityName *string
|
||||
if a.GeoLocation.CityName != "" {
|
||||
cityName = &a.GeoLocation.CityName
|
||||
}
|
||||
|
||||
return &api.ProxyAccessLog{
|
||||
Id: a.ID,
|
||||
ServiceId: a.ServiceID,
|
||||
Timestamp: a.Timestamp,
|
||||
Method: a.Method,
|
||||
Host: a.Host,
|
||||
Path: a.Path,
|
||||
DurationMs: int(a.Duration.Milliseconds()),
|
||||
StatusCode: a.StatusCode,
|
||||
SourceIp: sourceIP,
|
||||
Reason: reason,
|
||||
UserId: userID,
|
||||
AuthMethodUsed: authMethod,
|
||||
CountryCode: countryCode,
|
||||
CityName: cityName,
|
||||
}
|
||||
}
|
||||
109
management/internals/modules/reverseproxy/accesslogs/filter.go
Normal file
109
management/internals/modules/reverseproxy/accesslogs/filter.go
Normal file
@@ -0,0 +1,109 @@
|
||||
package accesslogs
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
// DefaultPageSize is the default number of records per page
|
||||
DefaultPageSize = 50
|
||||
// MaxPageSize is the maximum number of records allowed per page
|
||||
MaxPageSize = 100
|
||||
)
|
||||
|
||||
// AccessLogFilter holds pagination and filtering parameters for access logs
|
||||
type AccessLogFilter struct {
|
||||
// Page is the current page number (1-indexed)
|
||||
Page int
|
||||
// PageSize is the number of records per page
|
||||
PageSize int
|
||||
|
||||
// Filtering parameters
|
||||
Search *string // General search across log ID, host, path, source IP, and user fields
|
||||
SourceIP *string // Filter by source IP address
|
||||
Host *string // Filter by host header
|
||||
Path *string // Filter by request path (supports LIKE pattern)
|
||||
UserID *string // Filter by authenticated user ID
|
||||
UserEmail *string // Filter by user email (requires user lookup)
|
||||
UserName *string // Filter by user name (requires user lookup)
|
||||
Method *string // Filter by HTTP method
|
||||
Status *string // Filter by status: "success" (2xx/3xx) or "failed" (1xx/4xx/5xx)
|
||||
StatusCode *int // Filter by HTTP status code
|
||||
StartDate *time.Time // Filter by timestamp >= start_date
|
||||
EndDate *time.Time // Filter by timestamp <= end_date
|
||||
}
|
||||
|
||||
// ParseFromRequest parses pagination and filter parameters from HTTP request query parameters
|
||||
func (f *AccessLogFilter) ParseFromRequest(r *http.Request) {
|
||||
queryParams := r.URL.Query()
|
||||
|
||||
f.Page = parsePositiveInt(queryParams.Get("page"), 1)
|
||||
f.PageSize = min(parsePositiveInt(queryParams.Get("page_size"), DefaultPageSize), MaxPageSize)
|
||||
|
||||
f.Search = parseOptionalString(queryParams.Get("search"))
|
||||
f.SourceIP = parseOptionalString(queryParams.Get("source_ip"))
|
||||
f.Host = parseOptionalString(queryParams.Get("host"))
|
||||
f.Path = parseOptionalString(queryParams.Get("path"))
|
||||
f.UserID = parseOptionalString(queryParams.Get("user_id"))
|
||||
f.UserEmail = parseOptionalString(queryParams.Get("user_email"))
|
||||
f.UserName = parseOptionalString(queryParams.Get("user_name"))
|
||||
f.Method = parseOptionalString(queryParams.Get("method"))
|
||||
f.Status = parseOptionalString(queryParams.Get("status"))
|
||||
f.StatusCode = parseOptionalInt(queryParams.Get("status_code"))
|
||||
f.StartDate = parseOptionalRFC3339(queryParams.Get("start_date"))
|
||||
f.EndDate = parseOptionalRFC3339(queryParams.Get("end_date"))
|
||||
}
|
||||
|
||||
// parsePositiveInt parses a positive integer from a string, returning defaultValue if invalid
|
||||
func parsePositiveInt(s string, defaultValue int) int {
|
||||
if s == "" {
|
||||
return defaultValue
|
||||
}
|
||||
if val, err := strconv.Atoi(s); err == nil && val > 0 {
|
||||
return val
|
||||
}
|
||||
return defaultValue
|
||||
}
|
||||
|
||||
// parseOptionalString returns a pointer to the string if non-empty, otherwise nil
|
||||
func parseOptionalString(s string) *string {
|
||||
if s == "" {
|
||||
return nil
|
||||
}
|
||||
return &s
|
||||
}
|
||||
|
||||
// parseOptionalInt parses an optional positive integer from a string
|
||||
func parseOptionalInt(s string) *int {
|
||||
if s == "" {
|
||||
return nil
|
||||
}
|
||||
if val, err := strconv.Atoi(s); err == nil && val > 0 {
|
||||
v := val
|
||||
return &v
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// parseOptionalRFC3339 parses an optional RFC3339 timestamp from a string
|
||||
func parseOptionalRFC3339(s string) *time.Time {
|
||||
if s == "" {
|
||||
return nil
|
||||
}
|
||||
if t, err := time.Parse(time.RFC3339, s); err == nil {
|
||||
return &t
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetOffset calculates the database offset for pagination
|
||||
func (f *AccessLogFilter) GetOffset() int {
|
||||
return (f.Page - 1) * f.PageSize
|
||||
}
|
||||
|
||||
// GetLimit returns the page size for database queries
|
||||
func (f *AccessLogFilter) GetLimit() int {
|
||||
return f.PageSize
|
||||
}
|
||||
@@ -0,0 +1,371 @@
|
||||
package accesslogs
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestAccessLogFilter_ParseFromRequest(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
queryParams map[string]string
|
||||
expectedPage int
|
||||
expectedPageSize int
|
||||
}{
|
||||
{
|
||||
name: "default values when no params provided",
|
||||
queryParams: map[string]string{},
|
||||
expectedPage: 1,
|
||||
expectedPageSize: DefaultPageSize,
|
||||
},
|
||||
{
|
||||
name: "valid page and page_size",
|
||||
queryParams: map[string]string{
|
||||
"page": "2",
|
||||
"page_size": "25",
|
||||
},
|
||||
expectedPage: 2,
|
||||
expectedPageSize: 25,
|
||||
},
|
||||
{
|
||||
name: "page_size exceeds max, should cap at MaxPageSize",
|
||||
queryParams: map[string]string{
|
||||
"page": "1",
|
||||
"page_size": "200",
|
||||
},
|
||||
expectedPage: 1,
|
||||
expectedPageSize: MaxPageSize,
|
||||
},
|
||||
{
|
||||
name: "invalid page number, should use default",
|
||||
queryParams: map[string]string{
|
||||
"page": "invalid",
|
||||
"page_size": "10",
|
||||
},
|
||||
expectedPage: 1,
|
||||
expectedPageSize: 10,
|
||||
},
|
||||
{
|
||||
name: "invalid page_size, should use default",
|
||||
queryParams: map[string]string{
|
||||
"page": "2",
|
||||
"page_size": "invalid",
|
||||
},
|
||||
expectedPage: 2,
|
||||
expectedPageSize: DefaultPageSize,
|
||||
},
|
||||
{
|
||||
name: "zero page number, should use default",
|
||||
queryParams: map[string]string{
|
||||
"page": "0",
|
||||
"page_size": "10",
|
||||
},
|
||||
expectedPage: 1,
|
||||
expectedPageSize: 10,
|
||||
},
|
||||
{
|
||||
name: "negative page number, should use default",
|
||||
queryParams: map[string]string{
|
||||
"page": "-1",
|
||||
"page_size": "10",
|
||||
},
|
||||
expectedPage: 1,
|
||||
expectedPageSize: 10,
|
||||
},
|
||||
{
|
||||
name: "zero page_size, should use default",
|
||||
queryParams: map[string]string{
|
||||
"page": "1",
|
||||
"page_size": "0",
|
||||
},
|
||||
expectedPage: 1,
|
||||
expectedPageSize: DefaultPageSize,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
req := httptest.NewRequest(http.MethodGet, "/test", nil)
|
||||
q := req.URL.Query()
|
||||
for key, value := range tt.queryParams {
|
||||
q.Set(key, value)
|
||||
}
|
||||
req.URL.RawQuery = q.Encode()
|
||||
|
||||
filter := &AccessLogFilter{}
|
||||
filter.ParseFromRequest(req)
|
||||
|
||||
assert.Equal(t, tt.expectedPage, filter.Page, "Page mismatch")
|
||||
assert.Equal(t, tt.expectedPageSize, filter.PageSize, "PageSize mismatch")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAccessLogFilter_GetOffset(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
page int
|
||||
pageSize int
|
||||
expectedOffset int
|
||||
}{
|
||||
{
|
||||
name: "first page",
|
||||
page: 1,
|
||||
pageSize: 50,
|
||||
expectedOffset: 0,
|
||||
},
|
||||
{
|
||||
name: "second page",
|
||||
page: 2,
|
||||
pageSize: 50,
|
||||
expectedOffset: 50,
|
||||
},
|
||||
{
|
||||
name: "third page with page size 25",
|
||||
page: 3,
|
||||
pageSize: 25,
|
||||
expectedOffset: 50,
|
||||
},
|
||||
{
|
||||
name: "page 10 with page size 10",
|
||||
page: 10,
|
||||
pageSize: 10,
|
||||
expectedOffset: 90,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
filter := &AccessLogFilter{
|
||||
Page: tt.page,
|
||||
PageSize: tt.pageSize,
|
||||
}
|
||||
|
||||
offset := filter.GetOffset()
|
||||
assert.Equal(t, tt.expectedOffset, offset)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAccessLogFilter_GetLimit(t *testing.T) {
|
||||
filter := &AccessLogFilter{
|
||||
Page: 2,
|
||||
PageSize: 25,
|
||||
}
|
||||
|
||||
limit := filter.GetLimit()
|
||||
assert.Equal(t, 25, limit, "GetLimit should return PageSize")
|
||||
}
|
||||
|
||||
func TestAccessLogFilter_ParseFromRequest_FilterParams(t *testing.T) {
|
||||
startDate := "2024-01-15T10:30:00Z"
|
||||
endDate := "2024-01-16T15:45:00Z"
|
||||
|
||||
req := httptest.NewRequest(http.MethodGet, "/test", nil)
|
||||
q := req.URL.Query()
|
||||
q.Set("search", "test query")
|
||||
q.Set("source_ip", "192.168.1.1")
|
||||
q.Set("host", "example.com")
|
||||
q.Set("path", "/api/users")
|
||||
q.Set("user_id", "user123")
|
||||
q.Set("user_email", "user@example.com")
|
||||
q.Set("user_name", "John Doe")
|
||||
q.Set("method", "GET")
|
||||
q.Set("status", "success")
|
||||
q.Set("status_code", "200")
|
||||
q.Set("start_date", startDate)
|
||||
q.Set("end_date", endDate)
|
||||
req.URL.RawQuery = q.Encode()
|
||||
|
||||
filter := &AccessLogFilter{}
|
||||
filter.ParseFromRequest(req)
|
||||
|
||||
require.NotNil(t, filter.Search)
|
||||
assert.Equal(t, "test query", *filter.Search)
|
||||
|
||||
require.NotNil(t, filter.SourceIP)
|
||||
assert.Equal(t, "192.168.1.1", *filter.SourceIP)
|
||||
|
||||
require.NotNil(t, filter.Host)
|
||||
assert.Equal(t, "example.com", *filter.Host)
|
||||
|
||||
require.NotNil(t, filter.Path)
|
||||
assert.Equal(t, "/api/users", *filter.Path)
|
||||
|
||||
require.NotNil(t, filter.UserID)
|
||||
assert.Equal(t, "user123", *filter.UserID)
|
||||
|
||||
require.NotNil(t, filter.UserEmail)
|
||||
assert.Equal(t, "user@example.com", *filter.UserEmail)
|
||||
|
||||
require.NotNil(t, filter.UserName)
|
||||
assert.Equal(t, "John Doe", *filter.UserName)
|
||||
|
||||
require.NotNil(t, filter.Method)
|
||||
assert.Equal(t, "GET", *filter.Method)
|
||||
|
||||
require.NotNil(t, filter.Status)
|
||||
assert.Equal(t, "success", *filter.Status)
|
||||
|
||||
require.NotNil(t, filter.StatusCode)
|
||||
assert.Equal(t, 200, *filter.StatusCode)
|
||||
|
||||
require.NotNil(t, filter.StartDate)
|
||||
expectedStart, _ := time.Parse(time.RFC3339, startDate)
|
||||
assert.Equal(t, expectedStart, *filter.StartDate)
|
||||
|
||||
require.NotNil(t, filter.EndDate)
|
||||
expectedEnd, _ := time.Parse(time.RFC3339, endDate)
|
||||
assert.Equal(t, expectedEnd, *filter.EndDate)
|
||||
}
|
||||
|
||||
func TestAccessLogFilter_ParseFromRequest_EmptyFilters(t *testing.T) {
|
||||
req := httptest.NewRequest(http.MethodGet, "/test", nil)
|
||||
|
||||
filter := &AccessLogFilter{}
|
||||
filter.ParseFromRequest(req)
|
||||
|
||||
assert.Nil(t, filter.Search)
|
||||
assert.Nil(t, filter.SourceIP)
|
||||
assert.Nil(t, filter.Host)
|
||||
assert.Nil(t, filter.Path)
|
||||
assert.Nil(t, filter.UserID)
|
||||
assert.Nil(t, filter.UserEmail)
|
||||
assert.Nil(t, filter.UserName)
|
||||
assert.Nil(t, filter.Method)
|
||||
assert.Nil(t, filter.Status)
|
||||
assert.Nil(t, filter.StatusCode)
|
||||
assert.Nil(t, filter.StartDate)
|
||||
assert.Nil(t, filter.EndDate)
|
||||
}
|
||||
|
||||
func TestAccessLogFilter_ParseFromRequest_InvalidFilters(t *testing.T) {
|
||||
req := httptest.NewRequest(http.MethodGet, "/test", nil)
|
||||
q := req.URL.Query()
|
||||
q.Set("status_code", "invalid")
|
||||
q.Set("start_date", "not-a-date")
|
||||
q.Set("end_date", "2024-99-99")
|
||||
req.URL.RawQuery = q.Encode()
|
||||
|
||||
filter := &AccessLogFilter{}
|
||||
filter.ParseFromRequest(req)
|
||||
|
||||
assert.Nil(t, filter.StatusCode, "invalid status_code should be nil")
|
||||
assert.Nil(t, filter.StartDate, "invalid start_date should be nil")
|
||||
assert.Nil(t, filter.EndDate, "invalid end_date should be nil")
|
||||
}
|
||||
|
||||
func TestParsePositiveInt(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
input string
|
||||
defaultValue int
|
||||
expected int
|
||||
}{
|
||||
{"empty string", "", 10, 10},
|
||||
{"valid positive int", "25", 10, 25},
|
||||
{"zero", "0", 10, 10},
|
||||
{"negative", "-5", 10, 10},
|
||||
{"invalid string", "abc", 10, 10},
|
||||
{"float", "3.14", 10, 10},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
result := parsePositiveInt(tt.input, tt.defaultValue)
|
||||
assert.Equal(t, tt.expected, result)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseOptionalString(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
input string
|
||||
expected *string
|
||||
}{
|
||||
{"empty string", "", nil},
|
||||
{"valid string", "hello", strPtr("hello")},
|
||||
{"whitespace", " ", strPtr(" ")},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
result := parseOptionalString(tt.input)
|
||||
if tt.expected == nil {
|
||||
assert.Nil(t, result)
|
||||
} else {
|
||||
require.NotNil(t, result)
|
||||
assert.Equal(t, *tt.expected, *result)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseOptionalInt(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
input string
|
||||
expected *int
|
||||
}{
|
||||
{"empty string", "", nil},
|
||||
{"valid positive int", "42", intPtr(42)},
|
||||
{"zero", "0", nil},
|
||||
{"negative", "-10", nil},
|
||||
{"invalid string", "abc", nil},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
result := parseOptionalInt(tt.input)
|
||||
if tt.expected == nil {
|
||||
assert.Nil(t, result)
|
||||
} else {
|
||||
require.NotNil(t, result)
|
||||
assert.Equal(t, *tt.expected, *result)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseOptionalRFC3339(t *testing.T) {
|
||||
validDate := "2024-01-15T10:30:00Z"
|
||||
expectedTime, _ := time.Parse(time.RFC3339, validDate)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
input string
|
||||
expected *time.Time
|
||||
}{
|
||||
{"empty string", "", nil},
|
||||
{"valid RFC3339", validDate, &expectedTime},
|
||||
{"invalid format", "2024-01-15", nil},
|
||||
{"invalid date", "not-a-date", nil},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
result := parseOptionalRFC3339(tt.input)
|
||||
if tt.expected == nil {
|
||||
assert.Nil(t, result)
|
||||
} else {
|
||||
require.NotNil(t, result)
|
||||
assert.Equal(t, *tt.expected, *result)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// Helper functions for creating pointers
|
||||
func strPtr(s string) *string {
|
||||
return &s
|
||||
}
|
||||
|
||||
func intPtr(i int) *int {
|
||||
return &i
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
package accesslogs
|
||||
|
||||
import (
|
||||
"context"
|
||||
)
|
||||
|
||||
type Manager interface {
|
||||
SaveAccessLog(ctx context.Context, proxyLog *AccessLogEntry) error
|
||||
GetAllAccessLogs(ctx context.Context, accountID, userID string, filter *AccessLogFilter) ([]*AccessLogEntry, int64, error)
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
package manager
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
|
||||
"github.com/gorilla/mux"
|
||||
|
||||
"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
|
||||
nbcontext "github.com/netbirdio/netbird/management/server/context"
|
||||
"github.com/netbirdio/netbird/shared/management/http/api"
|
||||
"github.com/netbirdio/netbird/shared/management/http/util"
|
||||
)
|
||||
|
||||
type handler struct {
|
||||
manager accesslogs.Manager
|
||||
}
|
||||
|
||||
func RegisterEndpoints(router *mux.Router, manager accesslogs.Manager) {
|
||||
h := &handler{
|
||||
manager: manager,
|
||||
}
|
||||
|
||||
router.HandleFunc("/events/proxy", h.getAccessLogs).Methods("GET", "OPTIONS")
|
||||
}
|
||||
|
||||
func (h *handler) getAccessLogs(w http.ResponseWriter, r *http.Request) {
|
||||
userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
|
||||
if err != nil {
|
||||
util.WriteError(r.Context(), err, w)
|
||||
return
|
||||
}
|
||||
|
||||
var filter accesslogs.AccessLogFilter
|
||||
filter.ParseFromRequest(r)
|
||||
|
||||
logs, totalCount, err := h.manager.GetAllAccessLogs(r.Context(), userAuth.AccountId, userAuth.UserId, &filter)
|
||||
if err != nil {
|
||||
util.WriteError(r.Context(), err, w)
|
||||
return
|
||||
}
|
||||
|
||||
apiLogs := make([]api.ProxyAccessLog, 0, len(logs))
|
||||
for _, log := range logs {
|
||||
apiLogs = append(apiLogs, *log.ToAPIResponse())
|
||||
}
|
||||
|
||||
response := &api.ProxyAccessLogsResponse{
|
||||
Data: apiLogs,
|
||||
Page: filter.Page,
|
||||
PageSize: filter.PageSize,
|
||||
TotalRecords: int(totalCount),
|
||||
TotalPages: getTotalPageCount(int(totalCount), filter.PageSize),
|
||||
}
|
||||
|
||||
util.WriteJSONObject(r.Context(), w, response)
|
||||
}
|
||||
|
||||
// getTotalPageCount calculates the total number of pages
|
||||
func getTotalPageCount(totalCount, pageSize int) int {
|
||||
if pageSize <= 0 {
|
||||
return 0
|
||||
}
|
||||
return (totalCount + pageSize - 1) / pageSize
|
||||
}
|
||||
@@ -0,0 +1,108 @@
|
||||
package manager
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
|
||||
log "github.com/sirupsen/logrus"
|
||||
|
||||
"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
|
||||
"github.com/netbirdio/netbird/management/server/geolocation"
|
||||
"github.com/netbirdio/netbird/management/server/permissions"
|
||||
"github.com/netbirdio/netbird/management/server/permissions/modules"
|
||||
"github.com/netbirdio/netbird/management/server/permissions/operations"
|
||||
"github.com/netbirdio/netbird/management/server/store"
|
||||
"github.com/netbirdio/netbird/shared/management/status"
|
||||
)
|
||||
|
||||
type managerImpl struct {
|
||||
store store.Store
|
||||
permissionsManager permissions.Manager
|
||||
geo geolocation.Geolocation
|
||||
}
|
||||
|
||||
func NewManager(store store.Store, permissionsManager permissions.Manager, geo geolocation.Geolocation) accesslogs.Manager {
|
||||
return &managerImpl{
|
||||
store: store,
|
||||
permissionsManager: permissionsManager,
|
||||
geo: geo,
|
||||
}
|
||||
}
|
||||
|
||||
// SaveAccessLog saves an access log entry to the database after enriching it
|
||||
func (m *managerImpl) SaveAccessLog(ctx context.Context, logEntry *accesslogs.AccessLogEntry) error {
|
||||
if m.geo != nil && logEntry.GeoLocation.ConnectionIP != nil {
|
||||
location, err := m.geo.Lookup(logEntry.GeoLocation.ConnectionIP)
|
||||
if err != nil {
|
||||
log.WithContext(ctx).Warnf("failed to get location for access log source IP [%s]: %v", logEntry.GeoLocation.ConnectionIP.String(), err)
|
||||
} else {
|
||||
logEntry.GeoLocation.CountryCode = location.Country.ISOCode
|
||||
logEntry.GeoLocation.CityName = location.City.Names.En
|
||||
logEntry.GeoLocation.GeoNameID = location.City.GeonameID
|
||||
}
|
||||
}
|
||||
|
||||
if err := m.store.CreateAccessLog(ctx, logEntry); err != nil {
|
||||
log.WithContext(ctx).WithFields(log.Fields{
|
||||
"service_id": logEntry.ServiceID,
|
||||
"method": logEntry.Method,
|
||||
"host": logEntry.Host,
|
||||
"path": logEntry.Path,
|
||||
"status": logEntry.StatusCode,
|
||||
}).Errorf("failed to save access log: %v", err)
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetAllAccessLogs retrieves access logs for an account with pagination and filtering
|
||||
func (m *managerImpl) GetAllAccessLogs(ctx context.Context, accountID, userID string, filter *accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
|
||||
ok, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Services, operations.Read)
|
||||
if err != nil {
|
||||
return nil, 0, status.NewPermissionValidationError(err)
|
||||
}
|
||||
if !ok {
|
||||
return nil, 0, status.NewPermissionDeniedError()
|
||||
}
|
||||
|
||||
if err := m.resolveUserFilters(ctx, accountID, filter); err != nil {
|
||||
log.WithContext(ctx).Warnf("failed to resolve user filters: %v", err)
|
||||
}
|
||||
|
||||
logs, totalCount, err := m.store.GetAccountAccessLogs(ctx, store.LockingStrengthNone, accountID, *filter)
|
||||
if err != nil {
|
||||
return nil, 0, err
|
||||
}
|
||||
|
||||
return logs, totalCount, nil
|
||||
}
|
||||
|
||||
// resolveUserFilters converts user email/name filters to user ID filter
|
||||
func (m *managerImpl) resolveUserFilters(ctx context.Context, accountID string, filter *accesslogs.AccessLogFilter) error {
|
||||
if filter.UserEmail == nil && filter.UserName == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
users, err := m.store.GetAccountUsers(ctx, store.LockingStrengthNone, accountID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var matchingUserIDs []string
|
||||
for _, user := range users {
|
||||
if filter.UserEmail != nil && strings.Contains(strings.ToLower(user.Email), strings.ToLower(*filter.UserEmail)) {
|
||||
matchingUserIDs = append(matchingUserIDs, user.Id)
|
||||
continue
|
||||
}
|
||||
if filter.UserName != nil && strings.Contains(strings.ToLower(user.Name), strings.ToLower(*filter.UserName)) {
|
||||
matchingUserIDs = append(matchingUserIDs, user.Id)
|
||||
}
|
||||
}
|
||||
|
||||
if len(matchingUserIDs) > 0 {
|
||||
filter.UserID = &matchingUserIDs[0]
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user