Fix signature file being gzipped

infrastructure_files/download-geolite2.sh

@@ -30,6 +30,9 @@ download_geolite_mmdb() {
 
   # Verify the signature
   echo "Verifying signature..."
+
+  mv "$SIGNATURE_FILE" "$SIGNATURE_FILE".gz
+  gunzip "$SIGNATURE_FILE".gz
   if sha256sum -c --status "$SIGNATURE_FILE"; then
       echo "Signature is valid."
   else
@@ -71,6 +74,8 @@ download_geolite_csv_and_create_sqlite_db() {
 
   # Verify the signature
   echo "Verifying signature..."
+  mv "$SIGNATURE_FILE" "$SIGNATURE_FILE".gz
+  gunzip "$SIGNATURE_FILE".gz
   if sha256sum -c --status "$SIGNATURE_FILE"; then
       echo "Signature is valid."
   else

management/server/account.go

@@ -917,7 +917,12 @@ func (am *DefaultAccountManager) UpdateAccountSettings(accountID, userID string,
 	unlock := am.Store.AcquireAccountLock(accountID)
 	defer unlock()
 
-	account, err := am.Store.GetAccount(accountID)
+	account, err := am.Store.GetAccountByUser(userID)
+	if err != nil {
+		return nil, err
+	}
+
+	err = additions.ValidateExtraSettings(newSettings.Extra, account.Settings.Extra, account.Peers, userID, accountID, am.eventStore)
 	if err != nil {
 		return nil, err
 	}
@@ -931,11 +936,6 @@ func (am *DefaultAccountManager) UpdateAccountSettings(accountID, userID string,
 		return nil, status.Errorf(status.PermissionDenied, "user is not allowed to update account")
 	}
 
-	err = additions.ValidateExtraSettings(newSettings.Extra, account.Settings.Extra, account.Peers, userID, accountID, am.eventStore)
-	if err != nil {
-		return nil, err
-	}
-
 	oldSettings := account.Settings
 	if oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled {
 		event := activity.AccountPeerLoginExpirationEnabled

management/server/http/api/openapi.yml

@@ -862,8 +862,8 @@ components:
           $ref: '#/components/schemas/OSVersionCheck'
         geo_location_check:
           $ref: '#/components/schemas/GeoLocationCheck'
-        peer_network_range_check:
-          $ref: '#/components/schemas/PeerNetworkRangeCheck'
+        private_network_check:
+          $ref: '#/components/schemas/PrivateNetworkCheck'
     NBVersionCheck:
       description: Posture check for the version of NetBird
       type: object
@@ -934,16 +934,16 @@ components:
       required:
         - locations
         - action
-    PeerNetworkRangeCheck:
-      description: Posture check for allow or deny access based on peer local network addresses
+    PrivateNetworkCheck:
+      description: Posture check for allow or deny private network
       type: object
       properties:
         ranges:
-          description: List of peer network ranges in CIDR notation
+          description: List of private network ranges in CIDR notation
           type: array
           items:
             type: string
-            example: ["192.168.1.0/24", "10.0.0.0/8", "2001:db8:1234:1a00::/56"]
+            example: ["192.168.1.0/24", "10.0.0.0/8"]
         action:
           description: Action to take upon policy match
           type: string

management/server/http/api/types.gen.go

@@ -74,12 +74,6 @@ const (
 	NameserverNsTypeUdp NameserverNsType = "udp"
 )
 
-// Defines values for PeerNetworkRangeCheckAction.
-const (
-	PeerNetworkRangeCheckActionAllow PeerNetworkRangeCheckAction = "allow"
-	PeerNetworkRangeCheckActionDeny  PeerNetworkRangeCheckAction = "deny"
-)
-
 // Defines values for PolicyRuleAction.
 const (
 	PolicyRuleActionAccept PolicyRuleAction = "accept"
@@ -122,6 +116,12 @@ const (
 	PolicyRuleUpdateProtocolUdp  PolicyRuleUpdateProtocol = "udp"
 )
 
+// Defines values for PrivateNetworkCheckAction.
+const (
+	PrivateNetworkCheckActionAllow PrivateNetworkCheckAction = "allow"
+	PrivateNetworkCheckActionDeny  PrivateNetworkCheckAction = "deny"
+)
+
 // Defines values for UserStatus.
 const (
 	UserStatusActive  UserStatus = "active"
@@ -199,8 +199,8 @@ type Checks struct {
 	// OsVersionCheck Posture check for the version of operating system
 	OsVersionCheck *OSVersionCheck `json:"os_version_check,omitempty"`
 
-	// PeerNetworkRangeCheck Posture check for allow or deny access based on peer local network addresses
-	PeerNetworkRangeCheck *PeerNetworkRangeCheck `json:"peer_network_range_check,omitempty"`
+	// PrivateNetworkCheck Posture check for allow or deny private network
+	PrivateNetworkCheck *PrivateNetworkCheck `json:"private_network_check,omitempty"`
 }
 
 // City Describe city geographical location information
@@ -656,18 +656,6 @@ type PeerMinimum struct {
 	Name string `json:"name"`
 }
 
-// PeerNetworkRangeCheck Posture check for allow or deny access based on peer local network addresses
-type PeerNetworkRangeCheck struct {
-	// Action Action to take upon policy match
-	Action PeerNetworkRangeCheckAction `json:"action"`
-
-	// Ranges List of peer network ranges in CIDR notation
-	Ranges []string `json:"ranges"`
-}
-
-// PeerNetworkRangeCheckAction Action to take upon policy match
-type PeerNetworkRangeCheckAction string
-
 // PeerRequest defines model for PeerRequest.
 type PeerRequest struct {
 	// ApprovalRequired (Cloud only) Indicates whether peer needs approval
@@ -910,6 +898,18 @@ type PostureCheckUpdate struct {
 	Name string `json:"name"`
 }
 
+// PrivateNetworkCheck Posture check for allow or deny private network
+type PrivateNetworkCheck struct {
+	// Action Action to take upon policy match
+	Action PrivateNetworkCheckAction `json:"action"`
+
+	// Ranges List of private network ranges in CIDR notation
+	Ranges []string `json:"ranges"`
+}
+
+// PrivateNetworkCheckAction Action to take upon policy match
+type PrivateNetworkCheckAction string
+
 // Route defines model for Route.
 type Route struct {
 	// Description Route description

management/server/http/posture_checks_handler.go

@@ -213,8 +213,8 @@ func (p *PostureChecksHandler) savePostureChecks(
 		postureChecks.Checks.GeoLocationCheck = toPostureGeoLocationCheck(geoLocationCheck)
 	}
 
-	if peerNetworkRangeCheck := req.Checks.PeerNetworkRangeCheck; peerNetworkRangeCheck != nil {
-		postureChecks.Checks.PeerNetworkRangeCheck, err = toPeerNetworkRangeCheck(peerNetworkRangeCheck)
+	if privateNetworkCheck := req.Checks.PrivateNetworkCheck; privateNetworkCheck != nil {
+		postureChecks.Checks.PrivateNetworkCheck, err = toPrivateNetworkCheck(privateNetworkCheck)
 		if err != nil {
 			util.WriteError(status.Errorf(status.InvalidArgument, "invalid network prefix"), w)
 			return
@@ -235,7 +235,7 @@ func validatePostureChecksUpdate(req api.PostureCheckUpdate) error {
 	}
 
 	if req.Checks == nil || (req.Checks.NbVersionCheck == nil && req.Checks.OsVersionCheck == nil &&
-		req.Checks.GeoLocationCheck == nil && req.Checks.PeerNetworkRangeCheck == nil) {
+		req.Checks.GeoLocationCheck == nil && req.Checks.PrivateNetworkCheck == nil) {
 		return status.Errorf(status.InvalidArgument, "posture checks shouldn't be empty")
 	}
 
@@ -278,17 +278,17 @@ func validatePostureChecksUpdate(req api.PostureCheckUpdate) error {
 		}
 	}
 
-	if peerNetworkRangeCheck := req.Checks.PeerNetworkRangeCheck; peerNetworkRangeCheck != nil {
-		if peerNetworkRangeCheck.Action == "" {
-			return status.Errorf(status.InvalidArgument, "action for peer network range check shouldn't be empty")
+	if privateNetworkCheck := req.Checks.PrivateNetworkCheck; privateNetworkCheck != nil {
+		if privateNetworkCheck.Action == "" {
+			return status.Errorf(status.InvalidArgument, "action for private network check shouldn't be empty")
 		}
 
-		allowedActions := []api.PeerNetworkRangeCheckAction{api.PeerNetworkRangeCheckActionAllow, api.PeerNetworkRangeCheckActionDeny}
-		if !slices.Contains(allowedActions, peerNetworkRangeCheck.Action) {
-			return status.Errorf(status.InvalidArgument, "action for peer network range check is not valid value")
+		allowedActions := []api.PrivateNetworkCheckAction{api.PrivateNetworkCheckActionAllow, api.PrivateNetworkCheckActionDeny}
+		if !slices.Contains(allowedActions, privateNetworkCheck.Action) {
+			return status.Errorf(status.InvalidArgument, "action for private network check is not valid value")
 		}
-		if len(peerNetworkRangeCheck.Ranges) == 0 {
-			return status.Errorf(status.InvalidArgument, "network ranges for peer network range check shouldn't be empty")
+		if len(privateNetworkCheck.Ranges) == 0 {
+			return status.Errorf(status.InvalidArgument, "network ranges for private network check shouldn't be empty")
 		}
 	}
 
@@ -318,8 +318,8 @@ func toPostureChecksResponse(postureChecks *posture.Checks) *api.PostureCheck {
 		checks.GeoLocationCheck = toGeoLocationCheckResponse(postureChecks.Checks.GeoLocationCheck)
 	}
 
-	if postureChecks.Checks.PeerNetworkRangeCheck != nil {
-		checks.PeerNetworkRangeCheck = toPeerNetworkRangeCheckResponse(postureChecks.Checks.PeerNetworkRangeCheck)
+	if postureChecks.Checks.PrivateNetworkCheck != nil {
+		checks.PrivateNetworkCheck = toPrivateNetworkCheckResponse(postureChecks.Checks.PrivateNetworkCheck)
 	}
 
 	return &api.PostureCheck{
@@ -369,19 +369,19 @@ func toPostureGeoLocationCheck(apiGeoLocationCheck *api.GeoLocationCheck) *postu
 	}
 }
 
-func toPeerNetworkRangeCheckResponse(check *posture.PeerNetworkRangeCheck) *api.PeerNetworkRangeCheck {
+func toPrivateNetworkCheckResponse(check *posture.PrivateNetworkCheck) *api.PrivateNetworkCheck {
 	netPrefixes := make([]string, 0, len(check.Ranges))
 	for _, netPrefix := range check.Ranges {
 		netPrefixes = append(netPrefixes, netPrefix.String())
 	}
 
-	return &api.PeerNetworkRangeCheck{
+	return &api.PrivateNetworkCheck{
 		Ranges: netPrefixes,
-		Action: api.PeerNetworkRangeCheckAction(check.Action),
+		Action: api.PrivateNetworkCheckAction(check.Action),
 	}
 }
 
-func toPeerNetworkRangeCheck(check *api.PeerNetworkRangeCheck) (*posture.PeerNetworkRangeCheck, error) {
+func toPrivateNetworkCheck(check *api.PrivateNetworkCheck) (*posture.PrivateNetworkCheck, error) {
 	prefixes := make([]netip.Prefix, 0)
 	for _, prefix := range check.Ranges {
 		parsedPrefix, err := netip.ParsePrefix(prefix)
@@ -391,7 +391,7 @@ func toPeerNetworkRangeCheck(check *api.PeerNetworkRangeCheck) (*posture.PeerNet
 		prefixes = append(prefixes, parsedPrefix)
 	}
 
-	return &posture.PeerNetworkRangeCheck{
+	return &posture.PrivateNetworkCheck{
 		Ranges: prefixes,
 		Action: string(check.Action),
 	}, nil

management/server/http/posture_checks_handler_test.go

@@ -131,7 +131,7 @@ func TestGetPostureCheck(t *testing.T) {
 		ID:   "privateNetworkPostureCheck",
 		Name: "privateNetwork",
 		Checks: posture.ChecksDefinition{
-			PeerNetworkRangeCheck: &posture.PeerNetworkRangeCheck{
+			PrivateNetworkCheck: &posture.PrivateNetworkCheck{
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
 				},
@@ -375,7 +375,7 @@ func TestPostureCheckUpdate(t *testing.T) {
 			},
 		},
 		{
-			name:        "Create Posture Checks Peer Network Range",
+			name:        "Create Posture Checks Private Network",
 			requestType: http.MethodPost,
 			requestPath: "/api/posture-checks",
 			requestBody: bytes.NewBuffer(
@@ -383,7 +383,7 @@ func TestPostureCheckUpdate(t *testing.T) {
 					"name": "default",
 					"description": "default",
 					"checks": {
-						"peer_network_range_check": {
+						"private_network_check": {
 							"action": "allow",
 							"ranges": [
 								"10.0.0.0/8"
@@ -398,11 +398,11 @@ func TestPostureCheckUpdate(t *testing.T) {
 				Name:        "default",
 				Description: str("default"),
 				Checks: api.Checks{
-					PeerNetworkRangeCheck: &api.PeerNetworkRangeCheck{
+					PrivateNetworkCheck: &api.PrivateNetworkCheck{
 						Ranges: []string{
 							"10.0.0.0/8",
 						},
-						Action: api.PeerNetworkRangeCheckActionAllow,
+						Action: api.PrivateNetworkCheckActionAllow,
 					},
 				},
 			},
@@ -715,14 +715,14 @@ func TestPostureCheckUpdate(t *testing.T) {
 			expectedBody:   false,
 		},
 		{
-			name:        "Update Posture Checks Peer Network Range",
+			name:        "Update Posture Checks Private Network",
 			requestType: http.MethodPut,
-			requestPath: "/api/posture-checks/peerNetworkRangePostureCheck",
+			requestPath: "/api/posture-checks/privateNetworkPostureCheck",
 			requestBody: bytes.NewBuffer(
 				[]byte(`{
 					"name": "default",
 					"checks": {
-						"peer_network_range_check": {
+						"private_network_check": {
 							"action": "deny",
 							"ranges": [
 								"192.168.1.0/24"
@@ -737,11 +737,11 @@ func TestPostureCheckUpdate(t *testing.T) {
 				Name:        "default",
 				Description: str(""),
 				Checks: api.Checks{
-					PeerNetworkRangeCheck: &api.PeerNetworkRangeCheck{
+					PrivateNetworkCheck: &api.PrivateNetworkCheck{
 						Ranges: []string{
 							"192.168.1.0/24",
 						},
-						Action: api.PeerNetworkRangeCheckActionDeny,
+						Action: api.PrivateNetworkCheckActionDeny,
 					},
 				},
 			},
@@ -784,10 +784,10 @@ func TestPostureCheckUpdate(t *testing.T) {
 			},
 		},
 		&posture.Checks{
-			ID:   "peerNetworkRangePostureCheck",
-			Name: "peerNetworkRange",
+			ID:   "privateNetworkPostureCheck",
+			Name: "privateNetwork",
 			Checks: posture.ChecksDefinition{
-				PeerNetworkRangeCheck: &posture.PeerNetworkRangeCheck{
+				PrivateNetworkCheck: &posture.PrivateNetworkCheck{
 					Ranges: []netip.Prefix{
 						netip.MustParsePrefix("192.168.0.0/24"),
 					},
@@ -891,50 +891,29 @@ func TestPostureCheck_validatePostureChecksUpdate(t *testing.T) {
 	err = validatePostureChecksUpdate(api.PostureCheckUpdate{Name: "Default", Checks: &api.Checks{OsVersionCheck: &osVersionCheck}})
 	assert.NoError(t, err)
 
-	// valid peer network range check
-	peerNetworkRangeCheck := api.PeerNetworkRangeCheck{
-		Action: api.PeerNetworkRangeCheckActionAllow,
+	// valid private network check
+	privateNetworkCheck := api.PrivateNetworkCheck{
+		Action: api.PrivateNetworkCheckActionAllow,
 		Ranges: []string{
 			"192.168.1.0/24", "10.0.0.0/8",
 		},
 	}
-	err = validatePostureChecksUpdate(
-		api.PostureCheckUpdate{
-			Name: "Default",
-			Checks: &api.Checks{
-				PeerNetworkRangeCheck: &peerNetworkRangeCheck,
-			},
-		},
-	)
+	err = validatePostureChecksUpdate(api.PostureCheckUpdate{Name: "Default", Checks: &api.Checks{PrivateNetworkCheck: &privateNetworkCheck}})
 	assert.NoError(t, err)
 
-	// invalid peer network range check
-	peerNetworkRangeCheck = api.PeerNetworkRangeCheck{
-		Action: api.PeerNetworkRangeCheckActionDeny,
+	// invalid private network check
+	privateNetworkCheck = api.PrivateNetworkCheck{
+		Action: api.PrivateNetworkCheckActionDeny,
 		Ranges: []string{},
 	}
-	err = validatePostureChecksUpdate(
-		api.PostureCheckUpdate{
-			Name: "Default",
-			Checks: &api.Checks{
-				PeerNetworkRangeCheck: &peerNetworkRangeCheck,
-			},
-		},
-	)
+	err = validatePostureChecksUpdate(api.PostureCheckUpdate{Name: "Default", Checks: &api.Checks{PrivateNetworkCheck: &privateNetworkCheck}})
 	assert.Error(t, err)
 
-	// invalid peer network range check
-	peerNetworkRangeCheck = api.PeerNetworkRangeCheck{
+	// invalid private network check
+	privateNetworkCheck = api.PrivateNetworkCheck{
 		Action: "unknownAction",
 		Ranges: []string{},
 	}
-	err = validatePostureChecksUpdate(
-		api.PostureCheckUpdate{
-			Name: "Default",
-			Checks: &api.Checks{
-				PeerNetworkRangeCheck: &peerNetworkRangeCheck,
-			},
-		},
-	)
+	err = validatePostureChecksUpdate(api.PostureCheckUpdate{Name: "Default", Checks: &api.Checks{PrivateNetworkCheck: &privateNetworkCheck}})
 	assert.Error(t, err)
 }

management/server/posture/checks.go

@@ -10,10 +10,10 @@ import (
 )
 
 const (
-	NBVersionCheckName        = "NBVersionCheck"
-	OSVersionCheckName        = "OSVersionCheck"
-	GeoLocationCheckName      = "GeoLocationCheck"
-	PeerNetworkRangeCheckName = "PeerNetworkRangeCheck"
+	NBVersionCheckName      = "NBVersionCheck"
+	OSVersionCheckName      = "OSVersionCheck"
+	GeoLocationCheckName    = "GeoLocationCheck"
+	PrivateNetworkCheckName = "PrivateNetworkCheck"
 
 	CheckActionAllow string = "allow"
 	CheckActionDeny  string = "deny"
@@ -44,10 +44,10 @@ type Checks struct {
 
 // ChecksDefinition contains definition of actual check
 type ChecksDefinition struct {
-	NBVersionCheck        *NBVersionCheck        `json:",omitempty"`
-	OSVersionCheck        *OSVersionCheck        `json:",omitempty"`
-	GeoLocationCheck      *GeoLocationCheck      `json:",omitempty"`
-	PeerNetworkRangeCheck *PeerNetworkRangeCheck `json:",omitempty"`
+	NBVersionCheck      *NBVersionCheck      `json:",omitempty"`
+	OSVersionCheck      *OSVersionCheck      `json:",omitempty"`
+	GeoLocationCheck    *GeoLocationCheck    `json:",omitempty"`
+	PrivateNetworkCheck *PrivateNetworkCheck `json:",omitempty"`
 }
 
 // Copy returns a copy of a checks definition.
@@ -85,13 +85,13 @@ func (cd ChecksDefinition) Copy() ChecksDefinition {
 		}
 		copy(cdCopy.GeoLocationCheck.Locations, geoCheck.Locations)
 	}
-	if cd.PeerNetworkRangeCheck != nil {
-		peerNetRangeCheck := cd.PeerNetworkRangeCheck
-		cdCopy.PeerNetworkRangeCheck = &PeerNetworkRangeCheck{
-			Action: peerNetRangeCheck.Action,
-			Ranges: make([]netip.Prefix, len(peerNetRangeCheck.Ranges)),
+	if cd.PrivateNetworkCheck != nil {
+		privateNetCheck := cd.PrivateNetworkCheck
+		cdCopy.PrivateNetworkCheck = &PrivateNetworkCheck{
+			Action: privateNetCheck.Action,
+			Ranges: make([]netip.Prefix, len(privateNetCheck.Ranges)),
 		}
-		copy(cdCopy.PeerNetworkRangeCheck.Ranges, peerNetRangeCheck.Ranges)
+		copy(cdCopy.PrivateNetworkCheck.Ranges, privateNetCheck.Ranges)
 	}
 	return cdCopy
 }
@@ -130,8 +130,8 @@ func (pc *Checks) GetChecks() []Check {
 	if pc.Checks.GeoLocationCheck != nil {
 		checks = append(checks, pc.Checks.GeoLocationCheck)
 	}
-	if pc.Checks.PeerNetworkRangeCheck != nil {
-		checks = append(checks, pc.Checks.PeerNetworkRangeCheck)
+	if pc.Checks.PrivateNetworkCheck != nil {
+		checks = append(checks, pc.Checks.PrivateNetworkCheck)
 	}
 	return checks
 }

management/server/posture/checks_test.go

@@ -254,7 +254,7 @@ func TestChecks_Copy(t *testing.T) {
 				},
 				Action: CheckActionAllow,
 			},
-			PeerNetworkRangeCheck: &PeerNetworkRangeCheck{
+			PrivateNetworkCheck: &PrivateNetworkCheck{
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
 					netip.MustParsePrefix("10.0.0.0/8"),

management/server/posture/network.go

@@ -8,16 +8,16 @@ import (
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 )
 
-type PeerNetworkRangeCheck struct {
+type PrivateNetworkCheck struct {
 	Action string
 	Ranges []netip.Prefix `gorm:"serializer:json"`
 }
 
-var _ Check = (*PeerNetworkRangeCheck)(nil)
+var _ Check = (*PrivateNetworkCheck)(nil)
 
-func (p *PeerNetworkRangeCheck) Check(peer nbpeer.Peer) (bool, error) {
+func (p *PrivateNetworkCheck) Check(peer nbpeer.Peer) (bool, error) {
 	if len(peer.Meta.NetworkAddresses) == 0 {
-		return false, fmt.Errorf("peer's does not contain peer network range addresses")
+		return false, fmt.Errorf("peer's does not contain private network addresses")
 	}
 
 	maskedPrefixes := make([]netip.Prefix, 0, len(p.Ranges))
@@ -34,7 +34,7 @@ func (p *PeerNetworkRangeCheck) Check(peer nbpeer.Peer) (bool, error) {
 			case CheckActionAllow:
 				return true, nil
 			default:
-				return false, fmt.Errorf("invalid peer network range check action: %s", p.Action)
+				return false, fmt.Errorf("invalid private network check action: %s", p.Action)
 			}
 		}
 	}
@@ -46,9 +46,9 @@ func (p *PeerNetworkRangeCheck) Check(peer nbpeer.Peer) (bool, error) {
 		return false, nil
 	}
 
-	return false, fmt.Errorf("invalid peer network range check action: %s", p.Action)
+	return false, fmt.Errorf("invalid private network check action: %s", p.Action)
 }
 
-func (p *PeerNetworkRangeCheck) Name() string {
-	return PeerNetworkRangeCheckName
+func (p *PrivateNetworkCheck) Name() string {
+	return PrivateNetworkCheckName
 }

management/server/posture/network_test.go

@@ -9,17 +9,17 @@ import (
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 )
 
-func TestPeerNetworkRangeCheck_Check(t *testing.T) {
+func TestPrivateNetworkCheck_Check(t *testing.T) {
 	tests := []struct {
 		name    string
-		check   PeerNetworkRangeCheck
+		check   PrivateNetworkCheck
 		peer    nbpeer.Peer
 		wantErr bool
 		isValid bool
 	}{
 		{
-			name: "Peer networks range matches the allowed range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer private networks matches the allowed range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionAllow,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
@@ -42,8 +42,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: true,
 		},
 		{
-			name: "Peer networks range doesn't matches the allowed range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer private networks doesn't matches the allowed range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionAllow,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
@@ -63,8 +63,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: false,
 		},
 		{
-			name: "Peer with no network range in the allow range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer with no privates network in the allow range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionAllow,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/16"),
@@ -76,8 +76,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: false,
 		},
 		{
-			name: "Peer networks range matches the denied range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer private networks matches the denied range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionDeny,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
@@ -100,8 +100,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: false,
 		},
 		{
-			name: "Peer networks range doesn't matches the denied range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer private networks doesn't matches the denied range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionDeny,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/24"),
@@ -121,8 +121,8 @@ func TestPeerNetworkRangeCheck_Check(t *testing.T) {
 			isValid: true,
 		},
 		{
-			name: "Peer with no networks range in the denied range",
-			check: PeerNetworkRangeCheck{
+			name: "Peer with no private networks in the denied range",
+			check: PrivateNetworkCheck{
 				Action: CheckActionDeny,
 				Ranges: []netip.Prefix{
 					netip.MustParsePrefix("192.168.0.0/16"),

management/server/scheduler.go

@@ -1,10 +1,9 @@
 package server
 
 import (
+	log "github.com/sirupsen/logrus"
 	"sync"
 	"time"
-
-	log "github.com/sirupsen/logrus"
 )
 
 // Scheduler is an interface which implementations can schedule and cancel jobs
@@ -56,8 +55,14 @@ func (wm *DefaultScheduler) cancel(ID string) bool {
 	cancel, ok := wm.jobs[ID]
 	if ok {
 		delete(wm.jobs, ID)
-		close(cancel)
-		log.Debugf("cancelled scheduled job %s", ID)
+		select {
+		case cancel <- struct{}{}:
+			log.Debugf("cancelled scheduled job %s", ID)
+		default:
+			log.Warnf("couldn't cancel job %s because there was no routine listening on the cancel event", ID)
+			return false
+		}
+
 	}
 	return ok
 }
@@ -85,41 +90,25 @@ func (wm *DefaultScheduler) Schedule(in time.Duration, ID string, job func() (ne
 		return
 	}
 
-	ticker := time.NewTicker(in)
-
 	wm.jobs[ID] = cancel
 	log.Debugf("scheduled a job %s to run in %s. There are %d total jobs scheduled.", ID, in.String(), len(wm.jobs))
 	go func() {
-		for {
-			select {
-			case <-ticker.C:
-				select {
-				case <-cancel:
-					log.Debugf("scheduled job %s was canceled, stop timer", ID)
-					ticker.Stop()
-					return
-				default:
-					log.Debugf("time to do a scheduled job %s", ID)
-				}
-				runIn, reschedule := job()
-				if !reschedule {
-					wm.mu.Lock()
-					defer wm.mu.Unlock()
-					delete(wm.jobs, ID)
-					log.Debugf("job %s is not scheduled to run again", ID)
-					ticker.Stop()
-					return
-				}
-				// we need this comparison to avoid resetting the ticker with the same duration and missing the current elapsesed time
-				if runIn != in {
-					ticker.Reset(runIn)
-				}
-			case <-cancel:
-				log.Debugf("job %s was canceled, stopping timer", ID)
-				ticker.Stop()
-				return
+		select {
+		case <-time.After(in):
+			log.Debugf("time to do a scheduled job %s", ID)
+			runIn, reschedule := job()
+			wm.mu.Lock()
+			defer wm.mu.Unlock()
+			delete(wm.jobs, ID)
+			if reschedule {
+				go wm.Schedule(runIn, ID, job)
 			}
+		case <-cancel:
+			log.Debugf("stopped scheduled job %s ", ID)
+			wm.mu.Lock()
+			defer wm.mu.Unlock()
+			delete(wm.jobs, ID)
+			return
 		}
-
 	}()
 }

management/server/scheduler_test.go

@@ -2,12 +2,11 @@ package server
 
 import (
 	"fmt"
+	"github.com/stretchr/testify/assert"
 	"math/rand"
 	"sync"
 	"testing"
 	"time"
-
-	"github.com/stretchr/testify/assert"
 )
 
 func TestScheduler_Performance(t *testing.T) {
@@ -37,24 +36,15 @@ func TestScheduler_Cancel(t *testing.T) {
 	jobID1 := "test-scheduler-job-1"
 	jobID2 := "test-scheduler-job-2"
 	scheduler := NewDefaultScheduler()
-	tChan := make(chan struct{})
-	p := []string{jobID1, jobID2}
-	scheduler.Schedule(2*time.Millisecond, jobID1, func() (nextRunIn time.Duration, reschedule bool) {
-		tt := p[0]
-		<-tChan
-		t.Logf("job %s", tt)
-		return 2 * time.Millisecond, true
+	scheduler.Schedule(2*time.Second, jobID1, func() (nextRunIn time.Duration, reschedule bool) {
+		return 0, false
 	})
-	scheduler.Schedule(2*time.Millisecond, jobID2, func() (nextRunIn time.Duration, reschedule bool) {
-		return 2 * time.Millisecond, true
+	scheduler.Schedule(2*time.Second, jobID2, func() (nextRunIn time.Duration, reschedule bool) {
+		return 0, false
 	})
 
-	time.Sleep(4 * time.Millisecond)
 	assert.Len(t, scheduler.jobs, 2)
 	scheduler.Cancel([]string{jobID1})
-	close(tChan)
-	p = []string{}
-	time.Sleep(4 * time.Millisecond)
 	assert.Len(t, scheduler.jobs, 1)
 	assert.NotNil(t, scheduler.jobs[jobID2])
 }