Backup and restore encryption key

In case of encryption error fill variables
with content instead of empty string

.gitattributes

@@ -1 +0,0 @@
-*.go text eol=lf

.github/workflows/golangci-lint.yml

@@ -1,23 +1,12 @@
 name: golangci-lint
 on: [pull_request]
-
-permissions: 
-  contents: read
-  pull-requests: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
   cancel-in-progress: true
-
 jobs:
   golangci:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
     name: lint
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
@@ -25,12 +14,7 @@ jobs:
         uses: actions/setup-go@v4
         with:
           go-version: "1.20.x"
-          cache: false
       - name: Install dependencies
-        if: matrix.os == 'ubuntu-latest'
         run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
-        with:
-          version: latest
-          args: --timeout=12m
+        uses: golangci/golangci-lint-action@v3

client/ui/build-ui-linux.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-sudo apt update
-sudo apt remove gir1.2-appindicator3-0.1
-sudo apt install -y libayatana-appindicator3-dev
-go build

client/ui/client_ui.go

@@ -202,10 +202,9 @@ func (s *serviceClient) getSettingsForm() *widget.Form {
 				}
 
 				_, err = client.Login(s.ctx, &proto.LoginRequest{
-					ManagementUrl:        s.iMngURL.Text,
-					AdminURL:             s.iAdminURL.Text,
-					PreSharedKey:         s.iPreSharedKey.Text,
-					IsLinuxDesktopClient: runtime.GOOS == "linux",
+					ManagementUrl: s.iMngURL.Text,
+					AdminURL:      s.iAdminURL.Text,
+					PreSharedKey:  s.iPreSharedKey.Text,
 				})
 				if err != nil {
 					log.Errorf("login to management URL: %v", err)
@@ -234,9 +233,7 @@ func (s *serviceClient) login() error {
 		return err
 	}
 
-	loginResp, err := conn.Login(s.ctx, &proto.LoginRequest{
-		IsLinuxDesktopClient: runtime.GOOS == "linux",
-	})
+	loginResp, err := conn.Login(s.ctx, &proto.LoginRequest{})
 	if err != nil {
 		log.Errorf("login to management URL with: %v", err)
 		return err

infrastructure_files/configure.sh

@@ -170,6 +170,10 @@ if [ "$NETBIRD_DASH_AUTH_USE_AUDIENCE" = "false" ]; then
     export NETBIRD_AUTH_PKCE_AUDIENCE=
 fi
 
+# Read the encryption key
+encKey=$(grep DataStoreEncryptionKey management.json | awk -F'"' '{$0=$4}1')
+export NETBIRD_DATASTORE_ENC_KEY=$encKey
+
 env | grep NETBIRD
 
 envsubst <docker-compose.yml.tmpl >docker-compose.yml

infrastructure_files/management.json.tmpl

@@ -27,6 +27,7 @@
         "Password": null
     },
     "Datadir": "",
+    "DataStoreEncryptionKey": "$NETBIRD_DATASTORE_ENC_KEY",
     "HttpConfig": {
         "Address": "0.0.0.0:$NETBIRD_MGMT_API_PORT",
         "AuthIssuer": "$NETBIRD_AUTH_AUTHORITY",

management/cmd/management.go

@@ -301,15 +301,23 @@ var (
 func initEventStore(dataDir string, key string) (activity.Store, string, error) {
 	var err error
 	if key == "" {
-		log.Debugf("generate new activity store encryption key")
-		key, err = sqlite.GenerateKey()
+		log.Debugf("restore or generate new activity store encryption key")
+		key, err = sqlite.RestoreKey(dataDir)
+		if err == nil {
+			goto CreateStore
+		} else {
+			log.Debugf("failed to restore encryption key for activity store: %s", err)
+		}
+
+		log.Infof("generate new encryption key for activity store")
+		key, err = sqlite.GenerateKey(dataDir)
 		if err != nil {
 			return nil, "", err
 		}
 	}
+CreateStore:
 	store, err := sqlite.NewSQLiteStore(dataDir, key)
 	return store, key, err
-
 }
 
 func notifyStop(msg string) {

management/server/activity/sqlite/crypt.go

@@ -7,6 +7,12 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"fmt"
+	"os"
+	"path/filepath"
+)
+
+const (
+	backupFile = ".datastore.key"
 )
 
 var iv = []byte{10, 22, 13, 79, 05, 8, 52, 91, 87, 98, 88, 98, 35, 25, 13, 05}
@@ -15,16 +21,40 @@ type FieldEncrypt struct {
 	block cipher.Block
 }
 
-func GenerateKey() (string, error) {
+func RestoreKey(dataDir string) (string, error) {
+	fName := filepath.Join(dataDir, backupFile)
+	data, err := os.ReadFile(fName)
+	return string(data), err
+}
+
+func GenerateKey(dataDir string) (string, error) {
 	key := make([]byte, 32)
 	_, err := rand.Read(key)
 	if err != nil {
 		return "", err
 	}
 	readableKey := base64.StdEncoding.EncodeToString(key)
+
+	err = saveKey(dataDir, readableKey)
+	if err != nil {
+		return "", err
+	}
 	return readableKey, nil
 }
 
+func saveKey(dataDir, key string) error {
+	f, err := os.Create(filepath.Join(dataDir, backupFile))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	_, err = f.WriteString(key)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 func NewFieldEncrypt(key string) (*FieldEncrypt, error) {
 	binKey, err := base64.StdEncoding.DecodeString(key)
 	if err != nil {

management/server/activity/sqlite/crypt_test.go

@@ -2,11 +2,20 @@ package sqlite
 
 import (
 	"testing"
+
+	log "github.com/sirupsen/logrus"
 )
 
+func TestRestoreKey(t *testing.T) {
+	_, err := RestoreKey(t.TempDir())
+	if err != nil {
+		log.Infof("err: %s", err)
+	}
+}
+
 func TestGenerateKey(t *testing.T) {
 	testData := "exampl@netbird.io"
-	key, err := GenerateKey()
+	key, err := GenerateKey(t.TempDir())
 	if err != nil {
 		t.Fatalf("failed to generate key: %s", err)
 	}
@@ -32,7 +41,7 @@ func TestGenerateKey(t *testing.T) {
 
 func TestCorruptKey(t *testing.T) {
 	testData := "exampl@netbird.io"
-	key, err := GenerateKey()
+	key, err := GenerateKey(t.TempDir())
 	if err != nil {
 		t.Fatalf("failed to generate key: %s", err)
 	}
@@ -46,7 +55,7 @@ func TestCorruptKey(t *testing.T) {
 		t.Fatalf("invalid encrypted text")
 	}
 
-	newKey, err := GenerateKey()
+	newKey, err := GenerateKey(t.TempDir())
 	if err != nil {
 		t.Fatalf("failed to generate key: %s", err)
 	}

management/server/activity/sqlite/sqlite.go

@@ -45,6 +45,9 @@ const (
 		"VALUES(?, ?, ?, ?, ?, ?)"
 
 	insertDeleteUserQuery = `INSERT INTO deleted_users(id, email, name) VALUES(?, ?, ?)`
+
+	fallbackName  = "unknown"
+	fallbackEmail = "unknown@unknown.com"
 )
 
 // Store is the implementation of the activity.Store interface backed by SQLite
@@ -128,6 +131,7 @@ func NewSQLiteStore(dataDir string, encryptionKey string) (*Store, error) {
 
 func (store *Store) processResult(result *sql.Rows) ([]*activity.Event, error) {
 	events := make([]*activity.Event, 0)
+	var cryptErr error
 	for result.Next() {
 		var id int64
 		var operation activity.Activity
@@ -156,8 +160,8 @@ func (store *Store) processResult(result *sql.Rows) ([]*activity.Event, error) {
 		if targetUserName != nil {
 			name, err := store.fieldEncrypt.Decrypt(*targetUserName)
 			if err != nil {
-				log.Errorf("failed to decrypt username for target id: %s", target)
-				meta["username"] = ""
+				cryptErr = fmt.Errorf("failed to decrypt username for target id: %s", target)
+				meta["username"] = fallbackName
 			} else {
 				meta["username"] = name
 			}
@@ -166,8 +170,8 @@ func (store *Store) processResult(result *sql.Rows) ([]*activity.Event, error) {
 		if targetEmail != nil {
 			email, err := store.fieldEncrypt.Decrypt(*targetEmail)
 			if err != nil {
-				log.Errorf("failed to decrypt email address for target id: %s", target)
-				meta["email"] = ""
+				cryptErr = fmt.Errorf("failed to decrypt email address for target id: %s", target)
+				meta["email"] = fallbackEmail
 			} else {
 				meta["email"] = email
 			}
@@ -186,7 +190,8 @@ func (store *Store) processResult(result *sql.Rows) ([]*activity.Event, error) {
 		if initiatorName != nil {
 			name, err := store.fieldEncrypt.Decrypt(*initiatorName)
 			if err != nil {
-				log.Errorf("failed to decrypt username of initiator: %s", initiator)
+				cryptErr = fmt.Errorf("failed to decrypt username of initiator: %s", initiator)
+				event.InitiatorName = fallbackName
 			} else {
 				event.InitiatorName = name
 			}
@@ -195,7 +200,8 @@ func (store *Store) processResult(result *sql.Rows) ([]*activity.Event, error) {
 		if initiatorEmail != nil {
 			email, err := store.fieldEncrypt.Decrypt(*initiatorEmail)
 			if err != nil {
-				log.Errorf("failed to decrypt email address of initiator: %s", initiator)
+				cryptErr = fmt.Errorf("failed to decrypt email address of initiator: %s", initiator)
+				event.InitiatorEmail = fallbackEmail
 			} else {
 				event.InitiatorEmail = email
 			}
@@ -204,6 +210,10 @@ func (store *Store) processResult(result *sql.Rows) ([]*activity.Event, error) {
 		events = append(events, event)
 	}
 
+	if cryptErr != nil {
+		log.Warnf("%s", cryptErr)
+	}
+
 	return events, nil
 }
 

management/server/activity/sqlite/sqlite_test.go

@@ -12,7 +12,7 @@ import (
 
 func TestNewSQLiteStore(t *testing.T) {
 	dataDir := t.TempDir()
-	key, _ := GenerateKey()
+	key, _ := GenerateKey(dataDir)
 	store, err := NewSQLiteStore(dataDir, key)
 	if err != nil {
 		t.Fatal(err)

management/server/grpcserver.go

@@ -61,7 +61,7 @@ func NewServer(config *Config, accountManager AccountManager, peersUpdateManager
 	if appMetrics != nil {
 		// update gauge based on number of connected peers which is equal to open gRPC streams
 		err = appMetrics.GRPCMetrics().RegisterConnectedStreams(func() int64 {
-			return peersUpdateManager.Len()
+			return int64(len(peersUpdateManager.peerChannels))
 		})
 		if err != nil {
 			return nil, err

management/server/updatechannel.go

@@ -2,7 +2,6 @@ package server
 
 import (
 	"sync"
-	"sync/atomic"
 
 	log "github.com/sirupsen/logrus"
 
@@ -15,29 +14,25 @@ type UpdateMessage struct {
 	Update *proto.SyncResponse
 }
 
-type UpdateChannel chan *UpdateMessage
-
 type PeersUpdateManager struct {
 	// peerChannels is an update channel indexed by Peer.ID
-	peerChannels sync.Map
-	// peerChannelLocks keeps the peer locks to organize channel creations
-	peerChannelLocks sync.Map
-	// len is the length of peerChannels
-	len atomic.Int64
+	peerChannels map[string]chan *UpdateMessage
+	channelsMux  *sync.Mutex
 }
 
 // NewPeersUpdateManager returns a new instance of PeersUpdateManager
 func NewPeersUpdateManager() *PeersUpdateManager {
-	return &PeersUpdateManager{}
+	return &PeersUpdateManager{
+		peerChannels: make(map[string]chan *UpdateMessage),
+		channelsMux:  &sync.Mutex{},
+	}
 }
 
 // SendUpdate sends update message to the peer's channel
 func (p *PeersUpdateManager) SendUpdate(peerID string, update *UpdateMessage) {
-	if ch, ok := p.peerChannels.Load(peerID); ok {
-		channel, ok := ch.(UpdateChannel)
-		if !ok {
-			log.Warnf("could not cast to UpdateChannel")
-		}
+	p.channelsMux.Lock()
+	defer p.channelsMux.Unlock()
+	if channel, ok := p.peerChannels[peerID]; ok {
 		select {
 		case channel <- update:
 			log.Debugf("update was sent to channel for peer %s", peerID)
@@ -50,48 +45,35 @@ func (p *PeersUpdateManager) SendUpdate(peerID string, update *UpdateMessage) {
 }
 
 // CreateChannel creates a go channel for a given peer used to deliver updates relevant to the peer.
-func (p *PeersUpdateManager) CreateChannel(peerID string) UpdateChannel {
-	// we have to lock the whole operation by peerID as we do two non atomic operations:
-	// - closeChannel()
-	// - Store
-	value, _ := p.peerChannelLocks.LoadOrStore(peerID, &sync.Mutex{})
-	mtx := value.(*sync.Mutex)
-	mtx.Lock()
-	defer mtx.Unlock()
-
-	p.closeChannel(peerID)
+func (p *PeersUpdateManager) CreateChannel(peerID string) chan *UpdateMessage {
+	p.channelsMux.Lock()
+	defer p.channelsMux.Unlock()
 
+	if channel, ok := p.peerChannels[peerID]; ok {
+		delete(p.peerChannels, peerID)
+		close(channel)
+	}
 	// mbragin: todo shouldn't it be more? or configurable?
-	channel := make(UpdateChannel, channelBufferSize)
-	p.peerChannels.Store(peerID, channel)
-	p.len.Add(1)
+	channel := make(chan *UpdateMessage, channelBufferSize)
+	p.peerChannels[peerID] = channel
 
 	log.Debugf("opened updates channel for a peer %s", peerID)
 	return channel
 }
 
-func (p *PeersUpdateManager) GetChannel(peerID string) UpdateChannel {
-	if ch, ok := p.peerChannels.Load(peerID); ok {
-		channel := ch.(UpdateChannel)
-		return channel
-	}
-	return nil
-}
-
 func (p *PeersUpdateManager) closeChannel(peerID string) {
-	if ch, ok := p.peerChannels.LoadAndDelete(peerID); ok {
-		channel, ok := ch.(UpdateChannel)
-		if !ok {
-			log.Errorf("could not cast to UpdateChannel")
-		}
-		p.len.Add(-1)
+	if channel, ok := p.peerChannels[peerID]; ok {
+		delete(p.peerChannels, peerID)
 		close(channel)
-		log.Debugf("closed updates channel of a peer %s", peerID)
 	}
+
+	log.Debugf("closed updates channel of a peer %s", peerID)
 }
 
 // CloseChannels closes updates channel for each given peer
 func (p *PeersUpdateManager) CloseChannels(peerIDs []string) {
+	p.channelsMux.Lock()
+	defer p.channelsMux.Unlock()
 	for _, id := range peerIDs {
 		p.closeChannel(id)
 	}
@@ -99,22 +81,18 @@ func (p *PeersUpdateManager) CloseChannels(peerIDs []string) {
 
 // CloseChannel closes updates channel of a given peer
 func (p *PeersUpdateManager) CloseChannel(peerID string) {
+	p.channelsMux.Lock()
+	defer p.channelsMux.Unlock()
 	p.closeChannel(peerID)
 }
 
 // GetAllConnectedPeers returns a copy of the connected peers map
 func (p *PeersUpdateManager) GetAllConnectedPeers() map[string]struct{} {
+	p.channelsMux.Lock()
+	defer p.channelsMux.Unlock()
 	m := make(map[string]struct{})
-	p.peerChannels.Range(func(key any, value any) bool {
-		if ID, ok := key.(string); ok {
-			m[ID] = struct{}{}
-		}
-		return true
-	})
+	for ID := range p.peerChannels {
+		m[ID] = struct{}{}
+	}
 	return m
 }
-
-// Len returns the length of the peer channels
-func (p *PeersUpdateManager) Len() (len int64) {
-	return p.len.Load()
-}

management/server/updatechannel_test.go

@@ -1,10 +1,9 @@
 package server
 
 import (
+	"github.com/netbirdio/netbird/management/proto"
 	"testing"
 	"time"
-
-	"github.com/netbirdio/netbird/management/proto"
 )
 
 //var peersUpdater *PeersUpdateManager
@@ -14,22 +13,10 @@ func TestCreateChannel(t *testing.T) {
 	peersUpdater := NewPeersUpdateManager()
 	defer peersUpdater.CloseChannel(peer)
 
-	if peersUpdater.Len() != 0 {
-		t.Error("peersUpdated should not have any channels yet")
-	}
-
-	if ch := peersUpdater.GetChannel(peer); ch != nil {
-		t.Errorf("We should not have channel for %s yet", peer)
-	}
-
 	_ = peersUpdater.CreateChannel(peer)
-	if ch := peersUpdater.GetChannel(peer); ch == nil {
+	if _, ok := peersUpdater.peerChannels[peer]; !ok {
 		t.Error("Error creating the channel")
 	}
-
-	if peersUpdater.Len() != 1 {
-		t.Error("peersUpdated should have 1 channel")
-	}
 }
 
 func TestSendUpdate(t *testing.T) {
@@ -41,12 +28,12 @@ func TestSendUpdate(t *testing.T) {
 		},
 	}}
 	_ = peersUpdater.CreateChannel(peer)
-	if ch := peersUpdater.GetChannel(peer); ch == nil {
+	if _, ok := peersUpdater.peerChannels[peer]; !ok {
 		t.Error("Error creating the channel")
 	}
 	peersUpdater.SendUpdate(peer, update1)
 	select {
-	case <-peersUpdater.GetChannel(peer):
+	case <-peersUpdater.peerChannels[peer]:
 	default:
 		t.Error("Update wasn't send")
 	}
@@ -67,7 +54,7 @@ func TestSendUpdate(t *testing.T) {
 		select {
 		case <-timeout:
 			t.Error("timed out reading previously sent updates")
-		case updateReader := <-peersUpdater.GetChannel(peer):
+		case updateReader := <-peersUpdater.peerChannels[peer]:
 			if updateReader.Update.NetworkMap.Serial == update2.Update.NetworkMap.Serial {
 				t.Error("got the update that shouldn't have been sent")
 			}
@@ -80,11 +67,11 @@ func TestCloseChannel(t *testing.T) {
 	peer := "test-close"
 	peersUpdater := NewPeersUpdateManager()
 	_ = peersUpdater.CreateChannel(peer)
-	if ch := peersUpdater.GetChannel(peer); ch == nil {
+	if _, ok := peersUpdater.peerChannels[peer]; !ok {
 		t.Error("Error creating the channel")
 	}
 	peersUpdater.CloseChannel(peer)
-	if ch := peersUpdater.GetChannel(peer); ch != nil {
+	if _, ok := peersUpdater.peerChannels[peer]; ok {
 		t.Error("Error closing the channel")
 	}
 }