Skip to content

Commit f2c867c

Browse files
hakansahakansa
authored
[management] Support Extra DNS Labels for Peer Addressing (#3291)
[management] Support Extra DNS Labels for Peer Addressing
1 parent 8ebb26a commit f2c867c

19 files changed

+313
-72
lines changed

‎management/domain/validate.go

+25
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,28 @@ func ValidateDomains(domains []string) (List, error) {
3838
}
3939
return domainList, nil
4040
}
41+
42+
// ValidateDomainsStrSlice checks if each domain in the list is valid
43+
func ValidateDomainsStrSlice(domains []string) ([]string, error) {
44+
if len(domains) == 0 {
45+
return nil, nil
46+
}
47+
if len(domains) > maxDomains {
48+
return nil, fmt.Errorf("domains list exceeds maximum allowed domains: %d", maxDomains)
49+
}
50+
51+
domainRegex := regexp.MustCompile(`^(?:\*\.)?(?:(?:xn--)?[a-zA-Z0-9_](?:[a-zA-Z0-9-_]{0,61}[a-zA-Z0-9])?\.)*(?:xn--)?[a-zA-Z0-9](?:[a-zA-Z0-9-_]{0,61}[a-zA-Z0-9])?$`)
52+
53+
var domainList []string
54+
55+
for _, d := range domains {
56+
d := strings.ToLower(d)
57+
58+
if !domainRegex.MatchString(d) {
59+
return domainList, fmt.Errorf("invalid domain format: %s", d)
60+
}
61+
62+
domainList = append(domainList, d)
63+
}
64+
return domainList, nil
65+
}

‎management/domain/validate_test.go

+109
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package domain
22

33
import (
4+
"fmt"
45
"testing"
56

67
"github.com/stretchr/testify/assert"
@@ -95,3 +96,111 @@ func TestValidateDomains(t *testing.T) {
9596
})
9697
}
9798
}
99+
100+
// TestValidateDomainsStrSlice tests the ValidateDomainsStrSlice function.
101+
func TestValidateDomainsStrSlice(t *testing.T) {
102+
// Generate a slice of valid domains up to maxDomains
103+
validDomains := make([]string, maxDomains)
104+
for i := 0; i < maxDomains; i++ {
105+
validDomains[i] = fmt.Sprintf("example%d.com", i)
106+
}
107+
108+
tests := []struct {
109+
name string
110+
domains []string
111+
expected []string
112+
wantErr bool
113+
}{
114+
{
115+
name: "Empty list",
116+
domains: nil,
117+
expected: nil,
118+
wantErr: false,
119+
},
120+
{
121+
name: "Single valid ASCII domain",
122+
domains: []string{"sub.ex-ample.com"},
123+
expected: []string{"sub.ex-ample.com"},
124+
wantErr: false,
125+
},
126+
{
127+
name: "Underscores in labels",
128+
domains: []string{"_jabber._tcp.gmail.com"},
129+
expected: []string{"_jabber._tcp.gmail.com"},
130+
wantErr: false,
131+
},
132+
{
133+
// Unlike ValidateDomains (which converts to punycode),
134+
// ValidateDomainsStrSlice will fail on non-ASCII domain chars.
135+
name: "Unicode domain fails (no punycode conversion)",
136+
domains: []string{"münchen.de"},
137+
expected: nil,
138+
wantErr: true,
139+
},
140+
{
141+
name: "Invalid domain format - leading dash",
142+
domains: []string{"-example.com"},
143+
expected: nil,
144+
wantErr: true,
145+
},
146+
{
147+
name: "Invalid domain format - trailing dash",
148+
domains: []string{"example-.com"},
149+
expected: nil,
150+
wantErr: true,
151+
},
152+
{
153+
// The function stops on the first invalid domain and returns an error,
154+
// so only the first domain is definitely valid, but the second is invalid.
155+
name: "Multiple domains with a valid one, then invalid",
156+
domains: []string{"google.com", "invalid_domain.com-"},
157+
expected: []string{"google.com"},
158+
wantErr: true,
159+
},
160+
{
161+
name: "Valid wildcard domain",
162+
domains: []string{"*.example.com"},
163+
expected: []string{"*.example.com"},
164+
wantErr: false,
165+
},
166+
{
167+
name: "Wildcard with leading dot - invalid",
168+
domains: []string{".*.example.com"},
169+
expected: nil,
170+
wantErr: true,
171+
},
172+
{
173+
name: "Invalid wildcard with multiple asterisks",
174+
domains: []string{"a.*.example.com"},
175+
expected: nil,
176+
wantErr: true,
177+
},
178+
{
179+
name: "Exactly maxDomains items (valid)",
180+
domains: validDomains,
181+
expected: validDomains,
182+
wantErr: false,
183+
},
184+
{
185+
name: "Exceeds maxDomains items",
186+
domains: append(validDomains, "extra.com"),
187+
expected: nil,
188+
wantErr: true,
189+
},
190+
}
191+
192+
for _, tt := range tests {
193+
t.Run(tt.name, func(t *testing.T) {
194+
got, err := ValidateDomainsStrSlice(tt.domains)
195+
// Check if we got an error where expected
196+
if tt.wantErr {
197+
assert.Error(t, err)
198+
} else {
199+
assert.NoError(t, err)
200+
}
201+
202+
// Compare the returned domains to what we expect
203+
assert.Equal(t, tt.expected, got)
204+
})
205+
}
206+
}

‎management/server/account.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ type AccountManager interface {
6363
GetOrCreateAccountByUser(ctx context.Context, userId, domain string) (*types.Account, error)
6464
GetAccount(ctx context.Context, accountID string) (*types.Account, error)
6565
CreateSetupKey(ctx context.Context, accountID string, keyName string, keyType types.SetupKeyType, expiresIn time.Duration,
66-
autoGroups []string, usageLimit int, userID string, ephemeral bool) (*types.SetupKey, error)
66+
autoGroups []string, usageLimit int, userID string, ephemeral bool, allowExtraDNSLabels bool) (*types.SetupKey, error)
6767
SaveSetupKey(ctx context.Context, accountID string, key *types.SetupKey, userID string) (*types.SetupKey, error)
6868
CreateUser(ctx context.Context, accountID, initiatorUserID string, key *types.UserInfo) (*types.UserInfo, error)
6969
DeleteUser(ctx context.Context, accountID, initiatorUserID string, targetUserID string) error

‎management/server/account_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -1080,7 +1080,7 @@ func TestAccountManager_AddPeer(t *testing.T) {
10801080

10811081
serial := account.Network.CurrentSerial() // should be 0
10821082

1083-
setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false)
1083+
setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
10841084
if err != nil {
10851085
t.Fatal("error creating setup key")
10861086
return
@@ -1456,7 +1456,7 @@ func TestAccountManager_DeletePeer(t *testing.T) {
14561456
t.Fatal(err)
14571457
}
14581458

1459-
setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false)
1459+
setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
14601460
if err != nil {
14611461
t.Fatal("error creating setup key")
14621462
return
@@ -2948,7 +2948,7 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *types.Account,
29482948
t.Fatal(err)
29492949
}
29502950

2951-
setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false)
2951+
setupKey, err := manager.CreateSetupKey(context.Background(), account.Id, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
29522952
if err != nil {
29532953
t.Fatal("error creating setup key")
29542954
}

‎management/server/grpcserver.go

+1
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,7 @@ func (s *GRPCServer) Login(ctx context.Context, req *proto.EncryptedMessage) (*p
481481
UserID: userID,
482482
SetupKey: loginReq.GetSetupKey(),
483483
ConnectionIP: realIP,
484+
ExtraDNSLabels: loginReq.GetDnsLabels(),
484485
})
485486
if err != nil {
486487
log.WithContext(ctx).Warnf("failed logging in peer %s: %s", peerKey, err)

‎management/server/http/api/openapi.yml

+16
Original file line numberDiff line numberDiff line change
@@ -361,6 +361,12 @@ components:
361361
description: System serial number
362362
type: string
363363
example: "C02XJ0J0JGH7"
364+
extra_dns_labels:
365+
description: Extra DNS labels added to the peer
366+
type: array
367+
items:
368+
type: string
369+
example: "stage-host-1"
364370
required:
365371
- city_name
366372
- connected
@@ -384,6 +390,7 @@ components:
384390
- ui_version
385391
- approval_required
386392
- serial_number
393+
- extra_dns_labels
387394
AccessiblePeer:
388395
allOf:
389396
- $ref: '#/components/schemas/PeerMinimum'
@@ -503,6 +510,10 @@ components:
503510
description: Indicate that the peer will be ephemeral or not
504511
type: boolean
505512
example: true
513+
allow_extra_dns_labels:
514+
description: Allow extra DNS labels to be added to the peer
515+
type: boolean
516+
example: true
506517
required:
507518
- id
508519
- key
@@ -518,6 +529,7 @@ components:
518529
- updated_at
519530
- usage_limit
520531
- ephemeral
532+
- allow_extra_dns_labels
521533
SetupKeyClear:
522534
allOf:
523535
- $ref: '#/components/schemas/SetupKeyBase'
@@ -587,6 +599,10 @@ components:
587599
description: Indicate that the peer will be ephemeral or not
588600
type: boolean
589601
example: true
602+
allow_extra_dns_labels:
603+
description: Allow extra DNS labels to be added to the peer
604+
type: boolean
605+
example: true
590606
required:
591607
- name
592608
- type

‎management/server/http/api/types.gen.go

+18
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎management/server/http/handlers/peers/peers_handler.go

+10
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,7 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
338338
UserId: peer.UserID,
339339
UiVersion: peer.Meta.UIVersion,
340340
DnsLabel: fqdn(peer, dnsDomain),
341+
ExtraDnsLabels: fqdnList(peer.ExtraDNSLabels, dnsDomain),
341342
LoginExpirationEnabled: peer.LoginExpirationEnabled,
342343
LastLogin: peer.GetLastLogin(),
343344
LoginExpired: peer.Status.LoginExpired,
@@ -372,6 +373,7 @@ func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dn
372373
UserId: peer.UserID,
373374
UiVersion: peer.Meta.UIVersion,
374375
DnsLabel: fqdn(peer, dnsDomain),
376+
ExtraDnsLabels: fqdnList(peer.ExtraDNSLabels, dnsDomain),
375377
LoginExpirationEnabled: peer.LoginExpirationEnabled,
376378
LastLogin: peer.GetLastLogin(),
377379
LoginExpired: peer.Status.LoginExpired,
@@ -392,3 +394,11 @@ func fqdn(peer *nbpeer.Peer, dnsDomain string) string {
392394
return fqdn
393395
}
394396
}
397+
func fqdnList(extraLabels []string, dnsDomain string) []string {
398+
fqdnList := make([]string, 0, len(extraLabels))
399+
for _, label := range extraLabels {
400+
fqdn := fmt.Sprintf("%s.%s", label, dnsDomain)
401+
fqdnList = append(fqdnList, fqdn)
402+
}
403+
return fqdnList
404+
}

‎management/server/http/handlers/setup_keys/setupkeys_handler.go

+22-15
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package setup_keys
33
import (
44
"context"
55
"encoding/json"
6+
67
"net/http"
78
"time"
89

@@ -86,8 +87,13 @@ func (h *handler) createSetupKey(w http.ResponseWriter, r *http.Request) {
8687
ephemeral = *req.Ephemeral
8788
}
8889

90+
var allowExtraDNSLabels bool
91+
if req.AllowExtraDnsLabels != nil {
92+
allowExtraDNSLabels = *req.AllowExtraDnsLabels
93+
}
94+
8995
setupKey, err := h.accountManager.CreateSetupKey(r.Context(), accountID, req.Name, types.SetupKeyType(req.Type), expiresIn,
90-
req.AutoGroups, req.UsageLimit, userID, ephemeral)
96+
req.AutoGroups, req.UsageLimit, userID, ephemeral, allowExtraDNSLabels)
9197
if err != nil {
9298
util.WriteError(r.Context(), err, w)
9399
return
@@ -237,19 +243,20 @@ func ToResponseBody(key *types.SetupKey) *api.SetupKey {
237243
}
238244

239245
return &api.SetupKey{
240-
Id: key.Id,
241-
Key: key.KeySecret,
242-
Name: key.Name,
243-
Expires: key.GetExpiresAt(),
244-
Type: string(key.Type),
245-
Valid: key.IsValid(),
246-
Revoked: key.Revoked,
247-
UsedTimes: key.UsedTimes,
248-
LastUsed: key.GetLastUsed(),
249-
State: state,
250-
AutoGroups: key.AutoGroups,
251-
UpdatedAt: key.UpdatedAt,
252-
UsageLimit: key.UsageLimit,
253-
Ephemeral: key.Ephemeral,
246+
Id: key.Id,
247+
Key: key.KeySecret,
248+
Name: key.Name,
249+
Expires: key.GetExpiresAt(),
250+
Type: string(key.Type),
251+
Valid: key.IsValid(),
252+
Revoked: key.Revoked,
253+
UsedTimes: key.UsedTimes,
254+
LastUsed: key.GetLastUsed(),
255+
State: state,
256+
AutoGroups: key.AutoGroups,
257+
UpdatedAt: key.UpdatedAt,
258+
UsageLimit: key.UsageLimit,
259+
Ephemeral: key.Ephemeral,
260+
AllowExtraDnsLabels: key.AllowExtraDNSLabels,
254261
}
255262
}

0 commit comments

Comments
 (0)