Skip to content

Commit 6127a01

Browse files
lixmallixmal
authored
[client] Remove strings from allowed IPs (#3920)
1 parent de27d6d commit 6127a01

File tree

9 files changed

+68
-52
lines changed

9 files changed

+68
-52
lines changed

‎client/iface/configurer/common.go

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
package configurer
2+
3+
import (
4+
"net"
5+
"net/netip"
6+
)
7+
8+
func prefixesToIPNets(prefixes []netip.Prefix) []net.IPNet {
9+
ipNets := make([]net.IPNet, len(prefixes))
10+
for i, prefix := range prefixes {
11+
ipNets[i] = net.IPNet{
12+
IP: prefix.Addr().AsSlice(), // Convert netip.Addr to net.IP
13+
Mask: net.CIDRMask(prefix.Bits(), prefix.Addr().BitLen()), // Create subnet mask
14+
}
15+
}
16+
return ipNets
17+
}

‎client/iface/configurer/kernel_unix.go

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package configurer
55
import (
66
"fmt"
77
"net"
8+
"net/netip"
89
"time"
910

1011
log "github.com/sirupsen/logrus"
@@ -45,7 +46,7 @@ func (c *KernelConfigurer) ConfigureInterface(privateKey string, port int) error
4546
return nil
4647
}
4748

48-
func (c *KernelConfigurer) UpdatePeer(peerKey string, allowedIps []net.IPNet, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
49+
func (c *KernelConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
4950
peerKeyParsed, err := wgtypes.ParseKey(peerKey)
5051
if err != nil {
5152
return err
@@ -54,7 +55,7 @@ func (c *KernelConfigurer) UpdatePeer(peerKey string, allowedIps []net.IPNet, ke
5455
PublicKey: peerKeyParsed,
5556
ReplaceAllowedIPs: false,
5657
// don't replace allowed ips, wg will handle duplicated peer IP
57-
AllowedIPs: allowedIps,
58+
AllowedIPs: prefixesToIPNets(allowedIps),
5859
PersistentKeepaliveInterval: &keepAlive,
5960
Endpoint: endpoint,
6061
PresharedKey: preSharedKey,
@@ -91,10 +92,10 @@ func (c *KernelConfigurer) RemovePeer(peerKey string) error {
9192
return nil
9293
}
9394

94-
func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP string) error {
95-
_, ipNet, err := net.ParseCIDR(allowedIP)
96-
if err != nil {
97-
return err
95+
func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
96+
ipNet := net.IPNet{
97+
IP: allowedIP.Addr().AsSlice(),
98+
Mask: net.CIDRMask(allowedIP.Bits(), allowedIP.Addr().BitLen()),
9899
}
99100

100101
peerKeyParsed, err := wgtypes.ParseKey(peerKey)
@@ -105,7 +106,7 @@ func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP string) error
105106
PublicKey: peerKeyParsed,
106107
UpdateOnly: true,
107108
ReplaceAllowedIPs: false,
108-
AllowedIPs: []net.IPNet{*ipNet},
109+
AllowedIPs: []net.IPNet{ipNet},
109110
}
110111

111112
config := wgtypes.Config{
@@ -118,10 +119,10 @@ func (c *KernelConfigurer) AddAllowedIP(peerKey string, allowedIP string) error
118119
return nil
119120
}
120121

121-
func (c *KernelConfigurer) RemoveAllowedIP(peerKey string, allowedIP string) error {
122-
_, ipNet, err := net.ParseCIDR(allowedIP)
123-
if err != nil {
124-
return fmt.Errorf("parse allowed IP: %w", err)
122+
func (c *KernelConfigurer) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error {
123+
ipNet := net.IPNet{
124+
IP: allowedIP.Addr().AsSlice(),
125+
Mask: net.CIDRMask(allowedIP.Bits(), allowedIP.Addr().BitLen()),
125126
}
126127

127128
peerKeyParsed, err := wgtypes.ParseKey(peerKey)
@@ -189,7 +190,11 @@ func (c *KernelConfigurer) configure(config wgtypes.Config) error {
189190
if err != nil {
190191
return err
191192
}
192-
defer wg.Close()
193+
defer func() {
194+
if err := wg.Close(); err != nil {
195+
log.Errorf("Failed to close wgctrl client: %v", err)
196+
}
197+
}()
193198

194199
// validate if device with name exists
195200
_, err = wg.Device(c.deviceName)

‎client/iface/configurer/usp.go

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"encoding/hex"
66
"fmt"
77
"net"
8+
"net/netip"
89
"os"
910
"runtime"
1011
"strconv"
@@ -67,7 +68,7 @@ func (c *WGUSPConfigurer) ConfigureInterface(privateKey string, port int) error
6768
return c.device.IpcSet(toWgUserspaceString(config))
6869
}
6970

70-
func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []net.IPNet, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
71+
func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
7172
peerKeyParsed, err := wgtypes.ParseKey(peerKey)
7273
if err != nil {
7374
return err
@@ -76,7 +77,7 @@ func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []net.IPNet, kee
7677
PublicKey: peerKeyParsed,
7778
ReplaceAllowedIPs: false,
7879
// don't replace allowed ips, wg will handle duplicated peer IP
79-
AllowedIPs: allowedIps,
80+
AllowedIPs: prefixesToIPNets(allowedIps),
8081
PersistentKeepaliveInterval: &keepAlive,
8182
PresharedKey: preSharedKey,
8283
Endpoint: endpoint,
@@ -106,10 +107,10 @@ func (c *WGUSPConfigurer) RemovePeer(peerKey string) error {
106107
return c.device.IpcSet(toWgUserspaceString(config))
107108
}
108109

109-
func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP string) error {
110-
_, ipNet, err := net.ParseCIDR(allowedIP)
111-
if err != nil {
112-
return err
110+
func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
111+
ipNet := net.IPNet{
112+
IP: allowedIP.Addr().AsSlice(),
113+
Mask: net.CIDRMask(allowedIP.Bits(), allowedIP.Addr().BitLen()),
113114
}
114115

115116
peerKeyParsed, err := wgtypes.ParseKey(peerKey)
@@ -120,7 +121,7 @@ func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP string) error {
120121
PublicKey: peerKeyParsed,
121122
UpdateOnly: true,
122123
ReplaceAllowedIPs: false,
123-
AllowedIPs: []net.IPNet{*ipNet},
124+
AllowedIPs: []net.IPNet{ipNet},
124125
}
125126

126127
config := wgtypes.Config{
@@ -130,7 +131,7 @@ func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP string) error {
130131
return c.device.IpcSet(toWgUserspaceString(config))
131132
}
132133

133-
func (c *WGUSPConfigurer) RemoveAllowedIP(peerKey string, ip string) error {
134+
func (c *WGUSPConfigurer) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error {
134135
ipc, err := c.device.IpcGet()
135136
if err != nil {
136137
return err
@@ -153,6 +154,8 @@ func (c *WGUSPConfigurer) RemoveAllowedIP(peerKey string, ip string) error {
153154

154155
foundPeer := false
155156
removedAllowedIP := false
157+
ip := allowedIP.String()
158+
156159
for _, line := range lines {
157160
line = strings.TrimSpace(line)
158161

@@ -175,8 +178,8 @@ func (c *WGUSPConfigurer) RemoveAllowedIP(peerKey string, ip string) error {
175178

176179
// Append the line to the output string
177180
if foundPeer && strings.HasPrefix(line, "allowed_ip=") {
178-
allowedIP := strings.TrimPrefix(line, "allowed_ip=")
179-
_, ipNet, err := net.ParseCIDR(allowedIP)
181+
allowedIPStr := strings.TrimPrefix(line, "allowed_ip=")
182+
_, ipNet, err := net.ParseCIDR(allowedIPStr)
180183
if err != nil {
181184
return err
182185
}

‎client/iface/device/interface.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package device
22

33
import (
44
"net"
5+
"net/netip"
56
"time"
67

78
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
@@ -11,10 +12,10 @@ import (
1112

1213
type WGConfigurer interface {
1314
ConfigureInterface(privateKey string, port int) error
14-
UpdatePeer(peerKey string, allowedIps []net.IPNet, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
15+
UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
1516
RemovePeer(peerKey string) error
16-
AddAllowedIP(peerKey string, allowedIP string) error
17-
RemoveAllowedIP(peerKey string, allowedIP string) error
17+
AddAllowedIP(peerKey string, allowedIP netip.Prefix) error
18+
RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
1819
Close()
1920
GetStats() (map[string]configurer.WGStats, error)
2021
FullStats() (*configurer.Stats, error)

‎client/iface/iface.go

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -111,14 +111,14 @@ func (w *WGIface) UpdateAddr(newAddr string) error {
111111
}
112112

113113
// UpdatePeer updates existing Wireguard Peer or creates a new one if doesn't exist
114-
// Endpoint is optional
114+
// Endpoint is optional.
115+
// If allowedIps is given it will be added to the existing ones.
115116
func (w *WGIface) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
116117
w.mu.Lock()
117118
defer w.mu.Unlock()
118119

119-
netIPNets := prefixesToIPNets(allowedIps)
120-
log.Debugf("updating interface %s peer %s, endpoint %s", w.tun.DeviceName(), peerKey, endpoint)
121-
return w.configurer.UpdatePeer(peerKey, netIPNets, keepAlive, endpoint, preSharedKey)
120+
log.Debugf("updating interface %s peer %s, endpoint %s, allowedIPs %v", w.tun.DeviceName(), peerKey, endpoint, allowedIps)
121+
return w.configurer.UpdatePeer(peerKey, allowedIps, keepAlive, endpoint, preSharedKey)
122122
}
123123

124124
// RemovePeer removes a Wireguard Peer from the interface iface
@@ -131,7 +131,7 @@ func (w *WGIface) RemovePeer(peerKey string) error {
131131
}
132132

133133
// AddAllowedIP adds a prefix to the allowed IPs list of peer
134-
func (w *WGIface) AddAllowedIP(peerKey string, allowedIP string) error {
134+
func (w *WGIface) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
135135
w.mu.Lock()
136136
defer w.mu.Unlock()
137137

@@ -140,7 +140,7 @@ func (w *WGIface) AddAllowedIP(peerKey string, allowedIP string) error {
140140
}
141141

142142
// RemoveAllowedIP removes a prefix from the allowed IPs list of peer
143-
func (w *WGIface) RemoveAllowedIP(peerKey string, allowedIP string) error {
143+
func (w *WGIface) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error {
144144
w.mu.Lock()
145145
defer w.mu.Unlock()
146146

@@ -254,14 +254,3 @@ func (w *WGIface) GetNet() *netstack.Net {
254254

255255
return w.tun.GetNet()
256256
}
257-
258-
func prefixesToIPNets(prefixes []netip.Prefix) []net.IPNet {
259-
ipNets := make([]net.IPNet, len(prefixes))
260-
for i, prefix := range prefixes {
261-
ipNets[i] = net.IPNet{
262-
IP: net.IP(prefix.Addr().AsSlice()), // Convert netip.Addr to net.IP
263-
Mask: net.CIDRMask(prefix.Bits(), prefix.Addr().BitLen()), // Create subnet mask
264-
}
265-
}
266-
return ipNets
267-
}

‎client/internal/engine_test.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,8 @@ type MockWGIface struct {
8686
UpdateAddrFunc func(newAddr string) error
8787
UpdatePeerFunc func(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
8888
RemovePeerFunc func(peerKey string) error
89-
AddAllowedIPFunc func(peerKey string, allowedIP string) error
90-
RemoveAllowedIPFunc func(peerKey string, allowedIP string) error
89+
AddAllowedIPFunc func(peerKey string, allowedIP netip.Prefix) error
90+
RemoveAllowedIPFunc func(peerKey string, allowedIP netip.Prefix) error
9191
CloseFunc func() error
9292
SetFilterFunc func(filter device.PacketFilter) error
9393
GetFilterFunc func() device.PacketFilter
@@ -147,11 +147,11 @@ func (m *MockWGIface) RemovePeer(peerKey string) error {
147147
return m.RemovePeerFunc(peerKey)
148148
}
149149

150-
func (m *MockWGIface) AddAllowedIP(peerKey string, allowedIP string) error {
150+
func (m *MockWGIface) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
151151
return m.AddAllowedIPFunc(peerKey, allowedIP)
152152
}
153153

154-
func (m *MockWGIface) RemoveAllowedIP(peerKey string, allowedIP string) error {
154+
func (m *MockWGIface) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error {
155155
return m.RemoveAllowedIPFunc(peerKey, allowedIP)
156156
}
157157

‎client/internal/iface_common.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ type wgIfaceBase interface {
2828
GetProxy() wgproxy.Proxy
2929
UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
3030
RemovePeer(peerKey string) error
31-
AddAllowedIP(peerKey string, allowedIP string) error
32-
RemoveAllowedIP(peerKey string, allowedIP string) error
31+
AddAllowedIP(peerKey string, allowedIP netip.Prefix) error
32+
RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
3333
Close() error
3434
SetFilter(filter device.PacketFilter) error
3535
GetFilter() device.PacketFilter

‎client/internal/routemanager/iface/iface_common.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,15 @@ package iface
22

33
import (
44
"net"
5+
"net/netip"
56

67
"github.com/netbirdio/netbird/client/iface/device"
78
"github.com/netbirdio/netbird/client/iface/wgaddr"
89
)
910

1011
type wgIfaceBase interface {
11-
AddAllowedIP(peerKey string, allowedIP string) error
12-
RemoveAllowedIP(peerKey string, allowedIP string) error
12+
AddAllowedIP(peerKey string, allowedIP netip.Prefix) error
13+
RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
1314

1415
Name() string
1516
Address() wgaddr.Address

‎client/internal/routemanager/manager.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -159,10 +159,10 @@ func (m *DefaultManager) setupRefCounters(useNoop bool) {
159159
m.allowedIPsRefCounter = refcounter.New(
160160
func(prefix netip.Prefix, peerKey string) (string, error) {
161161
// save peerKey to use it in the remove function
162-
return peerKey, m.wgInterface.AddAllowedIP(peerKey, prefix.String())
162+
return peerKey, m.wgInterface.AddAllowedIP(peerKey, prefix)
163163
},
164164
func(prefix netip.Prefix, peerKey string) error {
165-
if err := m.wgInterface.RemoveAllowedIP(peerKey, prefix.String()); err != nil {
165+
if err := m.wgInterface.RemoveAllowedIP(peerKey, prefix); err != nil {
166166
if !errors.Is(err, configurer.ErrPeerNotFound) && !errors.Is(err, configurer.ErrAllowedIPNotFound) {
167167
return err
168168
}

0 commit comments

Comments
 (0)