Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generate network maps for routed network #2068

Merged
merged 26 commits into from
Jul 3, 2024
Merged

Generate network maps for routed network #2068

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
574dc50
extends route with access control groups
bcmmbaga May 21, 2024
d6ab64c
add support for creating and updating routes with access control groups
bcmmbaga May 21, 2024
00fd7d3
Add access control groups to routes API request and response
bcmmbaga May 21, 2024
cda9c7e
fix tests
bcmmbaga May 22, 2024
17f6984
fix tests
bcmmbaga May 22, 2024
79fcb04
Add network map processing for routed networks
bcmmbaga May 28, 2024
10ebf1c
Refactor FirewallRule message and add RouteFirewallRule
bcmmbaga May 30, 2024
a9cb906
Refactor enum and field names in management proto files
bcmmbaga May 30, 2024
8e60f79
Refactor firewall rules and add route firewall rules
bcmmbaga May 30, 2024
564482e
Add firewall rules for routed networks
bcmmbaga May 30, 2024
69df319
Refactor enums and remove redundant code
bcmmbaga May 30, 2024
bf67e73
fix lint errors
bcmmbaga May 31, 2024
35248ea
Move getAllRoutePoliciesFromGroups function to route.go
bcmmbaga Jun 2, 2024
58e99d7
Add tests for account peers routes firewall
bcmmbaga Jun 2, 2024
dc94586
Add support for port range in policy rules
bcmmbaga Jun 3, 2024
7498e93
Implement port range support in firewall rules
bcmmbaga Jun 3, 2024
c97ae04
fix tests
bcmmbaga Jun 3, 2024
b771f80
Fix sonarcloud
bcmmbaga Jun 6, 2024
655c967
Merge branch 'refs/heads/feature/network-route-access-control' into r…
bcmmbaga Jun 6, 2024
a53242f
Refactor
bcmmbaga Jun 6, 2024
ea89187
Replace PeerIP with SourceRange in RouteFirewallRule.
bcmmbaga Jun 10, 2024
a6c70ea
Add CIDR notation to source range
bcmmbaga Jun 10, 2024
8a9ab88
fix sonarlint
bcmmbaga Jun 10, 2024
9e6ef96
Merge branch 'refs/heads/feature/network-route-access-control' into r…
bcmmbaga Jun 20, 2024
37dcf73
Fix merge
bcmmbaga Jun 20, 2024
3053425
Add dynamic routing capabilities and allow all traffic for routes wit…
bcmmbaga Jun 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
124 changes: 62 additions & 62 deletions management/proto/management.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions management/proto/management.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -396,8 +396,8 @@ message PortInfo {

// RouteFirewallRule signifies a firewall rule applicable for a routed network.
message RouteFirewallRule {
// PeerIP IP address of the routing peer.
string peerIP = 1;
// sourceRange IP range of the routing peer.
string sourceRange = 1;

// Direction of the firewall.
RuleDirection direction = 2;
Expand Down
10 changes: 5 additions & 5 deletions management/server/route.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ import (

// RouteFirewallRule a firewall rule applicable for a routed network.
type RouteFirewallRule struct {
// PeerIP IP address of the routing peer.
PeerIP string
// SourceRange IP range of the routing peer.
SourceRange string

// Direction of the traffic
Direction int
Expand Down Expand Up @@ -354,7 +354,7 @@ func generateRouteFirewallRules(route *route.Route, rule *PolicyRule, groupPeers
}

baseRule := RouteFirewallRule{
PeerIP: peer.IP.String(),
SourceRange: peer.IP.String(),
bcmmbaga marked this conversation as resolved.
Show resolved Hide resolved
Direction: direction,
Action: string(rule.Action),
Destination: route.Network.String(),
Expand All @@ -375,7 +375,7 @@ func generateRouteFirewallRules(route *route.Route, rule *PolicyRule, groupPeers

// generateRuleIDBase generates the base rule ID for checking duplicates.
func generateRuleIDBase(rule *PolicyRule, baseRule RouteFirewallRule) string {
return rule.ID + baseRule.PeerIP + strconv.Itoa(firewallRuleDirectionIN) + baseRule.Protocol + baseRule.Action
return rule.ID + baseRule.SourceRange + strconv.Itoa(firewallRuleDirectionIN) + baseRule.Protocol + baseRule.Action
}

// generateRulesForPeer generates rules for a given peer based on ports and port ranges.
Expand Down Expand Up @@ -457,7 +457,7 @@ func toProtocolRoutesFirewallRules(rules []*RouteFirewallRule) []*proto.RouteFir
for i := range rules {
rule := rules[i]
result[i] = &proto.RouteFirewallRule{
PeerIP: rule.PeerIP,
SourceRange: rule.SourceRange,
Direction: getProtoDirection(rule.Direction),
Action: getProtoAction(rule.Action),
NetworkType: getProtoNetworkType(rule.NetworkType),
Expand Down
16 changes: 8 additions & 8 deletions management/server/route_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1459,7 +1459,7 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {

expectedRoutesFirewallRules := []*RouteFirewallRule{
{
PeerIP: peerCIp,
SourceRange: peerCIp,
Direction: firewallRuleDirectionIN,
Action: "accept",
Destination: "192.168.0.0/16",
Expand All @@ -1468,7 +1468,7 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
Port: 80,
},
{
PeerIP: peerCIp,
SourceRange: peerCIp,
Direction: firewallRuleDirectionIN,
Action: "accept",
Destination: "192.168.0.0/16",
Expand All @@ -1477,7 +1477,7 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
Port: 320,
},
{
PeerIP: peerHIp,
SourceRange: peerHIp,
Direction: firewallRuleDirectionIN,
Action: "accept",
Destination: "192.168.0.0/16",
Expand All @@ -1486,7 +1486,7 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
Port: 80,
},
{
PeerIP: peerHIp,
SourceRange: peerHIp,
Direction: firewallRuleDirectionIN,
Action: "accept",
Destination: "192.168.0.0/16",
Expand All @@ -1495,7 +1495,7 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
Port: 320,
},
{
PeerIP: peerBIp,
SourceRange: peerBIp,
Direction: firewallRuleDirectionIN,
Action: "accept",
Destination: "192.168.0.0/16",
Expand All @@ -1504,7 +1504,7 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
Port: 80,
},
{
PeerIP: peerBIp,
SourceRange: peerBIp,
Direction: firewallRuleDirectionIN,
Action: "accept",
Destination: "192.168.0.0/16",
Expand All @@ -1526,7 +1526,7 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {

expectedRoutesFirewallRules = []*RouteFirewallRule{
{
PeerIP: "100.65.250.202",
SourceRange: "100.65.250.202",
Direction: firewallRuleDirectionIN,
Action: "accept",
Destination: existingNetwork,
Expand All @@ -1535,7 +1535,7 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
PortRange: RulePortRange{Start: 80, End: 350},
},
{
PeerIP: "100.65.13.186",
SourceRange: "100.65.13.186",
Direction: firewallRuleDirectionIN,
Action: "accept",
Destination: existingNetwork,
Expand Down
Loading