networkmap

package
v0.78.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 4, 2026 License: BSD-3-Clause Imports: 21 Imported by: 0

Documentation

Overview

Package networkmap contains the shared NetworkMap helpers that both the management server and the client agent need.

The proto-conversion helpers (types.NetworkMap → proto.NetworkMap) live here so the client can run the same conversion locally after deriving its NetworkMap from a NetworkMapEnvelope, without taking a dependency on the server-side conversion package (which pulls in cloud integrations and is otherwise an unwanted internal import on the client).

The helpers are pure functions over inputs — no caches, no IO, no logging beyond a context-aware error log when an individual user-id hash fails.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func AppendRemotePeerConfig 

func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nmdata.Peer, dnsName string, includeIPv6 bool, localIsProxy bool) []*proto.RemotePeerConfig

AppendRemotePeerConfig appends typed peers as proto.RemotePeerConfig entries to dst and returns the result. localIsProxy reports whether the peer receiving this config is itself an embedded proxy.

func BuildAuthorizedUsersProto 

func BuildAuthorizedUsersProto(ctx context.Context, authorizedUsers map[string]map[string]struct{}) ([][]byte, map[string]*proto.MachineUserIndexes)

BuildAuthorizedUsersProto deduplicates user-IDs into a hashed list and builds per-machine-user index maps. Returns (hashedUsers, machineUsers). Errors from individual hash failures are logged via the provided context; they leave the offending user out of the result but don't abort the build.

func ConvertToProtoCustomZone 

func ConvertToProtoCustomZone(zone nbdns.CustomZone) *proto.CustomZone

ConvertToProtoCustomZone converts an nbdns.CustomZone to its proto form.

func ConvertToProtoNameServerGroup 

func ConvertToProtoNameServerGroup(nsGroup *nbdns.NameServerGroup) *proto.NameServerGroup

ConvertToProtoNameServerGroup converts a NameServerGroup to its proto form.

func DecodeEnvelope 

func DecodeEnvelope(ctx context.Context, env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents, error)

DecodeEnvelope converts a NetworkMapEnvelope into a NetworkMapComponents the client can run Calculate() over. Every ID-reference on the wire is a xid from corresponding public_id field.

ID scheme on the client side: 

Peers              base64(wg_pub_key)          // stable across snapshots

func GetProtoAction 

func GetProtoAction(action string) proto.RuleAction

GetProtoAction converts the action to proto.RuleAction.

func GetProtoDirection 

func GetProtoDirection(direction int) proto.RuleDirection

GetProtoDirection converts the direction to proto.RuleDirection.

func GetProtoPortInfo 

func GetProtoPortInfo(rule *types.RouteFirewallRule) *proto.PortInfo

GetProtoPortInfo converts route-firewall-rule port info to proto.PortInfo.

func GetProtoProtocol 

func GetProtoProtocol(protocol string) proto.RuleProtocol

GetProtoProtocol converts the protocol to proto.RuleProtocol.

func PeersCustomZone added in v0.78.0 

func PeersCustomZone(ctx context.Context, accountID string, dnsDomain string, peers map[string]*nmdata.Peer, ipv6AllowedPeers map[string]struct{}) nmdata.CustomZone

PeersCustomZone builds the peers DNS zone from twin peer rows. It is the single source of the zone-record logic; Account.GetPeersCustomZone delegates here via twins.

func ShouldUsePortRange 

func ShouldUsePortRange(rule *proto.FirewallRule) bool

ShouldUsePortRange reports whether the firewall rule should use a port range rather than a single port (TCP/UDP without a single port).

func ToProtocolDNSConfig 

func ToProtocolDNSConfig(update nbdns.Config, cache DNSConfigCache, forwardPort int64) *proto.DNSConfig

ToProtocolDNSConfig converts nbdns.Config to proto.DNSConfig. If cache is non-nil, NameServerGroup proto values are cached by NSG.ID across calls — the server amortises this across peers, the client passes nil.

func ToProtocolFirewallRules 

func ToProtocolFirewallRules(rules []*types.FirewallRule, includeIPv6, useSourcePrefixes bool) []*proto.FirewallRule

ToProtocolFirewallRules converts the firewall rules to the protocol form. When useSourcePrefixes is true, the compact SourcePrefixes field is populated alongside the deprecated PeerIP for forward compatibility. Wildcard rules ("0.0.0.0") are expanded into separate v4/v6 SourcePrefixes when includeIPv6 is true.

func ToProtocolRoute 

func ToProtocolRoute(route *nmdata.Route) *proto.Route

ToProtocolRoute converts one typed route to its proto form.

func ToProtocolRoutes 

func ToProtocolRoutes(routes []*nmdata.Route) []*proto.Route

ToProtocolRoutes converts a slice of typed routes to their proto form.

func ToProtocolRoutesFirewallRules 

func ToProtocolRoutesFirewallRules(rules []*types.RouteFirewallRule) []*proto.RouteFirewallRule

ToProtocolRoutesFirewallRules converts a slice of typed route-firewall rules to proto.

Types

type AppliedZoneCandidate added in v0.78.0 

type AppliedZoneCandidate struct {
	DistributionGroups []string
	Zone               nmdata.CustomZone
}

AppliedZoneCandidate is an account-level custom DNS zone reduced to the per-peer decision the components calc still makes: include the zone only when the peer belongs to one of its distribution groups. Record conversion is done once at build time.

type DNSConfigCache 

type DNSConfigCache interface {
	GetNameServerGroup(key string) (*proto.NameServerGroup, bool)
	SetNameServerGroup(key string, value *proto.NameServerGroup)
}

DNSConfigCache is the cache contract for amortising NameServerGroup proto-conversion across peers in the same account. Server uses a concrete implementation; client passes nil (no cross-peer caching needed when rebuilding a single NetworkMap from an envelope).

type EnvelopeResult 

type EnvelopeResult struct {
	NetworkMap *proto.NetworkMap
	Components *types.NetworkMapComponents
}

EnvelopeResult is what the client engine consumes after receiving a component-format NetworkMap. Both fields are populated:

  • NetworkMap is the *proto.NetworkMap shape the engine reads today via update.GetNetworkMap() — built from the envelope's components by running Calculate() locally + converting back through the shared proto helpers + merging the optional ProxyPatch.
  • Components is the *types.NetworkMapComponents the engine retains so future incremental delta updates have a base to apply changes against. The client keeps it under its sync lock.

func EnvelopeToNetworkMap 

func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, localPeerKey, dnsName string) (*EnvelopeResult, error)

EnvelopeToNetworkMap is the full client-side pipeline: decode the component envelope back to a typed NetworkMapComponents, run Calculate() locally to produce the typed NetworkMap, convert it to the wire form the engine consumes, and fold in any ProxyPatch the server attached.

localPeerKey is the receiving peer's WG pub key (used to derive includeIPv6 / useSourcePrefixes from the receiving peer's own record in the components struct, mirroring legacy ToSyncResponse behaviour).

dnsName is the account's DNS domain ("netbird.cloud" etc.); used when rebuilding the per-peer FQDNs that proto.RemotePeerConfig carries.

type NetworkMapData added in v0.78.0 

type NetworkMapData struct {
	Peers            map[string]*nmdata.Peer
	Groups           map[string]*nmdata.Group
	Policies         []*nmdata.Policy
	Routes           []*nmdata.Route
	NameServerGroups []*nmdata.NameServerGroup
	NetworkResources []*nmdata.NetworkResource

	Network         *nmdata.Network
	DNSSettings     *nmdata.DNSSettings
	AccountSettings *nmdata.AccountSettingsInfo

	PostureChecks map[string]*nmdata.PostureChecks

	// PostureValidation holds the precomputed posture-check results, keyed by
	// posture check ID then peer ID. Filled by PrecomputePostureValidation; a
	// present but nil inner map marks a check ID that resolves to no posture
	// check, which the calc treats as passing.
	PostureValidation map[string]map[string]bool

	AllowedUserIDs            map[string]struct{}
	NetworkXIDToPublicID      map[string]string
	PostureCheckXIDToPublicID map[string]string
	ValidatedPeers            map[string]struct{}
	ResourcePolicies          map[string][]*nmdata.Policy
	Routers                   map[string]map[string]*nmdata.NetworkRouter
	GroupIDToUserIDs          map[string][]string
	DNSDomain                 string

	// ProxyTargetedDomainResourceIDs is the account-level half of
	// forcesRoutingPeerDNSResolution: domain network resources targeted by an
	// enabled reverse-proxy service.
	ProxyTargetedDomainResourceIDs map[string]struct{}

	AppliedZoneCandidates    []AppliedZoneCandidate
	PrivateServiceCandidates []PrivateServiceCandidate

	// Services are the account's reverse-proxy services, persisted ones and
	// the in-memory ones synthesised from agent-network state. They are the
	// source of the proxy ACLs injectProxyPolicies synthesises, which no
	// builder can load because they are never written to the database.
	Services []*nmdata.Service

	// Domains are the account's registered reverse-proxy domains, used to
	// resolve the zone apex a private service's records hang under.
	Domains []nmdata.ProxyDomain
	// contains filtered or unexported fields
}

NetworkMapData is a dependency-light, slim twin of the server Account. It carries only the state GetPeerNetworkMapComponents needs, expressed in the fresh nmdata twin types. A builder converts an Account into a NetworkMapData once per account; the per-peer components calculation then runs on this twin with no reference back to the Account.

func (*NetworkMapData) BuildPrivateServiceCandidates added in v0.78.0 

func (nmd *NetworkMapData) BuildPrivateServiceCandidates()

BuildPrivateServiceCandidates derives the per-service DNS records a private service publishes, from the twin's own services. It is the counterpart of InjectProxyPolicies: that one synthesises the ACL half of a private service, this one the DNS half, and both read nmd.Services so a service added to the twin after it was loaded — an agent-network service is synthesised in memory and never persisted — reaches the peer with both halves rather than one.

The per-peer access-group gate and the merge by apex stay in the components calculation; this only precomputes what is account-wide.

func (*NetworkMapData) GetPeerGroups added in v0.78.0 

func (nmd *NetworkMapData) GetPeerGroups(peerID string) map[string]struct{}

GetPeerGroups returns the set of group IDs the peer belongs to. The underlying peer→groups index is built once per NetworkMapData and the returned set is shared — callers must not mutate it.

func (*NetworkMapData) GetPeerNetworkMapComponents added in v0.78.0 

func (nmd *NetworkMapData) GetPeerNetworkMapComponents(peerID string, peersCustomZone nmdata.CustomZone) *types.NetworkMapComponents

GetPeerNetworkMapComponents computes the peer's NetworkMapComponents from the slim twin store. It mirrors the former Account.GetPeerNetworkMapComponents exactly, operating on nmdata twins throughout — no Account reference and no twin↔real conversion, since the produced components hold twins.

func (*NetworkMapData) InjectProxyPolicies added in v0.78.0 

func (nmd *NetworkMapData) InjectProxyPolicies()

InjectProxyPolicies synthesises the in-memory ACLs that carry reverse-proxy traffic and appends them to the twin's policies. They are never persisted, so no builder can load them: a proxy-access policy lets a cluster's proxy peers reach each enabled target of a service, and a private-access policy lets a private service's AccessGroups reach those proxy peers on HTTP(S).

GetPeerNetworkMapComponents calls it, so every caller of the twin gets the same policy set no matter which builder produced it. It runs at most once per twin, and is safe to call again to force the synthesis early.

func (*NetworkMapData) PrecomputePostureValidation added in v0.78.0 

func (nmd *NetworkMapData) PrecomputePostureValidation()

type PrivateServiceCandidate added in v0.78.0 

type PrivateServiceCandidate struct {
	AccessGroups []string
	Zone         nmdata.CustomZone
}

PrivateServiceCandidate is a single private service's synthesized records, carried per apex zone. The builder resolves proxy-cluster connectivity and domain-suffix matching once; the calc merges the candidates whose AccessGroups the peer belongs to, grouped by Zone.Domain.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.