[management] Skip account peers update if no changes affect peers

go.mod

@@ -70,7 +70,7 @@ require (
  github.com/pion/transport/v3 v3.0.1
  github.com/pion/turn/v3 v3.0.1
  github.com/prometheus/client_golang v1.19.1
- github.com/r3labs/diff v1.1.0
+ github.com/r3labs/diff/v3 v3.0.1
  github.com/rs/xid v1.3.0
  github.com/shirou/gopsutil/v3 v3.24.4
  github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
@@ -211,6 +211,8 @@ require (
  github.com/tklauser/go-sysconf v0.3.14 // indirect
  github.com/tklauser/numcpus v0.8.0 // indirect
  github.com/vishvananda/netns v0.0.4 // indirect
+ github.com/vmihailenco/msgpack/v5 v5.3.5 // indirect
+ github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
  github.com/yuin/goldmark v1.7.1 // indirect
  github.com/zeebo/blake3 v0.2.3 // indirect
  go.opencensus.io v0.24.0 // indirect

go.sum

@@ -605,8 +605,8 @@ github.com/prometheus/common v0.53.0 h1:U2pL9w9nmJwJDa4qqLQ3ZaePJ6ZTwt7cMD3AG3+a
 github.com/prometheus/common v0.53.0/go.mod h1:BrxBKv3FWBIGXw89Mg1AeBq7FSyRzXWI3l3e7W3RN5U=
 github.com/prometheus/procfs v0.15.0 h1:A82kmvXJq2jTu5YUhSGNlYoxh85zLnKgPz4bMZgI5Ek=
 github.com/prometheus/procfs v0.15.0/go.mod h1:Y0RJ/Y5g5wJpkTisOtqwDSo4HwhGmLB4VQSw2sQJLHk=
-github.com/r3labs/diff v1.1.0 h1:V53xhrbTHrWFWq3gI4b94AjgEJOerO1+1l0xyHOBi8M=
-github.com/r3labs/diff v1.1.0/go.mod h1:7WjXasNzi0vJetRcB/RqNl5dlIsmXcTTLmF5IoH6Xig=
+github.com/r3labs/diff/v3 v3.0.1 h1:CBKqf3XmNRHXKmdU7mZP1w7TV0pDyVCis1AUHtA4Xtg=
+github.com/r3labs/diff/v3 v3.0.1/go.mod h1:f1S9bourRbiM66NskseyUdo0fTmEE0qKrikYJX63dgo=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
@@ -699,6 +699,10 @@ github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhg
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+github.com/vmihailenco/msgpack/v5 v5.3.5 h1:5gO0H1iULLWGhs2H5tbAHIZTV8/cYafcFOr9znI5mJU=
+github.com/vmihailenco/msgpack/v5 v5.3.5/go.mod h1:7xyJ9e+0+9SaZT0Wt1RGleJXzli6Q/V5KbhBonMG9jc=
+github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
+github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=

management/server/account.go

@@ -96,7 +96,6 @@ type AccountManager interface {
  DeletePAT(ctx context.Context, accountID string, initiatorUserID string, targetUserID string, tokenID string) error
  GetPAT(ctx context.Context, accountID string, initiatorUserID string, targetUserID string, tokenID string) (*PersonalAccessToken, error)
  GetAllPATs(ctx context.Context, accountID string, initiatorUserID string, targetUserID string) ([]*PersonalAccessToken, error)
- UpdatePeerSSHKey(ctx context.Context, peerID string, sshKey string) error
  GetUsersFromAccount(ctx context.Context, accountID, userID string) ([]*UserInfo, error)
  GetGroup(ctx context.Context, accountId, groupID, userID string) (*nbgroup.Group, error)
  GetAllGroups(ctx context.Context, accountID, userID string) ([]*nbgroup.Group, error)
@@ -478,12 +477,12 @@ func (a *Account) GetPeerNetworkMap(
  }
 
  nm := &NetworkMap{
- Peers: peersToConnect,
- Network: a.Network.Copy(),
- Routes: routesUpdate,
- DNSConfig: dnsUpdate,
- OfflinePeers: expiredPeers,
- FirewallRules: firewallRules,
+ Peers:  peersToConnect,
+ Network:  a.Network.Copy(),
+ Routes:  routesUpdate,
+ DNSConfig:  dnsUpdate,
+ OfflinePeers:  expiredPeers,
+ FirewallRules:  firewallRules,
  RoutesFirewallRules: routesFirewallRules,
  }
 
@@ -1860,7 +1859,9 @@ func (am *DefaultAccountManager) syncJWTGroups(ctx context.Context, accountID st
  // Propagate changes to peers if group propagation is enabled
  if settings.GroupsPropagationEnabled {
  log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating account peers", claims.UserId)
- am.updateAccountPeers(ctx, account)
+ if areGroupChangesAffectPeers(account, addNewGroups) || areGroupChangesAffectPeers(account, removeOldGroups) {
+ am.updateAccountPeers(ctx, account)
+ }
  }
 
  for _, g := range addNewGroups {

management/server/account_test.go

@@ -1133,14 +1133,34 @@ func TestAccountManager_AddPeerWithUserID(t *testing.T) {
 func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
  manager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
- updMsg := manager.peersUpdateManager.CreateChannel(context.Background(), peer1.ID)
- defer manager.peersUpdateManager.CloseChannel(context.Background(), peer1.ID)
-
  group := group.Group{
- ID: "group-id",
+ ID: "groupA",
  Name: "GroupA",
- Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+ Peers: []string{},
+ }
+ if err := manager.SaveGroup(context.Background(), account.Id, userID, &group); err != nil {
+ t.Errorf("save group: %v", err)
+ return
+ }
+
+ policy := Policy{
+ ID: "policy",
+ Enabled: true,
+ Rules: []*PolicyRule{
+ {
+ Enabled: true,
+ Sources: []string{"groupA"},
+ Destinations: []string{"groupA"},
+ Bidirectional: true,
+ Action: PolicyTrafficActionAccept,
+ },
+ },
  }
+ err := manager.SavePolicy(context.Background(), account.Id, userID, &policy, false)
+ require.NoError(t, err)
+
+ updMsg := manager.peersUpdateManager.CreateChannel(context.Background(), peer1.ID)
+ defer manager.peersUpdateManager.CloseChannel(context.Background(), peer1.ID)
 
  wg := sync.WaitGroup{}
  wg.Add(1)
@@ -1154,6 +1174,7 @@ func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
  }
  }()
 
+ group.Peers = []string{peer1.ID, peer2.ID, peer3.ID}
  if err := manager.SaveGroup(context.Background(), account.Id, userID, &group); err != nil {
  t.Errorf("save group: %v", err)
  return
@@ -1189,7 +1210,17 @@ func TestAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
- manager, account, peer1, _, _ := setupNetworkMapTest(t)
+ manager, account, peer1, peer2, _ := setupNetworkMapTest(t)
+
+ group := group.Group{
+ ID: "groupA",
+ Name: "GroupA",
+ Peers: []string{peer1.ID, peer2.ID},
+ }
+ if err := manager.SaveGroup(context.Background(), account.Id, userID, &group); err != nil {
+ t.Errorf("save group: %v", err)
+ return
+ }
 
  updMsg := manager.peersUpdateManager.CreateChannel(context.Background(), peer1.ID)
  defer manager.peersUpdateManager.CloseChannel(context.Background(), peer1.ID)
@@ -1199,8 +1230,8 @@ func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
  Rules: []*PolicyRule{
  {
  Enabled: true,
- Sources: []string{"group-id"},
- Destinations: []string{"group-id"},
+ Sources: []string{"groupA"},
+ Destinations: []string{"groupA"},
  Bidirectional: true,
  Action: PolicyTrafficActionAccept,
  },
@@ -1219,17 +1250,45 @@ func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
  }
  }()
 
-  if err := manager.SavePolicy(context.Background(), account.Id, userID, &policy, false); err != nil {
-  t.Errorf("delete default rule: %v", err)
-  return
-  }
+ if err := manager.SavePolicy(context.Background(), account.Id, userID, &policy, false); err != nil {
+ t.Errorf("delete default rule: %v", err)
+ return
+ }
 
  wg.Wait()
 }
 
 func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
  manager, account, peer1, _, peer3 := setupNetworkMapTest(t)
 
+ group := group.Group{
+ ID: "groupA",
+ Name: "GroupA",
+ Peers: []string{peer1.ID, peer3.ID},
+ }
+ if err := manager.SaveGroup(context.Background(), account.Id, userID, &group); err != nil {
+ t.Errorf("save group: %v", err)
+ return
+ }
+
+ policy := Policy{
+ Enabled: true,
+ Rules: []*PolicyRule{
+ {
+ Enabled: true,
+ Sources: []string{"groupA"},
+ Destinations: []string{"groupA"},
+ Bidirectional: true,
+ Action: PolicyTrafficActionAccept,
+ },
+ },
+ }
+
+ if err := manager.SavePolicy(context.Background(), account.Id, userID, &policy, false); err != nil {
+ t.Errorf("save policy: %v", err)
+ return
+ }
+
  updMsg := manager.peersUpdateManager.CreateChannel(context.Background(), peer1.ID)
  defer manager.peersUpdateManager.CloseChannel(context.Background(), peer1.ID)
 
@@ -1260,7 +1319,7 @@ func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
  defer manager.peersUpdateManager.CloseChannel(context.Background(), peer1.ID)
 
  group := group.Group{
- ID: "group-id",
+ ID: "groupA",
  Name: "GroupA",
  Peers: []string{peer1.ID, peer2.ID, peer3.ID},
  }
@@ -1270,8 +1329,8 @@ func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
  Rules: []*PolicyRule{
  {
  Enabled: true,
- Sources: []string{"group-id"},
- Destinations: []string{"group-id"},
+ Sources: []string{"groupA"},
+ Destinations: []string{"groupA"},
  Bidirectional: true,
  Action: PolicyTrafficActionAccept,
  },
@@ -1283,7 +1342,7 @@ func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
  return
  }
 
- if err := manager.SavePolicy(context.Background(), account.Id, userID, &policy); err != nil {
+ if err := manager.SavePolicy(context.Background(), account.Id, userID, &policy, false); err != nil {
  t.Errorf("save policy: %v", err)
  return
  }
@@ -2420,6 +2479,10 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *Account, *nbpee
  peer, _, _, err := manager.AddPeer(context.Background(), setupKey.Key, "", &nbpeer.Peer{
  Key: expectedPeerKey,
  Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+ Status: &nbpeer.PeerStatus{
+ Connected: true,
+ LastSeen: time.Now().UTC(),
+ },
  })
  if err != nil {
  t.Fatalf("expecting peer to be added, got failure %v", err)
@@ -2434,3 +2497,26 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *Account, *nbpee
 
  return manager, account, peer1, peer2, peer3
 }
+
+func peerShouldNotReceiveUpdate(t *testing.T, updateMessage <-chan *UpdateMessage) {
+ t.Helper()
+ select {
+ case msg := <-updateMessage:
+ t.Errorf("Unexpected message received: %+v", msg)
+ case <-time.After(500 * time.Millisecond):
+ return
+ }
+}
+
+func peerShouldReceiveUpdate(t *testing.T, updateMessage <-chan *UpdateMessage) {
+ t.Helper()
+
+ select {
+ case msg := <-updateMessage:
+ if msg == nil {
+ t.Errorf("Received nil update message, expected valid message")
+ }
+ case <-time.After(500 * time.Millisecond):
+ t.Error("Timed out waiting for update message")
+ }
+}

management/server/differs/netip.go

@@ -0,0 +1,82 @@
+package differs
+
+import (
+ "fmt"
+ "net/netip"
+ "reflect"
+
+ "github.com/r3labs/diff/v3"
+)
+
+// NetIPAddr is a custom differ for netip.Addr
+type NetIPAddr struct {
+ DiffFunc func(path []string, a, b reflect.Value, p interface{}) error
+}
+
+func (differ NetIPAddr) Match(a, b reflect.Value) bool {
+ return diff.AreType(a, b, reflect.TypeOf(netip.Addr{}))
+}
+
+func (differ NetIPAddr) Diff(_ diff.DiffType, _ diff.DiffFunc, cl *diff.Changelog, path []string, a, b reflect.Value, _ interface{}) error {
+ if a.Kind() == reflect.Invalid {
+ cl.Add(diff.CREATE, path, nil, b.Interface())
+ return nil
+ }
+
+ if b.Kind() == reflect.Invalid {
+ cl.Add(diff.DELETE, path, a.Interface(), nil)
+ return nil
+ }
+
+ fromAddr, ok1 := a.Interface().(netip.Addr)
+ toAddr, ok2 := b.Interface().(netip.Addr)
+ if !ok1 || !ok2 {
+ return fmt.Errorf("invalid type for netip.Addr")
+ }
+
+ if fromAddr.String() != toAddr.String() {
+ cl.Add(diff.UPDATE, path, fromAddr.String(), toAddr.String())
+ }
+
+ return nil
+}
+
+func (differ NetIPAddr) InsertParentDiffer(dfunc func(path []string, a, b reflect.Value, p interface{}) error) {
+ differ.DiffFunc = dfunc //nolint
+}
+
+// NetIPPrefix is a custom differ for netip.Prefix
+type NetIPPrefix struct {
+ DiffFunc func(path []string, a, b reflect.Value, p interface{}) error
+}
+
+func (differ NetIPPrefix) Match(a, b reflect.Value) bool {
+ return diff.AreType(a, b, reflect.TypeOf(netip.Prefix{}))
+}
+
+func (differ NetIPPrefix) Diff(_ diff.DiffType, _ diff.DiffFunc, cl *diff.Changelog, path []string, a, b reflect.Value, _ interface{}) error {
+ if a.Kind() == reflect.Invalid {
+ cl.Add(diff.CREATE, path, nil, b.Interface())
+ return nil
+ }
+ if b.Kind() == reflect.Invalid {
+ cl.Add(diff.DELETE, path, a.Interface(), nil)
+ return nil
+ }
+
+ fromPrefix, ok1 := a.Interface().(netip.Prefix)
+ toPrefix, ok2 := b.Interface().(netip.Prefix)
+ if !ok1 || !ok2 {
+ return fmt.Errorf("invalid type for netip.Addr")
+ }
+
+ if fromPrefix.String() != toPrefix.String() {
+ cl.Add(diff.UPDATE, path, fromPrefix.String(), toPrefix.String())
+ }
+
+ return nil
+}
+
+func (differ NetIPPrefix) InsertParentDiffer(dfunc func(path []string, a, b reflect.Value, p interface{}) error) {
+ differ.DiffFunc = dfunc //nolint
+}

management/server/dns.go

@@ -125,26 +125,29 @@ func (am *DefaultAccountManager) SaveDNSSettings(ctx context.Context, accountID
  oldSettings := account.DNSSettings.Copy()
  account.DNSSettings = dnsSettingsToSave.Copy()
 
+ addedGroups := difference(dnsSettingsToSave.DisabledManagementGroups, oldSettings.DisabledManagementGroups)
+ removedGroups := difference(oldSettings.DisabledManagementGroups, dnsSettingsToSave.DisabledManagementGroups)
+
  account.Network.IncSerial()
  if err = am.Store.SaveAccount(ctx, account); err != nil {
  return err
  }
 
- addedGroups := difference(dnsSettingsToSave.DisabledManagementGroups, oldSettings.DisabledManagementGroups)
  for _, id := range addedGroups {
  group := account.GetGroup(id)
  meta := map[string]any{"group": group.Name, "group_id": group.ID}
  am.StoreEvent(ctx, userID, accountID, accountID, activity.GroupAddedToDisabledManagementGroups, meta)
  }
 
- removedGroups := difference(oldSettings.DisabledManagementGroups, dnsSettingsToSave.DisabledManagementGroups)
  for _, id := range removedGroups {
  group := account.GetGroup(id)
  meta := map[string]any{"group": group.Name, "group_id": group.ID}
  am.StoreEvent(ctx, userID, accountID, accountID, activity.GroupRemovedFromDisabledManagementGroups, meta)
  }
 
- am.updateAccountPeers(ctx, account)
+ if anyGroupHasPeers(account, addedGroups) || anyGroupHasPeers(account, removedGroups) {
+ am.updateAccountPeers(ctx, account)
+ }
 
  return nil
 }