From a21605a1cf8b754d9febed34ce3a59a7acc68a11 Mon Sep 17 00:00:00 2001 From: ziti-ci Date: Sat, 17 Apr 2021 14:15:54 +0000 Subject: [PATCH 1/9] [ci skip] committing updated version related files --- service/ziti-tunnel/version.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/service/ziti-tunnel/version.go b/service/ziti-tunnel/version.go index 14f28fab..ad8e8496 100644 --- a/service/ziti-tunnel/version.go +++ b/service/ziti-tunnel/version.go @@ -21,8 +21,8 @@ package main const ( Version = "1.9.4" - Revision = "c5751307beae" + Revision = "bf21f40f8dbc" Branch = "release-next" BuildUser = "" - BuildDate = "2021-04-16 21:00:50" + BuildDate = "2021-04-17 14:10:53" ) From cd51730b576dfbf3c086fcdaa1a445f3b2104d2a Mon Sep 17 00:00:00 2001 From: Mary Lincy Dcouto Date: Sun, 18 Apr 2021 20:19:58 +0530 Subject: [PATCH 2/9] adding test nrpt policy function --- service/windns/windns.go | 48 ++++++++++++++++++++++++++++ service/ziti-tunnel/service/state.go | 26 +++++++-------- 2 files changed, 61 insertions(+), 13 deletions(-) diff --git a/service/windns/windns.go b/service/windns/windns.go index ae2897c0..f31c03f4 100644 --- a/service/windns/windns.go +++ b/service/windns/windns.go @@ -238,3 +238,51 @@ ForEach ($ns in $toRemove){ log.Errorf("ERROR removing nrpt rules: %v", err) } } + +func IsNrptPoliciesEffective() bool { + script := fmt.Sprintf(`Add-DnsClientNrptRule -Namespace ".ziti.test" -NameServers "100.64.0.1" -Comment "Added by ziti-tunnel" -DisplayName "ziti-tunnel:.ziti.test" + Get-DnsClientNrptPolicy -Effective | Select-Object Namespace -Unique | Where-Object Namespace -Eq ".ziti.test"`) + log.Debugf("checking the nrpt policies with: %s", script) + + cmd := exec.Command("powershell", "-Command", script) + cmd.Stderr = os.Stdout + output := new(bytes.Buffer) + cmd.Stdout = output + + err := cmd.Run() + if err != nil { + log.Errorf("ERROR removing all nrpt rules: %v", err) + } + + policyFound := false + for { + l, err := output.ReadString('\n') + policyOut := strings.Trim(l, "\r\n") + if err != nil { + break + } + + if strings.Compare(policyOut, ".ziti.test") == 0 { + policyFound = true + log.Debug("The nrpt policies are effective in this client") + removeSingleNrtpRule(".ziti.test") + break + } + } + return policyFound +} + +func removeSingleNrtpRule(nrptRule string) { + script := fmt.Sprintf(`Get-DnsClientNrptRule | where Namespace -eq "%s" | Remove-DnsClientNrptRule -Force -ErrorAction SilentlyContinue`, nrptRule) + log.Debugf("Removing the nrpt rule with: %s", script) + + cmd := exec.Command("powershell", "-Command", script) + cmd.Stderr = os.Stdout + output := new(bytes.Buffer) + cmd.Stdout = output + + err := cmd.Run() + if err != nil { + log.Errorf("ERROR removing the nrpt rules: %v", err) + } +} diff --git a/service/ziti-tunnel/service/state.go b/service/ziti-tunnel/service/state.go index aa625adb..ce0cf91c 100644 --- a/service/ziti-tunnel/service/state.go +++ b/service/ziti-tunnel/service/state.go @@ -20,25 +20,26 @@ package service import ( "bufio" "encoding/json" + "errors" "fmt" + "github.com/openziti/desktop-edge-win/service/cziti" + "github.com/openziti/desktop-edge-win/service/windns" + "github.com/openziti/desktop-edge-win/service/ziti-tunnel/config" + "github.com/openziti/desktop-edge-win/service/ziti-tunnel/constants" + "github.com/openziti/desktop-edge-win/service/ziti-tunnel/dto" + idcfg "github.com/openziti/sdk-golang/ziti/config" "golang.org/x/sys/windows" + "golang.org/x/sys/windows/registry" + "golang.zx2c4.com/wireguard/tun" + "golang.zx2c4.com/wireguard/windows/tunnel/winipcfg" "io" "io/ioutil" "net" "os" "path" + "strconv" "strings" "time" - "errors" - "strconv" - "github.com/openziti/desktop-edge-win/service/cziti" - "github.com/openziti/desktop-edge-win/service/ziti-tunnel/config" - "github.com/openziti/desktop-edge-win/service/ziti-tunnel/constants" - "github.com/openziti/desktop-edge-win/service/ziti-tunnel/dto" - idcfg "github.com/openziti/sdk-golang/ziti/config" - "golang.org/x/sys/windows/registry" - "golang.zx2c4.com/wireguard/tun" - "golang.zx2c4.com/wireguard/windows/tunnel/winipcfg" ) type RuntimeState struct { @@ -107,7 +108,6 @@ func backupConfig() (string, error) { return backup, err } - func (t *RuntimeState) ToStatus(onlyInitialized bool) dto.TunnelStatus { var uptime int64 @@ -223,7 +223,8 @@ func (t *RuntimeState) CreateTun(ipv4 string, ipv4mask int, applyDns bool) (net. } log.Info("routing applied") - if applyDns { + zitiPoliciesEffective := windns.IsNrptPoliciesEffective() + if applyDns || !zitiPoliciesEffective { //for windows 10+, could 'domains' be able to replace NRPT? dunno - didn't test it luid.SetDNS(windows.AF_INET, []net.IP{ip}, nil) } @@ -428,7 +429,6 @@ func UpdateRuntimeStateIpv4(ip string, ipv4Mask int, addDns string) error { } rts.SaveState() - return nil } From d2b81c612c24898b84dac1a3081687e75501418c Mon Sep 17 00:00:00 2001 From: Mary Lincy Dcouto Date: Sun, 18 Apr 2021 20:22:13 +0530 Subject: [PATCH 3/9] fixing format of code and log messages --- ZitiUpdateService/UpdateService.cs | 10 +++++----- service/ziti-tunnel/cli/service.go | 2 +- service/ziti-tunnel/cmd/update.go | 2 +- service/ziti-tunnel/dto/clidtos.go | 10 +++++----- service/ziti-tunnel/service/ipc.go | 4 ++-- 5 files changed, 14 insertions(+), 14 deletions(-) diff --git a/ZitiUpdateService/UpdateService.cs b/ZitiUpdateService/UpdateService.cs index 57fdf030..529ae040 100644 --- a/ZitiUpdateService/UpdateService.cs +++ b/ZitiUpdateService/UpdateService.cs @@ -214,7 +214,7 @@ namespace ZitiUpdateService { } return zipName; } catch (Exception ex) { - Logger.Error(ex, "Unexpected error {0}", ex.Message); + Logger.Error(ex, "Unexpected error in generating system files {0}", ex.Message); return null; } } @@ -233,7 +233,7 @@ namespace ZitiUpdateService { process.Start(); process.WaitForExit(); } catch (Exception ex) { - Logger.Error(ex, "Unexpected error {0}", ex.Message); + Logger.Error(ex, "Unexpected error in outputIpconfigInfo {0}", ex.Message); } } @@ -251,7 +251,7 @@ namespace ZitiUpdateService { process.Start(); process.WaitForExit(); } catch (Exception ex) { - Logger.Error(ex, "Unexpected error {0}", ex.Message); + Logger.Error(ex, "Unexpected error in outputSystemInfo {0}", ex.Message); } } @@ -269,7 +269,7 @@ namespace ZitiUpdateService { process.Start(); process.WaitForExit(); } catch (Exception ex) { - Logger.Error(ex, "Unexpected error {0}", ex.Message); + Logger.Error(ex, "Unexpected error in outputDnsCache {0}", ex.Message); } } @@ -283,7 +283,7 @@ namespace ZitiUpdateService { string responseBody = resp.Content.ReadAsStringAsync().Result; File.WriteAllText(extIpFile, responseBody); } catch (Exception ex) { - Logger.Error(ex, "Unexpected error {0}", ex.Message); + Logger.Error(ex, "Unexpected error in outputExternalIP {0}", ex.Message); } } diff --git a/service/ziti-tunnel/cli/service.go b/service/ziti-tunnel/cli/service.go index dd6ebcfb..bda4320d 100644 --- a/service/ziti-tunnel/cli/service.go +++ b/service/ziti-tunnel/cli/service.go @@ -19,9 +19,9 @@ package cli import ( "github.com/openziti/desktop-edge-win/service/ziti-tunnel/dto" + "net" "strconv" "strings" - "net" ) //GetIdentities is to fetch identities through cmdline diff --git a/service/ziti-tunnel/cmd/update.go b/service/ziti-tunnel/cmd/update.go index 25d2461c..a72d9958 100644 --- a/service/ziti-tunnel/cmd/update.go +++ b/service/ziti-tunnel/cmd/update.go @@ -37,7 +37,7 @@ var updateCmd = &cobra.Command{ flags := map[string]interface{}{} flags["CIDR"] = CIDR flags["AddDns"] = AddDns - cli.UpdateConfigIPSubnet(args,flags) + cli.UpdateConfigIPSubnet(args, flags) }, } diff --git a/service/ziti-tunnel/dto/clidtos.go b/service/ziti-tunnel/dto/clidtos.go index 6f7e840d..df93a954 100644 --- a/service/ziti-tunnel/dto/clidtos.go +++ b/service/ziti-tunnel/dto/clidtos.go @@ -27,11 +27,11 @@ type IdentityCli struct { } type ServiceCli struct { - Name string - Id string - Protocols string - Ports string - Addresses string + Name string + Id string + Protocols string + Ports string + Addresses string } type IdentityOnOffPayload struct { diff --git a/service/ziti-tunnel/service/ipc.go b/service/ziti-tunnel/service/ipc.go index d2343c10..f06e14ea 100644 --- a/service/ziti-tunnel/service/ipc.go +++ b/service/ziti-tunnel/service/ipc.go @@ -41,8 +41,8 @@ import ( "net" "os" "os/signal" - "strings" "strconv" + "strings" "sync" "time" ) @@ -645,7 +645,7 @@ func updateTunIpv4(out *json.Encoder, ip string, ipMask int, addDns string) { respondWithError(out, "Could not set Tun ip and mask", UNKNOWN_ERROR, err) return } - + respond(out, dto.Response{Message: "TunIPv4 and mask is set, Manual Restart is required", Code: SUCCESS, Error: "", Payload: ""}) } From 792a934de70d26cbf506aebdd9c61f50814e7408 Mon Sep 17 00:00:00 2001 From: Mary Lincy Dcouto Date: Mon, 19 Apr 2021 17:29:18 +0530 Subject: [PATCH 4/9] update release notes --- release-notes.md | 1 + 1 file changed, 1 insertion(+) diff --git a/release-notes.md b/release-notes.md index 821b8fc0..6394b297 100644 --- a/release-notes.md +++ b/release-notes.md @@ -8,6 +8,7 @@ ## Bugs fixed: * [#362](https://github.com/openziti/desktop-edge-win/issues/362) Update tun ip, mask and addDns flag +* [#364](https://github.com/openziti/desktop-edge-win/issues/364) Add the test nrpt policy function in the startup method ## Dependency Updates * none From 5d54e7edf1b8a54cde34018030814faee4c89816 Mon Sep 17 00:00:00 2001 From: Mary Lincy Dcouto Date: Mon, 19 Apr 2021 17:40:43 +0530 Subject: [PATCH 5/9] removing the test nrpt policy --- service/windns/windns.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/service/windns/windns.go b/service/windns/windns.go index f31c03f4..44ec0cc5 100644 --- a/service/windns/windns.go +++ b/service/windns/windns.go @@ -251,7 +251,7 @@ func IsNrptPoliciesEffective() bool { err := cmd.Run() if err != nil { - log.Errorf("ERROR removing all nrpt rules: %v", err) + log.Errorf("ERROR adding the test nrpt rules: %v", err) } policyFound := false @@ -265,10 +265,11 @@ func IsNrptPoliciesEffective() bool { if strings.Compare(policyOut, ".ziti.test") == 0 { policyFound = true log.Debug("The nrpt policies are effective in this client") - removeSingleNrtpRule(".ziti.test") break } } + removeSingleNrtpRule(".ziti.test") + return policyFound } From 72e46d893c4fb4f423d11f824009323664e89d67 Mon Sep 17 00:00:00 2001 From: Mary Lincy Dcouto Date: Mon, 19 Apr 2021 17:55:26 +0530 Subject: [PATCH 6/9] adding log --- service/ziti-tunnel/service/state.go | 1 + 1 file changed, 1 insertion(+) diff --git a/service/ziti-tunnel/service/state.go b/service/ziti-tunnel/service/state.go index ce0cf91c..e81a5549 100644 --- a/service/ziti-tunnel/service/state.go +++ b/service/ziti-tunnel/service/state.go @@ -225,6 +225,7 @@ func (t *RuntimeState) CreateTun(ipv4 string, ipv4mask int, applyDns bool) (net. zitiPoliciesEffective := windns.IsNrptPoliciesEffective() if applyDns || !zitiPoliciesEffective { + log.Info("DNS is applied to the TUN interface, because apply Dns flag in the config file : %t and ziti policies test result in this client: %t ", applyDns, zitiPoliciesEffective) //for windows 10+, could 'domains' be able to replace NRPT? dunno - didn't test it luid.SetDNS(windows.AF_INET, []net.IP{ip}, nil) } From 17dd0ef902d43b4aac90f1a5b9fafa91ccd4dda5 Mon Sep 17 00:00:00 2001 From: Mary Lincy Dcouto Date: Mon, 19 Apr 2021 17:59:25 +0530 Subject: [PATCH 7/9] returning if add nrpt rules fails --- service/windns/windns.go | 1 + service/ziti-tunnel/service/state.go | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/service/windns/windns.go b/service/windns/windns.go index 44ec0cc5..5f6124a5 100644 --- a/service/windns/windns.go +++ b/service/windns/windns.go @@ -252,6 +252,7 @@ func IsNrptPoliciesEffective() bool { err := cmd.Run() if err != nil { log.Errorf("ERROR adding the test nrpt rules: %v", err) + return false } policyFound := false diff --git a/service/ziti-tunnel/service/state.go b/service/ziti-tunnel/service/state.go index e81a5549..408e5416 100644 --- a/service/ziti-tunnel/service/state.go +++ b/service/ziti-tunnel/service/state.go @@ -225,7 +225,7 @@ func (t *RuntimeState) CreateTun(ipv4 string, ipv4mask int, applyDns bool) (net. zitiPoliciesEffective := windns.IsNrptPoliciesEffective() if applyDns || !zitiPoliciesEffective { - log.Info("DNS is applied to the TUN interface, because apply Dns flag in the config file : %t and ziti policies test result in this client: %t ", applyDns, zitiPoliciesEffective) + log.Info("DNS is applied to the TUN interface, because apply Dns flag in the config file: %t and ziti policies test result in this client: %t ", applyDns, zitiPoliciesEffective) //for windows 10+, could 'domains' be able to replace NRPT? dunno - didn't test it luid.SetDNS(windows.AF_INET, []net.IP{ip}, nil) } From dfdad6917b71ebf4e843aabb48eb0c3afb0c7927 Mon Sep 17 00:00:00 2001 From: Mary Lincy Dcouto Date: Mon, 19 Apr 2021 21:12:29 +0530 Subject: [PATCH 8/9] fix as per the code review comments --- service/windns/windns.go | 6 +++--- service/ziti-tunnel/service/state.go | 9 +++++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/service/windns/windns.go b/service/windns/windns.go index 5f6124a5..23e63f74 100644 --- a/service/windns/windns.go +++ b/service/windns/windns.go @@ -239,9 +239,9 @@ ForEach ($ns in $toRemove){ } } -func IsNrptPoliciesEffective() bool { - script := fmt.Sprintf(`Add-DnsClientNrptRule -Namespace ".ziti.test" -NameServers "100.64.0.1" -Comment "Added by ziti-tunnel" -DisplayName "ziti-tunnel:.ziti.test" - Get-DnsClientNrptPolicy -Effective | Select-Object Namespace -Unique | Where-Object Namespace -Eq ".ziti.test"`) +func IsNrptPoliciesEffective(dnsserver string) bool { + script := fmt.Sprintf(`Add-DnsClientNrptRule -Namespace ".ziti.test" -NameServers "%s" -Comment "Added by ziti-tunnel" -DisplayName "ziti-tunnel:.ziti.test" + Get-DnsClientNrptPolicy -Effective | Select-Object Namespace -Unique | Where-Object Namespace -Eq ".ziti.test"`, dnsserver) log.Debugf("checking the nrpt policies with: %s", script) cmd := exec.Command("powershell", "-Command", script) diff --git a/service/ziti-tunnel/service/state.go b/service/ziti-tunnel/service/state.go index 408e5416..7d667cfd 100644 --- a/service/ziti-tunnel/service/state.go +++ b/service/ziti-tunnel/service/state.go @@ -223,9 +223,14 @@ func (t *RuntimeState) CreateTun(ipv4 string, ipv4mask int, applyDns bool) (net. } log.Info("routing applied") - zitiPoliciesEffective := windns.IsNrptPoliciesEffective() + zitiPoliciesEffective := windns.IsNrptPoliciesEffective(ipv4) if applyDns || !zitiPoliciesEffective { - log.Info("DNS is applied to the TUN interface, because apply Dns flag in the config file: %t and ziti policies test result in this client: %t ", applyDns, zitiPoliciesEffective) + if applyDns { + log.Infof("DNS is applied to the TUN interface, because apply Dns flag in the config file is %t ", applyDns) + } + if !applyDns && !zitiPoliciesEffective { + log.Infof("DNS is applied to the TUN interface, because Ziti policies test result in this client is %t", zitiPoliciesEffective) + } //for windows 10+, could 'domains' be able to replace NRPT? dunno - didn't test it luid.SetDNS(windows.AF_INET, []net.IP{ip}, nil) } From a61b3772109411341c6e3f5039448312d80d1753 Mon Sep 17 00:00:00 2001 From: ziti-ci Date: Mon, 19 Apr 2021 15:56:27 +0000 Subject: [PATCH 9/9] [ci skip] committing updated version related files --- service/ziti-tunnel/version.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/service/ziti-tunnel/version.go b/service/ziti-tunnel/version.go index ad8e8496..cb777bfe 100644 --- a/service/ziti-tunnel/version.go +++ b/service/ziti-tunnel/version.go @@ -21,8 +21,8 @@ package main const ( Version = "1.9.4" - Revision = "bf21f40f8dbc" + Revision = "24a59ec169b9" Branch = "release-next" BuildUser = "" - BuildDate = "2021-04-17 14:10:53" + BuildDate = "2021-04-19 15:51:04" )