code review changes

service/cziti/mfa.c

@@ -1,24 +0,0 @@
-/*
- * Copyright NetFoundry, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-/*
-#include "sdk.h"
-#include <ziti/ziti_tunnel.h>
-#include <ziti/ziti_log.h>
-
-void ziti_mfa_auth_request(ziti_ar_mfa_cb response_cb, ziti_context ztx, void *mfa_ctx, char *code, ziti_ar_mfa_status_cb auth_response, char *fingerprint) {
-    response_cb(ztx, mfa_ctx, code, auth_response, fingerprint);
-}*/

service/cziti/sdk.go

@@ -61,6 +61,7 @@ var log = logging.Logger()
 var noFileLog = logging.NoFilenameLogger()
 var Version dto.ServiceVersion
 var BulkServiceChanges = make(chan BulkServiceChange, 32)
+var TimeoutPostureChecks = make(chan map[string]bool)
 
 var cCfgZitiTunnelerClientV1 = C.CString("ziti-tunneler-client.v1")
 var cCfgInterceptV1 = C.CString("intercept.v1")
@@ -90,7 +91,7 @@ type ToastNotification struct {
 	Message				string
 	MinimumTimeOut		int
 	AllServicesTimeout	int
-	NotificationTime	time.Time
+	TimeDuration		int
 	Severity			string
 }
 
@@ -153,15 +154,8 @@ type ZIdentity struct {
 	MinTimeout	  	int
 	MaxTimeout	  	int
 	LastUpdatedTime	time.Time
-	//mfa           *Mfa
 }
 
-/*type Mfa struct {
-	mfaContext unsafe.Pointer
-	authQuery  *C.ziti_auth_query_mfa
-	responseCb C.ziti_ar_mfa_cb
-}*/
-
 func NewZid(statusChange func(int)) *ZIdentity {
 	zid := &ZIdentity{}
 	zid.Services = sync.Map{}
@@ -568,6 +562,16 @@ func eventCB(ztx C.ziti_context, event *C.ziti_event_t) {
 		zid.MaxTimeout = allServicesTimeout
 		zid.LastUpdatedTime = time.Now()
 
+		if minimumTimeout == -1 && allServicesTimeout == -1 {
+			TimeoutPostureChecks <- map[string]bool {
+				zid.Fingerprint: false,
+			}
+		} else {
+			TimeoutPostureChecks <- map[string]bool {
+				zid.Fingerprint: true,
+			}
+		}
+
 		svcChange := BulkServiceChange{
 			Fingerprint:       zid.Fingerprint,
 			HostnamesToAdd:    hostnamesToAdd,
@@ -587,12 +591,6 @@ func eventCB(ztx C.ziti_context, event *C.ziti_event_t) {
 	case C.ZitiMfaAuthEvent:
 		zid := (*ZIdentity)(appCtx)
 		log.Debugf("mfa auth event for finger print %s", zid.Fingerprint)
-		/*mfa := &Mfa{
-			mfaContext: mfa_ctx,
-			authQuery:  aq_mfa,
-			responseCb: response_cb,
-		}
-		zid.mfa = mfa*/
 		zid.MfaNeeded = true
 		zid.MfaEnabled = true
 
@@ -663,8 +661,6 @@ func LoadZiti(zid *ZIdentity, cfg string, refreshInterval int) {
 	zid.Options.events = C.ZitiContextEvent | C.ZitiServiceEvent | C.ZitiRouterEvent | C.ZitiMfaAuthEvent
 	zid.Options.event_cb = C.ziti_event_cb(C.eventCB)
 
-	// zid.Options.aq_mfa_cb = C.ziti_aq_mfa_cb(C.ziti_aq_mfa_cb_go)
-
 	ptr := unsafe.Pointer(zid)
 	zid.Options.app_ctx = ptr
 

service/cziti/sdk.h

@@ -75,13 +75,11 @@ ziti_service* ziti_service_array_get(ziti_service_array arr, int idx);
 void ziti_dump_go(char *msg);
 
 //declare all mfa callbacks
-//void ziti_aq_mfa_cb_go(ziti_context ztx, void *mfa_ctx, ziti_auth_query_mfa *aq_mfa, ziti_ar_mfa_cb response_cb);
 void ziti_mfa_enroll_cb_go(ziti_context ztx, int status, ziti_mfa_enrollment *mfa_enrollment, char *fingerprint);
 void ziti_mfa_cb_verify_go(ziti_context ztx, int status, char *fingerprint);
 void ziti_mfa_cb_remove_go(ziti_context ztx, int status, char *fingerprint);
 void ziti_mfa_recovery_codes_cb_return(ziti_context ztx, int status, char **recovery_codes, char *fingerprint);
 void ziti_mfa_recovery_codes_cb_generate(ziti_context ztx, int status, char **recovery_codes, char *fingerprint);
-//void ziti_mfa_auth_request(ziti_ar_mfa_cb response_cb, ziti_context ztx, void *mfa_ctx, char *code, ziti_ar_mfa_status_cb auth_response, char *fingerprint);
 void ziti_mfa_ar_cb(ziti_context ztx, void *mfa_ctx, int status);
 void ziti_ar_mfa_status_cb_go(ziti_context ztx, void *mfa_ctx, int status, char *fingerprint);
 void ziti_auth_mfa_status_cb_go(ziti_context ztx, int status, char *fingerprint);

service/ziti-tunnel/service/ipc.go

@@ -102,7 +102,7 @@ func SubMain(ops chan string, changes chan<- svc.Status, winEvents <-chan Window
 	//listen for services that show up
 	go acceptServices()
 
-	go sendNotifications()
+	go rts.CheckTimeOuts()
 
 	// listen for windows power events and call mfa auth func
 	go func() {
@@ -1263,68 +1263,92 @@ func sendIdentityAndNotifyUI(enc *json.Encoder, fingerprint string) {
 	respond(enc, resp)
 }
 
-func sendNotifications() {
+func StartRefreshTimer() {
+
+	RuntimeStatusTicker := time.NewTicker(time.Duration(1) * time.Minute)
+	log.Debugf("starting service timeout refresh routine")
+
+	go func () {
+		for {
+			select {
+			case <- shutdown:
+				log.Debugf("shutdown request received, exiting refresh timer routine")
+				return
+			case <- RuntimeTimerStop:
+				RuntimeStatusTicker.Stop()
+				log.Debugf("timer is stopped, exiting runtime status ticker loop")
+				RuntimeStatusTicker = nil
+				return
+			case <- RuntimeStatusTicker.C:
+				clean := rts.ToStatus(true)
+				rts.BroadcastEvent(dto.TunnelStatusEvent{
+					StatusEvent: dto.StatusEvent{Op: "status"},
+					Status:      clean,
+					ApiVersion:  API_VERSION,
+				})
+			}
+		}
+	} ()
+}
+
+func SendNotifications() {
 	log.Debug("Started notification routine")
 
-	var notificationMutex = &sync.Mutex{}
-	broadcastStatusTicker := time.NewTicker(1 * time.Minute)
 	// allow user to set frequency dynamically
 	broadcastNotificationTicker := time.NewTicker(5 * time.Minute)
 
+	go func(){
+		for {
+			select {
+			case <- shutdown:
+				log.Debugf("Exiting Notification Alert loop")
+				return
+			case <- RuntimeTimerStop:
+				broadcastNotificationTicker.Stop()
+				log.Debugf("timer is stopped, exiting Notifications ticker loop")
+				broadcastNotificationTicker = nil
+				return
+			case <- broadcastNotificationTicker.C:
+				clean := rts.ToStatus(true)
 
-	for {
-		select {
-		case <- shutdown:
-			log.Debugf("Exiting Notification Alert loop")
-			return
+				cleanNotifications := make([]cziti.ToastNotification, 0)
 
-		case <- broadcastStatusTicker.C:
-			notificationMutex.Lock()
-			clean := rts.ToStatus(true)
-			notificationMutex.Unlock()
+				notificationMessage := ""
+				for _, id := range clean.Identities {
 
-			rts.BroadcastEvent(dto.TunnelStatusEvent{
-				StatusEvent: dto.StatusEvent{Op: "status"},
-				Status:      clean,
-				ApiVersion:  API_VERSION,
-			})
+					if id.MaxTimeout == -1 && id.MinTimeout == -1 {
+						continue
+					}
 
-		case <- broadcastNotificationTicker.C:
-			notificationMutex.Lock()
-			clean := rts.ToStatus(true)
-			notificationMutex.Unlock()
+					if (id.MaxTimeout - int(time.Since(id.LastUpdatedTime).Seconds())) < 0 {
+						notificationMessage = fmt.Sprintf("All of the services of identity %s are timed out", id.Name)
+					} else if (id.MinTimeout - int(time.Since(id.LastUpdatedTime).Seconds())) < 0 {
+						notificationMessage = fmt.Sprintf("Some of the services of identity %s are timed out", id.Name)
+					} else if (id.MinTimeout - int(time.Since(id.LastUpdatedTime).Seconds())) < int(time.Duration(20 * time.Minute)) {
+						notificationMessage = fmt.Sprintf("Some of the services of identity %s are timing out in sometime", id.Name)
+					}
 
-			cleanNotifications := make([]cziti.ToastNotification, 0)
+					cleanNotifications = append(cleanNotifications, cziti.ToastNotification{
+						Fingerprint: id.FingerPrint,
+						IdentityName: id.Name,
+						Severity: "major",
+						MinimumTimeOut: id.MinTimeout,
+						AllServicesTimeout: id.MaxTimeout,
+						Message: notificationMessage,
+						TimeDuration: int(time.Since(id.LastUpdatedTime).Seconds()),
+					})
 
-			notificationMessage := ""
-			for _, id := range clean.Identities {
-
-				if (id.MaxTimeout - int(time.Since(id.LastUpdatedTime).Seconds())) < 0 {
-					notificationMessage = fmt.Sprintf("All of the services of identity %s are timed out", id.Name)
-				} else if (id.MinTimeout - int(time.Since(id.LastUpdatedTime).Seconds())) < 0 {
-					notificationMessage = fmt.Sprintf("Some of the services of identity %s are timed out", id.Name)
-				} else if (id.MinTimeout - int(time.Since(id.LastUpdatedTime).Seconds())) < int(time.Duration(20 * time.Minute)) {
-					notificationMessage = fmt.Sprintf("Some of the services of identity %s are timing out in sometime", id.Name)
 				}
-
-				cleanNotifications = append(cleanNotifications, cziti.ToastNotification{
-					Fingerprint: id.FingerPrint,
-					IdentityName: id.Name,
-					Severity: "major",
-					MinimumTimeOut: id.MinTimeout,
-					AllServicesTimeout: id.MaxTimeout,
-					Message: notificationMessage,
-				})
-
+				if len(cleanNotifications) > 0 {
+					log.Debugf("Sending notification message to UI %v", cleanNotifications)
+					rts.BroadcastEvent(cziti.TunnelNotificationEvent{
+						Op: 			"notification",
+						Notification:	cleanNotifications,
+					})
+				}
+				// should send a toast message to windows
 			}
-			if len(cleanNotifications) > 0 {
-				log.Debugf("Sending notification message to UI %v", cleanNotifications)
-				rts.BroadcastEvent(cziti.TunnelNotificationEvent{
-					Op: 			"notification",
-					Notification:	cleanNotifications,
-				})
-			}
-			// should send a toast message to windows
 		}
-	}
+	}()
+
 }

service/ziti-tunnel/service/state.go

@@ -43,6 +43,9 @@ import (
 	"time"
 )
 
+var RuntimeTimerStop = make(chan bool)
+var RuntimeStatusTicker *time.Ticker = nil
+
 type RuntimeState struct {
 	state   *dto.TunnelStatus
 	tun     *tun.Device
@@ -545,3 +548,37 @@ func (t *RuntimeState) UpdateMfa(fingerprint string, mfaEnabled bool, mfaNeeded
 	}
 }
 
+func (t *RuntimeState) CheckTimeOuts() {
+	go func () {
+		for {
+			select {
+			case <- shutdown:
+				log.Debugf("Shutting down posture check timeout loop")
+				return
+			case timeoutEvent := <- cziti.TimeoutPostureChecks:
+
+				timeoutRefreshRequired := false
+				for _, id := range rts.ids {
+					if val, ok := timeoutEvent[id.FingerPrint]; ok {
+						if val {
+								timeoutRefreshRequired = true
+						}
+					} else {
+						if id.MinTimeout > -1 || id.MaxTimeout > -1 {
+							timeoutRefreshRequired = true
+						}
+					}
+				}
+				if timeoutRefreshRequired {
+					if RuntimeStatusTicker == nil {
+						StartRefreshTimer()
+						SendNotifications()
+					}
+				} else {
+					RuntimeTimerStop <- true
+				}
+			}
+		}
+	}()
+}
+