Merge pull request #350 from openziti/issue-349-chunk-nrpt-rules

initial stab at chunking nrpt rules

DesktopEdge/MainWindow.xaml.cs

@@ -252,8 +252,11 @@ namespace ZitiDesktopEdge {
 			if (IdentityMenu.IsVisible) {
 				if (isComplete) {
 					if (MFASetup.Type == 2) {
-						if (IdentityMenu.Identity.MFAInfo.RecoveryCodes.Length==0) ShowBlurbAsync("You do not have anymore recovery codes", this.RECOVER);
-						else ShowRecovery(IdentityMenu.Identity);
+						if (IdentityMenu.Identity.MFAInfo?.RecoveryCodes?.Length > 0) {
+							ShowRecovery(IdentityMenu.Identity);
+						} else {
+							ShowBlurbAsync("You do not have anymore recovery codes", this.RECOVER);
+						}
 					} else if (MFASetup.Type == 3) {
 						IdentityMenu.Identity.IsMFAEnabled = false;
 						IdentityMenu.Identity.MFAInfo.IsAuthenticated = false;

DesktopEdge/Views/Screens/IdentityDetails.xaml.cs

@@ -119,7 +119,7 @@ namespace ZitiDesktopEdge {
 			ServiceList.Children.Clear();
 			if (_identity.Services.Count>0) {
 				foreach(var zitiSvc in _identity.Services.OrderBy(s => s.Name.ToLower())) {
-					if (zitiSvc.Name.ToLower().IndexOf(filter)>=0||zitiSvc.ToString().ToLower().IndexOf(filter)>=0) {
+					if (zitiSvc.Name.ToLower().IndexOf(filter.ToLower()) >=0||zitiSvc.ToString().ToLower().IndexOf(filter.ToLower()) >=0) {
 						Logger.Trace("painting: " + zitiSvc.Name);
 						ServiceInfo info = new ServiceInfo();
 						info.Info = zitiSvc;

ZitiUpdateService/UpdateService.cs

@@ -199,6 +199,7 @@ namespace ZitiUpdateService {
 				outputTasklist(destinationLocation);
 				outputRouteInfo(destinationLocation);
 				outputNetstatInfo(destinationLocation);
+				outputNrpt(destinationLocation);
 
 				Task.Delay(500).Wait();
 
@@ -340,6 +341,37 @@ namespace ZitiUpdateService {
 			}
 		}
 
+		private void outputNrpt(string destinationFolder) {
+			Logger.Info("outputting NRPT rules");
+			try {
+				Logger.Info("outputting NRPT DnsClientNrptRule");
+				string nrptRuleOutput = Path.Combine(destinationFolder, "NrptRule.txt");
+				Process nrptRuleProcess = new Process();
+				ProcessStartInfo nrptRuleStartInfo = new ProcessStartInfo();
+				nrptRuleStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
+				nrptRuleStartInfo.FileName = "cmd.exe";
+				nrptRuleStartInfo.Arguments = $"/C powershell \"Get-DnsClientNrptRule | sort -Property Namespace\" > \"{nrptRuleOutput}\"";
+				Logger.Info("Running: {0}", nrptRuleStartInfo.Arguments);
+				nrptRuleProcess.StartInfo = nrptRuleStartInfo;
+				nrptRuleProcess.Start();
+				nrptRuleProcess.WaitForExit();
+
+				Logger.Info("outputting NRPT DnsClientNrptPolicy");
+				string nrptOutput = Path.Combine(destinationFolder, "NrptPolicy.txt");
+				Process process = new Process();
+				ProcessStartInfo startInfo = new ProcessStartInfo();
+				startInfo.WindowStyle = ProcessWindowStyle.Hidden;
+				startInfo.FileName = "cmd.exe";
+				startInfo.Arguments = $"/C powershell \"Get-DnsClientNrptPolicy | sort -Property Namespace\" > \"{nrptOutput}\"";
+				Logger.Info("Running: {0}", startInfo.Arguments);
+				process.StartInfo = startInfo;
+				process.Start();
+				process.WaitForExit();
+			} catch (Exception ex) {
+				Logger.Error(ex, "Unexpected error {0}", ex.Message);
+			}
+		}
+
 		public void Debug() {
 			OnStart(null);// new string[] { "FilesystemCheck" });
 		}

release-notes.md

@@ -7,7 +7,9 @@
 * none
 
 ## Bugs fixed:
-* none
+* [#346](https://github.com/openziti/desktop-edge-win/issues/346) Fixed the UI filtering of services on the Identity detail screen
+* [#348](https://github.com/openziti/desktop-edge-win/issues/348) IP addresses do not need to be added to the NRPT
+* [#349](https://github.com/openziti/desktop-edge-win/issues/349) Too many services can cause the NRPT update to fail
 
 ## Dependency Updates
 * none

service/.gitignore

@@ -7,3 +7,4 @@ NFWintunInstaller.msi
 wintun.dll
 
 gdb.txt
+logs

service/cziti/sdk.go

@@ -340,7 +340,7 @@ func serviceCB(ziti_ctx C.ziti_context, service *C.ziti_service, status C.int, z
 		}
 
 		zid.Services.Store(svcId, &added)
-		ServiceChanges <- se
+		go func() {ServiceChanges <- se}() //do this in a go routine just in case it gets blocked so the uv loop doesn't block
 	}
 	return addresses
 }
@@ -411,7 +411,9 @@ func eventCB(ztx C.ziti_context, event *C.ziti_event_t) {
 			}
 			addys := serviceCB(ztx, removed, C.ZITI_SERVICE_UNAVAILABLE, zid)
 			for _, toRemove := range addys {
-				hostnamesToRemove[toRemove.HostName] = true
+				if toRemove.IsHost {
+					hostnamesToRemove[toRemove.HostName] = true
+				}
 			}
 		}
 		for i := 0; true; i++ {
@@ -422,12 +424,16 @@ func eventCB(ztx C.ziti_context, event *C.ziti_event_t) {
 			log.Info("service changed remove the service then add it back immediately", C.GoString(changed.name))
 			addys := serviceCB(ztx, changed, C.ZITI_SERVICE_UNAVAILABLE, zid)
 			for _, toRemove := range addys {
-				hostnamesToRemove[toRemove.HostName] = true
+				if toRemove.IsHost {
+					hostnamesToRemove[toRemove.HostName] = true
+				}
 			}
 
 			addys = serviceCB(ztx, changed, C.ZITI_OK, zid)
 			for _, toAdd := range addys {
-				hostnamesToAdd[toAdd.HostName] = true
+				if toAdd.IsHost {
+					hostnamesToAdd[toAdd.HostName] = true
+				}
 			}
 		}
 		for i := 0; true; i++ {
@@ -437,7 +443,9 @@ func eventCB(ztx C.ziti_context, event *C.ziti_event_t) {
 			}
 			addys := serviceCB(ztx, added, C.ZITI_OK, zid)
 			for _, toAdd := range addys {
-				hostnamesToAdd[toAdd.HostName] = true
+				if toAdd.IsHost {
+					hostnamesToAdd[toAdd.HostName] = true
+				}
 			}
 		}
 

service/windns/windns.go

@@ -121,11 +121,35 @@ func AddNrptRules(domainsToMap map[string]bool, dnsServer string) {
 		log.Debug("no domains to map specified to AddNrptRules. exiting early")
 		return
 	}
+
+	blockSize := 50
+	if len(domainsToMap) > blockSize {
+		log.Debugf("domainsToMap is too long [%d] and may fail on some systems. splitting the requested entries into blocks of %d", len(domainsToMap), blockSize)
+	}
+	currentSize := 0
+	hostnames := make([]string, blockSize)
+	for hostname := range domainsToMap {
+		if currentSize >= blockSize {
+			log.Debugf("sending chunk of domains to be added to NRPT")
+			chunkedAddNrptRules(hostnames, dnsServer)
+			hostnames = make([]string, blockSize)
+			currentSize = 0
+		}
+		hostnames[currentSize] = hostname
+		currentSize++
+	}
+	if currentSize > 0 {
+		//means there's a chunk still to add....
+		chunkedAddNrptRules(hostnames[:currentSize], dnsServer)
+	}
+}
+
+func chunkedAddNrptRules(domainsToAdd []string, dnsServer string) {
 	sb := strings.Builder{}
 	sb.WriteString(`$Rules = @(
 `)
 
-	for hostname := range domainsToMap {
+	for _, hostname := range domainsToAdd {
 		sb.WriteString(fmt.Sprintf(`@{ Namespace ="%s"; NameServers = @("%s"); Comment = "Added by ziti-tunnel"; DisplayName = "ziti-tunnel:%s"; }%s`, hostname, dnsServer, hostname, "\n"))
 	}
 
@@ -136,7 +160,7 @@ ForEach ($Rule in $Rules) {
 }`))
 
 	script := sb.String()
-	log.Debugf("Executing NRPT script:\n%s", script)
+	log.Debugf("Executing NRPT script containing %d domains:\n%s", len(domainsToAdd), script)
 
 	cmd := exec.Command("powershell", "-Command", script)
 	cmd.Stderr = os.Stdout

service/ziti-tunnel/service/ipc.go

@@ -1037,7 +1037,15 @@ func handleEvents(isInitialized chan struct{}) {
 
 //Removes the Config from the provided identity and returns a 'cleaned' id
 func Clean(src *Id) dto.Identity {
-	log.Tracef("cleaning identity: %s %v %v", src.Name, src.CId.MfaNeeded, src.CId.MfaEnabled)
+	mfaNeeded := false
+	mfaEnabled := false
+
+	if src.CId != nil {
+		mfaNeeded = src.CId.MfaNeeded
+		mfaEnabled = src.CId.MfaEnabled
+	}
+
+	log.Tracef("cleaning identity: %s", src.Name, mfaNeeded, mfaEnabled)
 	AddMetrics(src)
 	nid := dto.Identity{
 		Name:              src.Name,
@@ -1046,8 +1054,8 @@ func Clean(src *Id) dto.Identity {
 		Config:            idcfg.Config{},
 		ControllerVersion: src.ControllerVersion,
 		Status:            "",
-		MfaNeeded:         src.CId.MfaNeeded,
-		MfaEnabled:        src.CId.MfaEnabled,
+		MfaNeeded:         mfaNeeded,
+		MfaEnabled:        mfaEnabled,
 		Services:          make([]*dto.Service, 0),
 		Metrics:           src.Metrics,
 		Tags:              nil,

service/ziti-tunnel/version.go

@@ -20,9 +20,9 @@
 package main
 
 const (
-	Version   = "1.9.1"
-	Revision  = "40dcdda233d7"
-	Branch    = "main"
+	Version   = "1.9.2"
+	Revision  = "e1789c51e4f4"
+	Branch    = "release-next"
 	BuildUser = ""
-	BuildDate = "2021-04-06 17:45:45"
+	BuildDate = "2021-04-06 20:24:07"
 )