From e1789c51e4f427bfe8aafef23c4a381c155aaaff Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Tue, 6 Apr 2021 16:20:07 -0400 Subject: [PATCH 01/10] fix the blurb when all recovery codes have been used --- DesktopEdge/MainWindow.xaml.cs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/DesktopEdge/MainWindow.xaml.cs b/DesktopEdge/MainWindow.xaml.cs index 387f0df6..f46d31e8 100644 --- a/DesktopEdge/MainWindow.xaml.cs +++ b/DesktopEdge/MainWindow.xaml.cs @@ -252,8 +252,11 @@ namespace ZitiDesktopEdge { if (IdentityMenu.IsVisible) { if (isComplete) { if (MFASetup.Type == 2) { - if (IdentityMenu.Identity.MFAInfo.RecoveryCodes.Length==0) ShowBlurbAsync("You do not have anymore recovery codes", this.RECOVER); - else ShowRecovery(IdentityMenu.Identity); + if (IdentityMenu.Identity.MFAInfo?.RecoveryCodes?.Length > 0) { + ShowRecovery(IdentityMenu.Identity); + } else { + ShowBlurbAsync("You do not have anymore recovery codes", this.RECOVER); + } } else if (MFASetup.Type == 3) { IdentityMenu.Identity.IsMFAEnabled = false; IdentityMenu.Identity.MFAInfo.IsAuthenticated = false; From d0ba8585fe6f5d176111e540fce7d86914889185 Mon Sep 17 00:00:00 2001 From: ziti-ci Date: Tue, 6 Apr 2021 20:29:47 +0000 Subject: [PATCH 02/10] [ci skip] committing updated version related files --- service/ziti-tunnel/version.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/service/ziti-tunnel/version.go b/service/ziti-tunnel/version.go index df69fcaa..f8a72b85 100644 --- a/service/ziti-tunnel/version.go +++ b/service/ziti-tunnel/version.go @@ -20,9 +20,9 @@ package main const ( - Version = "1.9.1" - Revision = "40dcdda233d7" - Branch = "main" + Version = "1.9.2" + Revision = "e1789c51e4f4" + Branch = "release-next" BuildUser = "" - BuildDate = "2021-04-06 17:45:45" + BuildDate = "2021-04-06 20:24:07" ) From 9c4d1295ff50516885bd3165c72c9d23600eb8dd Mon Sep 17 00:00:00 2001 From: Jeremy Tellier - ROG Date: Wed, 7 Apr 2021 13:01:19 +0100 Subject: [PATCH 03/10] Fix the search for service query --- DesktopEdge/Views/Screens/IdentityDetails.xaml.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DesktopEdge/Views/Screens/IdentityDetails.xaml.cs b/DesktopEdge/Views/Screens/IdentityDetails.xaml.cs index f7fd423d..f15ce065 100644 --- a/DesktopEdge/Views/Screens/IdentityDetails.xaml.cs +++ b/DesktopEdge/Views/Screens/IdentityDetails.xaml.cs @@ -119,7 +119,7 @@ namespace ZitiDesktopEdge { ServiceList.Children.Clear(); if (_identity.Services.Count>0) { foreach(var zitiSvc in _identity.Services.OrderBy(s => s.Name.ToLower())) { - if (zitiSvc.Name.ToLower().IndexOf(filter)>=0||zitiSvc.ToString().ToLower().IndexOf(filter)>=0) { + if (zitiSvc.Name.ToLower().IndexOf(filter.ToLower()) >=0||zitiSvc.ToString().ToLower().IndexOf(filter.ToLower()) >=0) { Logger.Trace("painting: " + zitiSvc.Name); ServiceInfo info = new ServiceInfo(); info.Info = zitiSvc; From d73d66a4a633d81aaf3dd1dab9b433fa1a340759 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Wed, 7 Apr 2021 12:59:03 -0400 Subject: [PATCH 04/10] initial stab at chunking nrpt rules --- service/windns/windns.go | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/service/windns/windns.go b/service/windns/windns.go index f342f845..384c9e95 100644 --- a/service/windns/windns.go +++ b/service/windns/windns.go @@ -121,11 +121,31 @@ func AddNrptRules(domainsToMap map[string]bool, dnsServer string) { log.Debug("no domains to map specified to AddNrptRules. exiting early") return } + + blockSize := 250 + if len(domainsToMap) > blockSize { + log.Debugf("domainsToMap is too long [%d] and may fail on some systems. splitting the requested entries into blocks of %d", len(domainsToMap), blockSize) + } + currentSize := 0 + hostnames := make([]string, blockSize) + for hostname := range domainsToMap { + hostnames[currentSize] = hostname + currentSize ++ + if currentSize >= blockSize { + log.Debugf("sending chunk of domains to be added to NRPT") + chunkedAddNrptRules(hostnames, dnsServer) + hostnames = make([]string, blockSize) + currentSize = 0 + } + } +} + +func chunkedAddNrptRules(domainsToAdd []string, dnsServer string) { sb := strings.Builder{} sb.WriteString(`$Rules = @( `) - for hostname := range domainsToMap { + for _, hostname := range domainsToAdd { sb.WriteString(fmt.Sprintf(`@{ Namespace ="%s"; NameServers = @("%s"); Comment = "Added by ziti-tunnel"; DisplayName = "ziti-tunnel:%s"; }%s`, hostname, dnsServer, hostname, "\n")) } @@ -136,7 +156,7 @@ ForEach ($Rule in $Rules) { }`)) script := sb.String() - log.Debugf("Executing NRPT script:\n%s", script) + log.Debugf("Executing NRPT script containing %d domains:\n%s", len(domainsToAdd), script) cmd := exec.Command("powershell", "-Command", script) cmd.Stderr = os.Stdout @@ -148,6 +168,7 @@ ForEach ($Rule in $Rules) { } } + func RemoveNrptRules(domainsToMap map[string]bool) { if len(domainsToMap) == 0 { log.Debug("no domains to map specified to RemoveNrptRules. exiting early") From 4b18db7cd1918b65957475e324560459d7fc8216 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Wed, 7 Apr 2021 13:55:37 -0400 Subject: [PATCH 05/10] make sure we add the final chunk of rules to the NRPT. also update the .gitignore with logs --- service/.gitignore | 1 + service/windns/windns.go | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/service/.gitignore b/service/.gitignore index da9d6160..879e2457 100644 --- a/service/.gitignore +++ b/service/.gitignore @@ -7,3 +7,4 @@ NFWintunInstaller.msi wintun.dll gdb.txt +logs diff --git a/service/windns/windns.go b/service/windns/windns.go index 384c9e95..e35f9ddb 100644 --- a/service/windns/windns.go +++ b/service/windns/windns.go @@ -122,7 +122,7 @@ func AddNrptRules(domainsToMap map[string]bool, dnsServer string) { return } - blockSize := 250 + blockSize := 50 if len(domainsToMap) > blockSize { log.Debugf("domainsToMap is too long [%d] and may fail on some systems. splitting the requested entries into blocks of %d", len(domainsToMap), blockSize) } @@ -138,6 +138,10 @@ func AddNrptRules(domainsToMap map[string]bool, dnsServer string) { currentSize = 0 } } + if currentSize > 0 { + //means there's a chunk still to add.... + chunkedAddNrptRules(hostnames[:currentSize], dnsServer) + } } func chunkedAddNrptRules(domainsToAdd []string, dnsServer string) { From f757977dd889190265d8f0866d18fd8f71e3319d Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Wed, 7 Apr 2021 13:57:15 -0400 Subject: [PATCH 06/10] fix two bugs - first don't add IPs to NRPT. dispatch service updates in a go routine just in case something ends up blocking the dispatch channel --- service/cziti/sdk.go | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/service/cziti/sdk.go b/service/cziti/sdk.go index 503820a8..28b01c73 100644 --- a/service/cziti/sdk.go +++ b/service/cziti/sdk.go @@ -340,7 +340,7 @@ func serviceCB(ziti_ctx C.ziti_context, service *C.ziti_service, status C.int, z } zid.Services.Store(svcId, &added) - ServiceChanges <- se + go func() {ServiceChanges <- se}() //do this in a go routine just in case it gets blocked so the uv loop doesn't block } return addresses } @@ -411,7 +411,9 @@ func eventCB(ztx C.ziti_context, event *C.ziti_event_t) { } addys := serviceCB(ztx, removed, C.ZITI_SERVICE_UNAVAILABLE, zid) for _, toRemove := range addys { - hostnamesToRemove[toRemove.HostName] = true + if toRemove.IsHost { + hostnamesToRemove[toRemove.HostName] = true + } } } for i := 0; true; i++ { @@ -422,12 +424,16 @@ func eventCB(ztx C.ziti_context, event *C.ziti_event_t) { log.Info("service changed remove the service then add it back immediately", C.GoString(changed.name)) addys := serviceCB(ztx, changed, C.ZITI_SERVICE_UNAVAILABLE, zid) for _, toRemove := range addys { - hostnamesToRemove[toRemove.HostName] = true + if toRemove.IsHost { + hostnamesToRemove[toRemove.HostName] = true + } } addys = serviceCB(ztx, changed, C.ZITI_OK, zid) for _, toAdd := range addys { - hostnamesToAdd[toAdd.HostName] = true + if toAdd.IsHost { + hostnamesToAdd[toAdd.HostName] = true + } } } for i := 0; true; i++ { @@ -437,7 +443,9 @@ func eventCB(ztx C.ziti_context, event *C.ziti_event_t) { } addys := serviceCB(ztx, added, C.ZITI_OK, zid) for _, toAdd := range addys { - hostnamesToAdd[toAdd.HostName] = true + if toAdd.IsHost { + hostnamesToAdd[toAdd.HostName] = true + } } } From 5a4687771a3b10a81de65c0fbced674dd71d9230 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Wed, 7 Apr 2021 15:39:49 -0400 Subject: [PATCH 07/10] output the NRPT policy/rule on feedback --- ZitiUpdateService/UpdateService.cs | 32 ++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/ZitiUpdateService/UpdateService.cs b/ZitiUpdateService/UpdateService.cs index 5b678107..57fdf030 100644 --- a/ZitiUpdateService/UpdateService.cs +++ b/ZitiUpdateService/UpdateService.cs @@ -199,6 +199,7 @@ namespace ZitiUpdateService { outputTasklist(destinationLocation); outputRouteInfo(destinationLocation); outputNetstatInfo(destinationLocation); + outputNrpt(destinationLocation); Task.Delay(500).Wait(); @@ -340,6 +341,37 @@ namespace ZitiUpdateService { } } + private void outputNrpt(string destinationFolder) { + Logger.Info("outputting NRPT rules"); + try { + Logger.Info("outputting NRPT DnsClientNrptRule"); + string nrptRuleOutput = Path.Combine(destinationFolder, "NrptRule.txt"); + Process nrptRuleProcess = new Process(); + ProcessStartInfo nrptRuleStartInfo = new ProcessStartInfo(); + nrptRuleStartInfo.WindowStyle = ProcessWindowStyle.Hidden; + nrptRuleStartInfo.FileName = "cmd.exe"; + nrptRuleStartInfo.Arguments = $"/C powershell \"Get-DnsClientNrptRule | sort -Property Namespace\" > \"{nrptRuleOutput}\""; + Logger.Info("Running: {0}", nrptRuleStartInfo.Arguments); + nrptRuleProcess.StartInfo = nrptRuleStartInfo; + nrptRuleProcess.Start(); + nrptRuleProcess.WaitForExit(); + + Logger.Info("outputting NRPT DnsClientNrptPolicy"); + string nrptOutput = Path.Combine(destinationFolder, "NrptPolicy.txt"); + Process process = new Process(); + ProcessStartInfo startInfo = new ProcessStartInfo(); + startInfo.WindowStyle = ProcessWindowStyle.Hidden; + startInfo.FileName = "cmd.exe"; + startInfo.Arguments = $"/C powershell \"Get-DnsClientNrptPolicy | sort -Property Namespace\" > \"{nrptOutput}\""; + Logger.Info("Running: {0}", startInfo.Arguments); + process.StartInfo = startInfo; + process.Start(); + process.WaitForExit(); + } catch (Exception ex) { + Logger.Error(ex, "Unexpected error {0}", ex.Message); + } + } + public void Debug() { OnStart(null);// new string[] { "FilesystemCheck" }); } From d9a55ffa25dad6c0789b92c8864567b17a64e3be Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Wed, 7 Apr 2021 16:20:00 -0400 Subject: [PATCH 08/10] update release-notes --- release-notes.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/release-notes.md b/release-notes.md index eb763f10..d291aec5 100644 --- a/release-notes.md +++ b/release-notes.md @@ -7,7 +7,9 @@ * none ## Bugs fixed: -* none +* [#346](https://github.com/openziti/desktop-edge-win/issues/346) Fixed the UI filtering of services on the Identity detail screen +* [#348](https://github.com/openziti/desktop-edge-win/issues/348) IP addresses do not need to be added to the NRPT +* [#349](https://github.com/openziti/desktop-edge-win/issues/349) Too many services can cause the NRPT update to fail ## Dependency Updates * none From 8ec6cb18b56bd71fb9a02ca12fbd9369c962752d Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Thu, 8 Apr 2021 06:31:27 -0400 Subject: [PATCH 09/10] fix race condition at startup --- service/ziti-tunnel/service/ipc.go | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/service/ziti-tunnel/service/ipc.go b/service/ziti-tunnel/service/ipc.go index ecac534a..04aca3fd 100644 --- a/service/ziti-tunnel/service/ipc.go +++ b/service/ziti-tunnel/service/ipc.go @@ -1037,7 +1037,15 @@ func handleEvents(isInitialized chan struct{}) { //Removes the Config from the provided identity and returns a 'cleaned' id func Clean(src *Id) dto.Identity { - log.Tracef("cleaning identity: %s %v %v", src.Name, src.CId.MfaNeeded, src.CId.MfaEnabled) + mfaNeeded := false + mfaEnabled := false + + if src.CId != nil { + mfaNeeded = src.CId.MfaNeeded + mfaEnabled = src.CId.MfaEnabled + } + + log.Tracef("cleaning identity: %s", src.Name, mfaNeeded, mfaEnabled) AddMetrics(src) nid := dto.Identity{ Name: src.Name, @@ -1046,8 +1054,8 @@ func Clean(src *Id) dto.Identity { Config: idcfg.Config{}, ControllerVersion: src.ControllerVersion, Status: "", - MfaNeeded: src.CId.MfaNeeded, - MfaEnabled: src.CId.MfaEnabled, + MfaNeeded: mfaNeeded, + MfaEnabled: mfaEnabled, Services: make([]*dto.Service, 0), Metrics: src.Metrics, Tags: nil, From cc3220de4551603c97f1118fad06b0b689134e8d Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Thu, 8 Apr 2021 06:53:37 -0400 Subject: [PATCH 10/10] try to fix the off by one issue --- service/windns/windns.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/service/windns/windns.go b/service/windns/windns.go index e35f9ddb..54dd0cbf 100644 --- a/service/windns/windns.go +++ b/service/windns/windns.go @@ -129,14 +129,14 @@ func AddNrptRules(domainsToMap map[string]bool, dnsServer string) { currentSize := 0 hostnames := make([]string, blockSize) for hostname := range domainsToMap { - hostnames[currentSize] = hostname - currentSize ++ if currentSize >= blockSize { log.Debugf("sending chunk of domains to be added to NRPT") chunkedAddNrptRules(hostnames, dnsServer) hostnames = make([]string, blockSize) currentSize = 0 } + hostnames[currentSize] = hostname + currentSize++ } if currentSize > 0 { //means there's a chunk still to add.... @@ -172,7 +172,6 @@ ForEach ($Rule in $Rules) { } } - func RemoveNrptRules(domainsToMap map[string]bool) { if len(domainsToMap) == 0 { log.Debug("no domains to map specified to RemoveNrptRules. exiting early")