Add initial support of device posture checks #1540

surik · 2024-02-07T15:54:41Z

Describe your changes

This PR implements the following posture checks:

Agent minimum version allowed
OS minimum version allowed
Geo-location based on connection IP

For the geo-based location, we rely on GeoLite2 databases which are free IP geolocation databases. MaxMind was tested and we provide a script that easily allows to download of all necessary files, see infrastructure_files/download-geolite2.sh.

The OpenAPI spec should extensively cover the life cycle of current version posture checks.

Additionally, this PR may use proper configuration to support X-Forwarded-IP, the basic one with one proxy could look like this:

"ReverseProxy": {
    "TrustedHTTPProxies": [],
    "TrustedHTTPProxiesCount": 1,
    "TrustedPeers": [
        "0.0.0.0/0",
        "::/0"
    ]
},

Ideally TrustedPeers should be set to a possible network range of LB/reverse-proxy.

Issue ticket number and link

Checklist

Is it a bug fix
Is a typo/documentation fix
Is a feature enhancement
It is a refactor
Created tests that fail without the change (if possible)
Extended the README / documentation, if necessary

* wip: add posture checks structs * add netbird version check * Refactor posture checks and add version checks * Implement posture and version checks in API models * Refactor API models and enhance posture check functionality * wip: add posture checks endpoints * go mod tidy * Reference the posture checks by id's in policy * Add posture checks management to server * Add posture checks management mocks * implement posture checks handlers * Add posture checks to account copy and fix tests * Refactor posture checks validation * wip: Add posture checks handler tests * Add JSON encoding support to posture checks * Encode posture checks to correct api response object * Refactored posture checks implementation to align with the new API schema * Refactor structure of `Checks` from slice to map * Cleanup * Add posture check activities (#1445) * Revert map to use list of checks * Add posture check activity events * Refactor posture check initialization in account test * Improve the handling of version range in posture check * Fix tests and linter * Remove max_version from NBVersionCheck * Added unit tests for NBVersionCheck * go mod tidy * Extend policy endpoint with posture checks (#1450) * Implement posture and version checks in API models * go mod tidy * Allow attaching posture checks to policy * Update error message for linked posture check on deleting * Refactor PostureCheck and Checks structures * go mod tidy * Add validation for non-existing posture checks * fix unit tests * use Wt version * Remove the enabled field, as posture check will now automatically be activated by default when attaching to a policy

…ture/posture-checks

* Apply posture checks to network map generation * run policy posture checks on peers to connect * Refactor and streamline policy posture check process for peers to connect. * Add posture checks testing in a network map * Remove redundant nil check in policy.go * Refactor peer validation check in policy.go * Update 'Check' function signature and use logger for version check * Refactor posture checks run on sources and updated the validation func * Update peer validation * fix tests * improved test coverage for policy posture check * Refactoring

* Add KernelVersion field to LoginRequest * Add KernelVersion to system info retrieval * Fix tests * Remove Core field from system info * Replace Core field with new OSVersion field in system info * Added WMI dependency to info_windows.go

* wip: implement geolocation check * add geo location posture checks to posture api * Merge branch 'feature/posture-checks' into geo-posture-check * Remove CityGeoNameID and update required fields in API * Add geoLocation checks to posture checks handler tests * Implement geo location-based checks for peers * Update test values and embed location struct in peer system * add support for country wide checks * initialize country code regex once

* Refactor extraction of OSVersion in grpcserver * Ignore lint check

* Revert core field deprecation * fix tests

This PR uses the geolocation service to resolve IP to location. The lookup happens once on the first connection - when a client calls the Sync func. The location is stored as part of the peer:

* add locations endpoints * Add sqlite3 check and database generation in geolite script * Add SQLite storage for geolocation data * Refactor file existence check into a separate function * Integrate geolocation services into management application * Refactoring * Refactor city retrieval to include Geonames ID * Add signature verification for GeoLite2 database download * Change to in-memory database for geolocation store * Merge manager to geolocation * Update GetAllCountries to return Country name and iso code * fix tests * Add reload to SqliteStore * Add geoname indexes * move db file check to connectDB * Add concurrency safety to SQL queries and database reloading The commit adds mutex locks to the GetAllCountries and GetCitiesByCountry functions to ensure thread-safety during database queries. Additionally, it introduces a mechanism to safely close the old database connection before a new connection is established upon reloading, which improves the reliability of database operations. Lastly, it moves the checking of database file existence to the connectDB function. * Add sha256 sum check to geolocation store before reload * Use read lock * Check SHA256 twice when reload geonames db --------- Co-authored-by: Yury Gargay <[email protected]>

…1546)

* Implement user admin checks in posture checks * Add geolocation handler tests * Mark initGeolocationTestData as helper func * Add error handling to geolocation database closure * Add cleanup function to close geolocation resources

* change network state and generate map on posture check update * Refactoring

We only support allow and deny

management/server/http/api/openapi.yml

management/server/http/peers_handler.go

management/server/http/posture_checks_handler.go

management/server/http/api/openapi.yml

management/server/http/handler.go

management/server/posture_checks.go

mlsmaycon · 2024-02-19T14:08:32Z

@surik @bcmmbaga let's make the posture check name unique as well.

* add a correct min version and kernel for os posture check example * handle error when geo or location db is nil * expose all peer location details in api response * Check for nil geolocation manager only * Validate posture check before save * bump open api version * add peer location fields to toPeerListItemResponse

This PR implements the following posture checks: * Agent minimum version allowed * OS minimum version allowed * Geo-location based on connection IP For the geo-based location, we rely on GeoLite2 databases which are free IP geolocation databases. MaxMind was tested and we provide a script that easily allows to download of all necessary files, see infrastructure_files/download-geolite2.sh. The OpenAPI spec should extensively cover the life cycle of current version posture checks.

bcmmbaga and others added 25 commits December 28, 2023 15:53

wip: add posture checks structs

8fa11b1

add netbird version check

92ffd68

Merge branch 'main' into feature/posture-checks

23bcdb7

Refactor posture checks and add version checks

bc2bf4e

Merge branch 'main' into feature/posture-checks

2a1afbb

Add posture check activities (#1445)

526bff5

Merge branch 'main' into feature/posture-checks

d1421e9

Merge branch 'main' into feature/posture-checks

dfa4bc0

wip: add posture checks structs

f3d58b9

add netbird version check

a7ee8c2

Refactor posture checks and add version checks

a261cf9

Add posture check activities (#1445)

62fd5af

Merge remote-tracking branch 'origin/feature/posture-checks' into fea…

146f70f

…ture/posture-checks

Add OS Version posture checks (#1479)

ad42ead

Initial support of Geolocation service (#1491)

c21bb77

Merge remote-tracking branch 'origin/main' into feature/posture-checks

626b2a8

Fix peer meta core compability with older clients (#1515)

b0462cd

* Refactor extraction of OSVersion in grpcserver * Ignore lint check

Fix peer meta core compability with older management (#1532)

3ccdf71

* Revert core field deprecation * fix tests

Extend peer meta with location information (#1517)

4bcee77

This PR uses the geolocation service to resolve IP to location. The lookup happens once on the first connection - when a client calls the Sync func. The location is stored as part of the peer:

surik marked this pull request as ready for review February 7, 2024 16:00

This was referenced Feb 7, 2024

Expose trusted proxy list and counter configuration for realip middleware #1535

Merged

Feautre/extend sys meta #1536

Merged

bcmmbaga and others added 2 commits February 8, 2024 15:44

Add tests and validation for empty peer location in GeoLocationCheck (#…

d564cd9

…1546)

Merge remote-tracking branch 'origin/main' into feature/posture-checks

74d6918

bcmmbaga and others added 15 commits February 8, 2024 16:24

Disallow Geo check creation/update without configured Geo DB (#1548)

b284c4d

Fix shared access to in memory copy of geonames.db (#1550)

c49bf62

Trim suffix in when evaluate Min Kernel Version in OS check

7072c02

Add Valid Peer Windows Kernel version test

ddf01ac

Add Geolocation handler tests (#1556)

59480b9

* Implement user admin checks in posture checks * Add geolocation handler tests * Mark initGeolocationTestData as helper func * Add error handling to geolocation database closure * Add cleanup function to close geolocation resources

Simplify checks definition serialisation (#1555)

daacd5f

Regenerate network map on posture check update (#1563)

6cfb214

* change network state and generate map on posture check update * Refactoring

Merge remote-tracking branch 'origin/main' into feature/posture-checks

6792b50

Make city name optional (#1575)

0bdf533

Do not return empty city name

4982cca

Merge remote-tracking branch 'origin/main' into feature/posture-checks

bca6dbe

Validate action param of geo location checks (#1577)

5d40396

We only support allow and deny

Switch realip middleware to upstream (#1578)

d3904c7

Be more silent in download-geolite2.sh script

91ebbc0

Fix geonames db reload (#1580)

7c26cdb

surik mentioned this pull request Feb 16, 2024

Update SQLite ERD to show posture checks table netbirdio/docs#145

Merged

mlsmaycon requested changes Feb 19, 2024

View reviewed changes

surik and others added 2 commits February 19, 2024 17:06

Ensure posture check name uniqueness when create (#1594)

08e5907

mlsmaycon approved these changes Feb 20, 2024

View reviewed changes

surik merged commit 9bc7b9e into main Feb 20, 2024
23 checks passed

surik deleted the feature/posture-checks branch February 20, 2024 08:59

mlsmaycon restored the feature/posture-checks branch February 20, 2024 09:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add initial support of device posture checks #1540

Add initial support of device posture checks #1540

surik commented Feb 7, 2024 •

edited

Loading

mlsmaycon commented Feb 19, 2024

Add initial support of device posture checks #1540

Add initial support of device posture checks #1540

Conversation

surik commented Feb 7, 2024 • edited Loading

Describe your changes

Issue ticket number and link

Checklist

mlsmaycon commented Feb 19, 2024

surik commented Feb 7, 2024 •

edited

Loading