Skip to content

Commit fd2bc56

Browse files
henrybarretohenrybarreto
committed
feature(agent,api,pkg): add VPN capability
It adds to the ShellHub's Agent the capability to connect to a ShellHub's Enterprise service, which provides a virtual private network between devices registered into the same namespace. To enable it, the ShellHub's instance must support it, and the `SHELLHUB_VPN` environmental variable must be set to `TRUE` on the ShellHub Agent startup.
1 parent 54fb229 commit fd2bc56

File tree

23 files changed

+1022
-14
lines changed

23 files changed

+1022
-14
lines changed

‎agent/go.mod

+3
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,10 @@ require (
4848
github.com/pkg/errors v0.9.1 // indirect
4949
github.com/pkg/sftp v1.13.5 // indirect
5050
github.com/sethvargo/go-envconfig v0.9.0 // indirect
51+
github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 // indirect
5152
github.com/spf13/pflag v1.0.5 // indirect
53+
github.com/vishvananda/netlink v1.2.1-beta.2 // indirect
54+
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f // indirect
5255
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.51.0 // indirect
5356
go.opentelemetry.io/otel v1.26.0 // indirect
5457
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.26.0 // indirect

‎agent/go.sum

+9
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,8 @@ github.com/shellhub-io/ssh v0.0.0-20230224143412-edd48dfd6eea h1:7tEI9nukSYZViCj
9898
github.com/shellhub-io/ssh v0.0.0-20230224143412-edd48dfd6eea/go.mod h1:8XB4KraRrX39qHhT6yxPsHedjA08I/uBVwj4xC+/+z4=
9999
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
100100
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
101+
github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
102+
github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
101103
github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
102104
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
103105
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
@@ -118,6 +120,11 @@ github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyC
118120
github.com/valyala/fasttemplate v1.2.1/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
119121
github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
120122
github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
123+
github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
124+
github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
125+
github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
126+
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f h1:p4VB7kIXpOQvVn1ZaTIVp+3vuYAXFe3OJEvjbUYJLaA=
127+
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
121128
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
122129
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
123130
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.51.0 h1:Xs2Ncz0gNihqu9iosIZ5SkBbWo5T8JhhLJFMQL1qmLI=
@@ -159,6 +166,8 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
159166
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
160167
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
161168
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
169+
golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
170+
golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
162171
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
163172
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
164173
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

‎agent/main.go

+35-11
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ func main() {
109109
"tenant_id": cfg.TenantID,
110110
"server_address": cfg.ServerAddress,
111111
"preferred_hostname": cfg.PreferredHostname,
112-
}).Info("Listening for connections")
112+
}).Info("Listening for SSH connections")
113113

114114
// Disable check update in development mode
115115
if AgentVersion != "latest" {
@@ -163,23 +163,47 @@ func main() {
163163
}()
164164
}
165165

166-
if err := ag.ListenSSH(ctx); err != nil {
167-
log.WithError(err).WithFields(log.Fields{
168-
"version": AgentVersion,
169-
"mode": mode,
170-
"tenant_id": cfg.TenantID,
171-
"server_address": cfg.ServerAddress,
172-
"preferred_hostname": cfg.PreferredHostname,
173-
}).Fatal("Failed to listen for SSH connections")
174-
}
166+
go func() {
167+
if err := ag.ListenSSH(ctx); err != nil {
168+
log.WithError(err).WithFields(log.Fields{
169+
"version": AgentVersion,
170+
"mode": mode,
171+
"tenant_id": cfg.TenantID,
172+
"server_address": cfg.ServerAddress,
173+
"preferred_hostname": cfg.PreferredHostname,
174+
}).Fatal("Failed to listen for SSH connections")
175+
}
176+
}()
177+
178+
go func() {
179+
if !cfg.VPN {
180+
log.Info("VPN is disable")
181+
182+
return
183+
}
184+
185+
log.Debug("VPN enabled")
186+
187+
for {
188+
log.Info("VPN connected")
189+
190+
if err := ag.ConnectVPN(ctx); err != nil {
191+
log.WithError(err).Error("Connect to VPN lost. Retrying in 10 seconds.")
192+
}
193+
194+
time.Sleep(10 * time.Second)
195+
}
196+
}()
197+
198+
<-ctx.Done()
175199

176200
log.WithFields(log.Fields{
177201
"version": AgentVersion,
178202
"mode": mode,
179203
"tenant_id": cfg.TenantID,
180204
"server_address": cfg.ServerAddress,
181205
"preferred_hostname": cfg.PreferredHostname,
182-
}).Info("Stopped listening for connections")
206+
}).Info("Agent Stopped")
183207
},
184208
}
185209

‎api/services/errors.go

+10
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,8 @@ var (
130130
ErrAPIKeyDuplicated = errors.New("APIKey duplicated", ErrLayer, ErrCodeDuplicated)
131131
ErrAuthForbidden = errors.New("user is authenticated but cannot access this resource", ErrLayer, ErrCodeForbidden)
132132
ErrRoleInvalid = errors.New("role is invalid", ErrLayer, ErrCodeForbidden)
133+
ErrNamespaceIPInvalid = errors.New("ip is invalid", ErrLayer, ErrCodeForbidden)
134+
ErrNamespaceIPNotPrivate = errors.New("ip is not a private address", ErrLayer, ErrCodeForbidden)
133135
)
134136

135137
func NewErrRoleInvalid() error {
@@ -471,3 +473,11 @@ func NewErrDeviceMaxDevicesReached(count int) error {
471473
func NewErrAuthForbidden() error {
472474
return NewErrForbidden(ErrAuthForbidden, nil)
473475
}
476+
477+
func NewErrNamespaceIPInvalid() error {
478+
return NewErrInvalid(ErrNamespaceIPInvalid, nil, nil)
479+
}
480+
481+
func NewErrNamespaceIPNotPrivate() error {
482+
return NewErrInvalid(ErrNamespaceIPNotPrivate, nil, nil)
483+
}

‎api/services/namespace.go

+31
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,13 @@ package services
33
import (
44
"context"
55
"errors"
6+
"net"
67
"strings"
78

89
"github.com/shellhub-io/shellhub/api/store"
910
"github.com/shellhub-io/shellhub/api/store/mongo"
1011
"github.com/shellhub-io/shellhub/pkg/api/authorizer"
12+
"github.com/shellhub-io/shellhub/pkg/api/internalclient"
1113
"github.com/shellhub-io/shellhub/pkg/api/requests"
1214
"github.com/shellhub-io/shellhub/pkg/clock"
1315
"github.com/shellhub-io/shellhub/pkg/envs"
@@ -204,6 +206,27 @@ func (s *service) EditNamespace(ctx context.Context, req *requests.NamespaceEdit
204206
ConnectionAnnouncement: req.Settings.ConnectionAnnouncement,
205207
}
206208

209+
if envs.IsEnterprise() {
210+
changes.VPNEnable = req.VPN.Enable
211+
212+
if req.VPN.Address != nil {
213+
address := *req.VPN.Address
214+
ip := net.IPv4(address[0], address[1], address[2], address[3])
215+
216+
if ip.IsLoopback() || ip.IsUnspecified() {
217+
return nil, NewErrNamespaceIPInvalid()
218+
}
219+
220+
if !ip.IsPrivate() {
221+
return nil, NewErrNamespaceIPNotPrivate()
222+
}
223+
224+
changes.VPNAddress = &address
225+
}
226+
227+
changes.VPNMask = req.VPN.Mask
228+
}
229+
207230
if err := s.store.NamespaceEdit(ctx, req.Tenant, changes); err != nil {
208231
switch {
209232
case errors.Is(err, store.ErrNoDocuments):
@@ -213,6 +236,14 @@ func (s *service) EditNamespace(ctx context.Context, req *requests.NamespaceEdit
213236
}
214237
}
215238

239+
if envs.IsEnterprise() {
240+
cli := s.client.(internalclient.Client)
241+
242+
if err := cli.VPNStopRouter(req.Tenant); err != nil {
243+
return nil, err
244+
}
245+
}
246+
216247
return s.store.NamespaceGet(ctx, req.Tenant, true)
217248
}
218249

‎api/services/namespace_test.go

+5
Original file line numberDiff line numberDiff line change
@@ -937,6 +937,7 @@ func TestEditNamespace(t *testing.T) {
937937
tenantID: "xxxxx",
938938
namespaceName: "newname",
939939
requiredMocks: func() {
940+
envMock.On("Get", "SHELLHUB_ENTERPRISE").Return("false").Once()
940941
mock.On("NamespaceEdit", ctx, "xxxxx", &models.NamespaceChanges{Name: "newname"}).
941942
Return(store.ErrNoDocuments).
942943
Once()
@@ -951,6 +952,7 @@ func TestEditNamespace(t *testing.T) {
951952
tenantID: "xxxxx",
952953
namespaceName: "newname",
953954
requiredMocks: func() {
955+
envMock.On("Get", "SHELLHUB_ENTERPRISE").Return("false").Once()
954956
mock.On("NamespaceEdit", ctx, "xxxxx", &models.NamespaceChanges{Name: "newname"}).
955957
Return(errors.New("error")).
956958
Once()
@@ -965,6 +967,7 @@ func TestEditNamespace(t *testing.T) {
965967
namespaceName: "newName",
966968
tenantID: "xxxxx",
967969
requiredMocks: func() {
970+
envMock.On("Get", "SHELLHUB_ENTERPRISE").Return("false").Once()
968971
mock.On("NamespaceEdit", ctx, "xxxxx", &models.NamespaceChanges{Name: "newname"}).
969972
Return(nil).
970973
Once()
@@ -991,6 +994,7 @@ func TestEditNamespace(t *testing.T) {
991994
namespaceName: "newname",
992995
tenantID: "xxxxx",
993996
requiredMocks: func() {
997+
envMock.On("Get", "SHELLHUB_ENTERPRISE").Return("false").Once()
994998
mock.On("NamespaceEdit", ctx, "xxxxx", &models.NamespaceChanges{Name: "newname"}).
995999
Return(nil).
9961000
Once()
@@ -1000,6 +1004,7 @@ func TestEditNamespace(t *testing.T) {
10001004
Name: "newname",
10011005
}
10021006

1007+
envMock.On("Get", "SHELLHUB_ENTERPRISE").Return("false").Once()
10031008
mock.On("NamespaceGet", ctx, "xxxxx", true).
10041009
Return(namespace, nil).
10051010
Once()

‎api/store/mongo/migrations/main.go

+1
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ func GenerateMigrations() []migrate.Migration {
8686
migration74,
8787
migration75,
8888
migration76,
89+
migration77,
8990
}
9091
}
9192

‎api/store/mongo/migrations/migration_77.go

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
package migrations
2+
3+
import (
4+
"context"
5+
6+
"github.com/shellhub-io/shellhub/pkg/envs"
7+
"github.com/sirupsen/logrus"
8+
migrate "github.com/xakep666/mongo-migrate"
9+
"go.mongodb.org/mongo-driver/bson"
10+
"go.mongodb.org/mongo-driver/mongo"
11+
)
12+
13+
var migration77 = migrate.Migration{
14+
Version: 77,
15+
Description: "Adding VPN settings to namespace",
16+
Up: migrate.MigrationFunc(func(ctx context.Context, db *mongo.Database) error {
17+
logrus.WithFields(logrus.Fields{
18+
"component": "migration",
19+
"version": 77,
20+
"action": "Up",
21+
}).Info("Applying migration")
22+
23+
if envs.IsEnterprise() {
24+
update := bson.M{
25+
"$set": bson.M{
26+
"vpn": bson.M{
27+
"enable": false,
28+
"address": bson.A{10, 0, 0, 0},
29+
"mask": 16,
30+
},
31+
},
32+
}
33+
34+
_, err := db.
35+
Collection("namespaces").
36+
UpdateMany(ctx, bson.M{}, update)
37+
38+
return err
39+
}
40+
41+
return nil
42+
}),
43+
Down: migrate.MigrationFunc(func(ctx context.Context, db *mongo.Database) error {
44+
logrus.WithFields(logrus.Fields{
45+
"component": "migration",
46+
"version": 77,
47+
"action": "Down",
48+
}).Info("Reverting migration")
49+
50+
if envs.IsEnterprise() {
51+
update := bson.M{
52+
"$unset": bson.M{"vpn": ""},
53+
}
54+
55+
_, err := db.
56+
Collection("namespaces").
57+
UpdateMany(ctx, bson.M{}, update)
58+
59+
return err
60+
}
61+
62+
return nil
63+
}),
64+
}

0 commit comments

Comments
 (0)