NM-341: Multi-tenancy changes

auth/auth.go

@@ -15,6 +15,7 @@ import (
 	"github.com/gravitl/netclient/wireguard"
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/models"
+	"github.com/gravitl/netmaker/scope"
 )
 
 var (
@@ -55,12 +56,13 @@ func Authenticate(server *config.Server, host *config.Config) (string, error) {
 	url := fmt.Sprintf("https://%s/api/hosts/adm/authenticate", server.API)
 	headers := make(http.Header)
 	headers.Set("Content-Type", "application/json")
+	headers.Set(scope.HeaderTenantID, host.TenantID)
 	respBytes, err := ncutils.SendRequest(http.MethodPost, url, headers, data)
 	if err != nil {
 		var notOkErr ncutils.ErrStatusNotOk
 		if errors.As(err, &notOkErr) {
 			if notOkErr.Status == http.StatusUnauthorized {
-				if err := cleanUpByServer(server); err != nil {
+				if err := cleanUpByServer(server, host); err != nil {
 					return "", err
 				}
 
@@ -85,7 +87,7 @@ func Authenticate(server *config.Server, host *config.Config) (string, error) {
 	return token.(string), nil
 }
 
-func cleanUpByServer(server *config.Server) error {
+func cleanUpByServer(server *config.Server, host *config.Config) error {
 	if err := config.ReadNodeConfig(); err != nil {
 		return err
 	}
@@ -111,7 +113,19 @@ func cleanUpByServer(server *config.Server) error {
 	if err := config.WriteNetclientConfig(); err != nil {
 		return err
 	}
-	config.DeleteServer(server.Name)
+
+	freshServer := config.GetServer(server.Name)
+	if freshServer != nil && host != nil && host.TenantID != "" {
+		logger.Log(0, "removing unauthorized tenant", host.TenantID, "from", server.Name)
+		delete(freshServer.HostIDs, host.TenantID)
+		if len(freshServer.HostIDs) == 0 {
+			config.DeleteServer(server.Name)
+		} else {
+			config.UpdateServer(server.Name, *freshServer)
+		}
+	} else {
+		config.DeleteServer(server.Name)
+	}
 	if err := config.WriteServerConfig(); err != nil {
 		return err
 	}

cmd/root.go

@@ -434,9 +434,19 @@ func checkConfig() {
 			fail = true
 			logger.Log(0, "configuration for", config.CurrServer, "is missing")
 		} else {
-			if server.MQID != netclient.ID {
+			if len(server.HostIDs) == 0 && netclient.ID != uuid.Nil {
+				// pre-multi-tenancy configs predate the HostIDs map; backfill it
+				// from the existing single host id instead of failing
+				logger.Log(0, "backfilling host id for", server.Name)
+				server.HostIDs = map[string]uuid.UUID{netclient.TenantID: netclient.ID}
+				config.UpdateServer(server.Name, *server)
+				if err := config.WriteServerConfig(); err != nil {
+					logger.Log(0, "failed to save server", server.Name, err.Error())
+				}
+			}
+			if server.HostIDs[netclient.TenantID] != netclient.ID {
 				fail = true
-				logger.Log(0, server.Name, "is misconfigured: MQID/Password does not match hostid/password")
+				logger.Log(0, server.Name, "is misconfigured: registered host ID does not match hostid/password")
 			}
 		}
 	}

cmd/server.go

@@ -38,6 +38,8 @@ func init() {
 	serverCmd.AddCommand(listServersCmd)
 	serverCmd.AddCommand(switchServerCmd)
 
+	leaveServerCmd.Flags().String("tenant-id", "", "leave only the specified tenant on the server")
+
 	// Here you will define your flags and configuration settings.
 
 	// Cobra supports Persistent Flags which will work for this command
@@ -53,10 +55,11 @@ func init() {
 var leaveServerCmd = &cobra.Command{
 	Use:   "leave [servername]",
 	Short: "leave a server",
-	Long:  `leave the specified server`,
+	Long:  `leave the specified server. Use --tenant-id to leave only that tenant; omit it to leave every tenant registered on the server.`,
 	Args:  cobra.ExactArgs(1),
 	Run: func(cmd *cobra.Command, args []string) {
-		if err := functions.LeaveServer(args[0]); err != nil {
+		tenantID, _ := cmd.Flags().GetString("tenant-id")
+		if err := functions.LeaveServer(args[0], tenantID); err != nil {
 			fmt.Println(err.Error())
 		}
 	},

config/server.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/gravitl/netmaker/models"
+	"github.com/gravitl/netmaker/schema"
 )
 
 var serverMutex sync.RWMutex
@@ -27,12 +28,12 @@ const ServerLockfile = "netclient-servers.lck"
 // Server represents a server configuration
 type Server struct {
 	models.ServerConfig
-	Name           string              `json:"name" yaml:"name"`
-	MQID           uuid.UUID           `json:"mqid" yaml:"mqid"`
-	Nodes          map[string]bool     `json:"nodes" yaml:"nodes"`
-	AccessKey      string              `json:"accesskey" yaml:"accesskey"`
-	NameServers    []string            `json:"name_servers"`
-	DnsNameservers []models.Nameserver `json:"dns_nameservers"`
+	HostIDs        map[string]uuid.UUID `json:"host_ids"`
+	Name           string               `json:"name" yaml:"name"`
+	Nodes          map[string]bool      `json:"nodes" yaml:"nodes"`
+	AccessKey      string               `json:"accesskey" yaml:"accesskey"`
+	NameServers    []string             `json:"name_servers"`
+	DnsNameservers []models.Nameserver  `json:"dns_nameservers"`
 }
 
 // TurnConfig - struct to hold turn server config
@@ -108,6 +109,17 @@ func GetServer(name string) *Server {
 	return nil
 }
 
+func GetServerByAPIHost(apiHost string) *Server {
+	serverMutex.RLock()
+	defer serverMutex.RUnlock()
+	for _, server := range Servers {
+		if server.APIHost == apiHost {
+			return &server
+		}
+	}
+	return nil
+}
+
 // GetServers - gets all the server names host has registered to.
 func GetServers() (servers []string) {
 	serverMutex.RLock()
@@ -164,7 +176,7 @@ func DeleteServer(k string) {
 }
 
 // UpdateServerConfig updates the in memory server map with values provided from netmaker server
-func UpdateServerConfig(cfg *models.ServerConfig) {
+func UpdateServerConfig(cfg *models.ServerConfig, host *schema.Host) {
 	serverMutex.Lock()
 	defer serverMutex.Unlock()
 	if cfg == nil {
@@ -175,8 +187,11 @@ func UpdateServerConfig(cfg *models.ServerConfig) {
 		server = Server{}
 		server.Nodes = make(map[string]bool)
 	}
+	if server.HostIDs == nil {
+		server.HostIDs = make(map[string]uuid.UUID)
+	}
+	server.HostIDs[host.TenantID] = host.ID
 	server.Name = cfg.Server
-	server.MQID = netclient.ID
 	server.ServerConfig = *cfg
 	Servers[cfg.Server] = server
 }

flow/manager_linux.go

@@ -109,10 +109,15 @@ func (m *Manager) Start(participantIdentifiers map[string]models.PeerIdentity) e
 				identity, found := m.participantIdentifiers[ipCidr]
 				if !found {
 					for addr := range m.participantIdentifiers {
+						if addr == "0.0.0.0/0" || addr == "::/0" {
+							continue
+						}
+
 						_, cidr, err := net.ParseCIDR(addr)
 						if err != nil {
 							continue
 						}
+
 						if cidr.Contains(net.ParseIP(ip)) {
 							identity, found = m.participantIdentifiers[addr]
 							break

flow/tracker/tracker.go

@@ -184,6 +184,7 @@ func (c *FlowTracker) handleEvent(event ct.Event) error {
 
 	return c.flowExporter.Export(&pbflow.FlowEvent{
 		Type:        eventType,
+		TenantId:    config.Netclient().TenantID,
 		FlowId:      flowID,
 		HostId:      c.hostIDStr,
 		HostName:    config.Netclient().Name,

functions/auto_relay.go

@@ -18,6 +18,7 @@ import (
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/models"
 	"github.com/gravitl/netmaker/schema"
+	"github.com/gravitl/netmaker/scope"
 
 	"golang.org/x/exp/slog"
 )
@@ -560,6 +561,7 @@ func autoRelayME(method, serverName, nodeID, peernodeID, relayID string) error {
 	headers := make(http.Header)
 	headers.Set("Content-Type", "application/json")
 	headers.Set("Authorization", "Bearer "+token)
+	headers.Set(scope.HeaderTenantID, host.TenantID)
 	_, err = ncutils.SendRequest(method, url, headers, models.AutoRelayMeReq{NodeID: peernodeID, AutoRelayGwID: relayID})
 	if err != nil {
 		return err

functions/daemon.go

@@ -19,6 +19,7 @@ import (
 
 	mqtt "github.com/eclipse/paho.mqtt.golang"
 	externalip "github.com/glendc/go-external-ip"
+	"github.com/google/uuid"
 	"github.com/gravitl/netclient/auth"
 	"github.com/gravitl/netclient/cache"
 	"github.com/gravitl/netclient/config"
@@ -595,8 +596,10 @@ func unsubscribeNode(client mqtt.Client, node *config.Node) {
 }
 
 // unsubscribe client broker communications for host topics
-func unsubscribeHost(client mqtt.Client, server string) {
-	hostID := config.Netclient().ID
+func unsubscribeHost(client mqtt.Client, server string, hostID uuid.UUID) {
+	if hostID != config.Netclient().ID {
+		return
+	}
 	slog.Info("removing subscription for host peer updates", "host", hostID, "server", server)
 	if token := client.Unsubscribe(fmt.Sprintf("peers/host/%s/%s", hostID.String(), server)); token.WaitTimeout(MQ_TIMEOUT*time.Second) && token.Error() != nil {
 		slog.Error("unable to unsubscribe from host peer updates", "host", hostID, "server", server, "error", token.Error())

functions/list.go

@@ -11,6 +11,7 @@ import (
 	"github.com/gravitl/netclient/ncutils"
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/models"
+	"github.com/gravitl/netmaker/scope"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
@@ -103,6 +104,7 @@ func GetNodePeers(node config.Node) ([]wgtypes.PeerConfig, error) {
 	headers := make(http.Header)
 	headers.Set("Content-Type", "application/json")
 	headers.Set("Authorization", "Bearer "+token)
+	headers.Set(scope.HeaderTenantID, host.TenantID)
 	respBytes, err := ncutils.SendRequest(http.MethodGet, url, headers, nil)
 	if err != nil {
 		return nil, err

functions/mqhandlers.go

@@ -28,6 +28,7 @@ import (
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/models"
 	"github.com/gravitl/netmaker/schema"
+	"github.com/gravitl/netmaker/scope"
 	"golang.org/x/exp/slog"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
@@ -492,8 +493,8 @@ func HostUpdate(client mqtt.Client, msg mqtt.Message) {
 		resetInterface = true
 	case models.DeleteHost:
 		clearRetainedMsg(client, msg.Topic())
-		unsubscribeHost(client, serverName)
-		deleteHostCfg(client, serverName)
+		unsubscribeHost(client, serverName, hostUpdate.Host.ID)
+		deleteHostCfg(client, serverName, hostUpdate.Host.TenantID)
 		config.WriteNodeConfig()
 		config.WriteServerConfig()
 		config.DeleteClientNodes()
@@ -648,7 +649,7 @@ func handleEndpointDetection(peers []wgtypes.PeerConfig, peerInfo models.HostInf
 	}
 }
 
-func deleteHostCfg(client mqtt.Client, server string) {
+func deleteHostCfg(client mqtt.Client, server, tenantID string) {
 	config.DeleteServerHostPeerCfg()
 	nodes := config.GetNodes()
 	for k, node := range nodes {
@@ -658,7 +659,18 @@ func deleteHostCfg(client mqtt.Client, server string) {
 			config.DeleteNode(k)
 		}
 	}
-	config.DeleteServer(server)
+
+	srvCfg := config.GetServer(server)
+	if srvCfg != nil && tenantID != "" {
+		delete(srvCfg.HostIDs, tenantID)
+		if len(srvCfg.HostIDs) == 0 {
+			config.DeleteServer(server)
+		} else {
+			config.UpdateServer(server, *srvCfg)
+		}
+	} else {
+		config.DeleteServer(server)
+	}
 }
 
 func parseNetworkFromTopic(topic string) string {
@@ -719,6 +731,7 @@ func getServerBrokerStatus() (bool, error) {
 	url := fmt.Sprintf("https://%s/api/server/status", server.API)
 	headers := make(http.Header)
 	headers.Set("Content-Type", "application/json")
+	headers.Set(scope.HeaderTenantID, config.Netclient().TenantID)
 	respBytes, err := ncutils.SendRequest(http.MethodGet, url, headers, nil)
 	if err != nil {
 		logger.Log(1, "failed to read from server during metrics publish", err.Error())

functions/mqpublish.go

@@ -21,6 +21,7 @@ import (
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/models"
 	"github.com/gravitl/netmaker/schema"
+	"github.com/gravitl/netmaker/scope"
 	"github.com/gravitl/netmaker/utils"
 	"golang.org/x/exp/slog"
 )
@@ -194,6 +195,7 @@ func hostUpdateWithServer(server *config.Server, hu models.HostUpdate) error {
 	headers := make(http.Header)
 	headers.Set("Content-Type", "application/json")
 	headers.Set("Authorization", "Bearer "+token)
+	headers.Set(scope.HeaderTenantID, host.TenantID)
 	_, err = ncutils.SendRequest(http.MethodPut, url, headers, buildHostUpdatePayload(hu))
 	if err != nil {
 		if denyErr := auth.AsMDMDenied(err); errors.Is(denyErr, auth.ErrMDMDenied) {

functions/pull.go

@@ -15,6 +15,7 @@ import (
 	"github.com/gravitl/netclient/wireguard"
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/models"
+	"github.com/gravitl/netmaker/scope"
 )
 
 var pMutex = sync.Mutex{} // used to mutex functions for pull
@@ -39,6 +40,7 @@ func Pull(restart bool, resetIfFailedOvered bool) (models.HostPull, bool, bool,
 	headers := make(http.Header)
 	headers.Set("Content-Type", "application/json")
 	headers.Set("Authorization", "Bearer "+token)
+	headers.Set(scope.HeaderTenantID, config.Netclient().TenantID)
 	respBytes, err := ncutils.SendRequest(http.MethodGet, url, headers, nil)
 	if err != nil {
 		if denyErr := auth.AsMDMDenied(err); errors.Is(denyErr, auth.ErrMDMDenied) {
@@ -82,7 +84,7 @@ func Pull(restart bool, resetIfFailedOvered bool) (models.HostPull, bool, bool,
 	}
 	replacePeers = wireguard.ShouldReplace(pullResponse.Peers)
 	config.UpdateHostPeers(pullResponse.Peers)
-	config.UpdateServerConfig(&pullResponse.ServerConfig)
+	config.UpdateServerConfig(&pullResponse.ServerConfig, &pullResponse.Host)
 	config.SetNodes(pullResponse.Nodes)
 	UpdateHostFromServer(&pullResponse.Host)
 	server = config.GetServer(serverName)

functions/register.go

@@ -16,6 +16,7 @@ import (
 	"github.com/gravitl/netclient/posture"
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/models"
+	"github.com/gravitl/netmaker/scope"
 )
 
 // Register - should be simple to register with a token
@@ -44,7 +45,7 @@ func Register(token string) error {
 	} else if defaultInterface != ncutils.GetInterfaceName() {
 		host.DefaultInterface = defaultInterface
 	}
-	shouldUpdateHost, err := doubleCheck(host)
+	shouldUpdateHost, err := doubleCheck(serverData.Server, serverData.TenantID, host)
 	if err != nil {
 		logger.FatalLog(fmt.Sprintf("error when checking host values - %v", err.Error()))
 	}
@@ -55,6 +56,7 @@ func Register(token string) error {
 	url := fmt.Sprintf("https://%s/api/v1/host/register/%s", serverData.Server, token)
 	headers := make(http.Header)
 	headers.Set("Content-Type", "application/json")
+	headers.Set(scope.HeaderTenantID, serverData.TenantID)
 	posture.ApplyIdentity(&host.Host)
 	respBytes, err := ncutils.SendRequest(http.MethodPost, url, headers, host)
 	if err != nil {
@@ -81,7 +83,7 @@ func Register(token string) error {
 	return nil
 }
 
-func doubleCheck(host *config.Config) (shouldUpdate bool, err error) {
+func doubleCheck(server, tenantID string, host *config.Config) (shouldUpdate bool, err error) {
 	var shouldUpdateHost bool
 
 	if len(config.CurrServer) == 0 { // should indicate a first join
@@ -107,6 +109,16 @@ func doubleCheck(host *config.Config) (shouldUpdate bool, err error) {
 			host.HostPass = ncutils.RandomString(32)
 			shouldUpdateHost = true
 		}
+	} else if tenantID != "" {
+		var hostIDs map[string]uuid.UUID
+		if server := config.GetServerByAPIHost(server); server != nil {
+			hostIDs = server.HostIDs
+		}
+		if existingID, ok := hostIDs[tenantID]; ok {
+			host.ID = existingID
+		} else if host.ID, err = uuid.NewUUID(); err != nil {
+			return false, err
+		}
 	}
 
 	if shouldUpdateHost {
@@ -118,7 +130,7 @@ func doubleCheck(host *config.Config) (shouldUpdate bool, err error) {
 }
 
 func handleRegisterResponse(registerResponse *models.RegisterResponse) {
-	config.UpdateServerConfig(&registerResponse.ServerConf)
+	config.UpdateServerConfig(&registerResponse.ServerConf, &registerResponse.RequestedHost)
 	server := config.GetServer(registerResponse.ServerConf.Server)
 	if err := config.SaveServer(registerResponse.ServerConf.Server, *server); err != nil {
 		logger.Log(0, "failed to save server", err.Error())