mirror of
https://github.com/fosrl/pangolin.git
synced 2026-07-26 07:14:37 +02:00
Compare commits
5 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dependabot[bot]
|
1c560591ec | ||
 Owen Schwartz
|
71f45b8a80 | ||
|
Owen
|
ecf008a8d9 | ||
|
Owen Schwartz
|
19c1c2042b | ||
 Fred KISSIE
|
56fcb80b23 |
Generated
+1779
-2983
File diff suppressed because it is too large
Load Diff
+63
-63
@@ -32,10 +32,10 @@
|
||||
"format": "prettier --write ."
|
||||
},
|
||||
"dependencies": {
|
||||
"@asteasolutions/zod-to-openapi": "8.5.0",
|
||||
"@asteasolutions/zod-to-openapi": "9.1.0",
|
||||
"@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
|
||||
"@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
|
||||
"@aws-sdk/client-s3": "3.1056.0",
|
||||
"@aws-sdk/client-s3": "3.1093.0",
|
||||
"@headlessui/react": "2.2.10",
|
||||
"@hookform/resolvers": "5.4.0",
|
||||
"@monaco-editor/react": "4.7.0",
|
||||
@@ -43,38 +43,38 @@
|
||||
"@novnc/novnc": "^1.7.0",
|
||||
"@oslojs/crypto": "1.0.1",
|
||||
"@oslojs/encoding": "1.1.0",
|
||||
"@radix-ui/react-avatar": "1.1.11",
|
||||
"@radix-ui/react-checkbox": "1.3.3",
|
||||
"@radix-ui/react-collapsible": "1.1.12",
|
||||
"@radix-ui/react-dialog": "1.1.15",
|
||||
"@radix-ui/react-dropdown-menu": "2.1.16",
|
||||
"@radix-ui/react-avatar": "1.2.4",
|
||||
"@radix-ui/react-checkbox": "1.3.9",
|
||||
"@radix-ui/react-collapsible": "1.1.18",
|
||||
"@radix-ui/react-dialog": "1.1.21",
|
||||
"@radix-ui/react-dropdown-menu": "2.1.22",
|
||||
"@radix-ui/react-icons": "1.3.2",
|
||||
"@radix-ui/react-label": "2.1.8",
|
||||
"@radix-ui/react-popover": "1.1.15",
|
||||
"@radix-ui/react-progress": "1.1.8",
|
||||
"@radix-ui/react-radio-group": "1.3.8",
|
||||
"@radix-ui/react-scroll-area": "1.2.10",
|
||||
"@radix-ui/react-select": "2.2.6",
|
||||
"@radix-ui/react-separator": "1.1.8",
|
||||
"@radix-ui/react-slot": "1.2.4",
|
||||
"@radix-ui/react-switch": "1.2.6",
|
||||
"@radix-ui/react-tabs": "1.1.13",
|
||||
"@radix-ui/react-toast": "1.2.15",
|
||||
"@radix-ui/react-tooltip": "1.2.8",
|
||||
"@radix-ui/react-label": "2.1.13",
|
||||
"@radix-ui/react-popover": "1.1.21",
|
||||
"@radix-ui/react-progress": "1.1.14",
|
||||
"@radix-ui/react-radio-group": "1.4.5",
|
||||
"@radix-ui/react-scroll-area": "1.2.16",
|
||||
"@radix-ui/react-select": "2.3.5",
|
||||
"@radix-ui/react-separator": "1.1.13",
|
||||
"@radix-ui/react-slot": "1.3.1",
|
||||
"@radix-ui/react-switch": "1.3.5",
|
||||
"@radix-ui/react-tabs": "1.1.19",
|
||||
"@radix-ui/react-toast": "1.2.21",
|
||||
"@radix-ui/react-tooltip": "1.2.14",
|
||||
"@react-email/body": "0.3.0",
|
||||
"@react-email/components": "1.0.12",
|
||||
"@react-email/render": "2.0.8",
|
||||
"@react-email/render": "2.1.0",
|
||||
"@react-email/tailwind": "2.0.7",
|
||||
"@simplewebauthn/browser": "13.3.0",
|
||||
"@simplewebauthn/server": "13.3.1",
|
||||
"@simplewebauthn/server": "13.3.2",
|
||||
"@tailwindcss/forms": "0.5.11",
|
||||
"@tanstack/react-query": "5.100.14",
|
||||
"@tanstack/react-query": "5.101.4",
|
||||
"@tanstack/react-table": "8.21.3",
|
||||
"@xterm/addon-fit": "^0.11.0",
|
||||
"@xterm/addon-web-links": "^0.12.0",
|
||||
"@xterm/xterm": "^6.0.0",
|
||||
"arctic": "3.7.0",
|
||||
"axios": "1.16.1",
|
||||
"axios": "1.18.1",
|
||||
"better-sqlite3": "11.9.1",
|
||||
"canvas-confetti": "1.9.4",
|
||||
"class-variance-authority": "0.7.1",
|
||||
@@ -86,61 +86,61 @@
|
||||
"d3": "7.9.0",
|
||||
"drizzle-orm": "0.45.2",
|
||||
"express": "5.2.1",
|
||||
"express-rate-limit": "8.5.2",
|
||||
"express-rate-limit": "8.6.0",
|
||||
"glob": "13.0.6",
|
||||
"helmet": "8.2.0",
|
||||
"helmet": "8.3.0",
|
||||
"http-errors": "2.0.1",
|
||||
"input-otp": "1.4.2",
|
||||
"ioredis": "5.11.0",
|
||||
"ioredis": "5.11.1",
|
||||
"jmespath": "0.16.0",
|
||||
"js-yaml": "4.2.0",
|
||||
"js-yaml": "5.2.1",
|
||||
"jsonwebtoken": "9.0.3",
|
||||
"lucide-react": "1.17.0",
|
||||
"lucide-react": "1.25.0",
|
||||
"maxmind": "5.0.6",
|
||||
"moment": "2.30.1",
|
||||
"next": "16.2.6",
|
||||
"next-intl": "4.13.0",
|
||||
"next": "16.2.11",
|
||||
"next-intl": "4.13.3",
|
||||
"next-themes": "0.4.6",
|
||||
"nextjs-toploader": "3.9.17",
|
||||
"node-cache": "5.1.2",
|
||||
"nodemailer": "9.0.1",
|
||||
"nodemailer": "9.0.3",
|
||||
"oslo": "1.2.1",
|
||||
"pg": "8.21.0",
|
||||
"posthog-node": "5.35.6",
|
||||
"pg": "8.22.0",
|
||||
"posthog-node": "5.46.0",
|
||||
"qrcode.react": "4.2.0",
|
||||
"react": "19.2.6",
|
||||
"react-day-picker": "9.14.0",
|
||||
"react-dom": "19.2.6",
|
||||
"react": "19.2.8",
|
||||
"react-day-picker": "10.0.1",
|
||||
"react-dom": "19.2.8",
|
||||
"react-easy-sort": "1.8.0",
|
||||
"react-hook-form": "7.76.1",
|
||||
"react-icons": "5.6.0",
|
||||
"recharts": "3.8.1",
|
||||
"react-hook-form": "7.82.0",
|
||||
"react-icons": "5.7.0",
|
||||
"recharts": "3.10.0",
|
||||
"reodotdev": "1.1.0",
|
||||
"semver": "7.8.1",
|
||||
"semver": "7.8.5",
|
||||
"sshpk": "1.18.0",
|
||||
"stripe": "22.2.0",
|
||||
"stripe": "22.3.2",
|
||||
"swagger-ui-express": "5.0.1",
|
||||
"tailwind-merge": "3.6.0",
|
||||
"topojson-client": "3.1.0",
|
||||
"tw-animate-css": "1.4.0",
|
||||
"use-debounce": "10.1.1",
|
||||
"uuid": "14.0.0",
|
||||
"uuid": "14.0.1",
|
||||
"vaul": "1.1.2",
|
||||
"visionscarto-world-atlas": "1.0.0",
|
||||
"winston": "3.19.0",
|
||||
"winston-daily-rotate-file": "5.0.0",
|
||||
"ws": "8.21.0",
|
||||
"ws": "8.21.1",
|
||||
"yaml": "2.9.0",
|
||||
"yargs": "18.0.0",
|
||||
"zod": "4.4.3",
|
||||
"zod-validation-error": "5.0.0"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@dotenvx/dotenvx": "1.69.1",
|
||||
"@dotenvx/dotenvx": "2.17.2",
|
||||
"@esbuild-plugins/tsconfig-paths": "0.1.2",
|
||||
"@react-email/ui": "^6.5.0",
|
||||
"@tailwindcss/postcss": "4.3.0",
|
||||
"@tanstack/react-query-devtools": "5.100.14",
|
||||
"@react-email/ui": "^6.9.0",
|
||||
"@tailwindcss/postcss": "4.3.3",
|
||||
"@tanstack/react-query-devtools": "5.101.4",
|
||||
"@types/better-sqlite3": "7.6.13",
|
||||
"@types/cookie-parser": "1.4.10",
|
||||
"@types/cors": "2.8.19",
|
||||
@@ -151,14 +151,14 @@
|
||||
"@types/jmespath": "0.15.2",
|
||||
"@types/js-yaml": "4.0.9",
|
||||
"@types/jsonwebtoken": "9.0.10",
|
||||
"@types/node": "25.9.1",
|
||||
"@types/nodemailer": "8.0.0",
|
||||
"@types/node": "26.1.1",
|
||||
"@types/nodemailer": "8.0.1",
|
||||
"@types/nprogress": "0.2.3",
|
||||
"@types/pg": "8.20.0",
|
||||
"@types/react": "19.2.15",
|
||||
"@types/react": "19.2.17",
|
||||
"@types/react-dom": "19.2.3",
|
||||
"@types/semver": "7.7.1",
|
||||
"@types/sshpk": "1.17.4",
|
||||
"@types/sshpk": "1.17.5",
|
||||
"@types/swagger-ui-express": "4.1.8",
|
||||
"@types/topojson-client": "3.1.5",
|
||||
"@types/ws": "8.18.1",
|
||||
@@ -166,21 +166,21 @@
|
||||
"babel-plugin-react-compiler": "1.0.0",
|
||||
"drizzle-kit": "0.31.10",
|
||||
"esbuild": "0.28.1",
|
||||
"esbuild-node-externals": "1.22.0",
|
||||
"eslint": "10.4.0",
|
||||
"eslint-config-next": "16.2.6",
|
||||
"postcss": "8.5.15",
|
||||
"prettier": "3.8.3",
|
||||
"react-email": "6.5.0",
|
||||
"tailwindcss": "4.3.0",
|
||||
"tsc-alias": "1.8.17",
|
||||
"tsx": "4.22.3",
|
||||
"typescript": "6.0.3",
|
||||
"typescript-eslint": "8.60.0"
|
||||
"esbuild-node-externals": "1.23.1",
|
||||
"eslint": "10.7.0",
|
||||
"eslint-config-next": "16.2.11",
|
||||
"postcss": "8.5.22",
|
||||
"prettier": "3.9.6",
|
||||
"react-email": "6.9.0",
|
||||
"tailwindcss": "4.3.3",
|
||||
"tsc-alias": "1.9.1",
|
||||
"tsx": "4.23.1",
|
||||
"typescript": "7.0.2",
|
||||
"typescript-eslint": "8.65.0"
|
||||
},
|
||||
"overrides": {
|
||||
"esbuild": "0.28.1",
|
||||
"dompurify": "3.4.0",
|
||||
"postcss": "8.5.15"
|
||||
"postcss": "8.5.22"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -5,6 +5,7 @@ export async function getValidCertificatesForDomains(
|
||||
Array<{
|
||||
id: number;
|
||||
domain: string;
|
||||
queriedDomain: string;
|
||||
wildcard: boolean | null;
|
||||
certFile: string | null;
|
||||
keyFile: string | null;
|
||||
|
||||
@@ -18,3 +18,19 @@ export function canCompress(
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// Whether this newt client understands `tlsCertId` references into the
|
||||
// sync message's `certs` array, instead of requiring each target to carry
|
||||
// its own inline `tlsCert`/`tlsKey` PEM data. Bump the version floor here to
|
||||
// match whatever release first ships the newt-side support.
|
||||
export function supportsCertReferences(
|
||||
clientVersion: string | null | undefined
|
||||
): boolean {
|
||||
try {
|
||||
if (!clientVersion) return false;
|
||||
if (!semver.valid(clientVersion)) return false;
|
||||
return semver.gte(clientVersion, "1.16.0");
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
+111
-13
@@ -5,6 +5,7 @@ import config from "@server/lib/config";
|
||||
import z from "zod";
|
||||
import logger from "@server/logger";
|
||||
import semver from "semver";
|
||||
import { createHash } from "crypto";
|
||||
import { getValidCertificatesForDomains } from "#dynamic/lib/certificates";
|
||||
import { lockManager } from "#dynamic/lib/lock";
|
||||
|
||||
@@ -648,21 +649,101 @@ export type SubnetProxyTargetV2 = {
|
||||
httpTargets?: HTTPTarget[];
|
||||
tlsCert?: string;
|
||||
tlsKey?: string;
|
||||
tlsCertId?: string; // references an entry in the sync message's top-level `certs` array instead of inlining tlsCert/tlsKey
|
||||
};
|
||||
|
||||
export type CertRef = { id: string; cert: string; key: string };
|
||||
|
||||
/**
|
||||
* Replaces each target's inline tlsCert/tlsKey with a tlsCertId reference
|
||||
* into a deduplicated certs array, so that many targets sharing the same
|
||||
* certificate (e.g. a wildcard cert used by thousands of site resources)
|
||||
* only need that certificate sent once per sync message.
|
||||
*/
|
||||
export function dedupeCertsForTargets(
|
||||
targetsV2: SubnetProxyTargetV2[]
|
||||
): { targets: SubnetProxyTargetV2[]; certs: CertRef[] } {
|
||||
const idByContent = new Map<string, string>();
|
||||
const certs: CertRef[] = [];
|
||||
|
||||
const targets = targetsV2.map((target) => {
|
||||
if (!target.tlsCert || !target.tlsKey) {
|
||||
return target;
|
||||
}
|
||||
|
||||
const contentKey = `${target.tlsCert}|${target.tlsKey}`;
|
||||
let id = idByContent.get(contentKey);
|
||||
if (!id) {
|
||||
id = createHash("sha1").update(contentKey).digest("hex").slice(0, 16);
|
||||
idByContent.set(contentKey, id);
|
||||
certs.push({ id, cert: target.tlsCert, key: target.tlsKey });
|
||||
}
|
||||
|
||||
const { tlsCert, tlsKey, ...rest } = target;
|
||||
return { ...rest, tlsCertId: id };
|
||||
});
|
||||
|
||||
return { targets, certs };
|
||||
}
|
||||
|
||||
export type HTTPTarget = {
|
||||
destAddr: string; // must be an IP or hostname
|
||||
destPort: number;
|
||||
scheme: "http" | "https";
|
||||
};
|
||||
|
||||
export type CertByDomain = Map<string, { certFile: string; keyFile: string }>;
|
||||
|
||||
/**
|
||||
* Fetches the TLS certificates for every enabled, SSL-enabled HTTP site
|
||||
* resource's fullDomain in a single batched call, instead of one call per
|
||||
* resource. Many resources commonly resolve to the very same certificate
|
||||
* (e.g. a wildcard covering the org's domain), so batching turns what would
|
||||
* be N concurrent DB/cache round-trips into one, and a lookup failure fails
|
||||
* loudly for the whole batch rather than silently dropping the cert on a
|
||||
* random subset of otherwise-identical resources under load.
|
||||
*/
|
||||
export async function batchFetchCertsForSiteResources(
|
||||
allSiteResources: SiteResource[]
|
||||
): Promise<CertByDomain> {
|
||||
const domains = new Set(
|
||||
allSiteResources
|
||||
.filter((r) => r.enabled && r.mode === "http" && r.ssl && r.fullDomain)
|
||||
.map((r) => r.fullDomain as string)
|
||||
);
|
||||
|
||||
const certByDomain: CertByDomain = new Map();
|
||||
if (domains.size === 0) {
|
||||
return certByDomain;
|
||||
}
|
||||
|
||||
try {
|
||||
const certResults = await getValidCertificatesForDomains(domains, true);
|
||||
for (const cert of certResults) {
|
||||
if (cert.certFile && cert.keyFile) {
|
||||
certByDomain.set(cert.queriedDomain, {
|
||||
certFile: cert.certFile,
|
||||
keyFile: cert.keyFile
|
||||
});
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
logger.error(
|
||||
`Failed to batch-retrieve certificates for ${domains.size} domain(s): ${err}`
|
||||
);
|
||||
}
|
||||
|
||||
return certByDomain;
|
||||
}
|
||||
|
||||
export async function generateSubnetProxyTargetV2(
|
||||
siteResource: SiteResource,
|
||||
clients: {
|
||||
clientId: number;
|
||||
pubKey: string | null;
|
||||
subnet: string | null;
|
||||
}[]
|
||||
}[],
|
||||
certByDomain?: CertByDomain
|
||||
): Promise<SubnetProxyTargetV2[] | undefined> {
|
||||
if (!siteResource.enabled) {
|
||||
logger.debug(
|
||||
@@ -750,23 +831,40 @@ export async function generateSubnetProxyTargetV2(
|
||||
let tlsKey: string | undefined;
|
||||
|
||||
if (siteResource.ssl && siteResource.fullDomain) {
|
||||
try {
|
||||
const certs = await getValidCertificatesForDomains(
|
||||
new Set([siteResource.fullDomain]),
|
||||
true
|
||||
);
|
||||
if (certs.length > 0 && certs[0].certFile && certs[0].keyFile) {
|
||||
tlsCert = certs[0].certFile;
|
||||
tlsKey = certs[0].keyFile;
|
||||
if (certByDomain) {
|
||||
// Caller batch-fetched certs for all resources up front (the
|
||||
// common, high-scale path) — just look up this resource's
|
||||
// domain rather than issuing its own DB/cache round-trip.
|
||||
const cert = certByDomain.get(siteResource.fullDomain);
|
||||
if (cert) {
|
||||
tlsCert = cert.certFile;
|
||||
tlsKey = cert.keyFile;
|
||||
} else {
|
||||
logger.warn(
|
||||
`No valid certificate found for SSL site resource ${siteResource.siteResourceId} with domain ${siteResource.fullDomain}`
|
||||
);
|
||||
}
|
||||
} catch (err) {
|
||||
logger.error(
|
||||
`Failed to retrieve certificate for site resource ${siteResource.siteResourceId} domain ${siteResource.fullDomain}: ${err}`
|
||||
);
|
||||
} else {
|
||||
// No batched map supplied by the caller — fall back to a
|
||||
// single-domain lookup for this resource alone.
|
||||
try {
|
||||
const certs = await getValidCertificatesForDomains(
|
||||
new Set([siteResource.fullDomain]),
|
||||
true
|
||||
);
|
||||
if (certs.length > 0 && certs[0].certFile && certs[0].keyFile) {
|
||||
tlsCert = certs[0].certFile;
|
||||
tlsKey = certs[0].keyFile;
|
||||
} else {
|
||||
logger.warn(
|
||||
`No valid certificate found for SSL site resource ${siteResource.siteResourceId} with domain ${siteResource.fullDomain}`
|
||||
);
|
||||
}
|
||||
} catch (err) {
|
||||
logger.error(
|
||||
`Failed to retrieve certificate for site resource ${siteResource.siteResourceId} domain ${siteResource.fullDomain}: ${err}`
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -19,6 +19,7 @@ import { eq, and, inArray } from "drizzle-orm";
|
||||
import config from "@server/lib/config";
|
||||
import { decrypt } from "@server/lib/crypto";
|
||||
import {
|
||||
batchFetchCertsForSiteResources,
|
||||
formatEndpoint,
|
||||
generateSubnetProxyTargetV2,
|
||||
SubnetProxyTargetV2
|
||||
@@ -206,11 +207,18 @@ export async function buildClientConfigurationForNewtClient(
|
||||
});
|
||||
}
|
||||
|
||||
// Batch-fetch certs for every SSL-enabled HTTP resource's domain in one
|
||||
// call rather than letting each resource fetch its own — with thousands
|
||||
// of resources this avoids a concurrent DB/cache stampede for what is
|
||||
// often the very same (e.g. wildcard) certificate.
|
||||
const certByDomain = await batchFetchCertsForSiteResources(allSiteResources);
|
||||
|
||||
const resourceTargetsArr = await Promise.all(
|
||||
allSiteResources.map((resource) =>
|
||||
generateSubnetProxyTargetV2(
|
||||
resource,
|
||||
clientsByResourceId.get(resource.siteResourceId) ?? []
|
||||
clientsByResourceId.get(resource.siteResourceId) ?? [],
|
||||
certByDomain
|
||||
)
|
||||
)
|
||||
);
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
import { sendToClient } from "#dynamic/routers/ws";
|
||||
import logger from "@server/logger";
|
||||
import {
|
||||
canCompress,
|
||||
supportsCertReferences
|
||||
} from "@server/lib/clientVersionChecks";
|
||||
import { CertRef } from "@server/lib/ip";
|
||||
|
||||
/**
|
||||
* Pushes an incremental set of certs to a newt client outside of a full
|
||||
* newt/sync or newt/wg/receive-config, e.g. after a certificate renewal so
|
||||
* that every target referencing it (by tlsCertId) picks up the new material
|
||||
* without waiting for the next full resync.
|
||||
*/
|
||||
export async function sendCertsAdd(
|
||||
newtId: string,
|
||||
certs: CertRef[],
|
||||
version?: string | null
|
||||
) {
|
||||
if (certs.length === 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (!supportsCertReferences(version)) {
|
||||
logger.debug(
|
||||
`Newt ${newtId} (version ${version}) does not support cert references, skipping certs/add`
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
await sendToClient(
|
||||
newtId,
|
||||
{
|
||||
type: "newt/certs/add",
|
||||
data: certs
|
||||
},
|
||||
{
|
||||
incrementConfigVersion: true,
|
||||
compress: canCompress(version, "newt")
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Tells a newt client to drop the given cert IDs, e.g. once the server knows
|
||||
* no target references them anymore.
|
||||
*/
|
||||
export async function sendCertsRemove(
|
||||
newtId: string,
|
||||
certIds: string[],
|
||||
version?: string | null
|
||||
) {
|
||||
if (certIds.length === 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (!supportsCertReferences(version)) {
|
||||
logger.debug(
|
||||
`Newt ${newtId} (version ${version}) does not support cert references, skipping certs/remove`
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
await sendToClient(
|
||||
newtId,
|
||||
{
|
||||
type: "newt/certs/remove",
|
||||
data: { ids: certIds }
|
||||
},
|
||||
{
|
||||
incrementConfigVersion: true,
|
||||
compress: canCompress(version, "newt")
|
||||
}
|
||||
);
|
||||
}
|
||||
@@ -7,7 +7,11 @@ import { eq } from "drizzle-orm";
|
||||
import { sendToExitNode } from "#dynamic/lib/exitNodes";
|
||||
import { buildClientConfigurationForNewtClient } from "./buildConfiguration";
|
||||
import { convertTargetsIfNecessary } from "../client/targets";
|
||||
import { canCompress } from "@server/lib/clientVersionChecks";
|
||||
import {
|
||||
canCompress,
|
||||
supportsCertReferences
|
||||
} from "@server/lib/clientVersionChecks";
|
||||
import { dedupeCertsForTargets } from "@server/lib/ip";
|
||||
import config from "@server/lib/config";
|
||||
import { waitForSiteRebuildIdle } from "@server/lib/rebuildClientAssociations";
|
||||
|
||||
@@ -119,7 +123,16 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
|
||||
exitNode
|
||||
);
|
||||
|
||||
const targetsToSend = await convertTargetsIfNecessary(newt.newtId, targets); // for backward compatibility with old newt versions that don't support the new target format
|
||||
// Older newt clients only understand inline tlsCert/tlsKey on each
|
||||
// target, so only switch to certId references once we know the client
|
||||
// can resolve them.
|
||||
let dedupedTargets = targets;
|
||||
let certs: { id: string; cert: string; key: string }[] = [];
|
||||
if (supportsCertReferences(newt.version)) {
|
||||
({ targets: dedupedTargets, certs } = dedupeCertsForTargets(targets));
|
||||
}
|
||||
|
||||
const targetsToSend = await convertTargetsIfNecessary(newt.newtId, dedupedTargets); // for backward compatibility with old newt versions that don't support the new target format
|
||||
|
||||
return {
|
||||
message: {
|
||||
@@ -128,6 +141,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
|
||||
ipAddress: site.address,
|
||||
peers,
|
||||
targets: targetsToSend,
|
||||
certs,
|
||||
chainId: chainId
|
||||
}
|
||||
},
|
||||
|
||||
@@ -6,7 +6,11 @@ import {
|
||||
buildClientConfigurationForNewtClient,
|
||||
buildTargetConfigurationForNewtClient
|
||||
} from "./buildConfiguration";
|
||||
import { canCompress } from "@server/lib/clientVersionChecks";
|
||||
import {
|
||||
canCompress,
|
||||
supportsCertReferences
|
||||
} from "@server/lib/clientVersionChecks";
|
||||
import { dedupeCertsForTargets } from "@server/lib/ip";
|
||||
|
||||
export async function sendNewtSyncMessage(newt: Newt, site: Site) {
|
||||
const {
|
||||
@@ -28,6 +32,16 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
|
||||
site,
|
||||
exitNode
|
||||
);
|
||||
|
||||
// Older newt clients only understand inline tlsCert/tlsKey on each
|
||||
// target, so only switch to certId references once we know the client
|
||||
// can resolve them.
|
||||
let clientTargets = targets;
|
||||
let certs: { id: string; cert: string; key: string }[] = [];
|
||||
if (supportsCertReferences(newt.version)) {
|
||||
({ targets: clientTargets, certs } = dedupeCertsForTargets(targets));
|
||||
}
|
||||
|
||||
await sendToClient(
|
||||
newt.newtId,
|
||||
{
|
||||
@@ -39,7 +53,8 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
|
||||
},
|
||||
healthCheckTargets: validHealthCheckTargets,
|
||||
peers: peers,
|
||||
clientTargets: targets,
|
||||
clientTargets: clientTargets,
|
||||
certs: certs,
|
||||
browserGatewayTargets: browserGatewayTargets,
|
||||
remoteExitNodeSubnets: remoteExitNodeSubnets
|
||||
}
|
||||
|
||||
@@ -95,7 +95,10 @@ export function useOptimisticLabels({
|
||||
}
|
||||
|
||||
async function refresh() {
|
||||
router.refresh();
|
||||
// Only refresh if the labels have been modified
|
||||
if (pendingActions.length > 0) {
|
||||
router.refresh();
|
||||
}
|
||||
setPendingActions([]);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user