Merge branch 'dev' into video_tutorials_menu

Author: wojcik91

Cargo.lock

@@ -316,24 +316,19 @@ impl<I> AclRule<I> {
 impl AclRule {
     /// Creates new [`AclRule`] with all related objects based on [`ApiAclRule`]
     pub(crate) async fn create_from_api(
-        pool: &PgPool,
+        conn: &mut PgConnection,
         api_rule: &EditAclRule,
         actor: &str,
     ) -> Result<ApiAclRule, AclError> {
-        let mut transaction = pool.begin().await?;
-
         // save the rule
         let mut rule: AclRule = api_rule.clone().try_into()?;
         rule.stamp_modified(actor);
-        let rule = rule.save(&mut *transaction).await?;
+        let rule = rule.save(&mut *conn).await?;
 
         // create related objects
-        rule.create_related_objects(&mut transaction, api_rule)
-            .await?;
+        rule.create_related_objects(conn, api_rule).await?;
 
-        let result = ApiAclRule::from(rule.to_info(&mut transaction).await?);
-
-        transaction.commit().await?;
+        let result = ApiAclRule::from(rule.to_info(&mut *conn).await?);
 
         Ok(result)
     }
@@ -355,21 +350,18 @@ impl AclRule {
     /// and performed appropriate operations, only that the next time configuration
     /// is being sent it will include this rule.
     pub(crate) async fn update_from_api(
-        pool: &PgPool,
+        conn: &mut PgConnection,
         id: Id,
         api_rule: &EditAclRule,
         actor: &str,
     ) -> Result<ApiAclRule, AclError> {
         debug!("Updating rule ID {id} with {api_rule:?}");
-        let mut transaction = pool.begin().await?;
 
         // find the existing rule
-        let existing_rule = AclRule::find_by_id(&mut *transaction, id)
-            .await?
-            .ok_or_else(|| {
-                warn!("Update of nonexistent rule ({id}) failed");
-                AclError::RuleNotFoundError(id)
-            })?;
+        let existing_rule = AclRule::find_by_id(&mut *conn, id).await?.ok_or_else(|| {
+            warn!("Update of nonexistent rule ({id}) failed");
+            AclError::RuleNotFoundError(id)
+        })?;
 
         // convert API rule to model
         let mut rule: AclRule<NoId> = api_rule.clone().try_into()?;
@@ -385,7 +377,7 @@ impl AclRule {
                 );
                 // remove old modifications of this rule
                 let result = query!("DELETE FROM aclrule WHERE parent_id = $1", id)
-                    .execute(&mut *transaction)
+                    .execute(&mut *conn)
                     .await?;
                 debug!(
                     "Removed {} old modifications of rule {id}",
@@ -395,11 +387,10 @@ impl AclRule {
                 // save as a new rule with appropriate parent_id and state
                 rule.state = RuleState::Modified;
                 rule.parent_id = Some(id);
-                let rule = rule.save(&mut *transaction).await?;
+                let rule = rule.save(&mut *conn).await?;
 
                 // create related objects
-                rule.create_related_objects(&mut transaction, api_rule)
-                    .await?;
+                rule.create_related_objects(conn, api_rule).await?;
 
                 rule
             }
@@ -416,20 +407,17 @@ impl AclRule {
                 let mut rule = rule.with_id(id);
                 rule.parent_id = existing_rule.parent_id;
                 rule.state = existing_rule.state;
-                rule.save(&mut *transaction).await?;
+                rule.save(&mut *conn).await?;
 
                 // recreate related objects
-                rule.delete_related_objects(&mut transaction).await?;
-                rule.create_related_objects(&mut transaction, api_rule)
-                    .await?;
+                rule.delete_related_objects(conn).await?;
+                rule.create_related_objects(conn, api_rule).await?;
 
                 rule
             }
         };
 
-        let rule_details = rule.to_info(&mut transaction).await?.into();
-
-        transaction.commit().await?;
+        let rule_details = rule.to_info(&mut *conn).await?.into();
 
         info!("Successfully updated rule {rule_details:?}");
         Ok(rule_details)

crates/defguard_core/src/enterprise/db/models/acl.rs

@@ -9,7 +9,7 @@ use axum::{
 use chrono::NaiveDateTime;
 use defguard_common::db::Id;
 use serde_json::{Value, json};
-use sqlx::query_as;
+use sqlx::{PgConnection, query_as};
 use utoipa::ToSchema;
 
 use super::LicenseInfo;
@@ -137,17 +137,52 @@ pub struct EditAclRule {
 }
 
 impl EditAclRule {
-    pub fn validate(&self) -> Result<(), WebError> {
-        let manual_configured = self.any_address
-            || self.any_port
-            || self.any_protocol
-            || !self.addresses.trim().is_empty()
-            || !self.ports.trim().is_empty()
-            || !self.protocols.is_empty();
+    pub async fn validate(&self, conn: &mut PgConnection) -> Result<(), WebError> {
         if self.use_manual_destination_settings {
-            if !manual_configured {
+            // Determine what the selected component aliases collectively contribute.
+            // Note: Component-kind aliases always have any_address/any_port/any_protocol = false,
+            // so we only check whether they have non-empty arrays.
+            let (alias_has_address, alias_has_port, alias_has_protocol) = if self.aliases.is_empty()
+            {
+                (false, false, false)
+            } else {
+                let row = query_as::<_, (Option<bool>, Option<bool>, Option<bool>)>(
+                    "SELECT \
+                            bool_or(array_length(addresses, 1) > 0) \
+                                OR EXISTS ( \
+                                    SELECT 1 FROM aclaliasdestinationrange dr \
+                                    JOIN aclalias a ON a.id = dr.alias_id \
+                                    WHERE a.id = ANY($1) \
+                                      AND a.kind = 'component'::aclalias_kind \
+                                ), \
+                            bool_or(array_length(ports, 1) > 0), \
+                            bool_or(array_length(protocols, 1) > 0) \
+                        FROM aclalias WHERE id = ANY($1) AND kind = 'component'::aclalias_kind",
+                )
+                .bind(&self.aliases)
+                .fetch_one(&mut *conn)
+                .await
+                .map_err(WebError::from)?;
+                (
+                    row.0.unwrap_or(false),
+                    row.1.unwrap_or(false),
+                    row.2.unwrap_or(false),
+                )
+            };
+
+            if !self.any_address && self.addresses.trim().is_empty() && !alias_has_address {
                 return Err(WebError::BadRequest(
-                    "Must provide manual destination settings".to_string(),
+                    "Must provide destination address, or enable any address".to_string(),
+                ));
+            }
+            if !self.any_port && self.ports.trim().is_empty() && !alias_has_port {
+                return Err(WebError::BadRequest(
+                    "Must provide destination port, or enable any port".to_string(),
+                ));
+            }
+            if !self.any_protocol && self.protocols.is_empty() && !alias_has_protocol {
+                return Err(WebError::BadRequest(
+                    "Must provide destination protocol, or enable any protocol".to_string(),
                 ));
             }
         } else if self.destinations.is_empty() {
@@ -347,15 +382,15 @@ pub(crate) async fn create_acl_rule(
 ) -> ApiResult {
     debug!("User {} creating ACL rule {data:?}", session.user.username);
 
-    // validate submitted ACL rule
-    data.validate()?;
-
-    let rule = AclRule::create_from_api(&appstate.pool, &data, &session.user.username)
+    let mut tx = appstate.pool.begin().await?;
+    data.validate(&mut tx).await?;
+    let rule = AclRule::create_from_api(&mut tx, &data, &session.user.username)
         .await
         .map_err(|err| {
             error!("Error creating ACL rule {data:?}: {err}");
             err
         })?;
+    tx.commit().await?;
     info!(
         "User {} created ACL rule {}",
         session.user.username, rule.id
@@ -386,15 +421,15 @@ pub(crate) async fn update_acl_rule(
 ) -> ApiResult {
     debug!("User {} updating ACL rule {data:?}", session.user.username);
 
-    // validate submitted ACL rule
-    data.validate()?;
-
-    let rule = AclRule::update_from_api(&appstate.pool, id, &data, &session.user.username)
+    let mut tx = appstate.pool.begin().await?;
+    data.validate(&mut tx).await?;
+    let rule = AclRule::update_from_api(&mut tx, id, &data, &session.user.username)
         .await
         .map_err(|err| {
             error!("Error updating ACL rule {data:?}: {err}");
             err
         })?;
+    tx.commit().await?;
     info!("User {} updated ACL rule", session.user.username);
     Ok(ApiResponse::json(rule, StatusCode::OK))
 }

crates/defguard_core/src/enterprise/handlers/acl.rs

@@ -324,15 +324,14 @@ pub(crate) async fn proxy_cert_self_signed(
             WebError::Http(StatusCode::INTERNAL_SERVER_ERROR)
         })?;
 
-    let (ca_cert_der, ca_key_der) = match (certs.ca_cert_der.clone(), certs.ca_key_der.clone()) {
-        (Some(c), Some(k)) => (c, k),
-        _ => {
-            warn!("CA not configured; cannot issue self-signed proxy cert");
-            return Ok(ApiResponse::json(
-                serde_json::json!({"msg": "Core CA is not configured"}),
-                StatusCode::BAD_REQUEST,
-            ));
-        }
+    let (Some(ca_cert_der), Some(ca_key_der)) =
+        (certs.ca_cert_der.clone(), certs.ca_key_der.clone())
+    else {
+        warn!("CA not configured; cannot issue self-signed proxy cert");
+        return Ok(ApiResponse::json(
+            serde_json::json!({"msg": "Core CA is not configured"}),
+            StatusCode::BAD_REQUEST,
+        ));
     };
 
     // Build CA from stored DER blobs.