From 6ccb2bb2396649d41d499988f002632597cd5919 Mon Sep 17 00:00:00 2001 From: pascal Date: Thu, 6 Aug 2026 15:12:12 +0200 Subject: [PATCH] handle nil values in policy, nameserver and resources --- .../shared/grpc/components_encoder.go | 3 +++ .../networkmap/networkmapcompute.go | 14 +++++++---- shared/management/networkmap/nmdata/policy.go | 5 +++- .../management/types/networkmap_components.go | 23 +++++++++++++++---- 4 files changed, 36 insertions(+), 9 deletions(-) diff --git a/management/internals/shared/grpc/components_encoder.go b/management/internals/shared/grpc/components_encoder.go index 8b6468bed..91e0db4b9 100644 --- a/management/internals/shared/grpc/components_encoder.go +++ b/management/internals/shared/grpc/components_encoder.go @@ -631,6 +631,9 @@ func (e *componentEncoder) encodeResourcePoliciesMap(rpm map[string][]*nmdata.Po } ids := make([]string, 0, len(policies)) for _, pol := range policies { + if pol == nil { + continue + } ids = append(ids, pol.PublicID) } if len(ids) == 0 { diff --git a/shared/management/networkmap/networkmapcompute.go b/shared/management/networkmap/networkmapcompute.go index dedfaaedd..0ec64c2bb 100644 --- a/shared/management/networkmap/networkmapcompute.go +++ b/shared/management/networkmap/networkmapcompute.go @@ -75,7 +75,7 @@ func (nmd *NetworkMapData) GetPeerNetworkMapComponents(peerID string, peersCusto components.AccountZones = append(components.AccountZones, nmd.privateServiceZones(peerGroups)...) for _, nsGroup := range nmd.NameServerGroups { - if nsGroup.Enabled { + if nsGroup != nil && nsGroup.Enabled { for _, gID := range nsGroup.Groups { if _, found := relevantGroups[gID]; found { components.NameServerGroups = append(components.NameServerGroups, nsGroup) @@ -86,7 +86,7 @@ func (nmd *NetworkMapData) GetPeerNetworkMapComponents(peerID string, peersCusto } for _, resource := range nmd.NetworkResources { - if !resource.Enabled { + if resource == nil || !resource.Enabled { continue } @@ -105,6 +105,9 @@ func (nmd *NetworkMapData) GetPeerNetworkMapComponents(peerID string, peersCusto } for _, policy := range policies { + if policy == nil || len(policy.Rules) == 0 || policy.Rules[0] == nil { + continue + } if addSourcePeers { var peers []string if policy.Rules[0].SourceResource.Type == string(types.ResourceTypePeer) && policy.Rules[0].SourceResource.ID != "" { @@ -144,6 +147,9 @@ func (nmd *NetworkMapData) GetPeerNetworkMapComponents(peerID string, peersCusto } for _, rule := range policy.Rules { + if rule == nil { + continue + } for _, srcGroupID := range rule.Sources { if g := nmd.Groups[srcGroupID]; g != nil { if _, exists := components.Groups[srcGroupID]; !exists { @@ -277,13 +283,13 @@ func (nmd *NetworkMapData) getPeersGroupsPoliciesRoutes( } for _, policy := range nmd.Policies { - if !policy.Enabled { + if policy == nil || !policy.Enabled { continue } policyRelevant := false for _, rule := range policy.Rules { - if !rule.Enabled { + if rule == nil || !rule.Enabled { continue } diff --git a/shared/management/networkmap/nmdata/policy.go b/shared/management/networkmap/nmdata/policy.go index f2f5af408..df0c77518 100644 --- a/shared/management/networkmap/nmdata/policy.go +++ b/shared/management/networkmap/nmdata/policy.go @@ -50,11 +50,14 @@ type Resource struct { } func (p *Policy) SourceGroups() []string { - if len(p.Rules) == 1 { + if len(p.Rules) == 1 && p.Rules[0] != nil { return p.Rules[0].Sources } groups := make(map[string]struct{}, len(p.Rules)) for _, rule := range p.Rules { + if rule == nil { + continue + } for _, source := range rule.Sources { groups[source] = struct{}{} } diff --git a/shared/management/types/networkmap_components.go b/shared/management/types/networkmap_components.go index 5d38c33ca..1339fbbdf 100644 --- a/shared/management/types/networkmap_components.go +++ b/shared/management/types/networkmap_components.go @@ -217,12 +217,12 @@ func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ( sshEnabled := false for _, policy := range c.Policies { - if !policy.Enabled { + if policy == nil || !policy.Enabled { continue } for _, rule := range policy.Rules { - if !rule.Enabled { + if rule == nil || !rule.Enabled { continue } @@ -707,7 +707,13 @@ func (c *NetworkMapComponents) getAllRoutePoliciesFromGroups(accessControlGroups routePolicies := make([]*nmdata.Policy, 0) for _, groupID := range accessControlGroups { for _, policy := range c.Policies { + if policy == nil { + continue + } for _, rule := range policy.Rules { + if rule == nil { + continue + } if slices.Contains(rule.Destinations, groupID) { routePolicies = append(routePolicies, policy) } @@ -721,12 +727,12 @@ func (c *NetworkMapComponents) getAllRoutePoliciesFromGroups(accessControlGroups func (c *NetworkMapComponents) getRouteFirewallRules(ctx context.Context, peerID string, policies []*nmdata.Policy, route *nmdata.Route, distributionPeers map[string]struct{}, includeIPv6 bool) []*RouteFirewallRule { var fwRules []*RouteFirewallRule for _, policy := range policies { - if !policy.Enabled { + if policy == nil || !policy.Enabled { continue } for _, rule := range policy.Rules { - if !rule.Enabled { + if rule == nil || !rule.Enabled { continue } @@ -813,6 +819,9 @@ func (c *NetworkMapComponents) processResourcePolicies( var routes []*nmdata.Route for _, policy := range c.ResourcePoliciesMap[resource.ID] { + if policy == nil || len(policy.Rules) == 0 || policy.Rules[0] == nil { + continue + } peers := c.getResourcePolicyPeers(policy) if addSourcePeers { for _, pID := range c.getPostureValidPeers(peers, policy.SourcePostureChecks) { @@ -930,7 +939,13 @@ func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*nmdata.Policy) sourcePeers := make(map[string]struct{}) for _, policy := range policies { + if policy == nil { + continue + } for _, rule := range policy.Rules { + if rule == nil { + continue + } for _, sourceGroup := range rule.Sources { group := c.GetGroupInfo(sourceGroup) if group == nil {