removed policy posture checks on original peer

management/server/networkmap.go

@@ -2,17 +2,11 @@ package server
 
 import (
 	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"time"
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/types"
@@ -30,8 +24,6 @@ func (am *DefaultAccountManager) getPeerNetworkMapExp(
 	validatedPeers map[string]struct{},
 	customZone nbdns.CustomZone,
 	metrics *telemetry.AccountManagerMetrics,
-	resourcePolicies map[string][]*types.Policy,
-	routers map[string]map[string]*routerTypes.NetworkRouter,
 ) *types.NetworkMap {
 	account := am.getAccountFromHolderOrInit(accountId)
 	if account == nil {
@@ -40,56 +32,7 @@ func (am *DefaultAccountManager) getPeerNetworkMapExp(
 			Network: &types.Network{},
 		}
 	}
-
-	legacyMap := account.GetPeerNetworkMap(ctx, peerId, customZone, validatedPeers, resourcePolicies, routers, nil)
-
-	go func() {
-		expMap := account.GetPeerNetworkMapExp(ctx, peerId, customZone, validatedPeers, metrics)
-		am.compareAndSaveNetworkMaps(ctx, accountId, peerId, expMap, legacyMap)
-	}()
-
-	return legacyMap
-}
-
-func (am *DefaultAccountManager) compareAndSaveNetworkMaps(ctx context.Context, accountId, peerId string, expMap, legacyMap *types.NetworkMap) {
-	expBytes, err := json.Marshal(expMap)
-	if err != nil {
-		log.WithContext(ctx).Warnf("failed to marshal experimental network map: %v", err)
-		return
-	}
-
-	legacyBytes, err := json.Marshal(legacyMap)
-	if err != nil {
-		log.WithContext(ctx).Warnf("failed to marshal legacy network map: %v", err)
-		return
-	}
-
-	if len(expBytes) == len(legacyBytes) {
-		log.WithContext(ctx).Debugf("network maps are equal for peer %s in account %s (size: %d bytes)", peerId, accountId, len(expBytes))
-		return
-	}
-
-	timestamp := time.Now().UnixMicro()
-	baseDir := filepath.Join("debug_networkmaps", accountId, peerId)
-
-	if err := os.MkdirAll(baseDir, 0o755); err != nil {
-		log.WithContext(ctx).Warnf("failed to create debug directory %s: %v", baseDir, err)
-		return
-	}
-
-	expFile := filepath.Join(baseDir, fmt.Sprintf("exp_networkmap_%d.json", timestamp))
-	if err := os.WriteFile(expFile, expBytes, 0o644); err != nil {
-		log.WithContext(ctx).Warnf("failed to write experimental network map to %s: %v", expFile, err)
-		return
-	}
-
-	legacyFile := filepath.Join(baseDir, fmt.Sprintf("legacy_networkmap_%d.json", timestamp))
-	if err := os.WriteFile(legacyFile, legacyBytes, 0o644); err != nil {
-		log.WithContext(ctx).Warnf("failed to write legacy network map to %s: %v", legacyFile, err)
-		return
-	}
-
-	log.WithContext(ctx).Infof("network maps differ for peer %s in account %s - saved to %s (exp: %d bytes, legacy: %d bytes)", peerId, accountId, baseDir, len(expBytes), len(legacyBytes))
+	return account.GetPeerNetworkMapExp(ctx, peerId, customZone, validatedPeers, metrics)
 }
 
 func (am *DefaultAccountManager) onPeerAddedUpdNetworkMapCache(account *types.Account, peerId string) error {

management/server/peer.go

@@ -431,15 +431,12 @@ func (am *DefaultAccountManager) GetNetworkMap(ctx context.Context, peerID strin
 		return nil, err
 	}
 
-	resourcePolicies := account.GetResourcePoliciesMap()
-	routers := account.GetResourceRoutersMap()
-
 	var networkMap *types.NetworkMap
 
 	if am.experimentalNetworkMap(peer.AccountID) {
-		networkMap = am.getPeerNetworkMapExp(ctx, peer.AccountID, peerID, validatedPeers, customZone, nil, resourcePolicies, routers)
+		networkMap = am.getPeerNetworkMapExp(ctx, peer.AccountID, peerID, validatedPeers, customZone, nil)
 	} else {
-		networkMap = account.GetPeerNetworkMap(ctx, peer.ID, customZone, validatedPeers, resourcePolicies, routers, nil)
+		networkMap = account.GetPeerNetworkMap(ctx, peer.ID, customZone, validatedPeers, account.GetResourcePoliciesMap(), account.GetResourceRoutersMap(), nil)
 	}
 
 	proxyNetworkMap, ok := proxyNetworkMaps[peer.ID]
@@ -1082,15 +1079,12 @@ func (am *DefaultAccountManager) getValidatedPeerWithMap(ctx context.Context, is
 		return nil, nil, nil, err
 	}
 
-	resourcePolicies := account.GetResourcePoliciesMap()
-	routers := account.GetResourceRoutersMap()
-
 	var networkMap *types.NetworkMap
 
 	if am.experimentalNetworkMap(accountID) {
-		networkMap = am.getPeerNetworkMapExp(ctx, peer.AccountID, peer.ID, approvedPeersMap, customZone, am.metrics.AccountManagerMetrics(), resourcePolicies, routers)
+		networkMap = am.getPeerNetworkMapExp(ctx, peer.AccountID, peer.ID, approvedPeersMap, customZone, am.metrics.AccountManagerMetrics())
 	} else {
-		networkMap = account.GetPeerNetworkMap(ctx, peer.ID, customZone, approvedPeersMap, resourcePolicies, routers, am.metrics.AccountManagerMetrics())
+		networkMap = account.GetPeerNetworkMap(ctx, peer.ID, customZone, approvedPeersMap, account.GetResourcePoliciesMap(), account.GetResourceRoutersMap(), am.metrics.AccountManagerMetrics())
 	}
 
 	proxyNetworkMap, ok := proxyNetworkMaps[peer.ID]
@@ -1309,7 +1303,7 @@ func (am *DefaultAccountManager) UpdateAccountPeers(ctx context.Context, account
 			var remotePeerNetworkMap *types.NetworkMap
 
 			if am.experimentalNetworkMap(accountID) {
-				remotePeerNetworkMap = am.getPeerNetworkMapExp(ctx, p.AccountID, p.ID, approvedPeersMap, customZone, am.metrics.AccountManagerMetrics(), resourcePolicies, routers)
+				remotePeerNetworkMap = am.getPeerNetworkMapExp(ctx, p.AccountID, p.ID, approvedPeersMap, customZone, am.metrics.AccountManagerMetrics())
 			} else {
 				remotePeerNetworkMap = account.GetPeerNetworkMap(ctx, p.ID, customZone, approvedPeersMap, resourcePolicies, routers, am.metrics.AccountManagerMetrics())
 			}
@@ -1425,7 +1419,7 @@ func (am *DefaultAccountManager) UpdateAccountPeer(ctx context.Context, accountI
 	var remotePeerNetworkMap *types.NetworkMap
 
 	if am.experimentalNetworkMap(accountId) {
-		remotePeerNetworkMap = am.getPeerNetworkMapExp(ctx, peer.AccountID, peer.ID, approvedPeersMap, customZone, am.metrics.AccountManagerMetrics(), resourcePolicies, routers)
+		remotePeerNetworkMap = am.getPeerNetworkMapExp(ctx, peer.AccountID, peer.ID, approvedPeersMap, customZone, am.metrics.AccountManagerMetrics())
 	} else {
 		remotePeerNetworkMap = account.GetPeerNetworkMap(ctx, peerId, customZone, approvedPeersMap, resourcePolicies, routers, am.metrics.AccountManagerMetrics())
 	}

management/server/types/networkmapbuilder.go

@@ -257,8 +257,6 @@ func (b *NetworkMapBuilder) buildPeerACLView(account *Account, peerID string) {
 func (b *NetworkMapBuilder) getPeerConnectionResources(account *Account, peer *nbpeer.Peer,
 	validatedPeersMap map[string]struct{},
 ) ([]*nbpeer.Peer, []*FirewallRule) {
-	ctx := context.Background()
-
 	peerID := peer.ID
 
 	peerGroups := b.cache.peerToGroups[peerID]
@@ -275,9 +273,6 @@ func (b *NetworkMapBuilder) getPeerConnectionResources(account *Account, peer *n
 	for _, group := range peerGroups {
 		policies := b.cache.groupToPolicies[group]
 		for _, policy := range policies {
-			if isValid := account.validatePostureChecksOnPeer(ctx, policy.SourcePostureChecks, peerID); !isValid {
-				continue
-			}
 			rules := b.cache.policyToRules[policy.ID]
 			for _, rule := range rules {
 				var sourcePeers, destinationPeers []*nbpeer.Peer