Add egress domain DNS resolution and posture identity collection

.github/workflows/deletedroplets.yml

@@ -14,7 +14,7 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: get logs
-        uses: dawidd6/action-download-artifact@v18
+        uses: dawidd6/action-download-artifact@v21
         with:
           run_id: ${{ github.event.workflow_run.id}}
           if_no_artifact_found: warn
@@ -62,7 +62,7 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     steps:
       - name: get logs
-        uses: dawidd6/action-download-artifact@v18
+        uses: dawidd6/action-download-artifact@v21
         with:
           run_id: ${{ github.event.workflow_run.id}}
           if_no_artifact_found: warn

README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <a href="https://github.com/gravitl/netmaker/releases">
-    <img src="https://img.shields.io/badge/Version-1.5.1-informational?style=flat-square" />
+    <img src="https://img.shields.io/badge/Version-1.6.0-informational?style=flat-square" />
   </a>
   <a href="https://hub.docker.com/r/gravitl/netclient/tags">
     <img src="https://img.shields.io/docker/pulls/gravitl/netclient?label=downloads" />

auth/mdm.go

@@ -0,0 +1,43 @@
+package auth
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gravitl/netclient/ncutils"
+)
+
+// ErrMDMDenied is returned (via wrapping) when the netmaker server refuses a
+// request because the host is not enrolled or compliant in the configured
+// MDM. Callers should detect it with errors.Is and surface MDMDeniedMessage
+// to the operator instead of a generic transport error.
+var ErrMDMDenied = errors.New("device not enrolled or compliant in MDM")
+
+// mdmDenialMarker is the case-insensitive substring the netmaker server
+// includes in its error message when refusing on MDM grounds. The exact
+// shape is owned by the server side; the substring is stable enough to use
+// as a marker without depending on a specific phrasing.
+const mdmDenialMarker = "mdm_posture"
+
+// AsMDMDenied returns a wrapped ErrMDMDenied when err carries the well-known
+// MDM denial signature (HTTP 403 + message containing "mdm_posture"), and
+// otherwise returns err unchanged. The original ErrStatusNotOk remains in
+// the wrap chain so existing transport handling still works.
+func AsMDMDenied(err error) error {
+	if err == nil {
+		return nil
+	}
+	var notOk ncutils.ErrStatusNotOk
+	if !errors.As(err, &notOk) {
+		return err
+	}
+	if notOk.Status != http.StatusForbidden {
+		return err
+	}
+	if !strings.Contains(strings.ToLower(notOk.Message), mdmDenialMarker) {
+		return err
+	}
+	return fmt.Errorf("%w: %w", ErrMDMDenied, err)
+}

auth/mdm_test.go

@@ -0,0 +1,58 @@
+package auth
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/gravitl/netclient/ncutils"
+)
+
+func TestAsMDMDeniedNil(t *testing.T) {
+	if got := AsMDMDenied(nil); got != nil {
+		t.Errorf("expected nil, got %v", got)
+	}
+}
+
+func TestAsMDMDeniedUnrelatedError(t *testing.T) {
+	in := errors.New("boom")
+	if got := AsMDMDenied(in); got != in {
+		t.Errorf("expected unchanged error, got %v", got)
+	}
+}
+
+func TestAsMDMDeniedNon403(t *testing.T) {
+	in := ncutils.ErrStatusNotOk{Status: http.StatusUnauthorized, Message: "mdm_posture_denied"}
+	got := AsMDMDenied(in)
+	if errors.Is(got, ErrMDMDenied) {
+		t.Errorf("non-403 should not be classified as MDM denial; got %v", got)
+	}
+}
+
+func TestAsMDMDenied403WithoutMarker(t *testing.T) {
+	in := ncutils.ErrStatusNotOk{Status: http.StatusForbidden, Message: "forbidden"}
+	got := AsMDMDenied(in)
+	if errors.Is(got, ErrMDMDenied) {
+		t.Errorf("403 without marker should pass through; got %v", got)
+	}
+}
+
+func TestAsMDMDenied403WithMarker(t *testing.T) {
+	in := ncutils.ErrStatusNotOk{Status: http.StatusForbidden, Message: "mdm_posture_denied"}
+	got := AsMDMDenied(in)
+	if !errors.Is(got, ErrMDMDenied) {
+		t.Fatalf("expected ErrMDMDenied, got %v", got)
+	}
+}
+
+func TestAsMDMDeniedThroughWrap(t *testing.T) {
+	wrapped := fmt.Errorf("send: %w", ncutils.ErrStatusNotOk{
+		Status:  http.StatusForbidden,
+		Message: "MDM_POSTURE refused",
+	})
+	got := AsMDMDenied(wrapped)
+	if !errors.Is(got, ErrMDMDenied) {
+		t.Fatalf("expected ErrMDMDenied through wrap, got %v", got)
+	}
+}

cmd/posture.go

@@ -0,0 +1,67 @@
+/*
+Copyright © 2026 Netmaker Team <info@netmaker.io>
+*/
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"github.com/gravitl/netclient/functions"
+	"github.com/gravitl/netclient/posture"
+	"github.com/spf13/cobra"
+)
+
+var postureCmd = &cobra.Command{
+	Use:   "posture",
+	Short: "Inspect the host's posture status",
+	Long:  `Subcommands for inspecting Netmaker posture-check evaluation results for this host.`,
+}
+
+var postureStatusCmd = &cobra.Command{
+	Use:   "status",
+	Short: "Show the host's last-evaluated posture status",
+	Long: `Fetches the most recent posture status evaluated by the Netmaker server for this host.
+
+The output includes the active MDM enrollment/compliance snapshot (when MDM is configured)
+and per-network violation summaries.
+
+Exit codes:
+  0 - all networks pass
+  1 - one or more networks have a 'fail' status (high severity violation)
+  2 - transport / authentication error`,
+	Args: cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		jsonOutput, _ := cmd.Flags().GetBool("json")
+		code, err := functions.PostureStatus(jsonOutput)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "posture status error:", err)
+		}
+		os.Exit(code)
+	},
+}
+
+var postureIdentityCmd = &cobra.Command{
+	Use:   "identity",
+	Short: "Print locally collected device identity fields",
+	Long: `Shows hostname, serial, hardware UUID, and Entra device ID as
+collected on this machine. Useful for verifying posture identity before check-in.`,
+	Args: cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		id := posture.Collect()
+		b, err := json.MarshalIndent(id, "", "  ")
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "posture identity error:", err)
+			os.Exit(2)
+		}
+		fmt.Println(string(b))
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(postureCmd)
+	postureCmd.AddCommand(postureStatusCmd)
+	postureCmd.AddCommand(postureIdentityCmd)
+	postureStatusCmd.Flags().BoolP("json", "j", false, "dump the raw JSON response")
+}

cmd/register.go

@@ -15,7 +15,7 @@ import (
 	"github.com/gravitl/netclient/functions"
 	"github.com/gravitl/netclient/ncutils"
 	"github.com/gravitl/netmaker/logger"
-	"github.com/gravitl/netmaker/models"
+	"github.com/gravitl/netmaker/schema"
 	"github.com/spf13/cobra"
 	"golang.org/x/term"
 )
@@ -109,15 +109,15 @@ func setHostFields(cmd *cobra.Command) {
 		config.Netclient().Interface = ifaceName
 	}
 	if firewall, err := cmd.Flags().GetString(registerFlags.Firewall); err == nil {
-		if ncutils.IsLinux() && (firewall == models.FIREWALL_IPTABLES || firewall == models.FIREWALL_NFTABLES) {
+		if ncutils.IsLinux() && (firewall == schema.FIREWALL_IPTABLES || firewall == schema.FIREWALL_NFTABLES) {
 			// check if firewall is present
-			if firewall == models.FIREWALL_IPTABLES {
+			if firewall == schema.FIREWALL_IPTABLES {
 				if !ncutils.IsIPTablesPresent() {
 					fmt.Println("iptables is not present")
 					os.Exit(1)
 				}
 			}
-			if firewall == models.FIREWALL_NFTABLES {
+			if firewall == schema.FIREWALL_NFTABLES {
 				if !ncutils.IsNFTablesPresent() {
 					fmt.Println("nftables is not present")
 					os.Exit(1)

cmd/root.go

@@ -13,8 +13,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitl/netclient/config"
 	"github.com/gravitl/netclient/daemon"
-	"github.com/gravitl/netclient/functions"
 	"github.com/gravitl/netclient/ncutils"
+	"github.com/gravitl/netclient/posture"
 	"github.com/gravitl/netclient/wireguard"
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/logic"
@@ -50,7 +50,7 @@ func Execute() {
 }
 
 func init() {
-	cobra.OnInitialize(functions.Migrate, initConfig)
+	cobra.OnInitialize(initConfig)
 	// Here you will define your flags and configuration settings.
 	// Cobra supports persistent flags, which, if defined here,
 	// will be global for your application.
@@ -417,6 +417,9 @@ func checkConfig() {
 		saveRequired = true
 		config.SetFirewall()
 	}
+	if posture.ApplyIdentityIfChanged(&netclient.Host) {
+		saveRequired = true
+	}
 	if saveRequired {
 		logger.Log(3, "saving netclient configuration")
 		if err := config.WriteNetclientConfig(); err != nil {

config/config.go

@@ -12,14 +12,14 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
 	"github.com/gravitl/netclient/ncutils"
 	"github.com/gravitl/netmaker/logger"
 	"github.com/gravitl/netmaker/models"
 	"github.com/gravitl/netmaker/schema"
-	"github.com/sasha-s/go-deadlock"
 	"golang.zx2c4.com/wireguard/wgctrl"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
@@ -68,7 +68,7 @@ func (i InitType) String() string {
 }
 
 var (
-	netclientCfgMutex = &deadlock.RWMutex{}
+	netclientCfgMutex sync.RWMutex
 	netclient         Config // netclient contains the netclient config
 	// Version - default version string
 	Version = "dev"
@@ -200,6 +200,10 @@ func UpdateHost(host *schema.Host) (resetInterface, restart, sendHostUpdate bool
 
 	// store password before updating
 	host.HostPass = hostCfg.HostPass
+	// Posture identity is client-authoritative; never accept server copies.
+	host.EntraDeviceID = hostCfg.EntraDeviceID
+	host.SerialNumber = hostCfg.SerialNumber
+	host.HardwareUUID = hostCfg.HardwareUUID
 	hostCfg.Host = *host
 	UpdateNetclient(*hostCfg)
 	WriteNetclientConfig()
@@ -513,27 +517,27 @@ func Convert(h *Config, n *Node) (models.Host, models.Node) {
 // only auto-detects when no valid firewall has been configured.
 func SetFirewall() {
 	if !ncutils.IsLinux() {
-		netclient.FirewallInUse = models.FIREWALL_NONE
+		netclient.FirewallInUse = schema.FIREWALL_NONE
 		return
 	}
 	// if user explicitly set a firewall and it's still present, keep it
 	switch netclient.FirewallInUse {
-	case models.FIREWALL_IPTABLES:
+	case schema.FIREWALL_IPTABLES:
 		if ncutils.IsIPTablesPresent() {
 			return
 		}
-	case models.FIREWALL_NFTABLES:
+	case schema.FIREWALL_NFTABLES:
 		if ncutils.IsNFTablesPresent() {
 			return
 		}
 	}
 	// auto-detect: user hasn't set one, or their choice is no longer available
 	if ncutils.IsIPTablesPresent() {
-		netclient.FirewallInUse = models.FIREWALL_IPTABLES
+		netclient.FirewallInUse = schema.FIREWALL_IPTABLES
 	} else if ncutils.IsNFTablesPresent() {
-		netclient.FirewallInUse = models.FIREWALL_NFTABLES
+		netclient.FirewallInUse = schema.FIREWALL_NFTABLES
 	} else {
-		netclient.FirewallInUse = models.FIREWALL_NONE
+		netclient.FirewallInUse = schema.FIREWALL_NONE
 	}
 }
 
@@ -542,14 +546,14 @@ func SetFirewall() {
 func FirewallHasChanged() bool {
 	if !ncutils.IsLinux() {
 		// non-Linux should always be FIREWALL_NONE; flag if not set
-		return netclient.FirewallInUse != models.FIREWALL_NONE
+		return netclient.FirewallInUse != schema.FIREWALL_NONE
 	}
 	switch netclient.FirewallInUse {
-	case models.FIREWALL_IPTABLES:
+	case schema.FIREWALL_IPTABLES:
 		return !ncutils.IsIPTablesPresent()
-	case models.FIREWALL_NFTABLES:
+	case schema.FIREWALL_NFTABLES:
 		return !ncutils.IsNFTablesPresent()
-	case models.FIREWALL_NONE:
+	case schema.FIREWALL_NONE:
 		// if a firewall becomes available, that's a change
 		return ncutils.IsIPTablesPresent() || ncutils.IsNFTablesPresent()
 	default: