sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-27 00:59:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Refuse --upload-bundle-insecure only when an upload is requested

Browse Source 
A request with no URL, no upload and uploadInsecure set was denied, although
uploadInsecure has no effect on a local-only bundle: there is no destination to
weaken, and the caller only wanted the file on disk. Pass the upload intent into
the gate and apply the empty-URL branch only when the request asks to upload.

Reported by cubic on #7514.
This commit is contained in:
riccardom
2026-09-14 09:18:02 +02:00
parent a2cff0adf9
commit 02d88fdeb0
4 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/server/debug_gate.go
+9 -7
View File
@@ -50,14 +50,16 @@ func uiLogOpener(id ipcauth.Identity, identified bool) debug.LogOpener {
//
// insecure relaxes transport security (http, or an untrusted TLS certificate)
// for a self-hosted server. It weakens a root-privileged upload, so it is
// refused for an unprivileged caller regardless of the host.
func requirePrivilegeForUploadURL(ctx context.Context, rawURL string, insecure bool) error {
// refused for an unprivileged caller regardless of the host. upload says whether
// the request asks for an upload at all; without one there is nothing to weaken.
func requirePrivilegeForUploadURL(ctx context.Context, rawURL string, insecure, upload bool) error {
if rawURL == "" {
// An empty URL is not "no upload": the daemon then resolves the
// destination the management server published. Relaxing TLS on the way
// there exposes the bundle exactly as naming the host outright would, so
// it needs the same privilege.
if insecure {
// An empty URL with upload requested is not "no upload": the daemon then
// resolves the destination the management server published. Relaxing TLS
// on the way there exposes the bundle exactly as naming the host outright
// would, so it needs the same privilege. Without an upload there is no
// destination to weaken and a local-only bundle must not be refused.
if insecure && upload {
return denyPrivileged(ctx,
"uploading a debug bundle without transport security (--upload-bundle-insecure)",
ipcauth.ElevatedCommand("netbird debug bundle -U --upload-bundle-insecure"))