sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-13 17:09:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Return error from gateApproval and log at the caller

Browse Source
This commit is contained in:
Viktor Liu
2026-05-23 19:50:27 +02:00
parent 5344b2cf8a
commit 03cf48f8cc
3 changed files with 36 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/vnc/server/server.go
+18 -16
View File
@@ -422,20 +422,22 @@ func (s *Server) untrackConn(c net.Conn) {
// gateApproval prompts the local user to accept or deny conn before any
// session resources are allocated. On rejection the conn already received
// an RFB reject reason; the gate does not close it.
func (s *Server) gateApproval(conn net.Conn, header *connectionHeader, connLog *log.Entry) (bool, ApprovalDecision) {
// gateApproval returns the user's decision when approval is enabled, or a
// zero decision when it isn't. On rejection it writes the RFB rejection
// message to conn and returns an error; the caller is responsible for
// logging it (this function does not log on its own).
func (s *Server) gateApproval(conn net.Conn, header *connectionHeader) (ApprovalDecision, error) {
if !s.requireApproval {
return true, ApprovalDecision{}
return ApprovalDecision{}, nil
}
if s.approver == nil {
rejectConnection(conn, codeMessage(RejectCodeNoApprover, "approval required but no approver configured"))
connLog.Warn("VNC connection rejected: approval required but no approver")
return false, ApprovalDecision{}
return ApprovalDecision{}, errors.New("approval required but no approver configured")
}
if s.serviceMode {
if err := interactiveUserError(); err != nil {
rejectConnection(conn, codeMessage(RejectCodeNoConsoleUser, "no interactive user session"))
connLog.Infof("VNC connection rejected: no interactive user session to approve: %v", err)
return false, ApprovalDecision{}
return ApprovalDecision{}, fmt.Errorf("no interactive user session: %w", err)
}
}
info := ApprovalInfo{
@@ -452,15 +454,9 @@ func (s *Server) gateApproval(conn net.Conn, header *connectionHeader, connLog *
decision, err := s.approver.Request(s.ctx, info)
if err != nil {
rejectConnection(conn, codeMessage(RejectCodeApprovalDenied, "approval denied"))
connLog.Infof("VNC connection rejected: approval %v", err)
return false, ApprovalDecision{}
return ApprovalDecision{}, fmt.Errorf("approval: %w", err)
}
if decision.ViewOnly {
connLog.Info("VNC connection approved by user (view-only)")
} else {
connLog.Info("VNC connection approved by user")
}
return true, decision
return decision, nil
}
// sourceIPString returns the IP portion of a remote address, or the full
@@ -804,10 +800,16 @@ func (s *Server) handleConnection(conn net.Conn) {
}
s.registerConnAuth(conn, header)
allow, decision := s.gateApproval(conn, header, connLog)
if !allow {
decision, err := s.gateApproval(conn, header)
if err != nil {
connLog.Infof("VNC connection rejected: %v", err)
return
}
if decision.ViewOnly {
connLog.Info("VNC connection approved by user (view-only)")
} else if s.requireApproval {
connLog.Info("VNC connection approved by user")
}
capturer, injector, sessionCleanup, ok := s.acquireSessionResources(conn, header, &connLog)
if !ok {