mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-07 05:59:06 +02:00
[misc] buf cli proto lint, format and gen
This commit is contained in:
Pedro Costa
@@ -0,0 +1,468 @@
|
||||
syntax = "proto3";
|
||||
|
||||
package daemon;
|
||||
|
||||
import "google/protobuf/descriptor.proto";
|
||||
import "google/protobuf/duration.proto";
|
||||
import "google/protobuf/timestamp.proto";
|
||||
|
||||
option go_package = "client/proto";
|
||||
|
||||
message EmptyRequest {}
|
||||
|
||||
service DaemonService {
|
||||
// Login uses setup key to prepare configuration for the daemon.
|
||||
rpc Login(LoginRequest) returns (LoginResponse) {}
|
||||
|
||||
// WaitSSOLogin uses the userCode to validate the TokenInfo and
|
||||
// waits for the user to continue with the login on a browser
|
||||
rpc WaitSSOLogin(WaitSSOLoginRequest) returns (WaitSSOLoginResponse) {}
|
||||
|
||||
// Up starts engine work in the daemon.
|
||||
rpc Up(UpRequest) returns (UpResponse) {}
|
||||
|
||||
// Status of the service.
|
||||
rpc Status(StatusRequest) returns (StatusResponse) {}
|
||||
|
||||
// Down engine work in the daemon.
|
||||
rpc Down(DownRequest) returns (DownResponse) {}
|
||||
|
||||
// GetConfig of the daemon.
|
||||
rpc GetConfig(GetConfigRequest) returns (GetConfigResponse) {}
|
||||
|
||||
// List available networks
|
||||
rpc ListNetworks(ListNetworksRequest) returns (ListNetworksResponse) {}
|
||||
|
||||
// Select specific routes
|
||||
rpc SelectNetworks(SelectNetworksRequest) returns (SelectNetworksResponse) {}
|
||||
|
||||
// Deselect specific routes
|
||||
rpc DeselectNetworks(SelectNetworksRequest) returns (SelectNetworksResponse) {}
|
||||
|
||||
rpc ForwardingRules(EmptyRequest) returns (ForwardingRulesResponse) {}
|
||||
|
||||
// DebugBundle creates a debug bundle
|
||||
rpc DebugBundle(DebugBundleRequest) returns (DebugBundleResponse) {}
|
||||
|
||||
// GetLogLevel gets the log level of the daemon
|
||||
rpc GetLogLevel(GetLogLevelRequest) returns (GetLogLevelResponse) {}
|
||||
|
||||
// SetLogLevel sets the log level of the daemon
|
||||
rpc SetLogLevel(SetLogLevelRequest) returns (SetLogLevelResponse) {}
|
||||
|
||||
// List all states
|
||||
rpc ListStates(ListStatesRequest) returns (ListStatesResponse) {}
|
||||
|
||||
// Clean specific state or all states
|
||||
rpc CleanState(CleanStateRequest) returns (CleanStateResponse) {}
|
||||
|
||||
// Delete specific state or all states
|
||||
rpc DeleteState(DeleteStateRequest) returns (DeleteStateResponse) {}
|
||||
|
||||
// SetNetworkMapPersistence enables or disables network map persistence
|
||||
rpc SetNetworkMapPersistence(SetNetworkMapPersistenceRequest) returns (SetNetworkMapPersistenceResponse) {}
|
||||
|
||||
rpc TracePacket(TracePacketRequest) returns (TracePacketResponse) {}
|
||||
|
||||
rpc SubscribeEvents(SubscribeRequest) returns (stream SystemEvent) {}
|
||||
|
||||
rpc GetEvents(GetEventsRequest) returns (GetEventsResponse) {}
|
||||
}
|
||||
|
||||
message LoginRequest {
|
||||
// setupKey netbird setup key.
|
||||
string setupKey = 1;
|
||||
|
||||
// This is the old PreSharedKey field which will be deprecated in favor of optionalPreSharedKey field that is defined as optional
|
||||
// to allow clearing of preshared key while being able to persist in the config file.
|
||||
string preSharedKey = 2 [deprecated = true];
|
||||
|
||||
// managementUrl to authenticate.
|
||||
string managementUrl = 3;
|
||||
|
||||
// adminUrl to manage keys.
|
||||
string adminURL = 4;
|
||||
|
||||
// natExternalIPs map list of external IPs
|
||||
repeated string natExternalIPs = 5;
|
||||
|
||||
// cleanNATExternalIPs clean map list of external IPs.
|
||||
// This is needed because the generated code
|
||||
// omits initialized empty slices due to omitempty tags
|
||||
bool cleanNATExternalIPs = 6;
|
||||
|
||||
bytes customDNSAddress = 7;
|
||||
|
||||
bool isLinuxDesktopClient = 8;
|
||||
|
||||
string hostname = 9;
|
||||
|
||||
optional bool rosenpassEnabled = 10;
|
||||
|
||||
optional string interfaceName = 11;
|
||||
|
||||
optional int64 wireguardPort = 12;
|
||||
|
||||
optional string optionalPreSharedKey = 13;
|
||||
|
||||
optional bool disableAutoConnect = 14;
|
||||
|
||||
optional bool serverSSHAllowed = 15;
|
||||
|
||||
optional bool rosenpassPermissive = 16;
|
||||
|
||||
repeated string extraIFaceBlacklist = 17;
|
||||
|
||||
optional bool networkMonitor = 18;
|
||||
|
||||
optional google.protobuf.Duration dnsRouteInterval = 19;
|
||||
|
||||
optional bool disable_client_routes = 20;
|
||||
optional bool disable_server_routes = 21;
|
||||
optional bool disable_dns = 22;
|
||||
optional bool disable_firewall = 23;
|
||||
|
||||
optional bool block_lan_access = 24;
|
||||
|
||||
optional bool disable_notifications = 25;
|
||||
|
||||
repeated string dns_labels = 26;
|
||||
|
||||
// cleanDNSLabels clean map list of DNS labels.
|
||||
// This is needed because the generated code
|
||||
// omits initialized empty slices due to omitempty tags
|
||||
bool cleanDNSLabels = 27;
|
||||
}
|
||||
|
||||
message LoginResponse {
|
||||
bool needsSSOLogin = 1;
|
||||
string userCode = 2;
|
||||
string verificationURI = 3;
|
||||
string verificationURIComplete = 4;
|
||||
}
|
||||
|
||||
message WaitSSOLoginRequest {
|
||||
string userCode = 1;
|
||||
string hostname = 2;
|
||||
}
|
||||
|
||||
message WaitSSOLoginResponse {}
|
||||
|
||||
message UpRequest {}
|
||||
|
||||
message UpResponse {}
|
||||
|
||||
message StatusRequest {
|
||||
bool getFullPeerStatus = 1;
|
||||
}
|
||||
|
||||
message StatusResponse {
|
||||
// status of the server.
|
||||
string status = 1;
|
||||
FullStatus fullStatus = 2;
|
||||
// NetBird daemon version
|
||||
string daemonVersion = 3;
|
||||
}
|
||||
|
||||
message DownRequest {}
|
||||
|
||||
message DownResponse {}
|
||||
|
||||
message GetConfigRequest {}
|
||||
|
||||
message GetConfigResponse {
|
||||
// managementUrl settings value.
|
||||
string managementUrl = 1;
|
||||
|
||||
// configFile settings value.
|
||||
string configFile = 2;
|
||||
|
||||
// logFile settings value.
|
||||
string logFile = 3;
|
||||
|
||||
// preSharedKey settings value.
|
||||
string preSharedKey = 4;
|
||||
|
||||
// adminURL settings value.
|
||||
string adminURL = 5;
|
||||
|
||||
string interfaceName = 6;
|
||||
|
||||
int64 wireguardPort = 7;
|
||||
|
||||
bool disableAutoConnect = 9;
|
||||
|
||||
bool serverSSHAllowed = 10;
|
||||
|
||||
bool rosenpassEnabled = 11;
|
||||
|
||||
bool rosenpassPermissive = 12;
|
||||
|
||||
bool disable_notifications = 13;
|
||||
}
|
||||
|
||||
// PeerState contains the latest state of a peer
|
||||
message PeerState {
|
||||
string IP = 1;
|
||||
string pubKey = 2;
|
||||
string connStatus = 3;
|
||||
google.protobuf.Timestamp connStatusUpdate = 4;
|
||||
bool relayed = 5;
|
||||
string localIceCandidateType = 7;
|
||||
string remoteIceCandidateType = 8;
|
||||
string fqdn = 9;
|
||||
string localIceCandidateEndpoint = 10;
|
||||
string remoteIceCandidateEndpoint = 11;
|
||||
google.protobuf.Timestamp lastWireguardHandshake = 12;
|
||||
int64 bytesRx = 13;
|
||||
int64 bytesTx = 14;
|
||||
bool rosenpassEnabled = 15;
|
||||
repeated string networks = 16;
|
||||
google.protobuf.Duration latency = 17;
|
||||
string relayAddress = 18;
|
||||
}
|
||||
|
||||
// LocalPeerState contains the latest state of the local peer
|
||||
message LocalPeerState {
|
||||
string IP = 1;
|
||||
string pubKey = 2;
|
||||
bool kernelInterface = 3;
|
||||
string fqdn = 4;
|
||||
bool rosenpassEnabled = 5;
|
||||
bool rosenpassPermissive = 6;
|
||||
repeated string networks = 7;
|
||||
}
|
||||
|
||||
// SignalState contains the latest state of a signal connection
|
||||
message SignalState {
|
||||
string URL = 1;
|
||||
bool connected = 2;
|
||||
string error = 3;
|
||||
}
|
||||
|
||||
// ManagementState contains the latest state of a management connection
|
||||
message ManagementState {
|
||||
string URL = 1;
|
||||
bool connected = 2;
|
||||
string error = 3;
|
||||
}
|
||||
|
||||
// RelayState contains the latest state of the relay
|
||||
message RelayState {
|
||||
string URI = 1;
|
||||
bool available = 2;
|
||||
string error = 3;
|
||||
}
|
||||
|
||||
message NSGroupState {
|
||||
repeated string servers = 1;
|
||||
repeated string domains = 2;
|
||||
bool enabled = 3;
|
||||
string error = 4;
|
||||
}
|
||||
|
||||
// FullStatus contains the full state held by the Status instance
|
||||
message FullStatus {
|
||||
ManagementState managementState = 1;
|
||||
SignalState signalState = 2;
|
||||
LocalPeerState localPeerState = 3;
|
||||
repeated PeerState peers = 4;
|
||||
repeated RelayState relays = 5;
|
||||
repeated NSGroupState dns_servers = 6;
|
||||
int32 NumberOfForwardingRules = 8;
|
||||
|
||||
repeated SystemEvent events = 7;
|
||||
}
|
||||
|
||||
// Networks
|
||||
message ListNetworksRequest {}
|
||||
|
||||
message ListNetworksResponse {
|
||||
repeated Network routes = 1;
|
||||
}
|
||||
|
||||
message SelectNetworksRequest {
|
||||
repeated string networkIDs = 1;
|
||||
bool append = 2;
|
||||
bool all = 3;
|
||||
}
|
||||
|
||||
message SelectNetworksResponse {}
|
||||
|
||||
message IPList {
|
||||
repeated string ips = 1;
|
||||
}
|
||||
|
||||
message Network {
|
||||
string ID = 1;
|
||||
string range = 2;
|
||||
bool selected = 3;
|
||||
repeated string domains = 4;
|
||||
map<string, IPList> resolvedIPs = 5;
|
||||
}
|
||||
|
||||
// ForwardingRules
|
||||
message PortInfo {
|
||||
oneof portSelection {
|
||||
uint32 port = 1;
|
||||
Range range = 2;
|
||||
}
|
||||
|
||||
message Range {
|
||||
uint32 start = 1;
|
||||
uint32 end = 2;
|
||||
}
|
||||
}
|
||||
|
||||
message ForwardingRule {
|
||||
string protocol = 1;
|
||||
PortInfo destinationPort = 2;
|
||||
string translatedAddress = 3;
|
||||
string translatedHostname = 4;
|
||||
PortInfo translatedPort = 5;
|
||||
}
|
||||
|
||||
message ForwardingRulesResponse {
|
||||
repeated ForwardingRule rules = 1;
|
||||
}
|
||||
|
||||
// DebugBundler
|
||||
message DebugBundleRequest {
|
||||
bool anonymize = 1;
|
||||
string status = 2;
|
||||
bool systemInfo = 3;
|
||||
}
|
||||
|
||||
message DebugBundleResponse {
|
||||
string path = 1;
|
||||
}
|
||||
|
||||
enum LogLevel {
|
||||
UNKNOWN = 0;
|
||||
PANIC = 1;
|
||||
FATAL = 2;
|
||||
ERROR = 3;
|
||||
WARN = 4;
|
||||
INFO = 5;
|
||||
DEBUG = 6;
|
||||
TRACE = 7;
|
||||
}
|
||||
|
||||
message GetLogLevelRequest {}
|
||||
|
||||
message GetLogLevelResponse {
|
||||
LogLevel level = 1;
|
||||
}
|
||||
|
||||
message SetLogLevelRequest {
|
||||
LogLevel level = 1;
|
||||
}
|
||||
|
||||
message SetLogLevelResponse {}
|
||||
|
||||
// State represents a daemon state entry
|
||||
message State {
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// ListStatesRequest is empty as it requires no parameters
|
||||
message ListStatesRequest {}
|
||||
|
||||
// ListStatesResponse contains a list of states
|
||||
message ListStatesResponse {
|
||||
repeated State states = 1;
|
||||
}
|
||||
|
||||
// CleanStateRequest for cleaning states
|
||||
message CleanStateRequest {
|
||||
string state_name = 1;
|
||||
bool all = 2;
|
||||
}
|
||||
|
||||
// CleanStateResponse contains the result of the clean operation
|
||||
message CleanStateResponse {
|
||||
int32 cleaned_states = 1;
|
||||
}
|
||||
|
||||
// DeleteStateRequest for deleting states
|
||||
message DeleteStateRequest {
|
||||
string state_name = 1;
|
||||
bool all = 2;
|
||||
}
|
||||
|
||||
// DeleteStateResponse contains the result of the delete operation
|
||||
message DeleteStateResponse {
|
||||
int32 deleted_states = 1;
|
||||
}
|
||||
|
||||
message SetNetworkMapPersistenceRequest {
|
||||
bool enabled = 1;
|
||||
}
|
||||
|
||||
message SetNetworkMapPersistenceResponse {}
|
||||
|
||||
message TCPFlags {
|
||||
bool syn = 1;
|
||||
bool ack = 2;
|
||||
bool fin = 3;
|
||||
bool rst = 4;
|
||||
bool psh = 5;
|
||||
bool urg = 6;
|
||||
}
|
||||
|
||||
message TracePacketRequest {
|
||||
string source_ip = 1;
|
||||
string destination_ip = 2;
|
||||
string protocol = 3;
|
||||
uint32 source_port = 4;
|
||||
uint32 destination_port = 5;
|
||||
string direction = 6;
|
||||
optional TCPFlags tcp_flags = 7;
|
||||
optional uint32 icmp_type = 8;
|
||||
optional uint32 icmp_code = 9;
|
||||
}
|
||||
|
||||
message TraceStage {
|
||||
string name = 1;
|
||||
string message = 2;
|
||||
bool allowed = 3;
|
||||
optional string forwarding_details = 4;
|
||||
}
|
||||
|
||||
message TracePacketResponse {
|
||||
repeated TraceStage stages = 1;
|
||||
bool final_disposition = 2;
|
||||
}
|
||||
|
||||
message SubscribeRequest {}
|
||||
|
||||
message SystemEvent {
|
||||
enum Severity {
|
||||
INFO = 0;
|
||||
WARNING = 1;
|
||||
ERROR = 2;
|
||||
CRITICAL = 3;
|
||||
}
|
||||
|
||||
enum Category {
|
||||
NETWORK = 0;
|
||||
DNS = 1;
|
||||
AUTHENTICATION = 2;
|
||||
CONNECTIVITY = 3;
|
||||
SYSTEM = 4;
|
||||
}
|
||||
|
||||
string id = 1;
|
||||
Severity severity = 2;
|
||||
Category category = 3;
|
||||
string message = 4;
|
||||
string userMessage = 5;
|
||||
google.protobuf.Timestamp timestamp = 6;
|
||||
map<string, string> metadata = 7;
|
||||
}
|
||||
|
||||
message GetEventsRequest {}
|
||||
|
||||
message GetEventsResponse {
|
||||
repeated SystemEvent events = 1;
|
||||
}
|
||||
@@ -0,0 +1,105 @@
|
||||
syntax = "proto3";
|
||||
|
||||
package flow;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
|
||||
option go_package = "flow/proto";
|
||||
|
||||
service FlowService {
|
||||
// Client to receiver streams of events and acknowledgements
|
||||
rpc Events(stream FlowEvent) returns (stream FlowEventAck) {}
|
||||
}
|
||||
|
||||
message FlowEvent {
|
||||
// Unique client event identifier
|
||||
bytes event_id = 1;
|
||||
|
||||
// When the event occurred
|
||||
google.protobuf.Timestamp timestamp = 2;
|
||||
|
||||
// Public key of the sending peer
|
||||
bytes public_key = 3;
|
||||
|
||||
FlowFields flow_fields = 4;
|
||||
|
||||
bool isInitiator = 5;
|
||||
}
|
||||
|
||||
message FlowEventAck {
|
||||
// Unique client event identifier that has been ack'ed
|
||||
bytes event_id = 1;
|
||||
bool isInitiator = 2;
|
||||
}
|
||||
|
||||
message FlowFields {
|
||||
// Unique client flow session identifier
|
||||
bytes flow_id = 1;
|
||||
|
||||
// Flow type
|
||||
Type type = 2;
|
||||
|
||||
// RuleId identifies the rule that allowed or denied the connection
|
||||
bytes rule_id = 3;
|
||||
|
||||
// Initiating traffic direction
|
||||
Direction direction = 4;
|
||||
|
||||
// IP protocol number
|
||||
uint32 protocol = 5;
|
||||
|
||||
// Source IP address
|
||||
bytes source_ip = 6;
|
||||
|
||||
// Destination IP address
|
||||
bytes dest_ip = 7;
|
||||
|
||||
// Layer 4 -specific information
|
||||
oneof connection_info {
|
||||
// TCP/UDP port information
|
||||
PortInfo port_info = 8;
|
||||
|
||||
// ICMP type and code
|
||||
ICMPInfo icmp_info = 9;
|
||||
}
|
||||
|
||||
// Number of packets
|
||||
uint64 rx_packets = 10;
|
||||
uint64 tx_packets = 11;
|
||||
|
||||
// Number of bytes
|
||||
uint64 rx_bytes = 12;
|
||||
uint64 tx_bytes = 13;
|
||||
|
||||
// Resource ID
|
||||
bytes source_resource_id = 14;
|
||||
bytes dest_resource_id = 15;
|
||||
|
||||
}
|
||||
|
||||
// Flow event types
|
||||
enum Type {
|
||||
TYPE_UNKNOWN = 0;
|
||||
TYPE_START = 1;
|
||||
TYPE_END = 2;
|
||||
TYPE_DROP = 3;
|
||||
}
|
||||
|
||||
// Flow direction
|
||||
enum Direction {
|
||||
DIRECTION_UNKNOWN = 0;
|
||||
INGRESS = 1;
|
||||
EGRESS = 2;
|
||||
}
|
||||
|
||||
// TCP/UDP port information
|
||||
message PortInfo {
|
||||
uint32 source_port = 1;
|
||||
uint32 dest_port = 2;
|
||||
}
|
||||
|
||||
// ICMP message information
|
||||
message ICMPInfo {
|
||||
uint32 icmp_type = 1;
|
||||
uint32 icmp_code = 2;
|
||||
}
|
||||
@@ -0,0 +1,518 @@
|
||||
syntax = "proto3";
|
||||
|
||||
package management;
|
||||
|
||||
import "google/protobuf/duration.proto";
|
||||
import "google/protobuf/timestamp.proto";
|
||||
|
||||
option go_package = "management/proto";
|
||||
|
||||
service ManagementService {
|
||||
// Login logs in peer. In case server returns codes.PermissionDenied this endpoint can be used to register Peer providing LoginRequest.setupKey
|
||||
// Returns encrypted LoginResponse in EncryptedMessage.Body
|
||||
rpc Login(EncryptedMessage) returns (EncryptedMessage) {}
|
||||
|
||||
// Sync enables peer synchronization. Each peer that is connected to this stream will receive updates from the server.
|
||||
// For example, if a new peer has been added to an account all other connected peers will receive this peer's Wireguard public key as an update
|
||||
// The initial SyncResponse contains all of the available peers so the local state can be refreshed
|
||||
// Returns encrypted SyncResponse in EncryptedMessage.Body
|
||||
rpc Sync(EncryptedMessage) returns (stream EncryptedMessage) {}
|
||||
|
||||
// Exposes a Wireguard public key of the Management service.
|
||||
// This key is used to support message encryption between client and server
|
||||
rpc GetServerKey(Empty) returns (ServerKeyResponse) {}
|
||||
|
||||
// health check endpoint
|
||||
rpc isHealthy(Empty) returns (Empty) {}
|
||||
|
||||
// Exposes a device authorization flow information
|
||||
// This is used for initiating a Oauth 2 device authorization grant flow
|
||||
// which will be used by our clients to Login.
|
||||
// EncryptedMessage of the request has a body of DeviceAuthorizationFlowRequest.
|
||||
// EncryptedMessage of the response has a body of DeviceAuthorizationFlow.
|
||||
rpc GetDeviceAuthorizationFlow(EncryptedMessage) returns (EncryptedMessage) {}
|
||||
|
||||
// Exposes a PKCE authorization code flow information
|
||||
// This is used for initiating a Oauth 2 authorization grant flow
|
||||
// with Proof Key for Code Exchange (PKCE) which will be used by our clients to Login.
|
||||
// EncryptedMessage of the request has a body of PKCEAuthorizationFlowRequest.
|
||||
// EncryptedMessage of the response has a body of PKCEAuthorizationFlow.
|
||||
rpc GetPKCEAuthorizationFlow(EncryptedMessage) returns (EncryptedMessage) {}
|
||||
|
||||
// SyncMeta is used to sync metadata of the peer.
|
||||
// After sync the peer if there is a change in peer posture check which needs to be evaluated by the client,
|
||||
// sync meta will evaluate the checks and update the peer meta with the result.
|
||||
// EncryptedMessage of the request has a body of Empty.
|
||||
rpc SyncMeta(EncryptedMessage) returns (Empty) {}
|
||||
}
|
||||
|
||||
message EncryptedMessage {
|
||||
// Wireguard public key
|
||||
string wgPubKey = 1;
|
||||
|
||||
// encrypted message Body
|
||||
bytes body = 2;
|
||||
// Version of the Netbird Management Service protocol
|
||||
int32 version = 3;
|
||||
}
|
||||
|
||||
message SyncRequest {
|
||||
// Meta data of the peer
|
||||
PeerSystemMeta meta = 1;
|
||||
}
|
||||
|
||||
// SyncResponse represents a state that should be applied to the local peer (e.g. Netbird servers config as well as local peer and remote peers configs)
|
||||
message SyncResponse {
|
||||
// Global config
|
||||
NetbirdConfig netbirdConfig = 1;
|
||||
|
||||
// Deprecated. Use NetworkMap.PeerConfig
|
||||
PeerConfig peerConfig = 2;
|
||||
|
||||
// Deprecated. Use NetworkMap.RemotePeerConfig
|
||||
repeated RemotePeerConfig remotePeers = 3;
|
||||
|
||||
// Indicates whether remotePeers array is empty or not to bypass protobuf null and empty array equality.
|
||||
// Deprecated. Use NetworkMap.remotePeersIsEmpty
|
||||
bool remotePeersIsEmpty = 4;
|
||||
|
||||
NetworkMap NetworkMap = 5;
|
||||
|
||||
// Posture checks to be evaluated by client
|
||||
repeated Checks Checks = 6;
|
||||
}
|
||||
|
||||
message SyncMetaRequest {
|
||||
// Meta data of the peer
|
||||
PeerSystemMeta meta = 1;
|
||||
}
|
||||
|
||||
message LoginRequest {
|
||||
// Pre-authorized setup key (can be empty)
|
||||
string setupKey = 1;
|
||||
// Meta data of the peer (e.g. name, os_name, os_version,
|
||||
PeerSystemMeta meta = 2;
|
||||
// SSO token (can be empty)
|
||||
string jwtToken = 3;
|
||||
// Can be absent for now.
|
||||
PeerKeys peerKeys = 4;
|
||||
|
||||
repeated string dnsLabels = 5;
|
||||
}
|
||||
|
||||
// PeerKeys is additional peer info like SSH pub key and WireGuard public key.
|
||||
// This message is sent on Login or register requests, or when a key rotation has to happen.
|
||||
message PeerKeys {
|
||||
// sshPubKey represents a public SSH key of the peer. Can be absent.
|
||||
bytes sshPubKey = 1;
|
||||
// wgPubKey represents a public WireGuard key of the peer. Can be absent.
|
||||
bytes wgPubKey = 2;
|
||||
}
|
||||
|
||||
// Environment is part of the PeerSystemMeta and describes the environment the agent is running in.
|
||||
message Environment {
|
||||
// cloud is the cloud provider the agent is running in if applicable.
|
||||
string cloud = 1;
|
||||
// platform is the platform the agent is running on if applicable.
|
||||
string platform = 2;
|
||||
}
|
||||
|
||||
// File represents a file on the system.
|
||||
message File {
|
||||
// path is the path to the file.
|
||||
string path = 1;
|
||||
// exist indicate whether the file exists.
|
||||
bool exist = 2;
|
||||
// processIsRunning indicates whether the file is a running process or not.
|
||||
bool processIsRunning = 3;
|
||||
}
|
||||
|
||||
message Flags {
|
||||
bool rosenpassEnabled = 1;
|
||||
bool rosenpassPermissive = 2;
|
||||
bool serverSSHAllowed = 3;
|
||||
bool disableClientRoutes = 4;
|
||||
bool disableServerRoutes = 5;
|
||||
bool disableDNS = 6;
|
||||
bool disableFirewall = 7;
|
||||
}
|
||||
|
||||
// PeerSystemMeta is machine meta data like OS and version.
|
||||
message PeerSystemMeta {
|
||||
string hostname = 1;
|
||||
string goOS = 2;
|
||||
string kernel = 3;
|
||||
string core = 4;
|
||||
string platform = 5;
|
||||
string OS = 6;
|
||||
string netbirdVersion = 7;
|
||||
string uiVersion = 8;
|
||||
string kernelVersion = 9;
|
||||
string OSVersion = 10;
|
||||
repeated NetworkAddress networkAddresses = 11;
|
||||
string sysSerialNumber = 12;
|
||||
string sysProductName = 13;
|
||||
string sysManufacturer = 14;
|
||||
Environment environment = 15;
|
||||
repeated File files = 16;
|
||||
Flags flags = 17;
|
||||
}
|
||||
|
||||
message LoginResponse {
|
||||
// Global config
|
||||
NetbirdConfig netbirdConfig = 1;
|
||||
// Peer local config
|
||||
PeerConfig peerConfig = 2;
|
||||
// Posture checks to be evaluated by client
|
||||
repeated Checks Checks = 3;
|
||||
}
|
||||
|
||||
message ServerKeyResponse {
|
||||
// Server's Wireguard public key
|
||||
string key = 1;
|
||||
// Key expiration timestamp after which the key should be fetched again by the client
|
||||
google.protobuf.Timestamp expiresAt = 2;
|
||||
// Version of the Netbird Management Service protocol
|
||||
int32 version = 3;
|
||||
}
|
||||
|
||||
message Empty {}
|
||||
|
||||
// NetbirdConfig is a common configuration of any Netbird peer. It contains STUN, TURN, Signal and Management servers configurations
|
||||
message NetbirdConfig {
|
||||
// a list of STUN servers
|
||||
repeated HostConfig stuns = 1;
|
||||
// a list of TURN servers
|
||||
repeated ProtectedHostConfig turns = 2;
|
||||
|
||||
// a Signal server config
|
||||
HostConfig signal = 3;
|
||||
|
||||
RelayConfig relay = 4;
|
||||
|
||||
FlowConfig flow = 5;
|
||||
}
|
||||
|
||||
// HostConfig describes connection properties of some server (e.g. STUN, Signal, Management)
|
||||
message HostConfig {
|
||||
// URI of the resource e.g. turns://stun.netbird.io:4430 or signal.netbird.io:10000
|
||||
string uri = 1;
|
||||
Protocol protocol = 2;
|
||||
|
||||
enum Protocol {
|
||||
UDP = 0;
|
||||
TCP = 1;
|
||||
HTTP = 2;
|
||||
HTTPS = 3;
|
||||
DTLS = 4;
|
||||
}
|
||||
}
|
||||
|
||||
message RelayConfig {
|
||||
repeated string urls = 1;
|
||||
string tokenPayload = 2;
|
||||
string tokenSignature = 3;
|
||||
}
|
||||
|
||||
message FlowConfig {
|
||||
string url = 1;
|
||||
string tokenPayload = 2;
|
||||
string tokenSignature = 3;
|
||||
google.protobuf.Duration interval = 4;
|
||||
bool enabled = 5;
|
||||
|
||||
// counters determines if flow packets and bytes counters should be sent
|
||||
bool counters = 6;
|
||||
// exitNodeCollection determines if event collection on exit nodes should be enabled
|
||||
bool exitNodeCollection = 7;
|
||||
// dnsCollection determines if DNS event collection should be enabled
|
||||
bool dnsCollection = 8;
|
||||
}
|
||||
|
||||
// ProtectedHostConfig is similar to HostConfig but has additional user and password
|
||||
// Mostly used for TURN servers
|
||||
message ProtectedHostConfig {
|
||||
HostConfig hostConfig = 1;
|
||||
string user = 2;
|
||||
string password = 3;
|
||||
}
|
||||
|
||||
// PeerConfig represents a configuration of a "our" peer.
|
||||
// The properties are used to configure local Wireguard
|
||||
message PeerConfig {
|
||||
// Peer's virtual IP address within the Netbird VPN (a Wireguard address config)
|
||||
string address = 1;
|
||||
// Netbird DNS server (a Wireguard DNS config)
|
||||
string dns = 2;
|
||||
|
||||
// SSHConfig of the peer.
|
||||
SSHConfig sshConfig = 3;
|
||||
// Peer fully qualified domain name
|
||||
string fqdn = 4;
|
||||
|
||||
bool RoutingPeerDnsResolutionEnabled = 5;
|
||||
}
|
||||
|
||||
// NetworkMap represents a network state of the peer with the corresponding configuration parameters to establish peer-to-peer connections
|
||||
message NetworkMap {
|
||||
// Serial is an ID of the network state to be used by clients to order updates.
|
||||
// The larger the Serial the newer the configuration.
|
||||
// E.g. the client app should keep track of this id locally and discard all the configurations with a lower value
|
||||
uint64 Serial = 1;
|
||||
|
||||
// PeerConfig represents configuration of a peer
|
||||
PeerConfig peerConfig = 2;
|
||||
|
||||
// RemotePeerConfig represents a list of remote peers that the receiver can connect to
|
||||
repeated RemotePeerConfig remotePeers = 3;
|
||||
|
||||
// Indicates whether remotePeers array is empty or not to bypass protobuf null and empty array equality.
|
||||
bool remotePeersIsEmpty = 4;
|
||||
|
||||
// List of routes to be applied
|
||||
repeated Route Routes = 5;
|
||||
|
||||
// DNS config to be applied
|
||||
DNSConfig DNSConfig = 6;
|
||||
|
||||
// RemotePeerConfig represents a list of remote peers that the receiver can connect to
|
||||
repeated RemotePeerConfig offlinePeers = 7;
|
||||
|
||||
// FirewallRule represents a list of firewall rules to be applied to peer
|
||||
repeated FirewallRule FirewallRules = 8;
|
||||
|
||||
// firewallRulesIsEmpty indicates whether FirewallRule array is empty or not to bypass protobuf null and empty array equality.
|
||||
bool firewallRulesIsEmpty = 9;
|
||||
|
||||
// RoutesFirewallRules represents a list of routes firewall rules to be applied to peer
|
||||
repeated RouteFirewallRule routesFirewallRules = 10;
|
||||
|
||||
// RoutesFirewallRulesIsEmpty indicates whether RouteFirewallRule array is empty or not to bypass protobuf null and empty array equality.
|
||||
bool routesFirewallRulesIsEmpty = 11;
|
||||
|
||||
repeated ForwardingRule forwardingRules = 12;
|
||||
}
|
||||
|
||||
// RemotePeerConfig represents a configuration of a remote peer.
|
||||
// The properties are used to configure WireGuard Peers sections
|
||||
message RemotePeerConfig {
|
||||
// A WireGuard public key of a remote peer
|
||||
string wgPubKey = 1;
|
||||
|
||||
// WireGuard allowed IPs of a remote peer e.g. [10.30.30.1/32]
|
||||
repeated string allowedIps = 2;
|
||||
|
||||
// SSHConfig is a SSH config of the remote peer. SSHConfig.sshPubKey should be ignored because peer knows it's SSH key.
|
||||
SSHConfig sshConfig = 3;
|
||||
|
||||
// Peer fully qualified domain name
|
||||
string fqdn = 4;
|
||||
}
|
||||
|
||||
// SSHConfig represents SSH configurations of a peer.
|
||||
message SSHConfig {
|
||||
// sshEnabled indicates whether a SSH server is enabled on this peer
|
||||
bool sshEnabled = 1;
|
||||
|
||||
// sshPubKey is a SSH public key of a peer to be added to authorized_hosts.
|
||||
// This property should be ignore if SSHConfig comes from PeerConfig.
|
||||
bytes sshPubKey = 2;
|
||||
}
|
||||
|
||||
// DeviceAuthorizationFlowRequest empty struct for future expansion
|
||||
message DeviceAuthorizationFlowRequest {}
|
||||
|
||||
// DeviceAuthorizationFlow represents Device Authorization Flow information
|
||||
// that can be used by the client to login initiate a Oauth 2.0 device authorization grant flow
|
||||
// see https://datatracker.ietf.org/doc/html/rfc8628
|
||||
message DeviceAuthorizationFlow {
|
||||
// An IDP provider , (eg. Auth0)
|
||||
provider Provider = 1;
|
||||
ProviderConfig ProviderConfig = 2;
|
||||
|
||||
enum provider {
|
||||
HOSTED = 0;
|
||||
}
|
||||
}
|
||||
|
||||
// PKCEAuthorizationFlowRequest empty struct for future expansion
|
||||
message PKCEAuthorizationFlowRequest {}
|
||||
|
||||
// PKCEAuthorizationFlow represents Authorization Code Flow information
|
||||
// that can be used by the client to login initiate a Oauth 2.0 authorization code grant flow
|
||||
// with Proof Key for Code Exchange (PKCE). See https://datatracker.ietf.org/doc/html/rfc7636
|
||||
message PKCEAuthorizationFlow {
|
||||
ProviderConfig ProviderConfig = 1;
|
||||
}
|
||||
|
||||
// ProviderConfig has all attributes needed to initiate a device/pkce authorization flow
|
||||
message ProviderConfig {
|
||||
// An IDP application client id
|
||||
string ClientID = 1;
|
||||
// An IDP application client secret
|
||||
string ClientSecret = 2;
|
||||
// An IDP API domain
|
||||
// Deprecated. Use a DeviceAuthEndpoint and TokenEndpoint
|
||||
string Domain = 3;
|
||||
// An Audience for validation
|
||||
string Audience = 4;
|
||||
// DeviceAuthEndpoint is an endpoint to request device authentication code.
|
||||
string DeviceAuthEndpoint = 5;
|
||||
// TokenEndpoint is an endpoint to request auth token.
|
||||
string TokenEndpoint = 6;
|
||||
// Scopes provides the scopes to be included in the token request
|
||||
string Scope = 7;
|
||||
// UseIDToken indicates if the id token should be used for authentication
|
||||
bool UseIDToken = 8;
|
||||
// AuthorizationEndpoint is the endpoint of an IDP manager where clients can obtain authorization code.
|
||||
string AuthorizationEndpoint = 9;
|
||||
// RedirectURLs handles authorization code from IDP manager
|
||||
repeated string RedirectURLs = 10;
|
||||
}
|
||||
|
||||
// Route represents a route.Route object
|
||||
message Route {
|
||||
string ID = 1;
|
||||
string Network = 2;
|
||||
int64 NetworkType = 3;
|
||||
string Peer = 4;
|
||||
int64 Metric = 5;
|
||||
bool Masquerade = 6;
|
||||
string NetID = 7;
|
||||
repeated string Domains = 8;
|
||||
bool keepRoute = 9;
|
||||
}
|
||||
|
||||
// DNSConfig represents a dns.Update
|
||||
message DNSConfig {
|
||||
bool ServiceEnable = 1;
|
||||
repeated NameServerGroup NameServerGroups = 2;
|
||||
repeated CustomZone CustomZones = 3;
|
||||
}
|
||||
|
||||
// CustomZone represents a dns.CustomZone
|
||||
message CustomZone {
|
||||
string Domain = 1;
|
||||
repeated SimpleRecord Records = 2;
|
||||
}
|
||||
|
||||
// SimpleRecord represents a dns.SimpleRecord
|
||||
message SimpleRecord {
|
||||
string Name = 1;
|
||||
int64 Type = 2;
|
||||
string Class = 3;
|
||||
int64 TTL = 4;
|
||||
string RData = 5;
|
||||
}
|
||||
|
||||
// NameServerGroup represents a dns.NameServerGroup
|
||||
message NameServerGroup {
|
||||
repeated NameServer NameServers = 1;
|
||||
bool Primary = 2;
|
||||
repeated string Domains = 3;
|
||||
bool SearchDomainsEnabled = 4;
|
||||
}
|
||||
|
||||
// NameServer represents a dns.NameServer
|
||||
message NameServer {
|
||||
string IP = 1;
|
||||
int64 NSType = 2;
|
||||
int64 Port = 3;
|
||||
}
|
||||
|
||||
enum RuleProtocol {
|
||||
UNKNOWN = 0;
|
||||
ALL = 1;
|
||||
TCP = 2;
|
||||
UDP = 3;
|
||||
ICMP = 4;
|
||||
CUSTOM = 5;
|
||||
}
|
||||
|
||||
enum RuleDirection {
|
||||
IN = 0;
|
||||
OUT = 1;
|
||||
}
|
||||
|
||||
enum RuleAction {
|
||||
ACCEPT = 0;
|
||||
DROP = 1;
|
||||
}
|
||||
|
||||
// FirewallRule represents a firewall rule
|
||||
message FirewallRule {
|
||||
string PeerIP = 1;
|
||||
RuleDirection Direction = 2;
|
||||
RuleAction Action = 3;
|
||||
RuleProtocol Protocol = 4;
|
||||
string Port = 5;
|
||||
PortInfo PortInfo = 6;
|
||||
|
||||
// PolicyID is the ID of the policy that this rule belongs to
|
||||
bytes PolicyID = 7;
|
||||
}
|
||||
|
||||
message NetworkAddress {
|
||||
string netIP = 1;
|
||||
string mac = 2;
|
||||
}
|
||||
|
||||
message Checks {
|
||||
repeated string Files = 1;
|
||||
}
|
||||
|
||||
message PortInfo {
|
||||
oneof portSelection {
|
||||
uint32 port = 1;
|
||||
Range range = 2;
|
||||
}
|
||||
|
||||
message Range {
|
||||
uint32 start = 1;
|
||||
uint32 end = 2;
|
||||
}
|
||||
}
|
||||
|
||||
// RouteFirewallRule signifies a firewall rule applicable for a routed network.
|
||||
message RouteFirewallRule {
|
||||
// sourceRanges IP ranges of the routing peers.
|
||||
repeated string sourceRanges = 1;
|
||||
|
||||
// Action to be taken by the firewall when the rule is applicable.
|
||||
RuleAction action = 2;
|
||||
|
||||
// Network prefix for the routed network.
|
||||
string destination = 3;
|
||||
|
||||
// Protocol of the routed network.
|
||||
RuleProtocol protocol = 4;
|
||||
|
||||
// Details about the port.
|
||||
PortInfo portInfo = 5;
|
||||
|
||||
// IsDynamic indicates if the route is a DNS route.
|
||||
bool isDynamic = 6;
|
||||
|
||||
// Domains is a list of domains for which the rule is applicable.
|
||||
repeated string domains = 7;
|
||||
|
||||
// CustomProtocol is a custom protocol ID.
|
||||
uint32 customProtocol = 8;
|
||||
|
||||
// PolicyID is the ID of the policy that this rule belongs to
|
||||
bytes PolicyID = 9;
|
||||
}
|
||||
|
||||
message ForwardingRule {
|
||||
// Protocol of the forwarding rule
|
||||
RuleProtocol protocol = 1;
|
||||
|
||||
// portInfo is the ingress destination port information, where the traffic arrives in the gateway node
|
||||
PortInfo destinationPort = 2;
|
||||
|
||||
// IP address of the translated address (remote peer) to send traffic to
|
||||
bytes translatedAddress = 3;
|
||||
|
||||
// Translated port information, where the traffic should be forwarded to
|
||||
PortInfo translatedPort = 4;
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
syntax = "proto3";
|
||||
|
||||
package signalexchange;
|
||||
|
||||
import "google/protobuf/descriptor.proto";
|
||||
|
||||
option go_package = "signal/proto";
|
||||
|
||||
service SignalExchange {
|
||||
// Synchronously connect to the Signal Exchange service offering connection candidates and waiting for connection candidates from the other party (remote peer)
|
||||
rpc Send(EncryptedMessage) returns (EncryptedMessage) {}
|
||||
// Connect to the Signal Exchange service offering connection candidates and maintain a channel for receiving candidates from the other party (remote peer)
|
||||
rpc ConnectStream(stream EncryptedMessage) returns (stream EncryptedMessage) {}
|
||||
}
|
||||
|
||||
// Used for sending through signal.
|
||||
// The body of this message is the Body message encrypted with the Wireguard private key and the remote Peer key
|
||||
message EncryptedMessage {
|
||||
// Wireguard public key
|
||||
string key = 2;
|
||||
|
||||
// Wireguard public key of the remote peer to connect to
|
||||
string remoteKey = 3;
|
||||
|
||||
// encrypted message Body
|
||||
bytes body = 4;
|
||||
}
|
||||
|
||||
// A decrypted representation of the EncryptedMessage. Used locally before/after encryption
|
||||
message Message {
|
||||
// WireGuard public key
|
||||
string key = 2;
|
||||
|
||||
// WireGuard public key of the remote peer to connect to
|
||||
string remoteKey = 3;
|
||||
|
||||
Body body = 4;
|
||||
}
|
||||
|
||||
// Actual body of the message that can contain credentials (type OFFER/ANSWER) or connection Candidate
|
||||
// This part will be encrypted
|
||||
message Body {
|
||||
// Message type
|
||||
enum Type {
|
||||
OFFER = 0;
|
||||
ANSWER = 1;
|
||||
CANDIDATE = 2;
|
||||
MODE = 4;
|
||||
}
|
||||
Type type = 1;
|
||||
string payload = 2;
|
||||
// wgListenPort is an actual WireGuard listen port
|
||||
uint32 wgListenPort = 3;
|
||||
string netBirdVersion = 4;
|
||||
Mode mode = 5;
|
||||
|
||||
// featuresSupported list of supported features by the client of this protocol
|
||||
repeated uint32 featuresSupported = 6;
|
||||
|
||||
// RosenpassConfig is a Rosenpass config of the remote peer our peer tries to connect to
|
||||
RosenpassConfig rosenpassConfig = 7;
|
||||
|
||||
// relayServerAddress is url of the relay server
|
||||
string relayServerAddress = 8;
|
||||
}
|
||||
|
||||
// Mode indicates a connection mode
|
||||
message Mode {
|
||||
optional bool direct = 1;
|
||||
}
|
||||
|
||||
message RosenpassConfig {
|
||||
bytes rosenpassPubKey = 1;
|
||||
// rosenpassServerAddr is an IP:port of the rosenpass service
|
||||
string rosenpassServerAddr = 2;
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
syntax = "proto3";
|
||||
|
||||
package testprotos;
|
||||
|
||||
option go_package = "encryption/testprotos";
|
||||
|
||||
message TestMessage {
|
||||
string body = 1;
|
||||
}
|
||||
Reference in New Issue
Block a user