sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-14 02:39:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Refuse a serialized config that carries no peer identity

Browse Source 
ConfigFromJSON still promised a "fully initialized" config after this PR
moved key generation out of apply() into EnsureIdentity, but identity stopped
being one of the defaults it applies. Its two callers both connect with what
they get back: the iOS SDK's Client.SetConfigFromJSON keeps it as the
preloaded config Run() uses on tvOS, and Auth.SetConfigFromJSON as the config
it authenticates with.

No caller feeds it a document without keys today — every stored document
comes from Auth.GetConfigJSON, whose config is provisioned by
DirectUpdateOrCreateConfig or CreateInMemoryConfig, and the tvOS app only
ever edits fields of a document it already has. This is a safety net for the
next caller, not a live bug.

Provisioning the identity here would be the wrong net. Neither caller can
hand a generated key back to the store the document came from — Client
exports no config at all — so the peer would connect under an identity
nothing persists and register anew on every launch, which is the failure the
EnsureIdentity split exists to prevent. A document with no identity means
nobody has logged in yet, and saying so is the only useful answer.

Both keys are required because both are dead ends when missing: an empty
WireGuard key fails the management login on its size, and an empty SSH key
fails ssh.GeneratePublicKey in ConnectClient before the engine starts.
This commit is contained in:
riccardom
2026-09-08 09:20:11 +02:00
parent 70167821bb
commit 155ced4ab9
4 changed files with 77 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/ios/NetBirdSDK/client.go
+4 -1
View File
@@ -128,7 +128,10 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
func (c *Client) SetConfigFromJSON(jsonStr string) error {
cfg, err := profilemanager.ConfigFromJSON(jsonStr)
if err != nil {
log.Errorf("SetConfigFromJSON: failed to parse config JSON: %v", err)
// Not only a parse error any more: a document with no peer identity is
// refused, because Run() would otherwise connect as a peer whose key
// this SDK has no way to hand back to the caller's store.
log.Errorf("SetConfigFromJSON: failed to load config JSON: %v", err)
return err
}
c.preloadedConfig = cfg