sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-27 17:19:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Lower CreateTemporaryAccess complexity and emit VncAuth for session pubkeys

Browse Source
This commit is contained in:
Viktor Liu
2026-05-22 12:01:18 +02:00
parent 5be2607708
commit 185fccd7f8
3 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
management/server/http/handlers/peers/peers_handler.go
+20 -11
View File
@@ -519,20 +519,12 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
policy.Rules[0].AuthorizedUser = userAuth.UserId
}
if protocol == types.PolicyRuleProtocolNetbirdVNC {
if req.SessionPubKey == nil || *req.SessionPubKey == "" {
util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is required for VNC temporary access"), w)
return
}
pub, err := base64.StdEncoding.DecodeString(*req.SessionPubKey)
pubKey, err := validateVNCSessionPubKey(req.SessionPubKey)
if err != nil {
util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is not valid base64: %v", err), w)
util.WriteError(r.Context(), err, w)
return
}
if len(pub) != 32 {
util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key must decode to 32 bytes, got %d", len(pub)), w)
return
}
policy.Rules[0].SessionPubKey = *req.SessionPubKey
policy.Rules[0].SessionPubKey = pubKey
}
_, err = h.accountManager.SavePolicy(r.Context(), userAuth.AccountId, userAuth.UserId, policy, true)
@@ -552,6 +544,23 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
util.WriteJSONObject(r.Context(), w, resp)
}
// validateVNCSessionPubKey ensures the request carries a base64-encoded
// 32-byte X25519 public key for VNC temporary access. Returns the original
// base64 string on success.
func validateVNCSessionPubKey(raw *string) (string, error) {
if raw == nil || *raw == "" {
return "", status.Errorf(status.InvalidArgument, "session_pub_key is required for VNC temporary access")
}
pub, err := base64.StdEncoding.DecodeString(*raw)
if err != nil {
return "", status.Errorf(status.InvalidArgument, "session_pub_key is not valid base64: %v", err)
}
if len(pub) != 32 {
return "", status.Errorf(status.InvalidArgument, "session_pub_key must decode to 32 bytes, got %d", len(pub))
}
return *raw, nil
}
func toAccessiblePeers(netMap *types.NetworkMap, dnsDomain string) []api.AccessiblePeer {
accessiblePeers := make([]api.AccessiblePeer, 0, len(netMap.Peers)+len(netMap.OfflinePeers))
for _, p := range netMap.Peers {