sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-21 16:01:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Address follow-up CodeRabbit VNC findings

Browse Source
This commit is contained in:
Viktor Liu
2026-05-22 11:35:16 +02:00
parent 412193c602
commit 1cc5967198
3 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
client/vnc/server/server.go
View File

@@ -871,8 +871,8 @@ func (s *Server) readConnectionHeader(conn net.Conn) (*connectionHeader, error)
// public key learned from the handshake. Any handshake failure is fatal
// (fail closed).
func (s *Server) maybeRunNoiseHandshake(conn net.Conn, br *bufio.Reader) ([]byte, bool, error) {
peek, err := br.Peek(len(vncIdentityMagic))
if err != nil || !bytes.Equal(peek, vncIdentityMagic) {
peek, _ := br.Peek(len(vncIdentityMagic))
if !bytes.Equal(peek, vncIdentityMagic) {
return nil, false, nil
}
if _, err := br.Discard(len(vncIdentityMagic)); err != nil {

6
management/server/http/handlers/peers/peers_handler.go
View File

@@ -518,7 +518,11 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
if protocol == types.PolicyRuleProtocolNetbirdSSH || protocol == types.PolicyRuleProtocolNetbirdVNC {
policy.Rules[0].AuthorizedUser = userAuth.UserId
}
if protocol == types.PolicyRuleProtocolNetbirdVNC && req.SessionPubKey != nil {
if protocol == types.PolicyRuleProtocolNetbirdVNC {
if req.SessionPubKey == nil || *req.SessionPubKey == "" {
util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is required for VNC temporary access"), w)
return
}
pub, err := base64.StdEncoding.DecodeString(*req.SessionPubKey)
if err != nil {
util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is not valid base64: %v", err), w)

2
management/server/types/policy_authorized_users.go
View File

@@ -81,7 +81,7 @@ func (cb ruleAuthCallbacks) handleVNCRule(rule *PolicyRule, peerInSources, peerI
return
}
cb.collectVNCUsers(rule, state.vncAuthorizedUsers)
if rule.SessionPubKey != "" && rule.AuthorizedUser != "" {
if peerInDestinations && rule.SessionPubKey != "" && rule.AuthorizedUser != "" {
state.vncSessionPubKeys = append(state.vncSessionPubKeys, VNCSessionPubKey{
PubKey: rule.SessionPubKey,
UserID: rule.AuthorizedUser,