WIP: acl interceptor and named pipe ui

client/cmd/service_json_gateway.go

@@ -14,16 +14,45 @@ import (
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
 
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
+// jsonPeerCtxKey keys the HTTP client's kernel identity in the request context.
+type jsonPeerCtxKey struct{}
+
+// jsonConnContext reads the connecting HTTP client's identity from the JSON
+// socket (peercred) and stashes it so it can be forwarded to the daemon. The
+// gateway re-dials the daemon as the daemon's own identity, so without this the
+// daemon would see every JSON request as privileged.
+func jsonConnContext(ctx context.Context, c net.Conn) context.Context {
+	id, err := ipcauth.PeerIdentity(c)
+	if err != nil {
+		log.Debugf("json gateway: cannot read HTTP client identity, requests won't carry it: %v", err)
+		return ctx
+	}
+	return context.WithValue(ctx, jsonPeerCtxKey{}, id)
+}
+
+// jsonForwardIdentity injects the stashed HTTP client identity as gRPC metadata
+// on the gateway's re-dial to the daemon. The daemon trusts it only because the
+// dial arrives as the daemon's own (self/privileged) identity.
+func jsonForwardIdentity(ctx context.Context, _ *http.Request) metadata.MD {
+	id, ok := ctx.Value(jsonPeerCtxKey{}).(ipcauth.Identity)
+	if !ok {
+		return nil
+	}
+	return ipcauth.ForwardIdentityMetadata(id)
+}
+
 func grpcGatewayEndpoint(addr string) string {
 	return strings.TrimPrefix(addr, "tcp://")
 }
 
 func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint string) error {
-	mux := runtime.NewServeMux()
+	mux := runtime.NewServeMux(runtime.WithMetadata(jsonForwardIdentity))
 	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
 	if err := proto.RegisterDaemonServiceHandlerFromEndpoint(p.ctx, mux, grpcGatewayEndpoint(daemonEndpoint), opts); err != nil {
 		return err
@@ -35,6 +64,7 @@ func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint
 		BaseContext: func(net.Listener) context.Context {
 			return p.ctx
 		},
+		ConnContext: jsonConnContext,
 	}
 
 	p.jsonServMu.Lock()