sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-31 20:11:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

Replace VNC JWT auth with a Noise_IK handshake bound to ACL-pushed pubkeys

Browse Source
This commit is contained in:
Viktor Liu
2026-05-21 16:49:47 +02:00
parent 2f4ddf0796
commit 3d3055dc7f
36 changed files with 2014 additions and 1118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
client/cmd/vnc_agent.go
View File

@@ -39,12 +39,22 @@ var vncAgentCmd = &cobra.Command{
if token == "" {
return fmt.Errorf("NB_VNC_AGENT_TOKEN not set; agent requires a token from the service")
}
// Drop the token from our process environment so any child the
// agent spawns does not inherit it, and casual debugging tools
// that dump /proc/<pid>/environ (or the Windows equivalent) on a
// running agent don't surface the loopback shared secret.
if err := os.Unsetenv("NB_VNC_AGENT_TOKEN"); err != nil {
log.Debugf("unset NB_VNC_AGENT_TOKEN: %v", err)
}
capturer, injector, err := newAgentResources()
if err != nil {
return err
}
srv := vncserver.New(capturer, injector)
// The per-user agent listens only on loopback and is gated by an
// agent token shared with the daemon, so no X25519 identity key
// is needed; auth is disabled at the RFB layer.
srv := vncserver.New(capturer, injector, nil)
srv.SetDisableAuth(true)
srv.SetAgentToken(token)