sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-26 16:49:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Honour the MDM upload destination in the daemon

Browse Source 
The remote job and both mobile SDKs applied the debugBundleUploadURL policy;
the daemon did not. So `netbird debug bundle -U` and the desktop UI — the two
paths a person drives by hand, and the ones a policy exists to constrain —
ignored the pin and uploaded wherever the caller or the management server said.

Read the policy under the same lock that already reads the management URL, and
pass it to the resolver, which puts it ahead of the caller's URL.

Reported by @pappz in review on #7514.
This commit is contained in:
riccardom
2026-09-25 13:37:30 +02:00
parent b3ee6c9af2
commit 578acab52d
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/server/debug.go
+13 -7
View File
@@ -36,7 +36,7 @@ func (s *Server) DebugBundle(callerCtx context.Context, req *proto.DebugBundleRe
// socket that carries no identity, which skips the UI log.
callerID, callerIdentified := ipcauth.CallerIdentity(callerCtx)
path, managementURL, publishedUploadURL, err := s.generateDebugBundle(req, uiLogOpener(callerID, callerIdentified))
path, managementURL, publishedUploadURL, mdmUploadURL, err := s.generateDebugBundle(req, uiLogOpener(callerID, callerIdentified))
if err != nil {
return nil, err
}
@@ -49,7 +49,10 @@ func (s *Server) DebugBundle(callerCtx context.Context, req *proto.DebugBundleRe
// it is the operator of this deployment naming their own upload service, and
// the peer already trusts that server for its whole configuration. Only a
// URL the local caller named goes through requirePrivilegeForUploadURL above.
uploadURL := debug.ResolveUploadURL("", req.GetUploadURL(), publishedUploadURL)
if mdmUploadURL != "" && req.GetUploadURL() != "" && mdmUploadURL != req.GetUploadURL() {
log.Infof("using the MDM debug bundle upload URL instead of the one the caller named")
}
uploadURL := debug.ResolveUploadURL(mdmUploadURL, req.GetUploadURL(), publishedUploadURL)
// The upload runs without s.mutex held: it does network I/O to a possibly
// slow destination and must not block the other RPCs that take the lock. The
@@ -83,7 +86,7 @@ func redactUploadURL(raw string) string {
// the management URL and the upload service the management server publishes,
// both captured under the lock, so the caller can run the upload without
// holding the lock.
func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener debug.LogOpener) (path string, managementURL string, publishedUploadURL string, err error) {
func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener debug.LogOpener) (path string, managementURL string, publishedUploadURL string, mdmUploadURL string, err error) {
s.mutex.Lock()
defer s.mutex.Unlock()
@@ -152,14 +155,17 @@ func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener deb
path, err = bundleGenerator.Generate()
if err != nil {
return "", "", "", fmt.Errorf("generate debug bundle: %w", err)
return "", "", "", "", fmt.Errorf("generate debug bundle: %w", err)
}
if s.config != nil && s.config.ManagementURL != nil {
managementURL = s.config.ManagementURL.String()
if s.config != nil {
if s.config.ManagementURL != nil {
managementURL = s.config.ManagementURL.String()
}
mdmUploadURL = s.config.DebugBundleUploadURL
}
return path, managementURL, publishedUploadURL, nil
return path, managementURL, publishedUploadURL, mdmUploadURL, nil
}
// GetLogLevel gets the current logging level for the server.