sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-27 06:49:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

Address follow-up CodeRabbit VNC findings

Browse Source
This commit is contained in:
Viktor Liu
2026-05-22 11:35:16 +02:00
parent d06ed64e59
commit 5be2607708
3 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/vnc/server/server.go
+2 -2
View File
@@ -871,8 +871,8 @@ func (s *Server) readConnectionHeader(conn net.Conn) (*connectionHeader, error)
// public key learned from the handshake. Any handshake failure is fatal // public key learned from the handshake. Any handshake failure is fatal
// (fail closed). // (fail closed).
func (s *Server) maybeRunNoiseHandshake(conn net.Conn, br *bufio.Reader) ([]byte, bool, error) { func (s *Server) maybeRunNoiseHandshake(conn net.Conn, br *bufio.Reader) ([]byte, bool, error) {
peek, err := br.Peek(len(vncIdentityMagic)) peek, _ := br.Peek(len(vncIdentityMagic))
if err != nil || !bytes.Equal(peek, vncIdentityMagic) { if !bytes.Equal(peek, vncIdentityMagic) {
return nil, false, nil return nil, false, nil
} }
if _, err := br.Discard(len(vncIdentityMagic)); err != nil { if _, err := br.Discard(len(vncIdentityMagic)); err != nil {
management/server/http/handlers/peers/peers_handler.go
+5 -1
View File
@@ -518,7 +518,11 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
if protocol == types.PolicyRuleProtocolNetbirdSSH || protocol == types.PolicyRuleProtocolNetbirdVNC { if protocol == types.PolicyRuleProtocolNetbirdSSH || protocol == types.PolicyRuleProtocolNetbirdVNC {
policy.Rules[0].AuthorizedUser = userAuth.UserId policy.Rules[0].AuthorizedUser = userAuth.UserId
} }
if protocol == types.PolicyRuleProtocolNetbirdVNC && req.SessionPubKey != nil { if protocol == types.PolicyRuleProtocolNetbirdVNC {
if req.SessionPubKey == nil || *req.SessionPubKey == "" {
util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is required for VNC temporary access"), w)
return
}
pub, err := base64.StdEncoding.DecodeString(*req.SessionPubKey) pub, err := base64.StdEncoding.DecodeString(*req.SessionPubKey)
if err != nil { if err != nil {
util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is not valid base64: %v", err), w) util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is not valid base64: %v", err), w)
management/server/types/policy_authorized_users.go
+1 -1
View File
@@ -81,7 +81,7 @@ func (cb ruleAuthCallbacks) handleVNCRule(rule *PolicyRule, peerInSources, peerI
return return
} }
cb.collectVNCUsers(rule, state.vncAuthorizedUsers) cb.collectVNCUsers(rule, state.vncAuthorizedUsers)
if rule.SessionPubKey != "" && rule.AuthorizedUser != "" { if peerInDestinations && rule.SessionPubKey != "" && rule.AuthorizedUser != "" {
state.vncSessionPubKeys = append(state.vncSessionPubKeys, VNCSessionPubKey{ state.vncSessionPubKeys = append(state.vncSessionPubKeys, VNCSessionPubKey{
PubKey: rule.SessionPubKey, PubKey: rule.SessionPubKey,
UserID: rule.AuthorizedUser, UserID: rule.AuthorizedUser,