sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-16 03:39:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Add local Prometheus metrics endpoint (#6689)

Browse Source
This commit is contained in:
Viktor Liu
2026-08-27 13:53:06 +02:00
committed by GitHub
parent e06c17cf59
commit 63c26be72f
26 changed files with 2265 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/server/ssh_gate_test.go
+98
View File
@@ -61,6 +61,8 @@ func noIdentityCtx() context.Context { return context.Background() }
func boolPtr(v bool) *bool { return &v }
func strPtr(v string) *string { return &v }
func mustURL(t *testing.T, raw string) *url.URL {
t.Helper()
u, err := url.Parse(raw)
@@ -194,6 +196,102 @@ func TestRequirePrivilegeForConfigChange_SSHFlags(t *testing.T) {
}
}
func TestRequirePrivilegeForConfigChange_LocalMetrics(t *testing.T) {
exposed := &profilemanager.Config{LocalMetricsEnabled: true, LocalMetricsAddress: "0.0.0.0:9191"}
tests := []struct {
name string
stored *profilemanager.Config
change privilegedConfigChange
privileged bool
wantDeny bool
}{
{
name: "binding a non-loopback address unprivileged is refused",
stored: &profilemanager.Config{},
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("0.0.0.0:9191")},
wantDeny: true,
},
{
name: "binding a non-loopback address as root is allowed",
stored: &profilemanager.Config{},
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("0.0.0.0:9191")},
privileged: true,
},
{
name: "enabling on the default loopback address is not guarded",
stored: &profilemanager.Config{},
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true)},
},
{
name: "enabling on an explicit loopback address is not guarded",
stored: &profilemanager.Config{},
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("127.0.0.1:9999")},
},
{
name: "enabling on the IPv6 loopback address is not guarded",
stored: &profilemanager.Config{},
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("[::1]:9191")},
},
{
// The address alone does nothing while the endpoint stays off.
name: "a non-loopback address without enabling is not guarded",
stored: &profilemanager.Config{},
change: privilegedConfigChange{localMetricsAddress: strPtr("0.0.0.0:9191")},
},
{
name: "widening an already enabled loopback endpoint is refused",
stored: &profilemanager.Config{LocalMetricsEnabled: true, LocalMetricsAddress: "127.0.0.1:9191"},
change: privilegedConfigChange{localMetricsAddress: strPtr("0.0.0.0:9191")},
wantDeny: true,
},
{
name: "restating an already exposed endpoint is not a change",
stored: exposed,
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("0.0.0.0:9191")},
},
{
name: "turning an exposed endpoint off is not guarded",
stored: exposed,
change: privilegedConfigChange{enableLocalMetrics: boolPtr(false)},
},
{
name: "re-enabling an exposed endpoint that was turned off is refused",
stored: &profilemanager.Config{LocalMetricsEnabled: false, LocalMetricsAddress: "0.0.0.0:9191"},
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true)},
wantDeny: true,
},
{
// Fail closed: an address that cannot be parsed is not confirmed loopback.
name: "an unparseable address is refused",
stored: &profilemanager.Config{},
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("not-an-address")},
wantDeny: true,
},
{
name: "a profile with no config yet counts as off, so exposing is refused",
stored: nil,
change: privilegedConfigChange{enableLocalMetrics: boolPtr(true), localMetricsAddress: strPtr("0.0.0.0:9191")},
wantDeny: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ctx := userCtx()
if tt.privileged {
ctx = rootCtx()
}
err := requirePrivilegeForConfigChange(ctx, tt.stored, tt.change)
if tt.wantDeny {
assertDenied(t, err)
return
}
assertAllowed(t, err)
})
}
}
func TestRequirePrivilegeForConfigChange_ManagementURL(t *testing.T) {
sshOn := func(raw string) *profilemanager.Config {
return &profilemanager.Config{ServerSSHAllowed: boolPtr(true), ManagementURL: mustURL(t, raw)}