sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-13 08:59:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Add nblink, an unprivileged forwarder into the network (#7955)

Browse Source 
Reaching an internal service meant installing the agent, which needs root
for a TUN device. nblink runs the embedded client in netstack mode and
forwards local HTTP listeners to upstreams inside the tunnel, so it works on
managed machines and in rootless containers. Upstream names resolve
in-process.

Forwards bind loopback unless --allow-public-bind is given. The listener
refuses rebound and cross-site browser requests and bounds stalled request
bodies. It ships as release archives and a distroless image that runs under
an arbitrary UID.

An embedded client given no StatePath now keeps its state in memory rather
than falling back to the installed agent's state file, which every embedded
client in a proxy process also shared. The state manager gets an explicit
in-memory store for it.
This commit is contained in:
Maycon Santos
2026-10-12 13:54:15 +02:00
committed by GitHub
parent fe7841721a
commit 66a28fd666
28 changed files with 4891 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/grpc/dialer_generic.go
+8 -16
View File
@@ -6,12 +6,9 @@ import (
"context"
"fmt"
"net"
"os/user"
"os"
"runtime"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
log "github.com/sirupsen/logrus"
"google.golang.org/grpc"
@@ -45,18 +42,13 @@ func WithSweeper(sweeper Sweeper) grpc.DialOption {
}
func dialContext(ctx context.Context, addr string) (net.Conn, error) {
if runtime.GOOS == "linux" {
currentUser, err := user.Current()
if err != nil {
return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
}
// the custom dialer requires root permissions which are not required for use cases run as non-root
if currentUser.Uid != "0" {
log.Debug("Not running as root, using standard dialer")
dialer := &net.Dialer{}
return dialer.DialContext(ctx, "tcp", addr)
}
// The custom dialer requires root permissions which are not required for
// use cases run as non-root. The effective UID is read directly: a passwd
// lookup fails without cgo for a UID that has no entry, as on OpenShift.
if runtime.GOOS == "linux" && os.Geteuid() != 0 {
log.Debug("Not running as root, using standard dialer")
dialer := &net.Dialer{}
return dialer.DialContext(ctx, "tcp", addr)
}
conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)