mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-20 05:39:07 +02:00
[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)
Adds a new "private" service mode for the reverse proxy: services reachable exclusively over the embedded WireGuard tunnel, gated by per-peer group membership instead of operator auth schemes. Wire contract - ProxyMapping.private (field 13): the proxy MUST call ValidateTunnelPeer and fail closed; operator schemes are bypassed. - ProxyCapabilities.private (4) + supports_private_service (5): capability gate. Management never streams private mappings to proxies that don't claim the capability; the broadcast path applies the same filter via filterMappingsForProxy. - ValidateTunnelPeer RPC: resolves an inbound tunnel IP to a peer, checks the peer's groups against service.AccessGroups, and mints a session JWT on success. checkPeerGroupAccess fails closed when a private service has empty AccessGroups. - ValidateSession/ValidateTunnelPeer responses now carry peer_group_ids + peer_group_names so the proxy can authorise policy-aware middlewares without an extra management round-trip. - ProxyInboundListener + SendStatusUpdate.inbound_listener: per-account inbound listener state surfaced to dashboards. - PathTargetOptions.direct_upstream (11): bypass the embedded NetBird client and dial the target via the proxy host's network stack for upstreams reachable without WireGuard. Data model - Service.Private (bool) + Service.AccessGroups ([]string, JSON- serialised). Validate() rejects bearer auth on private services. Copy() deep-copies AccessGroups. pgx getServices loads the columns. - DomainConfig.Private threaded into the proxy auth middleware. Request handler routes private services through forwardWithTunnelPeer and returns 403 on validation failure. - Account-level SynthesizePrivateServiceZones (synthetic DNS) and injectPrivateServicePolicies (synthetic ACL) gate on len(svc.AccessGroups) > 0. Proxy - /netbird proxy --private (embedded mode) flag; Config.Private in proxy/lifecycle.go. - Per-account inbound listener (proxy/inbound.go) binding HTTP/HTTPS on the embedded NetBird client's WireGuard tunnel netstack. - proxy/internal/auth/tunnel_cache: ValidateTunnelPeer response cache with single-flight de-duplication and per-account eviction. - Local peerstore short-circuit: when the inbound IP isn't in the account roster, deny fast without an RPC. - proxy/server.go reports SupportsPrivateService=true and redacts the full ProxyMapping JSON from info logs (auth_token + header-auth hashed values now only at debug level). Identity forwarding - ValidateSessionJWT returns user_id, email, method, groups, group_names. sessionkey.Claims carries Email + Groups + GroupNames so the proxy can stamp identity onto upstream requests without an extra management round-trip on every cookie-bearing request. - CapturedData carries userEmail / userGroups / userGroupNames; the proxy stamps X-NetBird-User and X-NetBird-Groups on r.Out from the authenticated identity (strips client-supplied values first to prevent spoofing). - AccessLog.UserGroups: access-log enrichment captures the user's group memberships at write time so the dashboard can render group context without reverse-resolving stale memberships. OpenAPI/dashboard surface - ReverseProxyService gains private + access_groups; ReverseProxyCluster gains private + supports_private. ReverseProxyTarget target_type enum gains "cluster". ServiceTargetOptions gains direct_upstream. ProxyAccessLog gains user_groups.
This commit is contained in:
Maycon Santos
@@ -1067,3 +1067,245 @@ func TestClassifyProxyError(t *testing.T) {
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestStampNetBirdIdentity_NoCapturedData_StripsOnly(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
pr.In.Header.Set(headerNetBirdUser, "spoofed@evil.io")
|
||||
pr.In.Header.Set(headerNetBirdGroups, "admin")
|
||||
pr.Out.Header = pr.In.Header.Clone()
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Empty(t, pr.Out.Header.Get(headerNetBirdUser),
|
||||
"client-supplied X-NetBird-User must be stripped when no captured identity is present")
|
||||
assert.Empty(t, pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"client-supplied X-NetBird-Groups must be stripped when no captured identity is present")
|
||||
}
|
||||
|
||||
func TestStampNetBirdIdentity_StampsFromCapturedData(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
pr.In.Header.Set(headerNetBirdUser, "spoofed@evil.io")
|
||||
pr.Out.Header = pr.In.Header.Clone()
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
cd.SetUserEmail("alice@netbird.io")
|
||||
cd.SetUserGroups([]string{"grp-eng", "grp-ops"})
|
||||
cd.SetUserGroupNames([]string{"engineering", "operations"})
|
||||
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Equal(t, "alice@netbird.io", pr.Out.Header.Get(headerNetBirdUser),
|
||||
"captured email must overwrite any spoofed value")
|
||||
assert.Equal(t, "engineering,operations", pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"group display names must be CSV-joined in positional order")
|
||||
}
|
||||
|
||||
// TestStampNetBirdIdentity_GroupsOnlyWhenEmailEmpty covers the
|
||||
// tunnel-peer-without-user case (machine agents, unattached proxy peers).
|
||||
// The proxy must still stamp the peer's groups so downstream services can
|
||||
// authorise, but X-NetBird-User stays unset — only its inbound stripping
|
||||
// must happen.
|
||||
func TestStampNetBirdIdentity_GroupsOnlyWhenEmailEmpty(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
pr.In.Header.Set(headerNetBirdUser, "spoofed@evil.io")
|
||||
pr.Out.Header = pr.In.Header.Clone()
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
cd.SetUserGroups([]string{"grp-machines"})
|
||||
cd.SetUserGroupNames([]string{"machines"})
|
||||
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Empty(t, pr.Out.Header.Get(headerNetBirdUser),
|
||||
"X-NetBird-User must remain unset when CapturedData carries no email")
|
||||
assert.Equal(t, "machines", pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"groups must still be stamped for peers without a user identity")
|
||||
}
|
||||
|
||||
// TestStampNetBirdIdentity_EmailOnlyWhenGroupsEmpty covers the symmetric
|
||||
// case: identity-resolved user without resolved group memberships.
|
||||
func TestStampNetBirdIdentity_EmailOnlyWhenGroupsEmpty(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
pr.In.Header.Set(headerNetBirdGroups, "spoofed-admin")
|
||||
pr.Out.Header = pr.In.Header.Clone()
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
cd.SetUserEmail("carol@netbird.io")
|
||||
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Equal(t, "carol@netbird.io", pr.Out.Header.Get(headerNetBirdUser),
|
||||
"email must be stamped even when no groups are captured")
|
||||
assert.Empty(t, pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"X-NetBird-Groups must remain unset when CapturedData carries no groups")
|
||||
}
|
||||
|
||||
func TestStampNetBirdIdentity_FallsBackToGroupIDsWhenNameMissing(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
cd.SetUserEmail("bob@netbird.io")
|
||||
cd.SetUserGroups([]string{"grp-a", "grp-b", "grp-c"})
|
||||
// "grp-b" gets an explicit empty-string display name (not just a
|
||||
// shorter slice). Both gap shapes must fall back to the id.
|
||||
cd.SetUserGroupNames([]string{"alpha", "", ""})
|
||||
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Equal(t, "alpha,grp-b,grp-c", pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"empty-string and out-of-range name slots must both fall back to the group id")
|
||||
}
|
||||
|
||||
// TestStampNetBirdIdentity_DropsLabelsWithComma covers the
|
||||
// comma-separator constraint: a group display name that itself contains
|
||||
// a comma is dropped from the header (rather than corrupting the list),
|
||||
// and the remaining labels are stamped.
|
||||
func TestStampNetBirdIdentity_DropsLabelsWithComma(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
cd.SetUserEmail("alice@netbird.io")
|
||||
cd.SetUserGroups([]string{"grp-a", "grp-b", "grp-c"})
|
||||
cd.SetUserGroupNames([]string{"engineering", "EU, EMEA", "operations"})
|
||||
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Equal(t, "engineering,operations", pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"group label with embedded comma must be dropped, remaining labels stamped")
|
||||
}
|
||||
|
||||
// TestStampNetBirdIdentity_RejectsControlCharsInEmail covers the
|
||||
// header-injection defence: an email value containing CR/LF/control
|
||||
// chars is omitted entirely (not partially stamped) so the upstream
|
||||
// request stays well-formed and no header injection is possible.
|
||||
func TestStampNetBirdIdentity_RejectsControlCharsInEmail(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
pr.In.Header.Set(headerNetBirdUser, "spoofed@evil.io")
|
||||
pr.Out.Header = pr.In.Header.Clone()
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
cd.SetUserEmail("alice@netbird.io\r\nX-Admin: yes")
|
||||
cd.SetUserGroups([]string{"grp-a"})
|
||||
cd.SetUserGroupNames([]string{"engineering"})
|
||||
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Empty(t, pr.Out.Header.Get(headerNetBirdUser),
|
||||
"email with CR/LF must be dropped, not partially stamped")
|
||||
assert.Equal(t, "engineering", pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"groups remain stampable even when email is invalid")
|
||||
}
|
||||
|
||||
// TestStampNetBirdIdentity_RejectsControlCharsInGroup covers the
|
||||
// per-label defence: a group name with a control char is silently
|
||||
// dropped, the rest are stamped.
|
||||
func TestStampNetBirdIdentity_RejectsControlCharsInGroup(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
cd.SetUserEmail("alice@netbird.io")
|
||||
cd.SetUserGroups([]string{"grp-a", "grp-b"})
|
||||
cd.SetUserGroupNames([]string{"engineering\r\nsneaky", "operations"})
|
||||
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Equal(t, "operations", pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"group label with control char must be dropped, valid ones kept")
|
||||
}
|
||||
|
||||
// TestStampNetBirdIdentity_OmitsGroupsHeaderWhenAllInvalid covers the
|
||||
// edge case where every group label is rejected: the header must not be
|
||||
// set at all (rather than set to an empty string).
|
||||
func TestStampNetBirdIdentity_OmitsGroupsHeaderWhenAllInvalid(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
pr.In.Header.Set(headerNetBirdGroups, "spoofed-admin")
|
||||
pr.Out.Header = pr.In.Header.Clone()
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
cd.SetUserEmail("alice@netbird.io")
|
||||
cd.SetUserGroups([]string{"grp-a", "grp-b"})
|
||||
cd.SetUserGroupNames([]string{"with,comma", "with\nbreak"})
|
||||
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
_, present := pr.Out.Header[http.CanonicalHeaderKey(headerNetBirdGroups)]
|
||||
assert.False(t, present,
|
||||
"X-NetBird-Groups must not be set when every group label is rejected")
|
||||
}
|
||||
|
||||
// TestStampNetBirdIdentity_CapturedDataPresentButEmpty covers requests
|
||||
// that carry CapturedData with no identity fields populated (e.g. the
|
||||
// auth middleware ran but the request didn't authenticate). Both
|
||||
// headers must be cleared and neither stamped.
|
||||
func TestStampNetBirdIdentity_CapturedDataPresentButEmpty(t *testing.T) {
|
||||
target, _ := url.Parse("http://backend.internal:8080")
|
||||
p := &ReverseProxy{forwardedProto: "auto"}
|
||||
rewrite := p.rewriteFunc(target, "", false, PathRewriteDefault, nil, nil)
|
||||
|
||||
pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
|
||||
pr.In.Header.Set(headerNetBirdUser, "spoofed@evil.io")
|
||||
pr.In.Header.Set(headerNetBirdGroups, "spoofed-admin")
|
||||
pr.Out.Header = pr.In.Header.Clone()
|
||||
|
||||
cd := NewCapturedData("req-1")
|
||||
pr.In = pr.In.WithContext(WithCapturedData(pr.In.Context(), cd))
|
||||
|
||||
rewrite(pr)
|
||||
|
||||
assert.Empty(t, pr.Out.Header.Get(headerNetBirdUser),
|
||||
"X-NetBird-User must be stripped when CapturedData has no email")
|
||||
assert.Empty(t, pr.Out.Header.Get(headerNetBirdGroups),
|
||||
"X-NetBird-Groups must be stripped when CapturedData has no groups")
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user