sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-08 14:39:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Accept named-pipe agent connections, carry the remote peer through the agent handshake, and treat pipe disconnects as probes

Browse Source
This commit is contained in:
Viktor Liu
2026-09-23 14:03:59 +02:00
parent b9264d2824
commit c26b17653a
10 changed files with 245 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/vnc/server/server.go
+19 -5
View File
@@ -1065,9 +1065,9 @@ func (s *Server) validateCapturer(capturer ScreenCapturer) error {
// and from the local WireGuard IP (prevents local privilege escalation).
// Matches the SSH server's connectionValidator logic.
func (s *Server) isAllowedSource(addr net.Addr) bool {
// Unix-socket remotes (the agent path) are local IPC, gated by the
// token, not by overlay membership.
if _, ok := addr.(*net.UnixAddr); ok {
// Unix-socket and named-pipe remotes (the agent path) are local IPC,
// gated by the token, not by overlay membership.
if isLocalIPCAddr(addr) {
return true
}
tcpAddr, ok := addr.(*net.TCPAddr)
@@ -1115,7 +1115,7 @@ func (s *Server) handleConnection(conn net.Conn) {
_ = conn.Close()
return
}
ok, agentViewOnly := s.verifyAgentToken(conn, connLog)
ok, grant := s.verifyAgentToken(conn, connLog)
if !ok {
// Reported there already, at a level that tells a liveness probe apart
// from a bad token. The daemon dials the agent socket to wait for it to
@@ -1124,6 +1124,10 @@ func (s *Server) handleConnection(conn net.Conn) {
connLog.Debug("VNC connection rejected: agent token check failed")
return
}
// Behind the daemon the accepted address is only the local socket; the
// remote peer is the one the daemon vouched for in the grant.
conn = withGrantPeer(conn, grant)
connLog = s.log.WithField("remote", conn.RemoteAddr().String())
header, err := s.readConnectionHeader(conn)
if err != nil {
connLog.Infof("VNC connection rejected: header read failed: %v", err)
@@ -1205,7 +1209,7 @@ func (s *Server) handleConnection(conn net.Conn) {
serverW: w,
serverH: h,
log: connLog,
viewOnly: decision.ViewOnly || agentViewOnly,
viewOnly: decision.ViewOnly || grant.viewOnly,
}
sess.serve()
connLog.Infof("VNC connection closed (%dms)", time.Since(start).Milliseconds())
@@ -1366,3 +1370,13 @@ func acceptRetryable(err error) bool {
return errors.Is(err, errno)
})
}
// isLocalIPCAddr reports whether addr belongs to a local IPC transport: a
// Unix-domain socket, or a Windows named pipe (go-winio names its network
// "pipe").
func isLocalIPCAddr(addr net.Addr) bool {
if _, ok := addr.(*net.UnixAddr); ok {
return true
}
return addr != nil && addr.Network() == "pipe"
}