sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-13 17:09:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[management] Configure per-target HTTP access actions (#8116)

Browse Source 
Let HTTP targets inherit service authentication, bypass it, or block access. Validate and persist the action, expose it through the API, and deliver it to the proxy. Private services reject bypass.

Validation: service/manager, store, and management-to-proxy integration race tests passed; scoped lint passed.
This commit is contained in:
Maycon Santos
2026-10-12 12:56:17 +02:00
committed by GitHub
parent 1161616c02
commit cd22a9d4f1
10 changed files with 1111 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
management/server/store/sql_store_service_target.go
+8 -1
View File
@@ -18,7 +18,7 @@ import (
)
const targetSelectColumns = `id, account_id, service_id, path, host, port, protocol,
target_id, target_type, enabled, proxy_protocol,
target_id, target_type, enabled, access_action, proxy_protocol,
skip_tls_verify, request_timeout, session_idle_timeout, path_rewrite, custom_headers,
direct_upstream, middlewares, capture_max_request_bytes, capture_max_response_bytes,
capture_content_types, agent_network, disable_access_log`
@@ -37,6 +37,7 @@ func (s *SqlStore) getServiceTargets(ctx context.Context, serviceIDs []string) (
func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
var t rpservice.Target
var path sql.NullString
var accessAction sql.NullString
var pathRewrite sql.NullString
var proxyProtocol, skipTLSVerify, directUpstream, agentNetwork, disableAccessLog sql.NullBool
var requestTimeout, sessionIdleTimeout, captureMaxRequestBytes, captureMaxResponseBytes sql.NullInt64
@@ -52,6 +53,7 @@ func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
&t.TargetId,
&t.TargetType,
&t.Enabled,
&accessAction,
&proxyProtocol,
&skipTLSVerify,
&requestTimeout,
@@ -72,6 +74,11 @@ func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
if path.Valid {
t.Path = &path.String
}
if accessAction.Valid && accessAction.String != "" {
t.AccessAction = rpservice.TargetAccessAction(accessAction.String)
} else {
t.AccessAction = rpservice.TargetAccessActionInherit
}
t.ProxyProtocol = proxyProtocol.Bool
t.Options.SkipTLSVerify = skipTLSVerify.Bool
management/server/store/sql_store_service_test.go
+2
View File
@@ -87,6 +87,7 @@ func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
Protocol: "http",
TargetId: "tgt-1",
Enabled: true,
AccessAction: rpservice.TargetAccessActionBlock,
ProxyProtocol: true,
Options: rpservice.TargetOptions{
SkipTLSVerify: true,
@@ -119,6 +120,7 @@ func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
require.Len(t, got.Targets, 1)
tg := got.Targets[0]
assert.Equal(t, rpservice.TargetAccessActionBlock, tg.AccessAction, "target access action")
assert.True(t, tg.ProxyProtocol, "target proxy protocol")
assert.True(t, tg.Options.SkipTLSVerify, "options skip TLS verify")
assert.Equal(t, 30*time.Second, tg.Options.RequestTimeout, "options request timeout")