sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-04-16 07:16:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into refactor/permissions-manager

Browse Source
This commit is contained in:
pascal
2026-03-06 17:06:18 +01:00
parent b0ce0048b4 e6587b071d
commit da4a0eb68a
3 changed files with 4 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
management/internals/shared/grpc/proxy.go
View File

@@ -18,7 +18,6 @@ import (
log "github.com/sirupsen/logrus" log "github.com/sirupsen/logrus"
"golang.org/x/oauth2" "golang.org/x/oauth2"
"google.golang.org/grpc/codes" "google.golang.org/grpc/codes"
"google.golang.org/grpc/peer"
"google.golang.org/grpc/status" "google.golang.org/grpc/status"
"github.com/netbirdio/netbird/shared/management/domain" "github.com/netbirdio/netbird/shared/management/domain"
@@ -177,11 +176,7 @@ func (s *ProxyServiceServer) SetProxyController(proxyController proxy.Controller
func (s *ProxyServiceServer) GetMappingUpdate(req *proto.GetMappingUpdateRequest, stream proto.ProxyService_GetMappingUpdateServer) error { func (s *ProxyServiceServer) GetMappingUpdate(req *proto.GetMappingUpdateRequest, stream proto.ProxyService_GetMappingUpdateServer) error {
ctx := stream.Context() ctx := stream.Context()
peerInfo := "" peerInfo := PeerIPFromContext(ctx)
if p, ok := peer.FromContext(ctx); ok {
peerInfo = p.Addr.String()
}
log.Infof("New proxy connection from %s", peerInfo) log.Infof("New proxy connection from %s", peerInfo)
proxyID := req.GetProxyId() proxyID := req.GetProxyId()

2
management/internals/shared/grpc/proxy_auth.go
View File

@@ -107,7 +107,7 @@ func NewProxyAuthInterceptors(tokenStore proxyTokenStore) (grpc.UnaryServerInter
} }
func (i *proxyAuthInterceptor) validateProxyToken(ctx context.Context) (*types.ProxyAccessToken, error) { func (i *proxyAuthInterceptor) validateProxyToken(ctx context.Context) (*types.ProxyAccessToken, error) {
clientIP := peerIPFromContext(ctx) clientIP := PeerIPFromContext(ctx)
if clientIP != "" && i.failureLimiter.isLimited(clientIP) { if clientIP != "" && i.failureLimiter.isLimited(clientIP) {
return nil, status.Errorf(codes.ResourceExhausted, "too many failed authentication attempts") return nil, status.Errorf(codes.ResourceExhausted, "too many failed authentication attempts")

4
management/internals/shared/grpc/proxy_auth_ratelimit.go
View File

@@ -115,9 +115,9 @@ func (l *authFailureLimiter) stop() {
l.cancel() l.cancel()
} }
// peerIPFromContext extracts the client IP from the gRPC context. // PeerIPFromContext extracts the client IP from the gRPC context.
// Uses realip (from trusted proxy headers) first, falls back to the transport peer address. // Uses realip (from trusted proxy headers) first, falls back to the transport peer address.
func peerIPFromContext(ctx context.Context) clientIP { func PeerIPFromContext(ctx context.Context) string {
if addr, ok := realip.FromContext(ctx); ok { if addr, ok := realip.FromContext(ctx); ok {
return addr.String() return addr.String()
} }