[management, reverse proxy] Add reverse proxy feature (#5291)

* implement reverse proxy


---------

Co-authored-by: Alisdair MacLeod <git@alisdairmacleod.co.uk>
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com>
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
Co-authored-by: Viktor Liu <viktor@netbird.io>
Co-authored-by: Diego Noguês <diego.sure@gmail.com>
Co-authored-by: Diego Noguês <49420+diegocn@users.noreply.github.com>
Co-authored-by: Bethuel Mmbaga <bethuelmbaga12@gmail.com>
Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com>
Co-authored-by: Ashley Mensah <ashleyamo982@gmail.com>

proxy/internal/accesslog/logger.go

@@ -0,0 +1,105 @@
+package accesslog
+
+import (
+	"context"
+	"net/netip"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+type gRPCClient interface {
+	SendAccessLog(ctx context.Context, in *proto.SendAccessLogRequest, opts ...grpc.CallOption) (*proto.SendAccessLogResponse, error)
+}
+
+// Logger sends access log entries to the management server via gRPC.
+type Logger struct {
+	client         gRPCClient
+	logger         *log.Logger
+	trustedProxies []netip.Prefix
+}
+
+// NewLogger creates a new access log Logger. The trustedProxies parameter
+// configures which upstream proxy IP ranges are trusted for extracting
+// the real client IP from X-Forwarded-For headers.
+func NewLogger(client gRPCClient, logger *log.Logger, trustedProxies []netip.Prefix) *Logger {
+	if logger == nil {
+		logger = log.StandardLogger()
+	}
+	return &Logger{
+		client:         client,
+		logger:         logger,
+		trustedProxies: trustedProxies,
+	}
+}
+
+type logEntry struct {
+	ID            string
+	AccountID     string
+	ServiceId     string
+	Host          string
+	Path          string
+	DurationMs    int64
+	Method        string
+	ResponseCode  int32
+	SourceIp      string
+	AuthMechanism string
+	UserId        string
+	AuthSuccess   bool
+}
+
+func (l *Logger) log(ctx context.Context, entry logEntry) {
+	// Fire off the log request in a separate routine.
+	// This increases the possibility of losing a log message
+	// (although it should still get logged in the event of an error),
+	// but it will reduce latency returning the request in the
+	// middleware.
+	// There is also a chance that log messages will arrive at
+	// the server out of order; however, the timestamp should
+	// allow for resolving that on the server.
+	now := timestamppb.Now() // Grab the timestamp before launching the goroutine to try to prevent weird timing issues. This is probably unnecessary.
+	go func() {
+		logCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		if entry.AuthMechanism != auth.MethodOIDC.String() {
+			entry.UserId = ""
+		}
+		if _, err := l.client.SendAccessLog(logCtx, &proto.SendAccessLogRequest{
+			Log: &proto.AccessLog{
+				LogId:         entry.ID,
+				AccountId:     entry.AccountID,
+				Timestamp:     now,
+				ServiceId:     entry.ServiceId,
+				Host:          entry.Host,
+				Path:          entry.Path,
+				DurationMs:    entry.DurationMs,
+				Method:        entry.Method,
+				ResponseCode:  entry.ResponseCode,
+				SourceIp:      entry.SourceIp,
+				AuthMechanism: entry.AuthMechanism,
+				UserId:        entry.UserId,
+				AuthSuccess:   entry.AuthSuccess,
+			},
+		}); err != nil {
+			// If it fails to send on the gRPC connection, then at least log it to the error log.
+			l.logger.WithFields(log.Fields{
+				"service_id":     entry.ServiceId,
+				"host":           entry.Host,
+				"path":           entry.Path,
+				"duration":       entry.DurationMs,
+				"method":         entry.Method,
+				"response_code":  entry.ResponseCode,
+				"source_ip":      entry.SourceIp,
+				"auth_mechanism": entry.AuthMechanism,
+				"user_id":        entry.UserId,
+				"auth_success":   entry.AuthSuccess,
+				"error":          err,
+			}).Error("Error sending access log on gRPC connection")
+		}
+	}()
+}

proxy/internal/accesslog/middleware.go

@@ -0,0 +1,74 @@
+package accesslog
+
+import (
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/rs/xid"
+
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/web"
+)
+
+func (l *Logger) Middleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Skip logging for internal proxy assets (CSS, JS, etc.)
+		if strings.HasPrefix(r.URL.Path, web.PathPrefix+"/") {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		// Generate request ID early so it can be used by error pages and log correlation.
+		requestID := xid.New().String()
+
+		l.logger.Debugf("request: request_id=%s method=%s host=%s path=%s", requestID, r.Method, r.Host, r.URL.Path)
+
+		// Use a response writer wrapper so we can access the status code later.
+		sw := &statusWriter{
+			w:      w,
+			status: http.StatusOK,
+		}
+
+		// Resolve the source IP using trusted proxy configuration before passing
+		// the request on, as the proxy will modify forwarding headers.
+		sourceIp := extractSourceIP(r, l.trustedProxies)
+
+		// Create a mutable struct to capture data from downstream handlers.
+		// We pass a pointer in the context - the pointer itself flows down immutably,
+		// but the struct it points to can be mutated by inner handlers.
+		capturedData := &proxy.CapturedData{RequestID: requestID}
+		capturedData.SetClientIP(sourceIp)
+		ctx := proxy.WithCapturedData(r.Context(), capturedData)
+
+		start := time.Now()
+		next.ServeHTTP(sw, r.WithContext(ctx))
+		duration := time.Since(start)
+
+		host, _, err := net.SplitHostPort(r.Host)
+		if err != nil {
+			// Fallback to just using the full host value.
+			host = r.Host
+		}
+
+		entry := logEntry{
+			ID:            requestID,
+			ServiceId:     capturedData.GetServiceId(),
+			AccountID:     string(capturedData.GetAccountId()),
+			Host:          host,
+			Path:          r.URL.Path,
+			DurationMs:    duration.Milliseconds(),
+			Method:        r.Method,
+			ResponseCode:  int32(sw.status),
+			SourceIp:      sourceIp,
+			AuthMechanism: capturedData.GetAuthMethod(),
+			UserId:        capturedData.GetUserID(),
+			AuthSuccess:   sw.status != http.StatusUnauthorized && sw.status != http.StatusForbidden,
+		}
+		l.logger.Debugf("response: request_id=%s method=%s host=%s path=%s status=%d duration=%dms source=%s origin=%s service=%s account=%s",
+			requestID, r.Method, host, r.URL.Path, sw.status, duration.Milliseconds(), sourceIp, capturedData.GetOrigin(), capturedData.GetServiceId(), capturedData.GetAccountId())
+
+		l.log(r.Context(), entry)
+	})
+}

proxy/internal/accesslog/requestip.go

@@ -0,0 +1,16 @@
+package accesslog
+
+import (
+	"net/http"
+	"net/netip"
+
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+)
+
+// extractSourceIP resolves the real client IP from the request using trusted
+// proxy configuration. When trustedProxies is non-empty and the direct
+// connection is from a trusted source, it walks X-Forwarded-For right-to-left
+// skipping trusted IPs. Otherwise it returns RemoteAddr directly.
+func extractSourceIP(r *http.Request, trustedProxies []netip.Prefix) string {
+	return proxy.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For"), trustedProxies)
+}

proxy/internal/accesslog/statuswriter.go

@@ -0,0 +1,26 @@
+package accesslog
+
+import (
+	"net/http"
+)
+
+// statusWriter is a simple wrapper around an http.ResponseWriter
+// that captures the setting of the status code via the WriteHeader
+// function and stores it so that it can be retrieved later.
+type statusWriter struct {
+	w      http.ResponseWriter
+	status int
+}
+
+func (w *statusWriter) Header() http.Header {
+	return w.w.Header()
+}
+
+func (w *statusWriter) Write(data []byte) (int, error) {
+	return w.w.Write(data)
+}
+
+func (w *statusWriter) WriteHeader(status int) {
+	w.status = status
+	w.w.WriteHeader(status)
+}