Viktor Liu
88b420da6d
Remove linux restriction
2025-01-03 00:23:35 +01:00
Viktor Liu
2930288f2d
Fix test expectation
2025-01-03 00:22:09 +01:00
Viktor Liu
0b9854b2b1
Fix tests
2025-01-03 00:01:40 +01:00
Viktor Liu
f772a21f37
Fix log level handling
2025-01-02 19:02:40 +01:00
Viktor Liu
e912f2d7c0
Fix double close in logger
2025-01-02 19:02:40 +01:00
Viktor Liu
568d064089
Drop certain forwarded icmp packets
2025-01-02 19:02:40 +01:00
Viktor Liu
911f86ded8
Support local IPs in netstack mode
2025-01-02 19:02:40 +01:00
Viktor Liu
2b8092dfad
Close endpoints
2025-01-02 16:41:54 +01:00
Viktor Liu
c3c6afa37b
Merge branch 'main' into userspace-router
2025-01-02 16:25:04 +01:00
Viktor Liu
fa27369b59
Fix linter issues
2025-01-02 16:21:03 +01:00
Viktor Liu
657413b8a6
Move icmp acceptance logic
2025-01-02 15:59:53 +01:00
Viktor Liu
d85e57e819
Handle other icmp types in forwarder
2025-01-02 15:59:53 +01:00
Viktor Liu
7667886794
Add more tcp logging
2025-01-02 15:17:53 +01:00
Viktor Liu
a12a9ac290
Handle all local IPs
2025-01-02 14:59:41 +01:00
Pascal Fischer
782e3f8853
[management] Add integration test for the setup-keys API endpoints ( #2936 )
2025-01-02 13:51:01 +01:00
Viktor Liu
ed22d79f04
Add more control with env vars, also allow to pass traffic to native firewall
2025-01-02 13:40:36 +01:00
Maycon Santos
03fd656344
[management] Fix policy tests ( #3135 )
...
- Add firewall rule isEqual method
- Fix tests
2024-12-31 18:45:40 +01:00
Pascal Fischer
18b049cd24
[management] remove sorting from network map generation ( #3126 )
2024-12-31 18:10:40 +01:00
Bethuel Mmbaga
2bdb4cb44a
[management] Preserve jwt groups when accessing API with PAT ( #3128 )
...
* Skip JWT group sync for token-based authentication
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
2024-12-31 18:59:37 +03:00
Viktor Liu
509b4e2132
Lower udp timeout and add teardown messages
2024-12-31 16:06:17 +01:00
Viktor Liu
fb1a10755a
Fix lint and test issues
2024-12-31 14:38:59 +01:00
Viktor Liu
abbdf20f65
[client] Allow inbound rosenpass port ( #3109 )
2024-12-31 14:08:48 +01:00
Viktor Liu
43ef64cf67
[client] Ignore case when matching domains in handler chain ( #3133 )
2024-12-31 14:07:21 +01:00
Viktor Liu
9feaa8d767
Add icmp forwarder
2024-12-31 12:23:16 +01:00
Viktor Liu
6a97d44d5d
Improve udp implementation
2024-12-31 00:34:05 +01:00
Viktor Liu
d2616544fe
Add logger
2024-12-31 00:34:05 +01:00
Viktor Liu
fad82ee65c
Add stop methods and improve udp implementation
2024-12-30 14:30:53 +01:00
Viktor Liu
b43a8c56df
Update wireguard-go ref
2024-12-30 13:05:26 +01:00
Pascal Fischer
18316be09a
[management] add selfhosted metrics for networks ( #3118 )
2024-12-30 12:53:51 +01:00
Maycon Santos
1a623943c8
[management] Fix networks net map generation with posture checks ( #3124 )
2024-12-30 12:40:24 +01:00
Viktor Liu
4199da4a45
Add userspace routing
2024-12-30 01:38:28 +01:00
Pascal Fischer
fbce8bb511
[management] remove ids from policy creation api ( #2997 )
2024-12-27 14:13:36 +01:00
Bethuel Mmbaga
445b626dc8
[management] Add missing group usage checks for network resources and routes access control ( #3117 )
...
* Prevent deletion of groups linked to routes access control groups
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Prevent deletion of groups linked to network resource
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
2024-12-27 14:39:34 +03:00
Viktor Liu
b3c87cb5d1
[client] Fix inbound tracking in userspace firewall ( #3111 )
...
* Don't create state for inbound SYN
* Allow final ack in some cases
* Relax state machine test a little
2024-12-26 00:51:27 +01:00
Viktor Liu
0dbaddc7be
[client] Don't fail debug if log file is console ( #3103 )
2024-12-24 15:05:23 +01:00
Viktor Liu
ad9f044aad
[client] Add stateful userspace firewall and remove egress filters ( #3093 )
...
- Add stateful firewall functionality for UDP/TCP/ICMP in userspace firewalll
- Removes all egress drop rules/filters, still needs refactoring so we don't add output rules to any chains/filters.
- on Linux, if the OUTPUT policy is DROP then we don't do anything about it (no extra allow rules). This is up to the user, if they don't want anything leaving their machine they'll have to manage these rules explicitly.
2024-12-23 18:22:17 +01:00
Viktor Liu
05930ee6b1
[client] Add firewall rules to the debug bundle ( #3089 )
...
Adds the following to the debug bundle:
- iptables: `iptables-save`, `iptables -v -n -L`
- nftables: `nft list ruleset` or if not available formatted output from netlink (WIP)
2024-12-23 15:57:15 +01:00
Pascal Fischer
e670068cab
[management] Run test sequential ( #3101 )
2024-12-23 14:37:09 +01:00
Viktor Liu
b48cf1bf65
[client] Reduce DNS handler chain lock contention ( #3099 )
2024-12-21 15:56:52 +01:00
Bethuel Mmbaga
7ee7ada273
[management] Fix duplicate resource routes when routing peer is part of the source group ( #3095 )
...
* Remove duplicate resource routes when routing peer is part of the source group
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
2024-12-20 21:10:53 +03:00
Zoltan Papp
82b4e58ad0
Do not start DNS forwarder on client side ( #3094 )
2024-12-20 16:20:50 +01:00
ddc365f7a0
[client, management] Add new network concept ( #3047 )
...
---------
Co-authored-by: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com >
Co-authored-by: bcmmbaga <bethuelmbaga12@gmail.com >
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com >
Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com >
2024-12-20 11:30:28 +01:00
Maycon Santos
37ad370344
[client] Avoid using iota on mixed const block ( #3057 )
...
Used the values as resolved when the first iota value was the second const in the block.
2024-12-16 18:09:31 +01:00
VYSE V.E.O
703647da1e
fix client unsupported h2 protocol when only 443 activated ( #3009 )
...
When I remove 80 http port in Caddyfile, netbird client cannot connect server:443. Logs show error below:
{"level":"debug","ts":1733809631.4012625,"logger":"http.stdlib","msg":"http: TLS handshake error from redacted:41580: tls: client requested unsupported application protocols ([h2])"}
I wonder here h2 protocol is absent.
2024-12-16 14:17:46 +01:00
Maycon Santos
9eff58ae62
Upgrade x/crypto package ( #3055 )
...
Mitigates the CVE-2024-45337
2024-12-16 10:30:41 +01:00
Jesse R Codling
3844516aa7
[client] fix: reformat IPv6 ICE addresses when punching ( #3050 )
...
Should fix #2327 and #2606 by checking for IPv6 addresses from ICE
2024-12-16 09:58:54 +01:00
M. Essam
f591e47404
Handle DNF5 install script ( #3026 )
2024-12-16 09:41:36 +01:00
Maycon Santos
287ae81195
[misc] split tests with management and rest ( #3051 )
...
optimize go cache for tests
2024-12-14 21:18:46 +01:00
M. Essam
a4a30744ad
Fix race condition with systray ready ( #2993 )
2024-12-14 12:17:53 -08:00
Maycon Santos and snyk-bot
dcba6a6b7e
fix: client/Dockerfile to reduce vulnerabilities ( #3019 )
...
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE320-OPENSSL-8235201
- https://snyk.io/vuln/SNYK-ALPINE320-OPENSSL-8235201
Co-authored-by: snyk-bot <snyk-bot@snyk.io >
2024-12-11 16:46:51 +01:00
Viktor Liu