Riccardo Manfrin
|
b7b0d5796e
|
[client] Bind netstack SOCKS5 proxy to 127.0.0.1 by default (#6812)
## Describe your changes
In netstack mode the SOCKS5 proxy bridges local host applications into
the
userspace WireGuard stack (`client/iface/netstack/proxy.go`), so it only
needs
to be reachable from the same machine. It was binding to `0.0.0.0`,
making an
unauthenticated proxy reachable from the network — any host able to
reach the
port could relay traffic through the client into its NetBird overlay.
Bind to `127.0.0.1` by default. Add `NB_SOCKS5_LISTENER_ADDRESS` to
override the
bind host for the rare case the proxy must be reachable from other hosts
(e.g. a
container gateway); it is validated as an IP and falls back to loopback.
`ListenAddr` is split into `listenHost`/`listenPort` helpers, with
tests.
Behavior change: setups that relied on reaching the netstack SOCKS5
proxy from
another host must now set `NB_SOCKS5_LISTENER_ADDRESS=0.0.0.0`
explicitly.
## Issue ticket number and link
Internal security hardening of the netstack SOCKS5 listener bind address
([client/iface/netstack/env.go](https://github.com/netbirdio/netbird/blob/main/client/iface/netstack/env.go)).
## Stack
- `0.74.7-branch` - ⚠️ No PR associated with branch <!--
branch-stack -->
- \#6812 :point\_left:
### Checklist
- [x] Is it a bug fix
- [ ] Is a typo/documentation fix
- [ ] Is a feature enhancement
- [ ] It is a refactor
- [x] Created tests that fail without the change (if possible)
- [ ] This change does **not** modify the public API, gRPC protocols,
functionality behavior, CLI / service flags, or introduce a new feature
— **OR** I have discussed it with the NetBird team beforehand (link the
issue / Slack thread in the description). See
[CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first).
> By submitting this pull request, you confirm that you have read and
agree to the terms of the [Contributor License
Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md).
## Documentation
Select exactly one:
- [x] I added/updated documentation for this change
- [ ] Documentation is **not needed** for this change (explain why)
### Docs PR URL (required if "docs added" is checked)
Paste the PR link from <https://github.com/netbirdio/docs> here:
<https://github.com/netbirdio/docs/pull/860>
<!-- codesmith:footer -->
***
<a
href="https://app.blacksmith.sh/netbirdio/codesmith/netbird/pr/6812"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img
alt="View with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a>
<a
href="https://backend.blacksmith.sh/track/enable-autofix?expires=1786872199&installation_id=146802194&pr_number=6812&repository=netbirdio%2Fnetbird&return_to=https%3A%2F%2Fgithub.com%2Fnetbirdio%2Fnetbird%2Fpull%2F6812&signature=6e78df77b784915baee9647b555483a8f7550a604d5393edcc501dd8f58b1395"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img
alt="Autofix with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a>
<sup>Need help on this PR? Tag <code>/codesmith</code> with what you
need. Autofix is disabled.</sup>
<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added configuration options for the SOCKS5 listener’s bind address and
port.
- SOCKS5 now defaults to listening only on the local machine for
improved security.
- Valid address and port overrides are supported, with safe defaults
used for invalid values.
- **Tests**
- Added coverage for default settings and valid or invalid address and
port configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
2026-07-17 15:09:09 +02:00 |
|
Viktor Liu
|
205ebcfda2
|
[management, client] Add IPv6 overlay support (#5631)
|
2026-05-07 11:33:37 +02:00 |
|
Viktor Liu
|
1ddc9ce2bf
|
[client] Fix nil pointer panic in device and engine code (#5287)
|
2026-02-12 09:15:42 +01:00 |
|
Viktor Liu
|
b5daec3b51
|
[client,signal,management] Add browser client support (#4415)
|
2025-10-01 20:10:11 +02:00 |
|
iisteev
|
e49bcc343d
|
[client] Avoid parsing NB_NETSTACK_SKIP_PROXY if empty (#4145)
Signed-off-by: iisteev <isteevan.shetoo@is-info.fr>
|
2025-07-13 15:42:48 +02:00 |
|
Viktor Liu
|
ea4d13e96d
|
[client] Use platform-native routing APIs for freeBSD, macOS and Windows
|
2025-06-04 16:28:58 +02:00 |
|
Philippe Vaucher
|
9d604b7e66
|
[client Fix env var typo (#3415)
|
2025-03-03 17:22:51 +01:00 |
|
Viktor Liu
|
631ef4ed28
|
[client] Add embeddable library (#3239)
|
2025-02-20 13:22:03 +01:00 |
|
Viktor Liu
|
6848e1e128
|
[client] Add rootless container and fix client routes in netstack mode (#3150)
|
2025-01-06 14:16:31 +01:00 |
|
Zoltan Papp
|
fd67892cb4
|
[client] Refactor/iface pkg (#2646)
Refactor the flat code structure
|
2024-10-02 18:24:22 +02:00 |
|
