* Close SSH connections still in the handshake on Stop and reject ones accepted by a stopped server
* Add a test that a connection dialed after Stop is refused
* [client] Clarify SSH server lifecycle and connection validation comments
* Clarify trackConn's doc comment on connection ownership after rejection
* Stop asserting a specific outcome of the Stop/Serve registration race in the post-Stop dial test
* Explicitly close the SSH listener on Stop and avoid logging the resulting race as an error
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Refuse SSH JWT auth when the client changes the user name between auth requests on one connection
* Run SSH sessions and SFTP as the OS user that was authorized, taken from the connection context
* [self-hosted] Override relay auth secret and store encryption key from the environment
Combined server.authSecret and server.store.encryptionKey could only be
set in YAML, so operators could not keep config.yaml in git without
secrets. A non-empty NB_AUTH_SECRET or NB_STORE_ENCRYPTION_KEY now
overrides those fields after YAML is parsed and before defaults and
validation, matching the standalone relay env name for the auth secret.
* [self-hosted] Cover secret env overrides when no config path is given
LoadConfig with an empty path starts from DefaultConfig and applies
NB_AUTH_SECRET and NB_STORE_ENCRYPTION_KEY without reading YAML. The
existing tests only used YAML paths, so that branch had no coverage.
* [client] Mark Rosenpass flags as deprecated
Rosenpass support is being deprecated. Users enabling it from the CLI
should learn that before they depend on it, while the feature itself
keeps working.
* [client] Show Rosenpass deprecation notice in the UI settings
Desktop users enable Rosenpass from the settings toggle, not the CLI,
so the deprecation notice needs to reach them there too. A new string
key falls back to English until Crowdin translates it, instead of
showing a stale translation without the notice.
* [client] Keep switchOrCreateProfile doc comment attached
The Rosenpass warning helper landed between switchOrCreateProfile and
its doc comment, leaving the function undocumented.
* [client] Use MarkDeprecated for the Rosenpass flags
Follows the convention already used for --enable-lazy-connection, as
asked in review. The flags drop out of --help and pflag warns on any
use, so the custom helper is no longer needed.
* [client] Isolate the Rosenpass flag test from upCmd's flag set
Setting the shared upCmd flags left them marked Changed for any later
test in the package.
* [client] Skip peers without a PTR record in kubernetes commands
getKubernetesClusters returned on the first failed reverse lookup, so a
single peer without a PTR record made `netbird kubernetes list` and
`write-kubeconfig` fail even when a netbird-kubeapi-proxy peer was
reachable later in the list. Log the failure at debug and keep scanning,
stopping only when the context is cancelled.
* [client] Return cancellation when the last peer's lookup is skipped
A failed lookup or fingerprint on the final peer was skipped and the
loop ended with a nil error, so a cancelled command reported no clusters
instead of the cancellation.
* [client] Report the lookup error when no peer resolves
Skipping every failed reverse lookup hid a broken resolver behind "No
Kubernetes clusters available" or "cluster not found", with the cause
only in the debug log. When no lookup succeeds, return the last lookup
error. One resolvable peer still means the resolver works, so per-peer
failures stay skipped.
* [client] Stop the kubernetes peer scan when the resolver is down
With a dead resolver every peer waited out the resolver timeout in turn
before the error was reported. A missing PTR record answers NXDOMAIN, so
a timeout or SERVFAIL before any peer resolved means the resolver itself
is failing: return it at once. After one peer resolved, later failures
are still skipped.
* [client] Extract kubernetes cluster probing from the peer scan
The lookup error handling pushed findKubernetesClusters past the
cognitive complexity limit. Move the FQDN match and fingerprint into
probeCluster so the scan loop only handles lookups and deduplication.
* Bound the SSH session request queue by bytes and stop resizes reaching a loop with no consumer
* Give the window change drain loop a body
* Avoid an empty case clause in the SSH request filter
* Charge only the newest resize to the request queue and classify requests before the byte limit
* [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys
Eight eMudhra intermediate CA private keys were compromised and browsers
blocked them on 2026-10-17. Our binaries were built with go1.26.7, which
accepts chains through those intermediates whenever the trust store still
holds emSign ECC Root CA - G3. go1.26.10 rejects them in crypto/x509 on
every platform, regardless of the trust store.
The UBI base still ships the root and Red Hat has no fixed package yet, so
the UBI images blocklist it with p11-kit. The ingest image, the UI server
image and the pinned Chainguard digests also carried the root and move to
bases that no longer do.
* [client,proxy,management,signal,relay] Use the fixed UBI base instead of a blocklist
Red Hat shipped ca-certificates 2026.2.92_v9.0.319-90.3 on 2026-10-22,
which drops emSign ECC Root CA - G3 and AAA Certificate Services. The
current ubi9-minimal image carries it, so pin that digest and remove the
p11-kit blocklist step.
* [misc] Pin upload-server images by digest only and restore go.mod comment
An integrated validator can approve or revoke peers outside a login or
sync, for example during a periodic EDR sync. Only revocations of SSO
peers reached anyone; a newly approved peer kept its empty map, and its
peers did not see it, until an unrelated update or a reconnect.
Add SetPeerValidationChangeListener to the IntegratedValidator interface.
The account manager registers a handler that resolves the affected peers
and calls OnPeersUpdated, the same path a login-time approval takes. The
OSS validator and the mock implement it as a no-op.
* we somehow can get a nil peer when returning empty components; this fix compensates for the issue, but doesn't fix the root cause (which is unknown atm)
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
* fix test
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
---------
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
* [management] Skip inactivity expiration rescan when a job is scheduled
Every SSO peer connect and disconnect cancelled the account's inactivity
expiration job and re-armed it, loading every inactivity-enabled peer of
the account each time. During a management deploy, when all peers
reconnect, that is a full account scan per peer.
A connecting peer cannot expire, and a disconnecting peer expires after
every peer that was already disconnected, so neither can move the next
run earlier. Connect and disconnect now leave an already scheduled job in
place, as login expiration already does. Settings and per-peer toggle
changes still cancel and reschedule, since they can move the run earlier.
* [management] Keep inactivity rescan on disconnect
A disconnect that lands while the inactivity job is finishing its last
run saw the job as scheduled and skipped arming a new one; the scheduler
then removed the job, leaving the disconnected peer without an inactivity
timer. Only connect, where the peer cannot expire, now skips a scheduled
job; disconnect cancels and re-arms as before.
The test asserts on the synchronous Cancel call instead of sleeping.
* [proxy] Fix npm audit findings in the web UI
npm audit reported 10 vulnerabilities (7 high), all in build tooling:
Vite/launch-editor, PostCSS, Babel, browserslist, js-yaml, nanoid,
brace-expansion and source-map-js. All are resolved by the lockfile
update; Vite is pinned exactly, so it is bumped from 7.3.2 to 7.3.7.
* [client] Migrate the desktop UI to Tailwind CSS 4 and fix npm audit findings
pnpm audit reported 36 vulnerabilities in the desktop UI. All but two
(braces and postcss-selector-parser, both pulled in by Tailwind 3 with
no patched version in range) are fixed by updating within the existing
ranges; react-router moves to 7.18.4, which also fixes an open redirect
and an XSS in its error handler.
The remaining two go away by moving to Tailwind CSS 4, which the proxy
web UI already uses:
- The config moves into an @theme block in globals.css; the official
upgrade tool applied the v4 utility renames across the components.
- @tailwindcss/vite replaces the PostCSS plugin and autoprefixer.
- tw-animate-css replaces tailwindcss-animate with the same classes.
- The Prettier plugin reads the theme from the stylesheet.
A screenshot comparison of every screen against the Tailwind 3 build
found three regressions caused by v4's changed utility and variant
ordering, fixed here so the UI renders as before:
- Label combined inline-block and flex; v4 let inline-block win, which
made every settings row taller. The dead inline-block is removed.
- The active settings tab lost its highlight in dark mode because
dark: now outranks group-data-[state=active]:. The active color is
set for dark mode explicitly.
- v4 rebuilt its default palette in OKLCH, shifting colors the theme
does not override such as sky-400. The Tailwind 3 values for the
neutral, zinc, sky, orange and amber families are pinned in @theme.
The only remaining visible difference is 2px less height per row in
the profiles list, because v4's preflight resets the browser's default
table-cell padding.
The harness hands peers the management address netbird.local:8080, which
only resolves on the deployment's own Docker network, and keeps that
network, the client image and the client container private. A suite that
runs agents somewhere else, such as the Kubernetes operator's Kind
cluster, has no way to attach to the deployment, run the same client
build, or check routed access from a harness peer.
Expose the network name, resolve the client image on its own, and let a
caller exec into a client container.
* [client] Drop the non-functional admin URL
#4218 deprecated --admin-url, but #3980 merged right after it and restored the flag and its wiring. The value has been stored and echoed back ever since, without anything reading it.
Stop sending it from the CLI, ignore it in the daemon and drop it from the profile config, the UI settings service and the debug bundle. The proto fields stay for older clients, and the mobile getters and setters keep their signatures as deprecated stubs.
* [client] Drop adminUrl from the Wails API reference
* [client] Split resolv.conf parsing from file reading
Pure refactor, no behavior change. parseResolvConf parses content that
was already read, so a caller can compare and parse the same snapshot
of the file instead of reading it twice.
* [client] Return the written content from the resolv.conf update function
Pure refactor, no behavior change. The repair watcher needs to know what
NetBird wrote so it can tell its own write apart from a third party's.
Callers ignore the content for now.
* [client] Keep the resolv.conf watch armed while repairing
In file mode the repair watcher removed its inotify watch, rewrote
resolv.conf and re-added the watch, without looking at the file again.
A second third-party write landing in that window raised no event, so
the file stayed on the upstream resolver until something else touched
it. systemd-resolved with the stub listener off, the Amazon Linux 2023
default, writes the file twice in a row on restart and does not rewrite
it on an unchanged DHCP renewal, so the host stayed off NetBird DNS
while the client reported connected.
The watch now stays armed during the repair. NetBird's own write is
recognized by comparing the file with the content it wrote, which also
covers a write whose search list was truncated to the resolv.conf
limits and would otherwise fail the parameter check forever. The
watcher checks the file once when it is armed, since a change made
before that produced no event.
* [client] Consume inotify errors in the resolv.conf watcher
fsnotify blocks its reader until an error is received. The watcher
never read the Errors channel, so a single error, such as an event
queue overflow, stopped all further events and silently disabled the
repair. The watcher now consumes errors and checks the file, since an
overflow means events were dropped.
* [client] Parse resolv.conf one line at a time
Pure refactor, no behavior change. The per-line handling moves into
parseResolvConfLine, which keeps parseResolvConf under the cognitive
complexity limit.
* [client] Drop the comment restating parseResolvConfLine
* [misc] Announce tag-pushed releases on the forum
Since 0.77 a release is cut by pushing a tag, and goreleaser creates the
GitHub release with GITHUB_TOKEN. Events raised by that token start no
workflow, so the release:published trigger never fires for them and
0.78.0, 0.79.0, 0.80.0, 0.81.0 and 0.81.3 got no forum topic, while
releases published from the UI still did.
Post from the completion of the Release workflow instead, for tag runs
that succeeded and whose release was created by the bot. Release
candidates stay off the forum, and an existing topic with the same title
is left alone so re-running a green Release run does not post twice.
* [misc] Point an empty forum post at the release notes
goreleaser creates the release with an empty body and the notes are
written on the release page afterwards, so the topic would otherwise
hold only its title link. Say where the notes and downloads are.
* [misc] Fail closed in the forum post lookups
Announce stable tags only: every pre-release tag carries a hyphen, so
canaries and release candidates pushed as tags stay off the forum.
A failed release lookup now fails the step instead of passing as "no
release"; only a 404 skips. The duplicate check searches by title rather
than reading the first page of the category, and a failed search stops
the step instead of falling through to a post. Discourse requests
refuse any non-HTTPS redirect and retry transient errors.
* [client] Reproduce Signal reconnect listener shutdown deadlock
* [client] Invoke Signal reconnect listeners outside the client mutex
Capture the listener with the registration state, then release the mutex before calling it. Watcher shutdown can now unregister a listener while an in-flight callback waits for the watcher lock.
Keep callback invocation synchronous and document that unregistration does not drain an already captured callback. Record callback completion inside the regression test's external lock.
* [management] Return the reason when custom domain validation fails
The validate endpoint returned an empty 202 and ran the check in a
goroutine, so a failed verification only reached the management log.
Run the check in the request and return 204 or 412 with a classified
reason. Resolver errors are not forwarded.
* [management] Address review feedback on custom domain validation
Pass the request context to the lookup and store calls now that the
check runs in the request, compare the self-resolved name
case-insensitively, document the 412 like the other entries, and
check the returned error in the existing tests.
* [management] Match custom domain CNAME targets case-insensitively
DNS names are case-insensitive, so a CNAME pointing at the cluster in
different casing should validate instead of failing as a mismatch.
* [management] Add validation timeout
---------
Co-authored-by: DevBot NetBird <91386968+netbirddev@users.noreply.github.com>
