netbird

mirror of https://github.com/netbirdio/netbird.git synced 2026-07-15 11:09:54 +00:00

Author	SHA1	Message	Date
mlsmaycon	f28ff2a1f1	Merge branch 'main' into 0.74.5-branch-sync # Conflicts: # client/internal/peer/conn.go # client/internal/peer/conn_test.go # client/internal/peer/wg_watcher.go # client/internal/peer/wg_watcher_test.go # go.mod # go.sum	2026-07-14 20:18:01 +02:00
Maycon Santos	f0eed7564f	[management] Remove proxy peer stale deduplication logic (#6768 ) ## Describe your changes Removing a leftover from an initial implementation. We ended up resolving it on the client with status checks on the DNS response ## Issue ticket number and link ## Stack - \#6726 <!-- branch-stack --> - \#6768 :point\_left: ### Checklist - [x] Is it a bug fix - [ ] Is a typo/documentation fix - [ ] Is a feature enhancement - [ ] It is a refactor - [ ] Created tests that fail without the change (if possible) - [ ] This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first). > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [ ] I added/updated documentation for this change - [x] Documentation is not needed for this change (explain why) ### Docs PR URL (required if "docs added" is checked) Paste the PR link from <https://github.com/netbirdio/docs> here: <https://github.com/netbirdio/docs/pull/>\_\_ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added support for Bedrock-native request routing in agent network scenarios. - Added guardrail management capabilities for creating and removing model allowlists. - Bug Fixes - Model allowlists now reject requests when the model is missing or blank. - Improved Rosenpass and WireGuard recovery after repeated handshake failures. - Improved relay connection handling so status and cleanup operations remain responsive during stalled connections. - Updated private service DNS zones to avoid unintended search-domain behavior. - Tests - Expanded coverage for model allowlists, handshake recovery, relay concurrency, and Bedrock routing. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-14 20:13:00 +02:00
Maycon Santos	277d8e4c53	[proxy] enforce model allowlist for URL-routed providers (Bedrock/Vertex) (#6764 ) ## Describe your changes The Agent Network policy Guardrail "Model Allowlist" was not enforced for providers whose model travels in the URL/path rather than the JSON body — most visibly AWS Bedrock (reported in netbirdio/netbird#6751), and the same class applies to Google Vertex. Root cause: the `llm_guardrail` allowlist check failed open. `evaluateAllowlist` returned allow whenever the request model was absent from the metadata bag (`middleware.go`, `if !modelPresent { return nil }`). The model is stamped upstream by `llm_request_parser`; for body-routed providers (OpenAI/Anthropic) it comes from the JSON body, but for path-routed providers the model is recovered only when the request matches a recognized path shape (Bedrock `/model/{id}/{invoke\|converse\|...}`, Vertex `/v1/projects/.../publishers/.../models/...`). Any shape the parser did not recognize reached the guardrail with no model and was allowed regardless of the allowlist. Fix (provider-agnostic): fail closed. When an allowlist is configured and the model cannot be determined (absent or empty), the request is denied `403` with a distinct `llm_policy.model_unknown` reason. This closes the bypass for Bedrock, Vertex, and any future URL-routed provider in one place. When no allowlist is configured, behavior is unchanged. The model allowlist is enforced solely in the proxy `llm_guardrail`; management's `CheckLLMPolicyLimits` handles only token/budget caps, so no management change is required. ## Issue ticket number and link <https://github.com/netbirdio/netbird/discussions/6751> ## Stack - \#6726 <!-- branch-stack --> - \#6764 :point\_left: ### Checklist - [x] Is it a bug fix - [ ] Is a typo/documentation fix - [ ] Is a feature enhancement - [ ] It is a refactor - [x] Created tests that fail without the change (if possible) - [x] This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first). > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [ ] I added/updated documentation for this change - [x] Documentation is not needed for this change (explain why) Bug fix that restores the documented allowlist behavior; no user-facing surface changes. ### Docs PR URL (required if "docs added" is checked) Paste the PR link from <https://github.com/netbirdio/docs> here: <https://github.com/netbirdio/docs/pull/>\_\_ ## Tests - `llm_guardrail`: absent/empty model under a configured allowlist now denies (`model_unknown`); empty allowlist still allows a missing model (fail-closed only applies when a list is set); existing allow/deny/case-insensitive cases retained. - `llm_request_parser`: new parser→guardrail integration test drives real Bedrock (`/model/{id}/invoke`) and Vertex (`/v1/projects/.../models/...`) URL shapes and asserts allowed→200, disallowed→403 (`model_blocked`), and an unrecognized Bedrock action→403 (`model_unknown`, the #6751 regression guard). Note: a full through-tunnel e2e for the allowlist is intentionally deferred — the agent-network e2e (`WaitProxyPeer`) is currently red on `main`/`0.74.x` for an unrelated lazy-connection reason; it will be added once that harness gate is fixed.	2026-07-14 19:03:01 +02:00
Viktor Liu	3d87547d95	[client] Bump golang.org/x/crypto to v0.54.0 and Go toolchain to 1.25.12 (#6709 )	2026-07-10 17:42:06 +02:00
Viktor Liu	4d4cc551fd	[client] Recover from rosenpass key desync (#6714 )	2026-07-10 17:38:29 +02:00
blaugrau90	08e46aa62f	[management] fix: prevent reverse proxy domain from being pushed as DNS search domain (#6498 ) SynthesizePrivateServiceZones created CustomZones for private services without setting SearchDomainDisabled, causing the reverse proxy domain to be injected as a search domain suffix on all connected peers. This broke local hostname resolution: short names like 'myserver' were expanded to 'myserver.app.example.com' (matching the reverse proxy domain) before local DNS search domains were tried. Fix: set SearchDomainDisabled: true so the zone is registered as a match-only supplemental resolver, consistent with the NonAuthoritative intent already expressed on the same zone.	2026-07-10 12:20:57 +02:00
Theodor Midtlien	7cd5c1732b	[client] Fix hanging status command during relay dial (#6694 ) * Add regression test for relay state lock * Make connect not hold a lock in openConnVia	2026-07-08 14:36:42 +02:00
Maycon Santos	816d80602f	[client] Update gopsutil to v4 (#6688 )	2026-07-08 10:15:31 +02:00

1 changed files with 4 additions and 9 deletions

									
										13

management/main.go
									
												View File
												
				@@ -1,24 +1,19 @@

				package main

				import (

					"log"

					"net/http"

					// nolint:gosec

					_ "net/http/pprof"

					"os"

					log "github.com/sirupsen/logrus"

					"github.com/netbirdio/netbird/management/cmd"

				)

				func main() {

					if pprofAddr := os.Getenv("NB_PPROF_ADDR"); pprofAddr != "" {

						log.Infof("pprof enabled, listening on: %s", pprofAddr)

						go func() {

							log.Println(http.ListenAndServe(pprofAddr, nil))

						}()

					}

					go func() {

						log.Println(http.ListenAndServe("localhost:6060", nil))

					}()

					if err := cmd.Execute(); err != nil {

						os.Exit(1)

					}

Compare commits

8 Commits

main ... 0.74.5-bra

13

management/main.go

View File

Compare commits

8 Commits main ... 0.74.5-bra

13 management/main.go Unescape Escape View File

8 Commits

main ... 0.74.5-bra

13

management/main.go

View File