mirror of
https://github.com/netbirdio/netbird.git
synced 2026-07-19 04:59:56 +00:00
7aebdd69dd
Adds a new "private" service mode for the reverse proxy: services reachable exclusively over the embedded WireGuard tunnel, gated by per-peer group membership instead of operator auth schemes. Wire contract - ProxyMapping.private (field 13): the proxy MUST call ValidateTunnelPeer and fail closed; operator schemes are bypassed. - ProxyCapabilities.private (4) + supports_private_service (5): capability gate. Management never streams private mappings to proxies that don't claim the capability; the broadcast path applies the same filter via filterMappingsForProxy. - ValidateTunnelPeer RPC: resolves an inbound tunnel IP to a peer, checks the peer's groups against service.AccessGroups, and mints a session JWT on success. checkPeerGroupAccess fails closed when a private service has empty AccessGroups. - ValidateSession/ValidateTunnelPeer responses now carry peer_group_ids + peer_group_names so the proxy can authorise policy-aware middlewares without an extra management round-trip. - ProxyInboundListener + SendStatusUpdate.inbound_listener: per-account inbound listener state surfaced to dashboards. - PathTargetOptions.direct_upstream (11): bypass the embedded NetBird client and dial the target via the proxy host's network stack for upstreams reachable without WireGuard. Data model - Service.Private (bool) + Service.AccessGroups ([]string, JSON- serialised). Validate() rejects bearer auth on private services. Copy() deep-copies AccessGroups. pgx getServices loads the columns. - DomainConfig.Private threaded into the proxy auth middleware. Request handler routes private services through forwardWithTunnelPeer and returns 403 on validation failure. - Account-level SynthesizePrivateServiceZones (synthetic DNS) and injectPrivateServicePolicies (synthetic ACL) gate on len(svc.AccessGroups) > 0. Proxy - /netbird proxy --private (embedded mode) flag; Config.Private in proxy/lifecycle.go. - Per-account inbound listener (proxy/inbound.go) binding HTTP/HTTPS on the embedded NetBird client's WireGuard tunnel netstack. - proxy/internal/auth/tunnel_cache: ValidateTunnelPeer response cache with single-flight de-duplication and per-account eviction. - Local peerstore short-circuit: when the inbound IP isn't in the account roster, deny fast without an RPC. - proxy/server.go reports SupportsPrivateService=true and redacts the full ProxyMapping JSON from info logs (auth_token + header-auth hashed values now only at debug level). Identity forwarding - ValidateSessionJWT returns user_id, email, method, groups, group_names. sessionkey.Claims carries Email + Groups + GroupNames so the proxy can stamp identity onto upstream requests without an extra management round-trip on every cookie-bearing request. - CapturedData carries userEmail / userGroups / userGroupNames; the proxy stamps X-NetBird-User and X-NetBird-Groups on r.Out from the authenticated identity (strips client-supplied values first to prevent spoofing). - AccessLog.UserGroups: access-log enrichment captures the user's group memberships at write time so the dashboard can render group context without reverse-resolving stale memberships. OpenAPI/dashboard surface - ReverseProxyService gains private + access_groups; ReverseProxyCluster gains private + supports_private. ReverseProxyTarget target_type enum gains "cluster". ServiceTargetOptions gains direct_upstream. ProxyAccessLog gains user_groups.
212 lines
8.7 KiB
Go
212 lines
8.7 KiB
Go
// Code generated by MockGen. DO NOT EDIT.
|
|
// Source: ./manager.go
|
|
|
|
// Package peers is a generated GoMock package.
|
|
package peers
|
|
|
|
import (
|
|
context "context"
|
|
net "net"
|
|
reflect "reflect"
|
|
|
|
gomock "github.com/golang/mock/gomock"
|
|
network_map "github.com/netbirdio/netbird/management/internals/controllers/network_map"
|
|
account "github.com/netbirdio/netbird/management/server/account"
|
|
integrated_validator "github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
|
|
peer "github.com/netbirdio/netbird/management/server/peer"
|
|
types "github.com/netbirdio/netbird/management/server/types"
|
|
)
|
|
|
|
// MockManager is a mock of Manager interface.
|
|
type MockManager struct {
|
|
ctrl *gomock.Controller
|
|
recorder *MockManagerMockRecorder
|
|
}
|
|
|
|
// MockManagerMockRecorder is the mock recorder for MockManager.
|
|
type MockManagerMockRecorder struct {
|
|
mock *MockManager
|
|
}
|
|
|
|
// NewMockManager creates a new mock instance.
|
|
func NewMockManager(ctrl *gomock.Controller) *MockManager {
|
|
mock := &MockManager{ctrl: ctrl}
|
|
mock.recorder = &MockManagerMockRecorder{mock}
|
|
return mock
|
|
}
|
|
|
|
// EXPECT returns an object that allows the caller to indicate expected use.
|
|
func (m *MockManager) EXPECT() *MockManagerMockRecorder {
|
|
return m.recorder
|
|
}
|
|
|
|
// CreateProxyPeer mocks base method.
|
|
func (m *MockManager) CreateProxyPeer(ctx context.Context, accountID, peerKey, cluster string) error {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "CreateProxyPeer", ctx, accountID, peerKey, cluster)
|
|
ret0, _ := ret[0].(error)
|
|
return ret0
|
|
}
|
|
|
|
// CreateProxyPeer indicates an expected call of CreateProxyPeer.
|
|
func (mr *MockManagerMockRecorder) CreateProxyPeer(ctx, accountID, peerKey, cluster interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateProxyPeer", reflect.TypeOf((*MockManager)(nil).CreateProxyPeer), ctx, accountID, peerKey, cluster)
|
|
}
|
|
|
|
// DeletePeers mocks base method.
|
|
func (m *MockManager) DeletePeers(ctx context.Context, accountID string, peerIDs []string, userID string, checkConnected bool) error {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "DeletePeers", ctx, accountID, peerIDs, userID, checkConnected)
|
|
ret0, _ := ret[0].(error)
|
|
return ret0
|
|
}
|
|
|
|
// DeletePeers indicates an expected call of DeletePeers.
|
|
func (mr *MockManagerMockRecorder) DeletePeers(ctx, accountID, peerIDs, userID, checkConnected interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeletePeers", reflect.TypeOf((*MockManager)(nil).DeletePeers), ctx, accountID, peerIDs, userID, checkConnected)
|
|
}
|
|
|
|
// GetAllPeers mocks base method.
|
|
func (m *MockManager) GetAllPeers(ctx context.Context, accountID, userID string) ([]*peer.Peer, error) {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "GetAllPeers", ctx, accountID, userID)
|
|
ret0, _ := ret[0].([]*peer.Peer)
|
|
ret1, _ := ret[1].(error)
|
|
return ret0, ret1
|
|
}
|
|
|
|
// GetAllPeers indicates an expected call of GetAllPeers.
|
|
func (mr *MockManagerMockRecorder) GetAllPeers(ctx, accountID, userID interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllPeers", reflect.TypeOf((*MockManager)(nil).GetAllPeers), ctx, accountID, userID)
|
|
}
|
|
|
|
// GetPeer mocks base method.
|
|
func (m *MockManager) GetPeer(ctx context.Context, accountID, userID, peerID string) (*peer.Peer, error) {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "GetPeer", ctx, accountID, userID, peerID)
|
|
ret0, _ := ret[0].(*peer.Peer)
|
|
ret1, _ := ret[1].(error)
|
|
return ret0, ret1
|
|
}
|
|
|
|
// GetPeer indicates an expected call of GetPeer.
|
|
func (mr *MockManagerMockRecorder) GetPeer(ctx, accountID, userID, peerID interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeer", reflect.TypeOf((*MockManager)(nil).GetPeer), ctx, accountID, userID, peerID)
|
|
}
|
|
|
|
// GetPeerAccountID mocks base method.
|
|
func (m *MockManager) GetPeerAccountID(ctx context.Context, peerID string) (string, error) {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "GetPeerAccountID", ctx, peerID)
|
|
ret0, _ := ret[0].(string)
|
|
ret1, _ := ret[1].(error)
|
|
return ret0, ret1
|
|
}
|
|
|
|
// GetPeerAccountID indicates an expected call of GetPeerAccountID.
|
|
func (mr *MockManagerMockRecorder) GetPeerAccountID(ctx, peerID interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerAccountID", reflect.TypeOf((*MockManager)(nil).GetPeerAccountID), ctx, peerID)
|
|
}
|
|
|
|
// GetPeerByTunnelIP mocks base method.
|
|
func (m *MockManager) GetPeerByTunnelIP(ctx context.Context, accountID string, ip net.IP) (*peer.Peer, error) {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "GetPeerByTunnelIP", ctx, accountID, ip)
|
|
ret0, _ := ret[0].(*peer.Peer)
|
|
ret1, _ := ret[1].(error)
|
|
return ret0, ret1
|
|
}
|
|
|
|
// GetPeerByTunnelIP indicates an expected call of GetPeerByTunnelIP.
|
|
func (mr *MockManagerMockRecorder) GetPeerByTunnelIP(ctx, accountID, ip interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerByTunnelIP", reflect.TypeOf((*MockManager)(nil).GetPeerByTunnelIP), ctx, accountID, ip)
|
|
}
|
|
|
|
// GetPeerID mocks base method.
|
|
func (m *MockManager) GetPeerID(ctx context.Context, peerKey string) (string, error) {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "GetPeerID", ctx, peerKey)
|
|
ret0, _ := ret[0].(string)
|
|
ret1, _ := ret[1].(error)
|
|
return ret0, ret1
|
|
}
|
|
|
|
// GetPeerID indicates an expected call of GetPeerID.
|
|
func (mr *MockManagerMockRecorder) GetPeerID(ctx, peerKey interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerID", reflect.TypeOf((*MockManager)(nil).GetPeerID), ctx, peerKey)
|
|
}
|
|
|
|
// GetPeerWithGroups mocks base method.
|
|
func (m *MockManager) GetPeerWithGroups(ctx context.Context, accountID, peerID string) (*peer.Peer, []*types.Group, error) {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "GetPeerWithGroups", ctx, accountID, peerID)
|
|
ret0, _ := ret[0].(*peer.Peer)
|
|
ret1, _ := ret[1].([]*types.Group)
|
|
ret2, _ := ret[2].(error)
|
|
return ret0, ret1, ret2
|
|
}
|
|
|
|
// GetPeerWithGroups indicates an expected call of GetPeerWithGroups.
|
|
func (mr *MockManagerMockRecorder) GetPeerWithGroups(ctx, accountID, peerID interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeerWithGroups", reflect.TypeOf((*MockManager)(nil).GetPeerWithGroups), ctx, accountID, peerID)
|
|
}
|
|
|
|
// GetPeersByGroupIDs mocks base method.
|
|
func (m *MockManager) GetPeersByGroupIDs(ctx context.Context, accountID string, groupsIDs []string) ([]*peer.Peer, error) {
|
|
m.ctrl.T.Helper()
|
|
ret := m.ctrl.Call(m, "GetPeersByGroupIDs", ctx, accountID, groupsIDs)
|
|
ret0, _ := ret[0].([]*peer.Peer)
|
|
ret1, _ := ret[1].(error)
|
|
return ret0, ret1
|
|
}
|
|
|
|
// GetPeersByGroupIDs indicates an expected call of GetPeersByGroupIDs.
|
|
func (mr *MockManagerMockRecorder) GetPeersByGroupIDs(ctx, accountID, groupsIDs interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeersByGroupIDs", reflect.TypeOf((*MockManager)(nil).GetPeersByGroupIDs), ctx, accountID, groupsIDs)
|
|
}
|
|
|
|
// SetAccountManager mocks base method.
|
|
func (m *MockManager) SetAccountManager(accountManager account.Manager) {
|
|
m.ctrl.T.Helper()
|
|
m.ctrl.Call(m, "SetAccountManager", accountManager)
|
|
}
|
|
|
|
// SetAccountManager indicates an expected call of SetAccountManager.
|
|
func (mr *MockManagerMockRecorder) SetAccountManager(accountManager interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetAccountManager", reflect.TypeOf((*MockManager)(nil).SetAccountManager), accountManager)
|
|
}
|
|
|
|
// SetIntegratedPeerValidator mocks base method.
|
|
func (m *MockManager) SetIntegratedPeerValidator(integratedPeerValidator integrated_validator.IntegratedValidator) {
|
|
m.ctrl.T.Helper()
|
|
m.ctrl.Call(m, "SetIntegratedPeerValidator", integratedPeerValidator)
|
|
}
|
|
|
|
// SetIntegratedPeerValidator indicates an expected call of SetIntegratedPeerValidator.
|
|
func (mr *MockManagerMockRecorder) SetIntegratedPeerValidator(integratedPeerValidator interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetIntegratedPeerValidator", reflect.TypeOf((*MockManager)(nil).SetIntegratedPeerValidator), integratedPeerValidator)
|
|
}
|
|
|
|
// SetNetworkMapController mocks base method.
|
|
func (m *MockManager) SetNetworkMapController(networkMapController network_map.Controller) {
|
|
m.ctrl.T.Helper()
|
|
m.ctrl.Call(m, "SetNetworkMapController", networkMapController)
|
|
}
|
|
|
|
// SetNetworkMapController indicates an expected call of SetNetworkMapController.
|
|
func (mr *MockManagerMockRecorder) SetNetworkMapController(networkMapController interface{}) *gomock.Call {
|
|
mr.mock.ctrl.T.Helper()
|
|
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetNetworkMapController", reflect.TypeOf((*MockManager)(nil).SetNetworkMapController), networkMapController)
|
|
}
|