mirror of
https://github.com/netbirdio/netbird.git
synced 2026-05-21 08:09:55 +00:00
167ee08e14
Adds a new "private" service mode for the reverse proxy: services reachable exclusively over the embedded WireGuard tunnel, gated by per-peer group membership instead of operator auth schemes. Wire contract - ProxyMapping.private (field 13): the proxy MUST call ValidateTunnelPeer and fail closed; operator schemes are bypassed. - ProxyCapabilities.private (4) + supports_private_service (5): capability gate. Management never streams private mappings to proxies that don't claim the capability; the broadcast path applies the same filter via filterMappingsForProxy. - ValidateTunnelPeer RPC: resolves an inbound tunnel IP to a peer, checks the peer's groups against service.AccessGroups, and mints a session JWT on success. checkPeerGroupAccess fails closed when a private service has empty AccessGroups. - ValidateSession/ValidateTunnelPeer responses now carry peer_group_ids + peer_group_names so the proxy can authorise policy-aware middlewares without an extra management round-trip. - ProxyInboundListener + SendStatusUpdate.inbound_listener: per-account inbound listener state surfaced to dashboards. - PathTargetOptions.direct_upstream (11): bypass the embedded NetBird client and dial the target via the proxy host's network stack for upstreams reachable without WireGuard. Data model - Service.Private (bool) + Service.AccessGroups ([]string, JSON- serialised). Validate() rejects bearer auth on private services. Copy() deep-copies AccessGroups. pgx getServices loads the columns. - DomainConfig.Private threaded into the proxy auth middleware. Request handler routes private services through forwardWithTunnelPeer and returns 403 on validation failure. - Account-level SynthesizePrivateServiceZones (synthetic DNS) and injectPrivateServicePolicies (synthetic ACL) gate on len(svc.AccessGroups) > 0. Proxy - /netbird proxy --private (embedded mode) flag; Config.Private in proxy/lifecycle.go. - Per-account inbound listener (proxy/inbound.go) binding HTTP/HTTPS on the embedded NetBird client's WireGuard tunnel netstack. - proxy/internal/auth/tunnel_cache: ValidateTunnelPeer response cache with single-flight de-duplication and per-account eviction. - Local peerstore short-circuit: when the inbound IP isn't in the account roster, deny fast without an RPC. - proxy/server.go reports SupportsPrivateService=true and redacts the full ProxyMapping JSON from info logs (auth_token + header-auth hashed values now only at debug level). Identity forwarding - ValidateSessionJWT returns user_id, email, method, groups, group_names. sessionkey.Claims carries Email + Groups + GroupNames so the proxy can stamp identity onto upstream requests without an extra management round-trip on every cookie-bearing request. - CapturedData carries userEmail / userGroups / userGroupNames; the proxy stamps X-NetBird-User and X-NetBird-Groups on r.Out from the authenticated identity (strips client-supplied values first to prevent spoofing). - AccessLog.UserGroups: access-log enrichment captures the user's group memberships at write time so the dashboard can render group context without reverse-resolving stale memberships. OpenAPI/dashboard surface - ReverseProxyService gains private + access_groups; ReverseProxyCluster gains private + supports_private. ReverseProxyTarget target_type enum gains "cluster". ServiceTargetOptions gains direct_upstream. ProxyAccessLog gains user_groups.
82 lines
3.0 KiB
Go
82 lines
3.0 KiB
Go
package proxy
|
|
|
|
import (
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
StatusConnected = "connected"
|
|
StatusDisconnected = "disconnected"
|
|
)
|
|
|
|
// Capabilities describes what a proxy can handle, as reported via gRPC.
|
|
// Nil fields mean the proxy never reported this capability.
|
|
type Capabilities struct {
|
|
// SupportsCustomPorts indicates whether this proxy can bind arbitrary
|
|
// ports for TCP/UDP services. TLS uses SNI routing and is not gated.
|
|
SupportsCustomPorts *bool
|
|
// RequireSubdomain indicates whether a subdomain label is required in
|
|
// front of the cluster domain.
|
|
RequireSubdomain *bool
|
|
// SupportsCrowdsec indicates whether this proxy has CrowdSec configured.
|
|
SupportsCrowdsec *bool
|
|
// Private indicates whether this proxy is embedded in a netbird client
|
|
// and serves exclusively over the WireGuard tunnel (i.e. `netbird proxy`
|
|
// rather than the standalone netbird-proxy binary). Surfaces upstream
|
|
// so dashboards can distinguish per-peer / private clusters.
|
|
Private *bool
|
|
}
|
|
|
|
// Proxy represents a reverse proxy instance
|
|
type Proxy struct {
|
|
ID string `gorm:"primaryKey;type:varchar(255)"`
|
|
SessionID string `gorm:"type:varchar(36)"`
|
|
ClusterAddress string `gorm:"type:varchar(255);not null;index:idx_proxy_cluster_status"`
|
|
IPAddress string `gorm:"type:varchar(45)"`
|
|
AccountID *string `gorm:"type:varchar(255);index:idx_proxy_account_id"`
|
|
LastSeen time.Time `gorm:"not null;index:idx_proxy_last_seen"`
|
|
ConnectedAt *time.Time
|
|
DisconnectedAt *time.Time
|
|
Status string `gorm:"type:varchar(20);not null;index:idx_proxy_cluster_status"`
|
|
Capabilities Capabilities `gorm:"embedded"`
|
|
CreatedAt time.Time
|
|
UpdatedAt time.Time
|
|
}
|
|
|
|
func (Proxy) TableName() string {
|
|
return "proxies"
|
|
}
|
|
|
|
// ClusterType is the source of a proxy cluster.
|
|
type ClusterType string
|
|
|
|
const (
|
|
// ClusterTypeAccount is a cluster operated by the account itself (BYOP) —
|
|
// at least one proxy row in the cluster carries a non-NULL account_id.
|
|
ClusterTypeAccount ClusterType = "account"
|
|
// ClusterTypeShared is a cluster operated by NetBird and shared across
|
|
// accounts — all proxy rows in the cluster have account_id IS NULL.
|
|
ClusterTypeShared ClusterType = "shared"
|
|
)
|
|
|
|
// Cluster represents a group of proxy nodes serving the same address.
|
|
//
|
|
// Online and ConnectedProxies derive from the same 2-min active window
|
|
// the rest of the module uses, but Cluster rows are not gated on it —
|
|
// the cluster listing surfaces offline clusters too so operators can
|
|
// see and clean them up. The 1-hour heartbeat reaper still bounds the
|
|
// table eventually.
|
|
type Cluster struct {
|
|
ID string
|
|
Address string
|
|
Type ClusterType
|
|
Online bool
|
|
ConnectedProxies int
|
|
// *bool: nil = no proxy reported the capability; the dashboard renders that as unknown.
|
|
SupportsCustomPorts *bool
|
|
RequireSubdomain *bool
|
|
SupportsCrowdSec *bool
|
|
// Private is true when at least one connected proxy reported the embedded-`netbird proxy` capability.
|
|
Private *bool
|
|
}
|