mirror of
https://github.com/netbirdio/netbird.git
synced 2026-05-21 08:09:55 +00:00
167ee08e14
Adds a new "private" service mode for the reverse proxy: services reachable exclusively over the embedded WireGuard tunnel, gated by per-peer group membership instead of operator auth schemes. Wire contract - ProxyMapping.private (field 13): the proxy MUST call ValidateTunnelPeer and fail closed; operator schemes are bypassed. - ProxyCapabilities.private (4) + supports_private_service (5): capability gate. Management never streams private mappings to proxies that don't claim the capability; the broadcast path applies the same filter via filterMappingsForProxy. - ValidateTunnelPeer RPC: resolves an inbound tunnel IP to a peer, checks the peer's groups against service.AccessGroups, and mints a session JWT on success. checkPeerGroupAccess fails closed when a private service has empty AccessGroups. - ValidateSession/ValidateTunnelPeer responses now carry peer_group_ids + peer_group_names so the proxy can authorise policy-aware middlewares without an extra management round-trip. - ProxyInboundListener + SendStatusUpdate.inbound_listener: per-account inbound listener state surfaced to dashboards. - PathTargetOptions.direct_upstream (11): bypass the embedded NetBird client and dial the target via the proxy host's network stack for upstreams reachable without WireGuard. Data model - Service.Private (bool) + Service.AccessGroups ([]string, JSON- serialised). Validate() rejects bearer auth on private services. Copy() deep-copies AccessGroups. pgx getServices loads the columns. - DomainConfig.Private threaded into the proxy auth middleware. Request handler routes private services through forwardWithTunnelPeer and returns 403 on validation failure. - Account-level SynthesizePrivateServiceZones (synthetic DNS) and injectPrivateServicePolicies (synthetic ACL) gate on len(svc.AccessGroups) > 0. Proxy - /netbird proxy --private (embedded mode) flag; Config.Private in proxy/lifecycle.go. - Per-account inbound listener (proxy/inbound.go) binding HTTP/HTTPS on the embedded NetBird client's WireGuard tunnel netstack. - proxy/internal/auth/tunnel_cache: ValidateTunnelPeer response cache with single-flight de-duplication and per-account eviction. - Local peerstore short-circuit: when the inbound IP isn't in the account roster, deny fast without an RPC. - proxy/server.go reports SupportsPrivateService=true and redacts the full ProxyMapping JSON from info logs (auth_token + header-auth hashed values now only at debug level). Identity forwarding - ValidateSessionJWT returns user_id, email, method, groups, group_names. sessionkey.Claims carries Email + Groups + GroupNames so the proxy can stamp identity onto upstream requests without an extra management round-trip on every cookie-bearing request. - CapturedData carries userEmail / userGroups / userGroupNames; the proxy stamps X-NetBird-User and X-NetBird-Groups on r.Out from the authenticated identity (strips client-supplied values first to prevent spoofing). - AccessLog.UserGroups: access-log enrichment captures the user's group memberships at write time so the dashboard can render group context without reverse-resolving stale memberships. OpenAPI/dashboard surface - ReverseProxyService gains private + access_groups; ReverseProxyCluster gains private + supports_private. ReverseProxyTarget target_type enum gains "cluster". ServiceTargetOptions gains direct_upstream. ProxyAccessLog gains user_groups.
80 lines
2.5 KiB
Go
80 lines
2.5 KiB
Go
package roundtrip
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// stubRoundTripper records whether RoundTrip was called and returns a
|
|
// canned response so tests can assert the dispatch decision without
|
|
// running a real network.
|
|
type stubRoundTripper struct {
|
|
called bool
|
|
body string
|
|
}
|
|
|
|
func (s *stubRoundTripper) RoundTrip(_ *http.Request) (*http.Response, error) {
|
|
s.called = true
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(s.body)),
|
|
Header: http.Header{},
|
|
}, nil
|
|
}
|
|
|
|
func TestMultiTransport_DispatchesByContextFlag(t *testing.T) {
|
|
embedded := &stubRoundTripper{body: "embedded"}
|
|
mt := NewMultiTransport(embedded, nil)
|
|
|
|
t.Run("default routes to embedded", func(t *testing.T) {
|
|
embedded.called = false
|
|
req := httptest.NewRequest(http.MethodGet, "http://example.invalid", nil)
|
|
resp, err := mt.RoundTrip(req)
|
|
require.NoError(t, err, "embedded path must not error on stubbed transport")
|
|
require.NotNil(t, resp)
|
|
_ = resp.Body.Close()
|
|
assert.True(t, embedded.called, "request without WithDirectUpstream must hit the embedded transport")
|
|
})
|
|
|
|
t.Run("WithDirectUpstream skips embedded", func(t *testing.T) {
|
|
embedded.called = false
|
|
// Hit a server we control to verify the stdlib transport is used.
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
_, _ = io.WriteString(w, "direct")
|
|
}))
|
|
defer srv.Close()
|
|
|
|
req, err := http.NewRequestWithContext(WithDirectUpstream(context.Background()), http.MethodGet, srv.URL, nil)
|
|
require.NoError(t, err)
|
|
resp, err := mt.RoundTrip(req)
|
|
require.NoError(t, err, "direct path must dial via stdlib transport")
|
|
body, err := io.ReadAll(resp.Body)
|
|
_ = resp.Body.Close()
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "direct", string(body), "stdlib transport must reach the test server")
|
|
assert.False(t, embedded.called, "WithDirectUpstream must bypass the embedded transport")
|
|
})
|
|
}
|
|
|
|
func TestMultiTransport_NilEmbeddedAlwaysDirects(t *testing.T) {
|
|
mt := NewMultiTransport(nil, nil)
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
_, _ = io.WriteString(w, "ok")
|
|
}))
|
|
defer srv.Close()
|
|
|
|
req, err := http.NewRequest(http.MethodGet, srv.URL, nil)
|
|
require.NoError(t, err)
|
|
resp, err := mt.RoundTrip(req)
|
|
require.NoError(t, err, "nil embedded must fall through to direct without panic")
|
|
_ = resp.Body.Close()
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
}
|