mirror of
https://github.com/netbirdio/netbird.git
synced 2026-05-21 08:09:55 +00:00
Adds a new "private" service mode for the reverse proxy: services reachable exclusively over the embedded WireGuard tunnel, gated by per-peer group membership instead of operator auth schemes. Wire contract - ProxyMapping.private (field 13): the proxy MUST call ValidateTunnelPeer and fail closed; operator schemes are bypassed. - ProxyCapabilities.private (4) + supports_private_service (5): capability gate. Management never streams private mappings to proxies that don't claim the capability; the broadcast path applies the same filter via filterMappingsForProxy. - ValidateTunnelPeer RPC: resolves an inbound tunnel IP to a peer, checks the peer's groups against service.AccessGroups, and mints a session JWT on success. checkPeerGroupAccess fails closed when a private service has empty AccessGroups. - ValidateSession/ValidateTunnelPeer responses now carry peer_group_ids + peer_group_names so the proxy can authorise policy-aware middlewares without an extra management round-trip. - ProxyInboundListener + SendStatusUpdate.inbound_listener: per-account inbound listener state surfaced to dashboards. - PathTargetOptions.direct_upstream (11): bypass the embedded NetBird client and dial the target via the proxy host's network stack for upstreams reachable without WireGuard. Data model - Service.Private (bool) + Service.AccessGroups ([]string, JSON- serialised). Validate() rejects bearer auth on private services. Copy() deep-copies AccessGroups. pgx getServices loads the columns. - DomainConfig.Private threaded into the proxy auth middleware. Request handler routes private services through forwardWithTunnelPeer and returns 403 on validation failure. - Account-level SynthesizePrivateServiceZones (synthetic DNS) and injectPrivateServicePolicies (synthetic ACL) gate on len(svc.AccessGroups) > 0. Proxy - /netbird proxy --private (embedded mode) flag; Config.Private in proxy/lifecycle.go. - Per-account inbound listener (proxy/inbound.go) binding HTTP/HTTPS on the embedded NetBird client's WireGuard tunnel netstack. - proxy/internal/auth/tunnel_cache: ValidateTunnelPeer response cache with single-flight de-duplication and per-account eviction. - Local peerstore short-circuit: when the inbound IP isn't in the account roster, deny fast without an RPC. - proxy/server.go reports SupportsPrivateService=true and redacts the full ProxyMapping JSON from info logs (auth_token + header-auth hashed values now only at debug level). Identity forwarding - ValidateSessionJWT returns user_id, email, method, groups, group_names. sessionkey.Claims carries Email + Groups + GroupNames so the proxy can stamp identity onto upstream requests without an extra management round-trip on every cookie-bearing request. - CapturedData carries userEmail / userGroups / userGroupNames; the proxy stamps X-NetBird-User and X-NetBird-Groups on r.Out from the authenticated identity (strips client-supplied values first to prevent spoofing). - AccessLog.UserGroups: access-log enrichment captures the user's group memberships at write time so the dashboard can render group context without reverse-resolving stale memberships. OpenAPI/dashboard surface - ReverseProxyService gains private + access_groups; ReverseProxyCluster gains private + supports_private. ReverseProxyTarget target_type enum gains "cluster". ServiceTargetOptions gains direct_upstream. ProxyAccessLog gains user_groups.
267 lines
6.9 KiB
Go
267 lines
6.9 KiB
Go
package peer
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestAddPeer(t *testing.T) {
|
|
key := "abc"
|
|
ip := "100.108.254.1"
|
|
status := NewRecorder("https://mgm")
|
|
err := status.AddPeer(key, "abc.netbird", ip, "")
|
|
assert.NoError(t, err, "shouldn't return error")
|
|
|
|
_, exists := status.peers[key]
|
|
assert.True(t, exists, "value was found")
|
|
|
|
err = status.AddPeer(key, "abc.netbird", ip, "")
|
|
|
|
assert.Error(t, err, "should return error on duplicate")
|
|
}
|
|
|
|
func TestGetPeer(t *testing.T) {
|
|
key := "abc"
|
|
ip := "100.108.254.1"
|
|
status := NewRecorder("https://mgm")
|
|
err := status.AddPeer(key, "abc.netbird", ip, "")
|
|
assert.NoError(t, err, "shouldn't return error")
|
|
|
|
peerStatus, err := status.GetPeer(key)
|
|
assert.NoError(t, err, "shouldn't return error on getting peer")
|
|
|
|
assert.Equal(t, key, peerStatus.PubKey, "retrieved public key should match")
|
|
|
|
_, err = status.GetPeer("non_existing_key")
|
|
assert.Error(t, err, "should return error when peer doesn't exist")
|
|
}
|
|
|
|
func TestUpdatePeerState(t *testing.T) {
|
|
key := "abc"
|
|
ip := "10.10.10.10"
|
|
fqdn := "peer-a.netbird.local"
|
|
status := NewRecorder("https://mgm")
|
|
require.NoError(t, status.AddPeer(key, fqdn, ip, ""))
|
|
|
|
peerState := State{
|
|
PubKey: key,
|
|
ConnStatusUpdate: time.Now(),
|
|
ConnStatus: StatusConnecting,
|
|
}
|
|
|
|
err := status.UpdatePeerState(peerState)
|
|
assert.NoError(t, err, "shouldn't return error")
|
|
|
|
state, exists := status.peers[key]
|
|
assert.True(t, exists, "state should be found")
|
|
assert.Equal(t, ip, state.IP, "ip should be equal")
|
|
}
|
|
|
|
func TestStatus_PeerStateByIP(t *testing.T) {
|
|
status := NewRecorder("https://mgm")
|
|
require := assert.New(t)
|
|
|
|
require.NoError(status.AddPeer("pk-1", "peer-1.netbird", "100.64.0.10", ""))
|
|
require.NoError(status.AddPeer("pk-2", "peer-2.netbird", "100.64.0.11", ""))
|
|
|
|
state, ok := status.PeerStateByIP("100.64.0.10")
|
|
require.True(ok, "known tunnel IP should resolve to a peer state")
|
|
require.Equal("pk-1", state.PubKey, "matching state must carry the right pub key")
|
|
require.Equal("peer-1.netbird", state.FQDN, "matching state must carry the right FQDN")
|
|
|
|
_, ok = status.PeerStateByIP("100.64.0.99")
|
|
require.False(ok, "unknown IP must report ok=false")
|
|
}
|
|
|
|
func TestStatus_UpdatePeerFQDN(t *testing.T) {
|
|
key := "abc"
|
|
fqdn := "peer-a.netbird.local"
|
|
status := NewRecorder("https://mgm")
|
|
peerState := State{
|
|
PubKey: key,
|
|
Mux: new(sync.RWMutex),
|
|
}
|
|
|
|
status.peers[key] = peerState
|
|
|
|
err := status.UpdatePeerFQDN(key, fqdn)
|
|
assert.NoError(t, err, "shouldn't return error")
|
|
|
|
state, exists := status.peers[key]
|
|
assert.True(t, exists, "state should be found")
|
|
assert.Equal(t, fqdn, state.FQDN, "fqdn should be equal")
|
|
}
|
|
|
|
func TestGetPeerStateChangeNotifierLogic(t *testing.T) {
|
|
key := "abc"
|
|
ip := "10.10.10.10"
|
|
status := NewRecorder("https://mgm")
|
|
_ = status.AddPeer(key, "abc.netbird", ip, "")
|
|
|
|
sub := status.SubscribeToPeerStateChanges(context.Background(), key)
|
|
assert.NotNil(t, sub, "channel shouldn't be nil")
|
|
|
|
peerState := State{
|
|
PubKey: key,
|
|
ConnStatus: StatusConnecting,
|
|
Relayed: false,
|
|
ConnStatusUpdate: time.Now(),
|
|
}
|
|
|
|
err := status.UpdatePeerRelayedStateToDisconnected(peerState)
|
|
assert.NoError(t, err, "shouldn't return error")
|
|
|
|
timeoutCtx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
|
|
defer cancel()
|
|
select {
|
|
case <-sub.eventsChan:
|
|
case <-timeoutCtx.Done():
|
|
t.Errorf("timed out waiting for event")
|
|
}
|
|
}
|
|
|
|
func TestRemovePeer(t *testing.T) {
|
|
key := "abc"
|
|
status := NewRecorder("https://mgm")
|
|
peerState := State{
|
|
PubKey: key,
|
|
Mux: new(sync.RWMutex),
|
|
}
|
|
|
|
status.peers[key] = peerState
|
|
|
|
err := status.RemovePeer(key)
|
|
assert.NoError(t, err, "shouldn't return error")
|
|
|
|
_, exists := status.peers[key]
|
|
assert.False(t, exists, "state value shouldn't be found")
|
|
|
|
err = status.RemovePeer("not existing")
|
|
assert.Error(t, err, "should return error when peer doesn't exist")
|
|
}
|
|
|
|
func TestUpdateLocalPeerState(t *testing.T) {
|
|
localPeerState := LocalPeerState{
|
|
IP: "10.10.10.10",
|
|
PubKey: "abc",
|
|
KernelInterface: false,
|
|
}
|
|
status := NewRecorder("https://mgm")
|
|
|
|
status.UpdateLocalPeerState(localPeerState)
|
|
|
|
assert.Equal(t, localPeerState, status.localPeer, "local peer status should be equal")
|
|
}
|
|
|
|
func TestCleanLocalPeerState(t *testing.T) {
|
|
emptyLocalPeerState := LocalPeerState{}
|
|
localPeerState := LocalPeerState{
|
|
IP: "10.10.10.10",
|
|
PubKey: "abc",
|
|
KernelInterface: false,
|
|
}
|
|
status := NewRecorder("https://mgm")
|
|
|
|
status.localPeer = localPeerState
|
|
|
|
status.CleanLocalPeerState()
|
|
|
|
assert.Equal(t, emptyLocalPeerState, status.localPeer, "local peer status should be empty")
|
|
}
|
|
|
|
func TestUpdateSignalState(t *testing.T) {
|
|
url := "https://signal"
|
|
var tests = []struct {
|
|
name string
|
|
connected bool
|
|
want bool
|
|
err error
|
|
}{
|
|
{"should mark as connected", true, true, nil},
|
|
{"should mark as disconnected", false, false, errors.New("test")},
|
|
}
|
|
|
|
status := NewRecorder("https://mgm")
|
|
status.UpdateSignalAddress(url)
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
if test.connected {
|
|
status.MarkSignalConnected()
|
|
} else {
|
|
status.MarkSignalDisconnected(test.err)
|
|
}
|
|
assert.Equal(t, test.want, status.signalState, "signal status should be equal")
|
|
assert.Equal(t, test.err, status.signalError)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestUpdateManagementState(t *testing.T) {
|
|
url := "https://management"
|
|
var tests = []struct {
|
|
name string
|
|
connected bool
|
|
want bool
|
|
err error
|
|
}{
|
|
{"should mark as connected", true, true, nil},
|
|
{"should mark as disconnected", false, false, errors.New("test")},
|
|
}
|
|
|
|
status := NewRecorder(url)
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
if test.connected {
|
|
status.MarkManagementConnected()
|
|
} else {
|
|
status.MarkManagementDisconnected(test.err)
|
|
}
|
|
assert.Equal(t, test.want, status.managementState, "signalState status should be equal")
|
|
assert.Equal(t, test.err, status.managementError)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestGetFullStatus(t *testing.T) {
|
|
key1 := "abc"
|
|
key2 := "def"
|
|
signalAddr := "https://signal"
|
|
managementState := ManagementState{
|
|
URL: "https://mgm",
|
|
Connected: true,
|
|
}
|
|
signalState := SignalState{
|
|
URL: signalAddr,
|
|
Connected: true,
|
|
}
|
|
peerState1 := State{
|
|
PubKey: key1,
|
|
}
|
|
|
|
peerState2 := State{
|
|
PubKey: key2,
|
|
}
|
|
|
|
status := NewRecorder("https://mgm")
|
|
status.UpdateSignalAddress(signalAddr)
|
|
|
|
status.managementState = managementState.Connected
|
|
status.signalState = signalState.Connected
|
|
status.peers[key1] = peerState1
|
|
status.peers[key2] = peerState2
|
|
|
|
fullStatus := status.GetFullStatus()
|
|
|
|
assert.Equal(t, managementState, fullStatus.ManagementState, "management status should be equal")
|
|
assert.Equal(t, signalState, fullStatus.SignalState, "signal status should be equal")
|
|
assert.ElementsMatch(t, []State{peerState1, peerState2}, fullStatus.Peers, "peers states should match")
|
|
}
|