mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-25 09:01:29 +02:00
223153993c
* feat(ios/ssh): add ConnectNetBirdPeer, JWT cache, and WireGuard dialer - Add ConnectNetBirdPeer() method that skips banner detection and authenticates directly via JWT (mirrors NetBird web dashboard flow) - Cache JWT token for 8 minutes to avoid OAuth re-auth on every reconnect (SSH servers reject tokens older than DefaultJWTMaxTokenAge = 10 min) - Bind SSH sockets to the WireGuard interface via IP_BOUND_IF (Darwin syscall 25) so connections to 100.x.x.x peers route through the tunnel in the iOS Network Extension process - Improve auth failure error message with actionable checklist - Add base64 JWT claims debug logging for auth troubleshooting Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(ios/ssh): never offer the JWT to an unverified SSH service Remove ConnectNetBirdPeer. It skipped banner detection and sent the JWT as a password to whatever sshd answered, under InsecureIgnoreHostKey. WireGuard authenticates the peer machine, not the SSH service listening on it, so that handed a valid bearer token to an unidentified listener — a plain OpenSSH + PAM setup may even log the password attempt. Connect is now the only entry point. Detection is what proves the listener is a NetBird SSH service before the token is offered, and the JWT path already verifies the host key against the management-plane registry via engineHostKeyVerifier. A peer whose NetBird SSH is disabled is served by plain sshd and authenticates by key or password like any other host, so it stays reachable without an OAuth round trip. Move the NetBird-specific auth-failure checklist into annotateAuthError, gated on serverType.RequiresJWT(), so a regular sshd rejection no longer tells the user to check dashboard SSH access. Drop base64DecodeJWT, which was left unused. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>