mlsmaycon e09d51c1a8 fix(proxy): gate tunnel-peer fast-path on inbound listener marker ...

forwardWithTunnelPeer previously accepted any RFC1918 / ULA / CGNAT
source IP, so a public client whose address happened to fall in those
ranges could bypass the configured operator auth scheme by colliding
with a known tunnel IP. The fast-path is now gated on
TunnelLookupFromContext(r.Context()) being present — that context value
is attached only by the per-account inbound (overlay) listener, so the
host-facing listener never enters this branch.

Tests updated to reflect the new requirement: requests that don't
carry the inbound marker now fall through to the regular auth flow.

2026-05-26 21:58:23 +02:00

..

auth.gohtml

[management, reverse proxy] Add reverse proxy feature (#5291)

2026-02-13 19:37:43 +01:00

header.go

[proxy, management] Add header auth, access restrictions, and session idle timeout (#5587)

2026-03-16 15:22:00 +01:00

identity.go

[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)

2026-05-25 17:41:50 +02:00

middleware_test.go

fix(proxy): gate tunnel-peer fast-path on inbound listener marker

2026-05-26 21:58:23 +02:00

middleware.go

fix(proxy): gate tunnel-peer fast-path on inbound listener marker

2026-05-26 21:58:23 +02:00

oidc.go

[management,proxy,client] Add L4 capabilities (TLS/TCP/UDP) (#5530)

2026-03-13 18:36:44 +01:00

password.go

[management,proxy,client] Add L4 capabilities (TLS/TCP/UDP) (#5530)

2026-03-13 18:36:44 +01:00

pin.go

[management,proxy,client] Add L4 capabilities (TLS/TCP/UDP) (#5530)

2026-03-13 18:36:44 +01:00

tunnel_cache_test.go

[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)

2026-05-25 17:41:50 +02:00

tunnel_cache.go

[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)

2026-05-25 17:41:50 +02:00

tunnel_lookup_test.go

fix(proxy): gate tunnel-peer fast-path on inbound listener marker

2026-05-26 21:58:23 +02:00