mirror of
https://github.com/netbirdio/netbird.git
synced 2026-07-18 20:49:56 +00:00
## Describe your changes In netstack mode the SOCKS5 proxy bridges local host applications into the userspace WireGuard stack (`client/iface/netstack/proxy.go`), so it only needs to be reachable from the same machine. It was binding to `0.0.0.0`, making an unauthenticated proxy reachable from the network — any host able to reach the port could relay traffic through the client into its NetBird overlay. Bind to `127.0.0.1` by default. Add `NB_SOCKS5_LISTENER_ADDRESS` to override the bind host for the rare case the proxy must be reachable from other hosts (e.g. a container gateway); it is validated as an IP and falls back to loopback. `ListenAddr` is split into `listenHost`/`listenPort` helpers, with tests. Behavior change: setups that relied on reaching the netstack SOCKS5 proxy from another host must now set `NB_SOCKS5_LISTENER_ADDRESS=0.0.0.0` explicitly. ## Issue ticket number and link Internal security hardening of the netstack SOCKS5 listener bind address ([client/iface/netstack/env.go](https://github.com/netbirdio/netbird/blob/main/client/iface/netstack/env.go)). ## Stack - `0.74.7-branch` - ⚠️ No PR associated with branch <!-- branch-stack --> - \#6812 :point\_left: ### Checklist - [x] Is it a bug fix - [ ] Is a typo/documentation fix - [ ] Is a feature enhancement - [ ] It is a refactor - [x] Created tests that fail without the change (if possible) - [ ] This change does **not** modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — **OR** I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first). > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [x] I added/updated documentation for this change - [ ] Documentation is **not needed** for this change (explain why) ### Docs PR URL (required if "docs added" is checked) Paste the PR link from <https://github.com/netbirdio/docs> here: <https://github.com/netbirdio/docs/pull/860> <!-- codesmith:footer --> *** <a href="https://app.blacksmith.sh/netbirdio/codesmith/netbird/pr/6812"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img alt="View with Codesmith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1786872199&installation_id=146802194&pr_number=6812&repository=netbirdio%2Fnetbird&return_to=https%3A%2F%2Fgithub.com%2Fnetbirdio%2Fnetbird%2Fpull%2F6812&signature=6e78df77b784915baee9647b555483a8f7550a604d5393edcc501dd8f58b1395"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with Codesmith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a> <sup>Need help on this PR? Tag <code>/codesmith</code> with what you need. Autofix is disabled.</sup> <!-- codesmith:autofix:disabled --> <!-- /codesmith:footer --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added configuration options for the SOCKS5 listener’s bind address and port. - SOCKS5 now defaults to listening only on the local machine for improved security. - Valid address and port overrides are supported, with safe defaults used for invalid values. - **Tests** - Added coverage for default settings and valid or invalid address and port configurations. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
64 lines
1.8 KiB
Go
64 lines
1.8 KiB
Go
//go:build !js
|
|
|
|
package netstack
|
|
|
|
import (
|
|
"net"
|
|
"strconv"
|
|
"testing"
|
|
)
|
|
|
|
func TestListenAddr_DefaultsToLoopback(t *testing.T) {
|
|
// No env overrides: must bind loopback, never all interfaces.
|
|
got := ListenAddr()
|
|
want := net.JoinHostPort("127.0.0.1", strconv.Itoa(DefaultSocks5Port))
|
|
if got != want {
|
|
t.Fatalf("ListenAddr() = %q, want %q", got, want)
|
|
}
|
|
}
|
|
|
|
func TestListenAddr_AddressOverride(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
env string
|
|
want string
|
|
}{
|
|
{name: "valid override honored", env: "0.0.0.0", want: "0.0.0.0"},
|
|
{name: "valid specific ip honored", env: "10.0.0.5", want: "10.0.0.5"},
|
|
{name: "ipv6 loopback bracketed", env: "::1", want: "::1"},
|
|
{name: "invalid falls back to loopback", env: "not-an-ip", want: "127.0.0.1"},
|
|
{name: "empty falls back to loopback", env: "", want: "127.0.0.1"},
|
|
}
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Setenv(EnvSocks5ListenerAddress, tc.env)
|
|
want := net.JoinHostPort(tc.want, strconv.Itoa(DefaultSocks5Port))
|
|
if got := ListenAddr(); got != want {
|
|
t.Fatalf("ListenAddr() = %q, want %q", got, want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestListenAddr_PortOverride(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
env string
|
|
want int
|
|
}{
|
|
{name: "valid port honored", env: "1081", want: 1081},
|
|
{name: "non-numeric falls back", env: "abc", want: DefaultSocks5Port},
|
|
{name: "out of range falls back", env: "70000", want: DefaultSocks5Port},
|
|
{name: "zero falls back", env: "0", want: DefaultSocks5Port},
|
|
}
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Setenv(EnvSocks5ListenerPort, tc.env)
|
|
want := net.JoinHostPort("127.0.0.1", strconv.Itoa(tc.want))
|
|
if got := ListenAddr(); got != want {
|
|
t.Fatalf("ListenAddr() = %q, want %q", got, want)
|
|
}
|
|
})
|
|
}
|
|
}
|