mirror of
https://github.com/netbirdio/netbird.git
synced 2026-04-16 07:16:38 +00:00
c5186f1483
Implement sideband authorization and credential provider architecture for passwordless RDP access to Windows peers via NetBird. Go components: - Sideband RDP auth server (TCP on WG interface, port 3390/22023) - Pending session store with TTL expiry and replay protection - Named pipe IPC server (\\.\pipe\netbird-rdp-auth) for credential provider - Sideband client for connecting peer to request authorization - CLI command `netbird rdp [user@]host` with JWT auth flow - Engine integration with DNAT port redirection Rust credential provider DLL (client/rdp/credprov/): - COM DLL implementing ICredentialProvider + ICredentialProviderCredential - Loaded by Windows LogonUI.exe at the RDP login screen - Queries NetBird agent via named pipe for pending sessions - Performs S4U logon (LsaLogonUser) for passwordless Windows token creation - Self-registration via regsvr32 (DllRegisterServer/DllUnregisterServer) https://claude.ai/code/session_01C38bCDyYzLgxYLVwJkcUng
22 lines
445 B
Go
22 lines
445 B
Go
package server
|
|
|
|
import (
|
|
"fmt"
|
|
"net/netip"
|
|
)
|
|
|
|
// parseAddr parses a string into a netip.Addr, stripping any port or zone.
|
|
func parseAddr(s string) (netip.Addr, error) {
|
|
// Try as plain IP first
|
|
if addr, err := netip.ParseAddr(s); err == nil {
|
|
return addr, nil
|
|
}
|
|
|
|
// Try as IP:port
|
|
if addrPort, err := netip.ParseAddrPort(s); err == nil {
|
|
return addrPort.Addr(), nil
|
|
}
|
|
|
|
return netip.Addr{}, fmt.Errorf("invalid IP address: %s", s)
|
|
}
|