grpc

package
v0.65.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 17, 2026 License: BSD-3-Clause, AGPL-3.0 Imports: 71 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ProxyTokenContextKey = proxyTokenContextKey{}

ProxyTokenContextKey is the typed key used to store validated token info in context.

Functions

func GetProxyTokenFromContext added in v0.65.0 

func GetProxyTokenFromContext(ctx context.Context) *types.ProxyAccessToken

GetProxyTokenFromContext retrieves the validated proxy token from the context

func NewProxyAuthInterceptors added in v0.65.0 

func NewProxyAuthInterceptors(tokenStore proxyTokenStore) (grpc.UnaryServerInterceptor, grpc.StreamServerInterceptor, func())

NewProxyAuthInterceptors creates gRPC unary and stream interceptors that validate proxy access tokens. They only intercept ProxyService methods. Both interceptors share state for last-used and failure rate limiting. The returned close function must be called on shutdown to stop background goroutines.

func ToResponseProto 

func ToResponseProto(configProto nbconfig.Protocol) proto.HostConfig_Protocol

func ToSyncResponse 

func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, peer *nbpeer.Peer, turnCredentials *Token, relayCredentials *Token, networkMap *types.NetworkMap, dnsName string, checks []*posture.Checks, dnsCache *cache.DNSConfigCache, settings *types.Settings, extraSettings *types.ExtraSettings, peerGroups []string, dnsFwdPort int64) *proto.SyncResponse

Types

type ClusterInfo added in v0.65.0 

type ClusterInfo struct {
	Address          string
	ConnectedProxies int
}

ClusterInfo contains information about a proxy cluster.

type OneTimeTokenStore added in v0.65.0 

type OneTimeTokenStore struct {
	// contains filtered or unexported fields
}

OneTimeTokenStore manages short-lived, single-use authentication tokens for proxy-to-management RPC authentication. Tokens are generated when a service is created and must be used exactly once by the proxy to authenticate a subsequent RPC call.

func NewOneTimeTokenStore added in v0.65.0 

func NewOneTimeTokenStore(cleanupInterval time.Duration) *OneTimeTokenStore

NewOneTimeTokenStore creates a new token store with automatic cleanup of expired tokens. The cleanupInterval determines how often expired tokens are removed from memory.

func (*OneTimeTokenStore) Close added in v0.65.0 

func (s *OneTimeTokenStore) Close()

Close stops the cleanup goroutine and releases resources

func (*OneTimeTokenStore) GenerateToken added in v0.65.0 

func (s *OneTimeTokenStore) GenerateToken(accountID, serviceID string, ttl time.Duration) (string, error)

GenerateToken creates a new cryptographically secure one-time token with the specified TTL. The token is associated with a specific accountID and serviceID for validation purposes.

Returns the generated token string or an error if random generation fails.

func (*OneTimeTokenStore) GetTokenCount added in v0.65.0 

func (s *OneTimeTokenStore) GetTokenCount() int

GetTokenCount returns the current number of tokens in the store (for debugging/metrics)

func (*OneTimeTokenStore) ValidateAndConsume added in v0.65.0 

func (s *OneTimeTokenStore) ValidateAndConsume(token, accountID, serviceID string) error

ValidateAndConsume verifies the token against the provided accountID and serviceID, checks expiration, and then deletes it to enforce single-use.

This method uses constant-time comparison to prevent timing attacks.

Returns nil on success, or an error if: - Token doesn't exist - Token has expired - Account ID doesn't match - Reverse proxy ID doesn't match

type ProxyOIDCConfig added in v0.65.0 

type ProxyOIDCConfig struct {
	Issuer      string
	ClientID    string
	Scopes      []string
	CallbackURL string
	HMACKey     []byte

	Audience     string
	KeysLocation string
}

type ProxyServiceServer added in v0.65.0 

type ProxyServiceServer struct {
	proto.UnimplementedProxyServiceServer
	// contains filtered or unexported fields
}

ProxyServiceServer implements the ProxyService gRPC server

func NewProxyServiceServer added in v0.65.0 

func NewProxyServiceServer(accessLogMgr accesslogs.Manager, tokenStore *OneTimeTokenStore, oidcConfig ProxyOIDCConfig, peersManager peers.Manager, usersManager users.Manager) *ProxyServiceServer

NewProxyServiceServer creates a new proxy service server.

func (*ProxyServiceServer) Authenticate added in v0.65.0 

func (s *ProxyServiceServer) Authenticate(ctx context.Context, req *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error)

func (*ProxyServiceServer) Close added in v0.65.0 

func (s *ProxyServiceServer) Close()

Close stops background goroutines.

func (*ProxyServiceServer) CreateProxyPeer added in v0.65.0 

func (s *ProxyServiceServer) CreateProxyPeer(ctx context.Context, req *proto.CreateProxyPeerRequest) (*proto.CreateProxyPeerResponse, error)

CreateProxyPeer handles proxy peer creation with one-time token authentication

func (*ProxyServiceServer) GenerateSessionToken added in v0.65.0 

func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, userID string, method proxyauth.Method) (string, error)

GenerateSessionToken creates a signed session JWT for the given domain and user.

func (*ProxyServiceServer) GetAvailableClusters added in v0.65.0 

func (s *ProxyServiceServer) GetAvailableClusters() []ClusterInfo

GetAvailableClusters returns information about all connected proxy clusters.

func (*ProxyServiceServer) GetConnectedProxies added in v0.65.0 

func (s *ProxyServiceServer) GetConnectedProxies() []string

GetConnectedProxies returns a list of connected proxy IDs

func (*ProxyServiceServer) GetConnectedProxyURLs added in v0.65.0 

func (s *ProxyServiceServer) GetConnectedProxyURLs() []string

GetConnectedProxyURLs returns a deduplicated list of URLs from all connected proxies.

func (*ProxyServiceServer) GetMappingUpdate added in v0.65.0 

func (s *ProxyServiceServer) GetMappingUpdate(req *proto.GetMappingUpdateRequest, stream proto.ProxyService_GetMappingUpdateServer) error

GetMappingUpdate handles the control stream with proxy clients

func (*ProxyServiceServer) GetOIDCConfig added in v0.65.0 

func (s *ProxyServiceServer) GetOIDCConfig() ProxyOIDCConfig

GetOIDCConfig returns the OIDC configuration for token validation.

func (*ProxyServiceServer) GetOIDCURL added in v0.65.0 

func (s *ProxyServiceServer) GetOIDCURL(ctx context.Context, req *proto.GetOIDCURLRequest) (*proto.GetOIDCURLResponse, error)

func (*ProxyServiceServer) GetOIDCValidationConfig added in v0.65.0 

func (s *ProxyServiceServer) GetOIDCValidationConfig() reverseproxy.OIDCValidationConfig

GetOIDCValidationConfig returns the OIDC configuration for token validation in the format needed by ToProtoMapping.

func (*ProxyServiceServer) SendAccessLog added in v0.65.0 

func (s *ProxyServiceServer) SendAccessLog(ctx context.Context, req *proto.SendAccessLogRequest) (*proto.SendAccessLogResponse, error)

SendAccessLog processes access log from proxy

func (*ProxyServiceServer) SendServiceUpdate added in v0.65.0 

func (s *ProxyServiceServer) SendServiceUpdate(update *proto.ProxyMapping)

SendServiceUpdate broadcasts a service update to all connected proxy servers. Management should call this when services are created/updated/removed. For create/update operations a unique one-time auth token is generated per proxy so that every replica can independently authenticate with management.

func (*ProxyServiceServer) SendServiceUpdateToCluster added in v0.65.0 

func (s *ProxyServiceServer) SendServiceUpdateToCluster(update *proto.ProxyMapping, clusterAddr string)

SendServiceUpdateToCluster sends a service update to all proxy servers in a specific cluster. If clusterAddr is empty, broadcasts to all connected proxy servers (backward compatibility). For create/update operations a unique one-time auth token is generated per proxy so that every replica can independently authenticate with management.

func (*ProxyServiceServer) SendStatusUpdate added in v0.65.0 

func (s *ProxyServiceServer) SendStatusUpdate(ctx context.Context, req *proto.SendStatusUpdateRequest) (*proto.SendStatusUpdateResponse, error)

SendStatusUpdate handles status updates from proxy clients

func (*ProxyServiceServer) SetProxyManager added in v0.65.0 

func (s *ProxyServiceServer) SetProxyManager(manager reverseproxy.Manager)

func (*ProxyServiceServer) ValidateSession added in v0.65.0 

func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.ValidateSessionRequest) (*proto.ValidateSessionResponse, error)

ValidateSession validates a session token and checks if the user has access to the domain.

func (*ProxyServiceServer) ValidateState added in v0.65.0 

func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL string, err error)

ValidateState validates the state parameter from an OAuth callback. Returns the original redirect URL if valid, or an error if invalid.

func (*ProxyServiceServer) ValidateUserGroupAccess added in v0.65.0 

func (s *ProxyServiceServer) ValidateUserGroupAccess(ctx context.Context, domain, userID string) error

ValidateUserGroupAccess checks if a user has access to a service. It looks up the service within the user's account only, then optionally checks group membership if BearerAuth with DistributionGroups is configured.

type SecretsManager 

type SecretsManager interface {
	GenerateTurnToken() (*Token, error)
	GenerateRelayToken() (*Token, error)
	SetupRefresh(ctx context.Context, accountID, peerKey string)
	CancelRefresh(peerKey string)
	GetWGKey() (wgtypes.Key, error)
}

SecretsManager used to manage TURN and relay secrets

type Server 

type Server struct {
	proto.UnimplementedManagementServiceServer
	// contains filtered or unexported fields
}

Server an instance of a Management gRPC API server

func NewServer 

func NewServer(
	config *nbconfig.Config,
	accountManager account.Manager,
	settingsManager settings.Manager,
	jobManager *job.Manager,
	secretsManager SecretsManager,
	appMetrics telemetry.AppMetrics,
	authManager auth.Manager,
	integratedPeerValidator integrated_validator.IntegratedValidator,
	networkMapController network_map.Controller,
	oAuthConfigProvider idp.OAuthConfigProvider,
) (*Server, error)

NewServer creates a new Management server

func (*Server) GetDeviceAuthorizationFlow 

func (s *Server) GetDeviceAuthorizationFlow(ctx context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error)

GetDeviceAuthorizationFlow returns a device authorization flow information This is used for initiating an Oauth 2 device authorization grant flow which will be used by our clients to Login

func (*Server) GetPKCEAuthorizationFlow 

func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error)

GetPKCEAuthorizationFlow returns a pkce authorization flow information This is used for initiating an Oauth 2 pkce authorization grant flow which will be used by our clients to Login

func (*Server) GetServerKey 

func (s *Server) GetServerKey(ctx context.Context, req *proto.Empty) (*proto.ServerKeyResponse, error)

func (*Server) IsHealthy 

func (s *Server) IsHealthy(ctx context.Context, req *proto.Empty) (*proto.Empty, error)

IsHealthy indicates whether the service is healthy

func (*Server) Job added in v0.64.0 

func (s *Server) Job(srv proto.ManagementService_JobServer) error

func (*Server) Login 

func (s *Server) Login(ctx context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error)

Login endpoint first checks whether peer is registered under any account In case it is, the login is successful In case it isn't, the endpoint checks whether setup key is provided within the request and tries to register a peer. In case of the successful registration login is also successful

func (*Server) Logout 

func (s *Server) Logout(ctx context.Context, req *proto.EncryptedMessage) (*proto.Empty, error)

func (*Server) Sync 

func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_SyncServer) error

Sync validates the existence of a connecting peer, sends an initial state (all available for the connecting peers) and notifies the connected peer of any updates (e.g. new peers under the same account)

func (*Server) SyncMeta 

func (s *Server) SyncMeta(ctx context.Context, req *proto.EncryptedMessage) (*proto.Empty, error)

SyncMeta endpoint is used to synchronize peer's system metadata and notifies the connected, peer's under the same account of any updates.

type TimeBasedAuthSecretsManager 

type TimeBasedAuthSecretsManager struct {
	// contains filtered or unexported fields
}

TimeBasedAuthSecretsManager generates credentials with TTL and using pre-shared secret known to TURN server

func NewTimeBasedAuthSecretsManager 

func NewTimeBasedAuthSecretsManager(updateManager network_map.PeersUpdateManager, turnCfg *nbconfig.TURNConfig, relayCfg *nbconfig.Relay, settingsManager settings.Manager, groupsManager groups.Manager) (*TimeBasedAuthSecretsManager, error)

func (*TimeBasedAuthSecretsManager) CancelRefresh 

func (m *TimeBasedAuthSecretsManager) CancelRefresh(peerID string)

CancelRefresh cancels scheduled peer credentials refresh

func (*TimeBasedAuthSecretsManager) GenerateRelayToken 

func (m *TimeBasedAuthSecretsManager) GenerateRelayToken() (*Token, error)

GenerateRelayToken generates new time-based secret credentials for relay

func (*TimeBasedAuthSecretsManager) GenerateTurnToken 

func (m *TimeBasedAuthSecretsManager) GenerateTurnToken() (*Token, error)

GenerateTurnToken generates new time-based secret credentials for TURN

func (*TimeBasedAuthSecretsManager) GetWGKey added in v0.60.5 

func (m *TimeBasedAuthSecretsManager) GetWGKey() (wgtypes.Key, error)

GetWGKey returns WireGuard private key used to generate peer keys

func (*TimeBasedAuthSecretsManager) SetupRefresh 

func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountID, peerID string)

SetupRefresh starts peer credentials refresh

type Token 

type Token auth.Token

type UpdateDebouncer added in v0.64.6 

type UpdateDebouncer struct {
	// contains filtered or unexported fields
}

UpdateDebouncer implements a backpressure mechanism that: - Sends the first update immediately - Coalesces rapid subsequent network map updates (only latest matters) - Queues control/config updates (all must be delivered) - Preserves the order of messages (important for control configs between network maps) - Ensures pending updates are sent after a quiet period

func NewUpdateDebouncer added in v0.64.6 

func NewUpdateDebouncer(interval time.Duration) *UpdateDebouncer

NewUpdateDebouncer creates a new debouncer with the specified interval

func (*UpdateDebouncer) GetPendingUpdates added in v0.64.6 

func (d *UpdateDebouncer) GetPendingUpdates() []*network_map.UpdateMessage

GetPendingUpdates returns and clears all pending updates after timer expiration. Updates are returned in the order they were received, with consecutive network maps already coalesced to only the latest one. If there were pending updates, it restarts the timer to continue debouncing. If there were no pending updates, it clears the timer (true quiet period).

func (*UpdateDebouncer) ProcessUpdate added in v0.64.6 

func (d *UpdateDebouncer) ProcessUpdate(update *network_map.UpdateMessage) bool

ProcessUpdate handles an incoming update and returns whether it should be sent immediately

func (*UpdateDebouncer) Stop added in v0.64.6 

func (d *UpdateDebouncer) Stop()

Stop stops the debouncer and cleans up resources

func (*UpdateDebouncer) TimerChannel added in v0.64.6 

func (d *UpdateDebouncer) TimerChannel() <-chan time.Time

TimerChannel returns the timer channel for select statements

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.