GO-2024-3057: NetBird uses a static initialization vector (IV) in github.com/netbirdio/netbird

systemops

package

v0.54.2 Latest Latest Go to latest Published: Aug 13, 2025 License: BSD-3-Clause Imports: 28 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/netbirdio/netbird

Links

Open Source Insights

Documentation ¶

Rendered for

Index ¶

Constants
Variables
func EnableIPForwarding() error
func GetRoutesFromTable() ([]netip.Prefix, error)
func IsAddrRouted(addr netip.Addr, vpnRoutes []netip.Prefix) (bool, netip.Prefix)
type DetailedRoute
- func GetDetailedRoutesFromTable() ([]DetailedRoute, error)
type ExclusionCounter
type IPRule
- func GetIPRules() ([]IPRule, error)
type Nexthop
- func GetNextHop(ip netip.Addr) (Nexthop, error)
- func (n Nexthop) Equal(other Nexthop) bool
- func (n Nexthop) String() string
type Route
type ShutdownState
type SysOps
- func NewSysOps(wgInterface wgIface, notifier *notifier.Notifier) *SysOps

Constants ¶

View Source

const (
	// NetbirdVPNTableID is the ID of the custom routing table used by Netbird.
	NetbirdVPNTableID = 0x1BD0
	// NetbirdVPNTableName is the name of the custom routing table used by Netbird.
	NetbirdVPNTableName = "netbird"
)

Variables ¶

View Source

var ErrRoutingIsSeparate = errors.New("routing is separate")

View Source

var ErrTableIDExists = errors.New("ID exists with different name")

Functions ¶

func EnableIPForwarding ¶

func EnableIPForwarding() error

func GetRoutesFromTable ¶ added in v0.28.7

func GetRoutesFromTable() ([]netip.Prefix, error)

func IsAddrRouted ¶

func IsAddrRouted(addr netip.Addr, vpnRoutes []netip.Prefix) (bool, netip.Prefix)

IsAddrRouted checks if the candidate address would route to the vpn, in which case it returns true and the matched prefix.

Types ¶

type DetailedRoute ¶ added in v0.52.0

type DetailedRoute struct {
	Route
	Metric          int
	InterfaceMetric int
	InterfaceIndex  int
	Protocol        string
	Scope           string
	Type            string
	Table           string
	Flags           string
}

DetailedRoute extends Route with additional metadata for display and debugging

func GetDetailedRoutesFromTable ¶ added in v0.52.0

func GetDetailedRoutesFromTable() ([]DetailedRoute, error)

GetDetailedRoutesFromTable returns detailed route information from all routing tables

type ExclusionCounter ¶

type ExclusionCounter = refcounter.Counter[netip.Prefix, struct{}, Nexthop]

type IPRule ¶ added in v0.52.0

type IPRule struct {
	Priority     int
	From         netip.Prefix
	To           netip.Prefix
	IIF          string
	OIF          string
	Table        string
	Action       string
	Mark         uint32
	Mask         uint32
	TunID        uint32
	Goto         uint32
	Flow         uint32
	SuppressPlen int
	SuppressIFL  int
	Invert       bool
}

IPRule contains IP rule information for debugging

func GetIPRules ¶ added in v0.52.0

func GetIPRules() ([]IPRule, error)

GetIPRules returns IP rules for debugging

type Nexthop ¶

type Nexthop struct {
	IP   netip.Addr
	Intf *net.Interface
}

func GetNextHop ¶

func GetNextHop(ip netip.Addr) (Nexthop, error)

func (Nexthop) Equal ¶ added in v0.43.3

func (n Nexthop) Equal(other Nexthop) bool

Equal checks if two nexthops are equal.

func (Nexthop) String ¶ added in v0.43.3

func (n Nexthop) String() string

String returns a string representation of the nexthop.

type Route ¶ added in v0.52.0

type Route struct {
	Dst       netip.Prefix
	Gw        netip.Addr
	Interface *net.Interface
}

Route represents a basic network route with core routing information

type ShutdownState ¶ added in v0.30.3

type ShutdownState ExclusionCounter

func (*ShutdownState) Cleanup ¶ added in v0.30.3

func (s *ShutdownState) Cleanup() error

func (*ShutdownState) MarshalJSON ¶ added in v0.32.0

func (s *ShutdownState) MarshalJSON() ([]byte, error)

func (*ShutdownState) Name ¶ added in v0.30.3

func (s *ShutdownState) Name() string

func (*ShutdownState) UnmarshalJSON ¶ added in v0.32.0

func (s *ShutdownState) UnmarshalJSON(data []byte) error

type SysOps ¶

type SysOps struct {
	// contains filtered or unexported fields
}

func NewSysOps ¶

func NewSysOps(wgInterface wgIface, notifier *notifier.Notifier) *SysOps

func (*SysOps) AddVPNRoute ¶

func (r *SysOps) AddVPNRoute(prefix netip.Prefix, intf *net.Interface) error

func (*SysOps) CleanupRouting ¶

func (r *SysOps) CleanupRouting(stateManager *statemanager.Manager) error

CleanupRouting performs a thorough cleanup of the routing configuration established by 'setupRouting'. It systematically removes the three rules and any associated routing table entries to ensure a clean state. The function uses error aggregation to report any errors encountered during the cleanup process.

func (*SysOps) RemoveVPNRoute ¶

func (r *SysOps) RemoveVPNRoute(prefix netip.Prefix, intf *net.Interface) error

func (*SysOps) SetupRouting ¶

func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager.Manager) (err error)

SetupRouting establishes the routing configuration for the VPN, including essential rules to ensure proper traffic flow for management, locally configured routes, and VPN traffic.

Rule 1 (Main Route Precedence): Safeguards locally installed routes by giving them precedence over potential routes received and configured for the VPN. This rule is skipped for the default route and routes that are not in the main table.

Rule 2 (VPN Traffic Routing): Directs all remaining traffic to the 'NetbirdVPNTableID' custom routing table. This table is where a default route or other specific routes received from the management server are configured, enabling VPN connectivity.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL