[PR #6675] [codex] Add access control flags to netbird expose #29792

Open
opened 2026-08-05 08:08:58 -04:00 by saavagebueno · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/netbirdio/netbird/pull/6675
Author: @constantins2001
Created: 7/6/2026
Status: 🔄 Open

Base: mainHead: codex/expose-access-control-flags


📝 Commits (2)

  • 4bf3a3c Add expose access control flags
  • ee25f12 Address expose access control review feedback

📊 Changes

15 files changed (+1417 additions, -959 deletions)

View changed files

📝 client/cmd/expose.go (+103 -7)
client/cmd/expose_test.go (+74 -0)
📝 client/internal/expose/manager.go (+9 -8)
📝 client/internal/expose/manager_test.go (+31 -0)
📝 client/internal/expose/request.go (+30 -16)
📝 client/proto/daemon.pb.go (+237 -153)
📝 client/proto/daemon.proto (+8 -0)
📝 management/internals/modules/reverseproxy/service/service.go (+3 -1)
📝 management/internals/modules/reverseproxy/service/service_test.go (+40 -0)
📝 management/internals/shared/grpc/expose_service.go (+14 -0)
management/internals/shared/grpc/expose_service_test.go (+25 -0)
📝 shared/management/client/grpc.go (+37 -16)
shared/management/client/grpc_expose_test.go (+29 -0)
📝 shared/management/proto/management.pb.go (+775 -758)
📝 shared/management/proto/management.proto (+2 -0)

📄 Description

Describe your changes

Adds CLI parity for reverse-proxy Access Control Rules when creating peer-initiated expose services with netbird expose.

The new flags are:

  • --allow-ip
  • --block-ip
  • --allow-cidr
  • --block-cidr
  • --allow-country
  • --block-country

Single IP flags are normalized to /32 or /128 CIDRs before being sent to management, matching the existing reverse-proxy access restriction model.

Implementation details:

  • Threads access restrictions through the daemon expose request, management expose request, and reverse-proxy peer service creation flow.
  • Reuses the existing AccessRestrictions backend model and validation.
  • Keeps auth flag behavior unchanged: L4/TLS still reject password/PIN/user-group auth, while access restrictions apply to both HTTP and L4 services.
  • Preserves crowdsec_mode when peer-created expose services receive the shared AccessRestrictions proto.
  • Adds focused tests for CLI normalization, request conversion, proto mapping, service validation, and service construction.

Closes https://github.com/netbirdio/netbird/issues/6673

Discussion-first validation: https://github.com/netbirdio/netbird/discussions/6676

Stack

Single-PR change; no stacked dependencies.

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)
  • This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See CONTRIBUTING.md.

This PR is intentionally kept as draft while the discussion-first validation happens in https://github.com/netbirdio/netbird/discussions/6676.

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

  • I added/updated documentation for this change
  • Documentation is not needed for this change (explain why)

The CLI help output is updated by the Cobra flags in this PR. External docs can be added in netbirdio/docs after maintainers confirm the CLI/API shape.

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__

Validation

  • GOCACHE=/private/tmp/netbird-go-build-cache GOMODCACHE=/private/tmp/netbird-go-mod-cache go test ./client/cmd ./management/internals/shared/grpc
  • GOCACHE=/private/tmp/netbird-go-build-cache GOMODCACHE=/private/tmp/netbird-go-mod-cache go test ./client/cmd ./client/internal/expose ./shared/management/client ./management/internals/modules/reverseproxy/service ./management/internals/shared/grpc ./management/internals/modules/reverseproxy/service/manager
  • git diff --check

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbirdio/netbird/pull/6675 **Author:** [@constantins2001](https://github.com/constantins2001) **Created:** 7/6/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/expose-access-control-flags` --- ### 📝 Commits (2) - [`4bf3a3c`](https://github.com/netbirdio/netbird/commit/4bf3a3cdc4691a52458b768590a89e616681599a) Add expose access control flags - [`ee25f12`](https://github.com/netbirdio/netbird/commit/ee25f1237a4964bec199cc7195563f0521a079c8) Address expose access control review feedback ### 📊 Changes **15 files changed** (+1417 additions, -959 deletions) <details> <summary>View changed files</summary> 📝 `client/cmd/expose.go` (+103 -7) ➕ `client/cmd/expose_test.go` (+74 -0) 📝 `client/internal/expose/manager.go` (+9 -8) 📝 `client/internal/expose/manager_test.go` (+31 -0) 📝 `client/internal/expose/request.go` (+30 -16) 📝 `client/proto/daemon.pb.go` (+237 -153) 📝 `client/proto/daemon.proto` (+8 -0) 📝 `management/internals/modules/reverseproxy/service/service.go` (+3 -1) 📝 `management/internals/modules/reverseproxy/service/service_test.go` (+40 -0) 📝 `management/internals/shared/grpc/expose_service.go` (+14 -0) ➕ `management/internals/shared/grpc/expose_service_test.go` (+25 -0) 📝 `shared/management/client/grpc.go` (+37 -16) ➕ `shared/management/client/grpc_expose_test.go` (+29 -0) 📝 `shared/management/proto/management.pb.go` (+775 -758) 📝 `shared/management/proto/management.proto` (+2 -0) </details> ### 📄 Description ## Describe your changes Adds CLI parity for reverse-proxy Access Control Rules when creating peer-initiated expose services with `netbird expose`. The new flags are: - `--allow-ip` - `--block-ip` - `--allow-cidr` - `--block-cidr` - `--allow-country` - `--block-country` Single IP flags are normalized to `/32` or `/128` CIDRs before being sent to management, matching the existing reverse-proxy access restriction model. Implementation details: - Threads access restrictions through the daemon expose request, management expose request, and reverse-proxy peer service creation flow. - Reuses the existing `AccessRestrictions` backend model and validation. - Keeps auth flag behavior unchanged: L4/TLS still reject password/PIN/user-group auth, while access restrictions apply to both HTTP and L4 services. - Preserves `crowdsec_mode` when peer-created expose services receive the shared `AccessRestrictions` proto. - Adds focused tests for CLI normalization, request conversion, proto mapping, service validation, and service construction. ## Issue ticket number and link Closes https://github.com/netbirdio/netbird/issues/6673 Discussion-first validation: https://github.com/netbirdio/netbird/discussions/6676 ## Stack <!-- branch-stack --> Single-PR change; no stacked dependencies. ### Checklist - [ ] Is it a bug fix - [ ] Is a typo/documentation fix - [x] Is a feature enhancement - [ ] It is a refactor - [x] Created tests that fail without the change (if possible) - [ ] This change does **not** modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — **OR** I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first). This PR is intentionally kept as draft while the discussion-first validation happens in https://github.com/netbirdio/netbird/discussions/6676. > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [ ] I added/updated documentation for this change - [x] Documentation is **not needed** for this change (explain why) The CLI help output is updated by the Cobra flags in this PR. External docs can be added in `netbirdio/docs` after maintainers confirm the CLI/API shape. ### Docs PR URL (required if "docs added" is checked) Paste the PR link from https://github.com/netbirdio/docs here: https://github.com/netbirdio/docs/pull/__ ## Validation - `GOCACHE=/private/tmp/netbird-go-build-cache GOMODCACHE=/private/tmp/netbird-go-mod-cache go test ./client/cmd ./management/internals/shared/grpc` - `GOCACHE=/private/tmp/netbird-go-build-cache GOMODCACHE=/private/tmp/netbird-go-mod-cache go test ./client/cmd ./client/internal/expose ./shared/management/client ./management/internals/modules/reverseproxy/service ./management/internals/shared/grpc ./management/internals/modules/reverseproxy/service/manager` - `git diff --check` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
saavagebueno added the pull-request label 2026-08-05 08:08:58 -04:00
Sign in to join this conversation.
No Label pull-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#29792