[management] Validate peer ownership during login (#2704)

* check peer ownership in login Signed-off-by: bcmmbaga <[email protected]> * update error message Signed-off-by: bcmmbaga <[email protected]> --------- Signed-off-by: bcmmbaga <[email protected]>
netbirdio · Oct 7, 2024 · 2c1f5e4 · 2c1f5e4
1 parent dbec24b
commit 2c1f5e4
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/management/server/peer.go b/management/server/peer.go
@@ -693,6 +693,11 @@ func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login PeerLogin)
  updateRemotePeers := false
 
  if login.UserID != "" {
+ if peer.UserID != login.UserID {
+ log.Warnf("user mismatch when logging in peer %s: peer user %s, login user %s ", peer.ID, peer.UserID, login.UserID)
+ return nil, nil, nil, status.Errorf(status.Unauthenticated, "invalid user")
+ }
+
  changed, err := am.handleUserPeer(ctx, peer, settings)
  if err != nil {
  return nil, nil, nil, err