From 07bcac7cd95a03184a2ceac6676da5e07944b253 Mon Sep 17 00:00:00 2001 From: Alessandro Frigerio Date: Mon, 21 Sep 2026 14:08:50 +0000 Subject: [PATCH] TUN-10803: Wire Quick Tunnel callback authorization Initializes recipient policy, assertion validation, and session management for protected Quick Tunnels. --- cmd/cloudflared/tunnel/quick_tunnel.go | 29 ++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/cmd/cloudflared/tunnel/quick_tunnel.go b/cmd/cloudflared/tunnel/quick_tunnel.go index f8abcf57..5cc1fcd0 100644 --- a/cmd/cloudflared/tunnel/quick_tunnel.go +++ b/cmd/cloudflared/tunnel/quick_tunnel.go @@ -47,7 +47,14 @@ func RunQuickTunnel(sc *subcommandContext) error { // TODO(TUN-10798): register the --allowed-mail flag so this path becomes reachable. allowedMail := sc.c.StringSlice(flags.AllowedMail) - isProtected := len(allowedMail) > 0 + var recipientPolicy *quicktunnelauth.QuickTunnelAuthRecipientPolicy + if len(allowedMail) > 0 { + var err error + recipientPolicy, err = quicktunnelauth.NewQuickTunnelAuthRecipientPolicy(allowedMail) + if err != nil { + return fmt.Errorf("validate Quick Tunnel recipient policy: %w", err) + } + } client := http.Client{ Transport: &http.Transport{ @@ -57,7 +64,7 @@ func RunQuickTunnel(sc *subcommandContext) error { Timeout: httpTimeout, } - reqBody, err := buildQuickTunnelRequestBody(isProtected) + reqBody, err := buildQuickTunnelRequestBody(recipientPolicy != nil) if err != nil { return errors.Wrap(err, "failed to build quick tunnel request body") } @@ -118,12 +125,26 @@ func RunQuickTunnel(sc *subcommandContext) error { } var quickTunnelAuth connection.HTTPRequestInterceptor - if isProtected { + if recipientPolicy != nil { stateManager, err := quicktunnelauth.NewQuickTunnelAuthStateManager(data.Result.Hostname) if err != nil { return fmt.Errorf("initialize Quick Tunnel authentication state: %w", err) } - quickTunnelAuth, err = quicktunnelauth.NewQuickTunnelAuthHandler(stateManager) + assertionValidator, err := quicktunnelauth.NewQuickTunnelAuthAssertionValidator() + if err != nil { + return fmt.Errorf("initialize Quick Tunnel assertion validator: %w", err) + } + defer assertionValidator.Close() + sessionManager, err := quicktunnelauth.NewQuickTunnelAuthSessionManager() + if err != nil { + return fmt.Errorf("initialize Quick Tunnel session manager: %w", err) + } + quickTunnelAuth, err = quicktunnelauth.NewQuickTunnelAuthHandlerWithAuthorization( + stateManager, + assertionValidator, + sessionManager, + recipientPolicy, + ) if err != nil { return fmt.Errorf("initialize Quick Tunnel authentication handler: %w", err) }