Sovran_Systems/Sovran_SystemsOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 12 Wiki Activity

hub: answer the local network only, whichever way a client arrives

Browse Source 
The reported bug was the Hub being reachable from outside the local
network when Server + Desktop is active. c33457f guards the Caddy site
for sovransystemsos.local, but the Hub is an application that also
listens on a port of its own (8937), and a check in Caddy does nothing
for a client that never goes through Caddy. Whether a client could reach
the Hub depended on which door it used.

The Hub now asks the question itself. LanOnlyMiddleware is registered
outermost, so a client that is not on this computer or the local network
gets a bare 403 before authentication is considered; it never sees the
login page.

- Local means loopback, 10/8, 172.16/12, 192.168/16, 100.64/10
  (Tailscale and other CGNAT/VPN ranges) and 169.254/16 over IPv4, and
  ::1, fc00::/7 and fe80::/10 over IPv6.
- IPv6 global addresses are not on the list. A global address belonging
  to a laptop on the LAN cannot be told apart from a stranger's by the
  address alone, and 2000::/3 is every public IPv6 address there is.
- ::ffff:a.b.c.d is read as the IPv4 address inside it.
- sovran_systemsOS.hub.extraLanNetworks adds networks (IPv4 or IPv6 CIDR)
  for setups whose own devices use addresses outside those ranges. It is
  checked at build time. The app ignores an entry it cannot parse and
  refuses 0.0.0.0/0 and ::/0: it must never widen its policy by
  guessing, and "everyone" is hub.lanOnly = false, asked for by name.
- sovran_systemsOS.hub.lanOnly (default true) turns the check off.
- The first refusal from each address is logged, naming the option to
  change, so an operator whose own device is refused can find out why.
  The list is capped so a scanner cannot fill the journal or memory.

Behind Caddy the policy applies to the real client, not to Caddy: uvicorn
takes the address from X-Forwarded-For only when the peer is 127.0.0.1.

Checked, not only reviewed:
- The real app with the config.json the module really generates (nix
  eval on the nixpkgs revision flake.lock pins, read back from the
  derivation), on a real socket with the source address chosen per
  request: 127.0.0.1, 192.168/16, 100.64/10 and a declared extra
  network are served; 203.0.113.9, 8.8.4.4 and an address just outside
  the declared /28 get 403 on /login, / and /api/ping. /auto-login still
  answers 303 to loopback and 403 to everyone else.
- With c33457f's Caddy guard in front, an IPv6 client at 2001:db8::9
  passes Caddy (it is inside 2000::/3) and is refused by the Hub; an
  IPv4 stranger has the connection closed by Caddy; a LAN client is
  served.
- hub.extraLanNetworks accepts 203.0.113.0/28, 2001:db8:abcd::/48 and
  bare hosts, and fails the build for /33, 300.1.1.1/8, 0.0.0.0/0, ::/0,
  2001:db8::/129 and junk, with a message that says what to write.

Add tests/test_lan_policy.py and tests/test_hub_lan_only.py, and a note
in SECURITY.md.
This commit is contained in:
Security Fix
2026-10-02 02:24:29 -05:00
committed by naturallaw777
parent 7d784eb653
commit 361b25a8bd
7 changed files with 492 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/core/roles.nix
+40
View File
@@ -61,6 +61,46 @@
sshd = lib.mkEnableOption "SSH remote access";
};
# ── Hub ───────────────────────────────────────────────────
hub = {
lanOnly = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Refuse Hub requests from clients that are not on this computer or on
the local network: loopback, private (10.0.0.0/8, 172.16.0.0/12,
192.168.0.0/16), VPN/CGNAT (100.64.0.0/10) and link-local addresses,
plus anything listed in sovran_systemsOS.hub.extraLanNetworks.
The Hub runs as root and can display stored credentials and reboot
the machine. Whether a packet may reach its port is up to the
firewall and your router; this check is the second lock, so that a
port forward or a firewall mistake does not put the Hub's login page
in front of the internet.
Set it to false only if this computer sits on a network that hands
out public addresses to your own devices and you would rather not
list them.
'';
};
extraLanNetworks = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [ "203.0.113.0/28" ];
description = ''
Extra networks, in CIDR notation, that the Hub should treat as local
in addition to the built-in ranges. Needed only if devices on your
local network use addresses outside the private ranges, for example a
public IPv4 block your provider routes onto your LAN.
Keep each entry as narrow as you can: every address inside it is let
through. To let everything through, set sovran_systemsOS.hub.lanOnly
to false instead; 0.0.0.0/0 and ::/0 are not accepted here.
'';
};
};
# ── Web exposure (controls Caddy vhosts) ──────────────────
web = {
btcpayserver = lib.mkOption {
modules/core/sovran-hub.nix
+28
View File
@@ -115,6 +115,15 @@ let
else if cfg.roles.node then "node"
else "server_plus_desktop";
# IPv4 a.b.c.d[/0-32] or IPv6 [/0-128], and never a /0 (that is "everyone").
octet = "(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])";
lanNetworkOk = p:
(
builtins.match "${octet}(\\.${octet}){3}(/(3[0-2]|[12]?[0-9]))?" p != null
|| builtins.match "[0-9a-fA-F:]*:[0-9a-fA-F:]*(/(12[0-8]|1[01][0-9]|[1-9]?[0-9]))?" p != null
)
&& builtins.match ".*/0" p == null;
generatedConfig = pkgs.writeText "sovran-hub-config.json"
(builtins.toJSON {
refresh_interval = 5;
@@ -122,6 +131,9 @@ let
role = activeRole;
services = monitoredServices;
feature_manager = true;
# Read by LanOnlyMiddleware in server.py.
lan_only = cfg.hub.lanOnly;
lan_extra_networks = cfg.hub.extraLanNetworks;
feature_states = {
bitcoin-tor-gossip = cfg.features.bitcoin-tor-gossip;
};
@@ -503,6 +515,22 @@ in
};
config = {
# Catch a typo'd network at build time. The Hub ignores an entry it cannot
# parse (it must never widen its policy by guessing), so without this the
# only symptom would be a client that is refused for no visible reason.
assertions = [
{
assertion = builtins.all lanNetworkOk cfg.hub.extraLanNetworks;
message = ''
sovran_systemsOS.hub.extraLanNetworks must be a list of IPv4 or IPv6
networks in CIDR notation, for example [ "203.0.113.0/28" ]. A /0
prefix is not accepted; set sovran_systemsOS.hub.lanOnly = false to
let every client through. Got:
${builtins.toJSON cfg.hub.extraLanNetworks}
'';
}
];
systemd.services.sovran-hub-web = {
description = "Sovran_SystemsOS Hub Web Interface";
wantedBy = [ "multi-user.target" ];