caddy: stop filtering the RTL and Mempool sites by client address
c33457fput an address check (sovran_lan_only) on the Hub, RTL and Mempool sites. It was written for ports 80/443 being forwarded and a Host header selecting a site, and that only ever applied to the Hub. RTL and Mempool are sites on ports of their own (:3051, :60847): a request on 80/443 cannot select them, whatever Host it carries. Checked with Caddy 2.9.1 and the Caddyfile this module generates for Server + Desktop with every domain configured, serving the public sites on a stand-in port: Host: sovransystemsos.local, localhost:8937, 127.0.0.1 and x:3051 all get an empty 200, and Host: matrix.example.org gets the Synapse stand-in. With the Hub off Caddy the guard has nothing left to guard, and it could not be made right for the two sites that remain: - IPv6. A laptop's global address on the LAN looks exactly like a stranger's. The choice was between letting all of 2000::/3 through, which is the whole IPv6 internet and is whatc33457fdoes, and refusing every LAN device that connects over a global address unless the operator copies the ISP's prefix into a Nix option. - They do not need it. RTL has a random 20-character password (pwgen -s 20, about 119 bits) and, since 0.15.12, which Sovran_Bitcoin pins, a 30-minute lockout keyed on the client address. Mempool shows public chain data. If someone forwards 3051 or 60847 that is the same exposure as any other port on the machine, and SECURITY.md says not to. Remove the snippet and its two imports, and tests/test_caddy_lan_only.py with them. What is still worth pinning moves to test_hub_direct.py: no address filter anywhere in caddy.nix, the two sites are plain proxies to their loopback ports, and no option for a declared prefix is left half-wired. Behaviour change: RTL and Mempool answer any client that can reach :3051 or :60847, as they did beforec33457f. In practice that is the local network, because nothing asks you to forward those ports. Checked with the real generator and Caddy 2.9.1: Node Only generates `auto_https off` and the two plain sites and validates. Run live next to the real Hub, a LAN client gets the Hub, RTL and Mempool; a stranger's address gets RTL and Mempool (by design) and a 403 from the Hub; port 80 is not listening on Node Only.
This commit is contained in:
Security Fix
@@ -1,112 +0,0 @@
|
||||
"""Guards for the LAN-only Caddy sites.
|
||||
|
||||
Ride The Lightning (:3051) and Mempool (:60847) sites are for the home network.
|
||||
Caddy has to check where a request comes from because forwarding ports 80/443 on
|
||||
the router lets other clients reach it too. The domain sites for the operator's
|
||||
own public services must stay public. (The Hub is not a Caddy site: it is served
|
||||
on its own port and checks its own clients.)
|
||||
|
||||
These read modules/core/caddy.nix like the nix-file checks in test_security.py:
|
||||
nothing is run and nothing touches the network.
|
||||
"""
|
||||
|
||||
import ipaddress
|
||||
import os
|
||||
import re
|
||||
import unittest
|
||||
|
||||
_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
|
||||
|
||||
# What Caddy's "private_ranges" shortcut expands to (see the remote_ip matcher docs).
|
||||
_PRIVATE_RANGES = ["192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8",
|
||||
"127.0.0.1/8", "fd00::/8", "::1"]
|
||||
|
||||
_LAN_SITES = (":3051", ":60847")
|
||||
|
||||
|
||||
def _read(*parts):
|
||||
with open(os.path.join(_ROOT, *parts), encoding="utf-8") as f:
|
||||
return f.read()
|
||||
|
||||
|
||||
def _site(src, address):
|
||||
m = re.search(r"^" + re.escape(address) + r" \{\n(.*?)^\}$", src, re.S | re.M)
|
||||
return m.group(1) if m else None
|
||||
|
||||
|
||||
def _snippet(src):
|
||||
m = re.search(r"^\(sovran_lan_only\) \{\n(.*?)^\}$", src, re.S | re.M)
|
||||
return m.group(1) if m else None
|
||||
|
||||
|
||||
def _allowed_networks(snippet):
|
||||
m = re.search(r"^\s*@outside not remote_ip (.+)$", snippet, re.M)
|
||||
assert m, "the @outside matcher is missing"
|
||||
nets = []
|
||||
for token in m.group(1).split():
|
||||
for cidr in (_PRIVATE_RANGES if token == "private_ranges" else [token]):
|
||||
nets.append(ipaddress.ip_network(cidr, strict=False))
|
||||
return nets
|
||||
|
||||
|
||||
def _is_allowed(nets, address):
|
||||
ip = ipaddress.ip_address(address)
|
||||
return any(ip.version == n.version and ip in n for n in nets)
|
||||
|
||||
|
||||
class LanOnlySites(unittest.TestCase):
|
||||
|
||||
@classmethod
|
||||
def setUpClass(cls):
|
||||
cls.src = _read("modules", "core", "caddy.nix")
|
||||
|
||||
def test_lan_sites_use_the_guard_before_they_proxy(self):
|
||||
for address in _LAN_SITES:
|
||||
with self.subTest(site=address):
|
||||
body = _site(self.src, address)
|
||||
self.assertIsNotNone(body, f"{address} site not found")
|
||||
self.assertIn("import sovran_lan_only", body)
|
||||
self.assertLess(body.index("import sovran_lan_only"),
|
||||
body.index("reverse_proxy"))
|
||||
|
||||
def test_only_the_lan_sites_use_the_guard(self):
|
||||
self.assertEqual(self.src.count("import sovran_lan_only"), len(_LAN_SITES))
|
||||
public = re.findall(r"^\$[A-Z]+ \{\n(.*?)^\}$", self.src, re.S | re.M)
|
||||
self.assertGreaterEqual(len(public), 6, "domain sites not found")
|
||||
for body in public:
|
||||
self.assertNotIn("sovran_lan_only", body)
|
||||
# the Matrix site that Element calling writes instead of the plain one
|
||||
self.assertNotIn("sovran_lan_only", _read("modules", "element-calling.nix"))
|
||||
|
||||
def test_guard_closes_the_connection_for_everyone_else(self):
|
||||
snippet = _snippet(self.src)
|
||||
self.assertIsNotNone(snippet, "(sovran_lan_only) snippet not found")
|
||||
self.assertRegex(snippet, r"(?m)^\s*abort @outside\s*$")
|
||||
# defined before the sites that import it are written (the sites come
|
||||
# from bitcoinUiSites, which the generator appends after the snippet)
|
||||
self.assertLess(self.src.index("(sovran_lan_only) {"),
|
||||
self.src.index("${bitcoinUiSites}"))
|
||||
|
||||
def test_guard_ranges(self):
|
||||
nets = _allowed_networks(_snippet(self.src))
|
||||
for address in ("127.0.0.1", "::1", "10.0.0.1", "172.16.0.1", "172.31.255.254",
|
||||
"192.168.1.10", "100.64.0.1", "100.127.255.254", "169.254.1.1",
|
||||
"fd12:3456::1", "fe80::1", "fc00::1"):
|
||||
with self.subTest(allowed=address):
|
||||
self.assertTrue(_is_allowed(nets, address))
|
||||
for address in ("8.8.8.8", "1.1.1.1", "203.0.113.9", "9.255.255.255", "11.0.0.1",
|
||||
"172.15.255.255", "172.32.0.1", "192.169.0.1", "100.63.255.255",
|
||||
"100.128.0.1", "169.253.255.255"):
|
||||
with self.subTest(refused=address):
|
||||
self.assertFalse(_is_allowed(nets, address))
|
||||
|
||||
def test_ipv6_global_addresses_are_not_filtered(self):
|
||||
# Computers on the home network often connect over their own global IPv6
|
||||
# address, which cannot be told apart from the internet's by address alone.
|
||||
# If this is ever tightened, LAN clients on IPv6 networks lose the Hub.
|
||||
nets = _allowed_networks(_snippet(self.src))
|
||||
self.assertTrue(_is_allowed(nets, "2001:db8::5"))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -57,6 +57,44 @@ class HubIsNotACaddySite(unittest.TestCase):
|
||||
)
|
||||
|
||||
|
||||
class CaddyDoesNoAddressFiltering(unittest.TestCase):
|
||||
"""Caddy is a bridge for RTL and Mempool and a TLS front for public sites.
|
||||
|
||||
It used to carry a client-address guard (sovran_lan_only). That guard was
|
||||
never aimed at these two sites: the bug was a Host header on ports 80/443
|
||||
reaching the Hub, and RTL and Mempool sit on ports of their own. It also
|
||||
could not be made right for IPv6, where a laptop's global address on the
|
||||
LAN is indistinguishable from a stranger's.
|
||||
"""
|
||||
|
||||
@classmethod
|
||||
def setUpClass(cls):
|
||||
cls.caddy = _read("modules", "core", "caddy.nix")
|
||||
cls.code = _without_comments(cls.caddy)
|
||||
|
||||
def test_there_is_no_address_filter(self):
|
||||
# (private_ranges is deliberately not on this list: the Nextcloud site
|
||||
# uses it for trusted_proxies, which is not a filter on who may connect.)
|
||||
for needle in ("sovran_lan_only", "remote_ip", "abort @"):
|
||||
with self.subTest(needle=needle):
|
||||
self.assertNotIn(needle, self.code)
|
||||
|
||||
def test_the_bitcoin_sites_are_plain_proxies(self):
|
||||
for site, upstream in ((":3051", ":3050"), (":60847", ":60845")):
|
||||
with self.subTest(site=site):
|
||||
m = re.search(r"^" + re.escape(site) + r" \{\n(.*?)^\}$", self.code, re.S | re.M)
|
||||
self.assertIsNotNone(m, f"{site} site not found")
|
||||
directives = [l.strip() for l in m.group(1).splitlines() if l.strip()]
|
||||
self.assertEqual(directives, [f"reverse_proxy {upstream}", "encode gzip zstd"])
|
||||
|
||||
def test_the_options_for_a_declared_prefix_are_gone(self):
|
||||
# Never needed once Caddy stops guessing: neither the option nor its
|
||||
# build-time assertion may linger half-wired.
|
||||
roles = _read("modules", "core", "roles.nix")
|
||||
self.assertNotIn("lanIPv6Prefixes", roles)
|
||||
self.assertNotIn("lanIPv6Prefixes", self.caddy)
|
||||
|
||||
|
||||
class CaddyRunsWhereItIsNeeded(unittest.TestCase):
|
||||
|
||||
@classmethod
|
||||
|
||||
Reference in New Issue
Block a user