Security Fix
78bfc5b408
Caddy fronted the Hub at http://sovransystemsos.local, but the Hub already listens on 0.0.0.0:8937 itself, and nothing Caddy added is something it needs: - Not the name. That is avahi's: mDNS advertises a hostname, not a port, so the name resolves wherever the Hub listens. - Not TLS (the site was plain http), not authentication, not cache headers. The header block duplicated NoCacheMiddleware, and its Clear-Site-Data ("cache") overrode the app's stronger ("cache", "storage"). - Not access control, and this is the point. With ports 80/443 forwarded for public services, a Host header on those ports reached the Hub. That second door is how the reported bug happened, andc33457fguards it with an address check instead of closing it. The Hub is now served on port 8937 only, at http://sovransystemsos.local:8937, and Caddy has no site for it. The only thing Caddy answers on 80/443 is the public sites. Caddy keeps Ride The Lightning (:3051) and Mempool (:60847), because those do need it: Sovran_Bitcoin binds both to 127.0.0.1 and RTL's unit is sandboxed to loopback besides, so Caddy is how the local network reaches them. - caddy.nix: no Hub site. Caddy runs wherever RTL and Mempool do, which includes Bitcoin Node Only. There it did not run at all (enable was needsHttpsPorts || extraVhosts != ""), so :3051 and :60847 were open in the firewall with nothing listening. Ports 80/443 still follow needsHttpsPorts alone, so Node Only does not open them. The two sites are written only where their service exists; they were unconditional. - sovran-hub.nix: 8937 follows the new hub.directPort, 60847 follows Mempool. It used to be `[ 8937 60847 ]` on every role, Desktop Only included. - roles.nix: hub.directPort defaults to !roles.desktop: open on Server + Desktop and Bitcoin Node Only, closed on Desktop Only, where the Hub is reached from the machine itself through the desktop window on localhost. - The bind stays 0.0.0.0, which is IPv4 only: with that bind [::1]:8937 is refused and "localhost" falls back to 127.0.0.1. That is on purpose and is now said in the comment. An IPv6 listener would let in clients whose global addresses the Hub cannot tell from a stranger's, which is the question the previous commit declines to answer by guessing. - README, SECURITY.md and two strings in index.html give the new URL. Behaviour changes: the Hub's address gains :8937, and http://sovransystemsos.local on port 80 no longer reaches it. Bitcoin Node Only now runs Caddy. Evaluated with nix eval (nixpkgs as flake.lock pins it, Sovran_Bitcoin at the locked revision), firewall TCP ports per role:c33457fthis commit Server + Desktop 22 80 443 3051 8937 60847 22 80 443 3051 8937 Bitcoin Node Only 22 3051 8937 60847 22 3051 8937 60847 (Caddy now runs) Desktop Only 22 8937 60847 22 Port 22 is open on every role although sshd listens on loopback only; the last commit of this series deals with that. The Caddyfile the module really generates (the evaluated generator script, run, then `caddy validate` with Caddy 2.9.1): Node Only gets the two sites and nothing else; Server + Desktop with every domain configured gets the seven domain sites plus :3051 and :60847 and no mention of the Hub; with Bitcoin off there are no local-network sites; Node Only with Bitcoin off and no domains leaves Caddy off. Add tests/test_hub_direct.py and keep tests/test_caddy_lan_only.py for the two sites it still covers.
113 lines
4.6 KiB
Python
113 lines
4.6 KiB
Python
"""Guards for the LAN-only Caddy sites.
|
|
|
|
Ride The Lightning (:3051) and Mempool (:60847) sites are for the home network.
|
|
Caddy has to check where a request comes from because forwarding ports 80/443 on
|
|
the router lets other clients reach it too. The domain sites for the operator's
|
|
own public services must stay public. (The Hub is not a Caddy site: it is served
|
|
on its own port and checks its own clients.)
|
|
|
|
These read modules/core/caddy.nix like the nix-file checks in test_security.py:
|
|
nothing is run and nothing touches the network.
|
|
"""
|
|
|
|
import ipaddress
|
|
import os
|
|
import re
|
|
import unittest
|
|
|
|
_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
|
|
|
|
# What Caddy's "private_ranges" shortcut expands to (see the remote_ip matcher docs).
|
|
_PRIVATE_RANGES = ["192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8",
|
|
"127.0.0.1/8", "fd00::/8", "::1"]
|
|
|
|
_LAN_SITES = (":3051", ":60847")
|
|
|
|
|
|
def _read(*parts):
|
|
with open(os.path.join(_ROOT, *parts), encoding="utf-8") as f:
|
|
return f.read()
|
|
|
|
|
|
def _site(src, address):
|
|
m = re.search(r"^" + re.escape(address) + r" \{\n(.*?)^\}$", src, re.S | re.M)
|
|
return m.group(1) if m else None
|
|
|
|
|
|
def _snippet(src):
|
|
m = re.search(r"^\(sovran_lan_only\) \{\n(.*?)^\}$", src, re.S | re.M)
|
|
return m.group(1) if m else None
|
|
|
|
|
|
def _allowed_networks(snippet):
|
|
m = re.search(r"^\s*@outside not remote_ip (.+)$", snippet, re.M)
|
|
assert m, "the @outside matcher is missing"
|
|
nets = []
|
|
for token in m.group(1).split():
|
|
for cidr in (_PRIVATE_RANGES if token == "private_ranges" else [token]):
|
|
nets.append(ipaddress.ip_network(cidr, strict=False))
|
|
return nets
|
|
|
|
|
|
def _is_allowed(nets, address):
|
|
ip = ipaddress.ip_address(address)
|
|
return any(ip.version == n.version and ip in n for n in nets)
|
|
|
|
|
|
class LanOnlySites(unittest.TestCase):
|
|
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
cls.src = _read("modules", "core", "caddy.nix")
|
|
|
|
def test_lan_sites_use_the_guard_before_they_proxy(self):
|
|
for address in _LAN_SITES:
|
|
with self.subTest(site=address):
|
|
body = _site(self.src, address)
|
|
self.assertIsNotNone(body, f"{address} site not found")
|
|
self.assertIn("import sovran_lan_only", body)
|
|
self.assertLess(body.index("import sovran_lan_only"),
|
|
body.index("reverse_proxy"))
|
|
|
|
def test_only_the_lan_sites_use_the_guard(self):
|
|
self.assertEqual(self.src.count("import sovran_lan_only"), len(_LAN_SITES))
|
|
public = re.findall(r"^\$[A-Z]+ \{\n(.*?)^\}$", self.src, re.S | re.M)
|
|
self.assertGreaterEqual(len(public), 6, "domain sites not found")
|
|
for body in public:
|
|
self.assertNotIn("sovran_lan_only", body)
|
|
# the Matrix site that Element calling writes instead of the plain one
|
|
self.assertNotIn("sovran_lan_only", _read("modules", "element-calling.nix"))
|
|
|
|
def test_guard_closes_the_connection_for_everyone_else(self):
|
|
snippet = _snippet(self.src)
|
|
self.assertIsNotNone(snippet, "(sovran_lan_only) snippet not found")
|
|
self.assertRegex(snippet, r"(?m)^\s*abort @outside\s*$")
|
|
# defined before the sites that import it are written (the sites come
|
|
# from bitcoinUiSites, which the generator appends after the snippet)
|
|
self.assertLess(self.src.index("(sovran_lan_only) {"),
|
|
self.src.index("${bitcoinUiSites}"))
|
|
|
|
def test_guard_ranges(self):
|
|
nets = _allowed_networks(_snippet(self.src))
|
|
for address in ("127.0.0.1", "::1", "10.0.0.1", "172.16.0.1", "172.31.255.254",
|
|
"192.168.1.10", "100.64.0.1", "100.127.255.254", "169.254.1.1",
|
|
"fd12:3456::1", "fe80::1", "fc00::1"):
|
|
with self.subTest(allowed=address):
|
|
self.assertTrue(_is_allowed(nets, address))
|
|
for address in ("8.8.8.8", "1.1.1.1", "203.0.113.9", "9.255.255.255", "11.0.0.1",
|
|
"172.15.255.255", "172.32.0.1", "192.169.0.1", "100.63.255.255",
|
|
"100.128.0.1", "169.253.255.255"):
|
|
with self.subTest(refused=address):
|
|
self.assertFalse(_is_allowed(nets, address))
|
|
|
|
def test_ipv6_global_addresses_are_not_filtered(self):
|
|
# Computers on the home network often connect over their own global IPv6
|
|
# address, which cannot be told apart from the internet's by address alone.
|
|
# If this is ever tightened, LAN clients on IPv6 networks lose the Hub.
|
|
nets = _allowed_networks(_snippet(self.src))
|
|
self.assertTrue(_is_allowed(nets, "2001:db8::5"))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|