From 454b689a54263a9aa21eef51cdc6273ddaac39ef Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Mon, 5 Oct 2026 19:35:10 -0700 Subject: [PATCH] fix(nh3-svos): strip Tailscale-User-* and X-Forwarded-* as whole families at the SVOS front door svos-dev review: the Caddyfile deleted named headers only. Prefix deletes cover the families; the named strays (Tailscale-Headers-Info, X-Real-IP, Forwarded, X-SVOS-Peer) stay. Wildcard semantics checked on a scratch Caddy (case-insensitive; look-alikes outside the family survive). Deployed, validated via systemd-run with EnvironmentFile, reloaded; deny tests re-run (403). README: safe validate recipe, pending acceptance list. --- configs/svos-front/Caddyfile | 10 ++++------ servers/nh3-svos/README.md | 18 ++++++++++++++---- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/configs/svos-front/Caddyfile b/configs/svos-front/Caddyfile index ca0d7d5..561ee8b 100644 --- a/configs/svos-front/Caddyfile +++ b/configs/svos-front/Caddyfile @@ -21,13 +21,11 @@ https://svos.phasefinal.com:443 { resolvers 1.1.1.1 8.8.8.8 } route { - request_header -Tailscale-User-Login - request_header -Tailscale-User-Name - request_header -Tailscale-User-Profile-Pic + # Whole families by prefix (Caddy header-delete wildcard; tested 2026-10-05: case-insensitive, and + # X-Forwardedness / Tailscale-Other survive), plus the named strays outside them. + request_header -Tailscale-User-* + request_header -X-Forwarded-* request_header -Tailscale-Headers-Info - request_header -X-Forwarded-For - request_header -X-Forwarded-Proto - request_header -X-Forwarded-Host request_header -X-Real-IP request_header -Forwarded request_header -X-SVOS-Peer diff --git a/servers/nh3-svos/README.md b/servers/nh3-svos/README.md index 0ee3807..1d7d396 100644 --- a/servers/nh3-svos/README.md +++ b/servers/nh3-svos/README.md @@ -44,10 +44,20 @@ scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml (phasefinal.com only), in `/etc/caddy/env` (root:caddy 0640), vaulted `nh3-svos/cloudflare-caddy-dns01-token`. - **Identity:** `svos-whois-auth.service` (`configs/svos-front/svos-whois-auth.py`, DynamicUser, 127.0.0.1:8405). Caddy's `forward_auth` passes the SOCKET peer; the responder asks tailscaled WhoIs and answers 200 + `Tailscale-User-Login` only - for logins in **`/etc/svos-front/allowed-logins`** (empty = nobody). Client identity/forwarding headers are deleted first. -- **Tested 2026-10-05:** LAN → no connection; mesh peer fv-ml1 (login `pfi`) → 403; forged `Tailscale-User-Login` → 403; - the responder directly with a bogus, garbage or empty peer → 403. Still to run once a login is allowed: an allowed - device gets 200, its forged header is replaced, and a stopped tailscaled gives 403. + for logins in **`/etc/svos-front/allowed-logins`** (empty = nobody). Client identity/forwarding headers are deleted + first, as whole families by prefix (`Tailscale-User-*`, `X-Forwarded-*`, svos-dev's ask) plus `Tailscale-Headers-Info`, + `X-Real-IP`, `Forwarded` and `X-SVOS-Peer`. The wildcard was tested on a scratch Caddy first: case-insensitive, and + look-alikes outside the family (`X-Forwardedness`, `Tailscale-Other`) survive. +- **Config changes:** validate WITHOUT putting the token on a command line, then reload: + `sudo systemd-run --wait --pipe --collect -p User=caddy -p Group=caddy -p EnvironmentFile=/etc/caddy/env + -p "Environment=XDG_DATA_HOME=/var/lib/caddy XDG_CONFIG_HOME=/var/lib/caddy" /usr/local/bin/caddy validate --config + --adapter caddyfile`, then `systemctl reload caddy-svos`. (`env $(cat /etc/caddy/env) caddy …` leaked the first + token into sudo's argv log on 2026-10-05; it was revoked.) +- **Tested 2026-10-05:** LAN → no connection; mesh peer fv-ml1 (login `pfi`) → 403; forged `Tailscale-User-Login`, + `Tailscale-User-Whatever` and `X-Forwarded-For` → 403; the responder directly with a bogus, garbage or empty peer → 403. +- **Still to run (handoff to svos-dev's acceptance):** once a login is allowed, an allowed device gets 200 and its forged + `Tailscale-User-*` / `X-Forwarded-*` headers (arbitrary family members included) are replaced or gone at the app; a + stopped tailscaled gives 403; and the live-service vzdump + restore-mount drill once the SVOS services run. - ⚠ **Every mesh node, servers included, has WhoIs LoginName `pfi`** (headscale has one user). `pfi` must never go in the allow-list: it would admit every server and LAN traffic SNAT'd through a subnet router. Prime's decision pending: a separate headscale user for his devices (recommended) or a device allow-list.