Ilker ManapandClaude Opus 5.5
d167686cf1
The admin listener has no login. Reaching it is meant to mean holding the control plane, so it binds to loopback and an operator reaches it over an ssh tunnel — and so does every page open in that operator's browser. The API decoded JSON whatever the Content-Type said, so a page could POST a text/plain model definition, no preflight needed. A model's profile env reached an engine the agent runs as root, unfiltered: LD_PRELOAD in a definition was code execution on every node. A page that rebound its own name to 127.0.0.1 could also read pprof's heap, which holds API keys. The admin listener now answers only when Host is an address or localhost, refuses requests a browser marks as cross-site (Origin, Sec-Fetch-Site), and takes changes only as application/json, which no page can send across origins without a preflight nobody grants. ctl sends that on every change, bodiless DELETEs included; curl and ctl are otherwise unaffected. Profile env that changes what runs rather than how — the dynamic loader's LD_*, PATH, Python's PYTHON* start-up variables, BASH_ENV and their like — is refused when a model is defined, and dropped again by the engine adapter before the process starts, whatever sent the profile. None of the live catalog's models sets any. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
76 lines
2.4 KiB
Go
76 lines
2.4 KiB
Go
package router
|
|
|
|
import (
|
|
"net"
|
|
"net/http"
|
|
"net/netip"
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
// AdminGuard keeps a browser from being used against the admin listener.
|
|
//
|
|
// The listener has no login: reaching it is meant to mean holding the machine,
|
|
// so it binds to loopback and an operator reaches it over an ssh tunnel. But a
|
|
// browser on that operator's machine reaches it too, from any page it has
|
|
// open. A page could POST a model whose profile runs as root on every node,
|
|
// or — by pointing its own domain at 127.0.0.1 — read pprof's heap, which
|
|
// holds API keys in the clear. Three checks close that without touching what
|
|
// ctl and curl do:
|
|
//
|
|
// - Host must be an address or localhost. A page that rebinds its own name
|
|
// to 127.0.0.1 still sends that name.
|
|
// - A request carrying Origin or Sec-Fetch-Site from another site is
|
|
// refused. Browsers send them; ctl and curl do not.
|
|
// - Anything but GET and HEAD must be application/json. A page can send a
|
|
// form or text/plain anywhere without asking; JSON across origins needs a
|
|
// preflight this listener never grants.
|
|
func AdminGuard(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if !addressHost(r.Host) {
|
|
http.Error(w, "the admin listener answers to an address or localhost, not a name", http.StatusMisdirectedRequest)
|
|
return
|
|
}
|
|
if crossSite(r) {
|
|
http.Error(w, "cross-site request refused", http.StatusForbidden)
|
|
return
|
|
}
|
|
if r.Method != http.MethodGet && r.Method != http.MethodHead {
|
|
ct := r.Header.Get("Content-Type")
|
|
if mt, _, _ := strings.Cut(ct, ";"); strings.TrimSpace(strings.ToLower(mt)) != "application/json" {
|
|
http.Error(w, "a change to the admin API must be sent as application/json", http.StatusUnsupportedMediaType)
|
|
return
|
|
}
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func addressHost(hostport string) bool {
|
|
host := hostport
|
|
if h, _, err := net.SplitHostPort(hostport); err == nil {
|
|
host = h
|
|
}
|
|
host = strings.Trim(host, "[]")
|
|
if strings.EqualFold(host, "localhost") {
|
|
return true
|
|
}
|
|
_, err := netip.ParseAddr(host)
|
|
return err == nil
|
|
}
|
|
|
|
func crossSite(r *http.Request) bool {
|
|
switch r.Header.Get("Sec-Fetch-Site") {
|
|
case "", "same-origin", "none":
|
|
default:
|
|
return true
|
|
}
|
|
if o := r.Header.Get("Origin"); o != "" {
|
|
u, err := url.Parse(o)
|
|
if err != nil || !strings.EqualFold(u.Host, r.Host) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|