Repository navigation
Subscriptions need a credential; the socket leaves /tmp - #2
Merged
Merged
Conversation
Brings in external.MessageBusSocketPath, which the bus needs to move its unix socket out of /tmp. None of the changed Common APIs (ExecuteScripts, PublishEventInSocket) are used here, so nothing else had to change.
The bus listened on /tmp/message-bus.sock. /tmp is world-writable, so any local user could create that path first and keep the bus from listening. The socket now lives at external.MessageBusSocketPath(RuntimePath), /var/run/casaos/message-bus.sock by default, a directory only root can write. main creates the runtime directory before anything else, a socket left by the previous run is removed before listening, and the socket stays chmod 0600 since requests on it skip authentication. app-management publishes there through Common's PublishEventInSocket.
skipJWT let any GET with Upgrade: websocket through on the subscribe routes, so anyone who reached the dashboard's port could read every event. That exemption is gone: a request skips the user JWT only on the unix socket or from loopback with the internal secret (external.IsInternalRequest), which is how user-service subscribes.
Browsers cannot set headers on a WebSocket, so the subscription routes - GET /event/{source_id}, GET /action/{source_id} and GET/POST on /socket.io and /socket.io/, websocket and polling alike - also take the JWT from the token query parameter, which the dashboard now sends. The lookup is keyed on method and matched route, so every other route ignores the parameter. The OpenAPI spec documents it as a second, query-based security scheme on those six operations; codegen is regenerated from it.
The access log used echo's default format, which records the request URI with its query string, token included. It now records the path instead. Nothing else in the repo logs a request URL or query: the websocket and socket.io handlers log the remote address only.
Tests cover each subscription route without a credential, with ?token, with a tampered ?token, with the header, with the secret from loopback and from the LAN; ?token on non-subscription routes; and an access log free of the token.
The bus created its runtime directory with Common's file.IsNotExistMkDir, which chmods it to 0777 without the sticky bit. When the bus is the first service to create /var/run/casaos (the gateway failed or has not started yet, or RuntimePath differs), any local user could unlink message-bus.sock and bind their own socket in its place, taking app-management's event posts away from the bus. Create it with os.MkdirAll(path, 0o755), as writeAddressFile and the gateway already do, so only root can write there.
MkdirAll leaves an existing directory as it is, and buses before this one created /var/run/casaos 0777. Until the next reboot that directory would hold the bus socket, and anyone could swap it. The bus now brings it back to 0755.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
?token=.Ships with the dashboard and UserService that send the credential.