litebastion: Support requests on a local endpoint - #38
Conversation
|
@FiloSottile can you take a look and see if this looks reasonable? Please pay especially close attention to no other unexpected ways of sneaking in traffic on the public endpoint. My understanding is that (since before) we're only accepting TLS traffix, and with my optional configuration we're additionally dropping everything that's not a valid backend. And instead take http requests on localhost. I've tested this on bastion-2.testonly.rgdd.se, with the definition of "works" as: my backend connection from rgdd.se/poc-witness is accepted while attempts to e.g. get its index page are rejected from the public internet. But I am able to pull the index page from the local endpoint with curl, so requests seem to be going through as expected. (I'll take a look at the pipelines tomorrow -- hence draft.) |
This commit makes it possible to receive backend connections from the public internet while *only* accepting requests to those backends on a different endpoint (forced on 127.0.0.1 because of being HTTP only). This is for example useful when running a bastion host on the same system as a log; or when the bastion host operator has its own authenticated interface to inject the -local-request-at endpoint.
9f17815 to
2bfbf7a
Compare
|
Undrafting -- the failing pipeline looks unrelated to this PR. |
Closes #38 Co-authored-by: Rasmus Dahlberg <rasmus@rgdd.se>
|
I don't love exposing the HTTP server to the outside world and then resting the whole protection on an if statement three configs deep. There's an alternative (untested for now) implementation at #39. Do you like that better? |
|
Closing in favor of #39 |
Closes #38 Co-authored-by: Rasmus Dahlberg <rasmus@rgdd.se>
2 participants
This commit makes it possible to receive backend connections from the public internet while only accepting requests to those backends on a different endpoint (forced on 127.0.0.1 because of being HTTP only).
This is for example useful when running a bastion host on the same system as a log; or when the bastion host operator has its own authenticated interface to inject the -local-request-at endpoint.