Merge pull request #187 from fmaass/feature/session-ip-binding

feat(auth): make session IP binding configurable (SESSION_IP_BINDING log|strict|off)

Author: stefan-ernst

deploy/.env.example

@@ -16,6 +16,15 @@ DOMAIN=windshift.example.com
 # Generate manually with: openssl rand -hex 32
 SSO_SECRET=
 
+# How a session presented from a different client IP than it was created from
+# is handled (default: log). One of: log, strict, off.
+#   log    - record the mismatch, serve the request, and remember the new IP
+#            as the session's binding (a parseable IP only; garbage is never
+#            persisted)
+#   strict - reject the session, forcing re-authentication
+#   off    - do not compare client IPs at all
+# SESSION_IP_BINDING=log
+
 # =============================================================================
 # PostgreSQL Settings (uncomment when using PostgreSQL instead of SQLite)
 # =============================================================================

deploy/docker-compose-main.yml

@@ -23,6 +23,7 @@ services:
       - PORT=8080
       - USE_PROXY=true
       - SSO_SECRET=${SSO_SECRET}
+      - SESSION_IP_BINDING=${SESSION_IP_BINDING:-log}
       - ATTACHMENT_PATH=/data/attachments
       - DB_TYPE=postgres
       - POSTGRES_HOST=db

deploy/docker-compose.yml

@@ -25,6 +25,7 @@ services:
       - PORT=8080
       - USE_PROXY=true
       - SSO_SECRET=${SSO_SECRET}
+      - SESSION_IP_BINDING=${SESSION_IP_BINDING:-log}
       - ATTACHMENT_PATH=/data/attachments
       - DB_PATH=/data/windshift.db
       - LOG_LEVEL=info

internal/auth/portal_session.go

@@ -57,17 +57,25 @@ type PortalSession struct {
 type PortalSessionManager struct {
 	cookieManager
 	db database.Database
+	// ipBinding is the resolved SESSION_IP_BINDING mode (config.SessionIPBinding*)
+	// that portal session validation applies to a client-IP change. An unknown
+	// or zero value is treated as strict so managers built without config.Load
+	// fail closed.
+	ipBinding string
 }
 
 // NewPortalSessionManager creates a new portal session manager with secure cookie handling.
 // If cookieSecret is set, deterministic cookie keys are derived from it
 // so that sessions survive process restarts with the same secret.
+// ipBinding is the resolved SESSION_IP_BINDING mode; portal sessions share the
+// setting with internal user sessions because they enforce the same binding.
 // last review: ser, 210426, NOTE: Found hardcoded env var in caller
-func NewPortalSessionManager(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret string) *PortalSessionManager {
+func NewPortalSessionManager(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret, ipBinding string) *PortalSessionManager {
 	return &PortalSessionManager{
 		cookieManager: newCookieManager(useSecureCookies, useProxy, additionalProxies, cookieSecret,
 			"windshift-portal-cookie-hash", "windshift-portal-cookie-block"),
-		db: db,
+		db:        db,
+		ipBinding: ipBinding,
 	}
 }
 
@@ -169,26 +177,45 @@ func (sm *PortalSessionManager) ValidatePortalSession(token, ipAddress string) (
 	}
 
 	// Validate IP address for security. Portal sessions store the client IP at
-	// creation; subsequent validations must match the same binding used by
-	// internal user sessions. Legacy rows with no recorded IP are accepted but
-	// logged so operators can investigate. Missing request IP or mismatch fails
-	// closed.
-	switch {
-	case session.IPAddress == "":
+	// creation; subsequent validations apply the same SESSION_IP_BINDING mode
+	// as internal user sessions. Legacy rows with no recorded IP are accepted
+	// but logged so operators can investigate. Under strict a missing request
+	// IP or a mismatch fails closed; under log the session is followed to its
+	// new IP; under off no comparison happens. No mode deactivates the session.
+	switch decideIPBinding(sm.ipBinding, session.IPAddress, ipAddress) {
+	case ipBindingLegacyUnbound:
 		slog.Warn("portal session has no recorded IP, skipping bind check",
 			slog.Int("portal_customer_id", session.PortalCustomerID),
 			slog.Int("session_id", session.ID))
-	case ipAddress == "":
+	case ipBindingRejectNoRequestIP:
 		slog.Warn("request has no client IP, rejecting IP-bound portal session",
 			slog.Int("portal_customer_id", session.PortalCustomerID),
 			slog.String("session_ip", session.IPAddress))
 		return nil, ErrPortalSessionInvalid
-	case session.IPAddress != ipAddress:
+	case ipBindingAcceptNoRequestIP:
+		slog.Warn("request has no client IP, accepting IP-bound portal session",
+			slog.Int("portal_customer_id", session.PortalCustomerID),
+			slog.String("session_ip", session.IPAddress),
+			slog.String("session_ip_binding", sm.ipBinding))
+	case ipBindingAcceptUnparsedIP:
+		slog.Warn("request client IP is not a valid address, accepting IP-bound portal session without rebinding",
+			slog.Int("portal_customer_id", session.PortalCustomerID),
+			slog.String("session_ip", session.IPAddress),
+			slog.String("request_ip", ipAddress),
+			slog.String("session_ip_binding", sm.ipBinding))
+	case ipBindingRejectMismatch:
 		slog.Warn("portal session IP mismatch",
 			slog.Int("portal_customer_id", session.PortalCustomerID),
 			slog.String("session_ip", session.IPAddress),
 			slog.String("request_ip", ipAddress))
 		return nil, ErrPortalSessionInvalid
+	case ipBindingRebindMismatch:
+		slog.Warn("portal session IP mismatch",
+			slog.Int("portal_customer_id", session.PortalCustomerID),
+			slog.String("session_ip", session.IPAddress),
+			slog.String("request_ip", ipAddress))
+		sm.rebindPortalSessionIP(token, session, ipAddress)
+	case ipBindingMatch, ipBindingSkip:
 	}
 
 	if channelID.Valid {
@@ -209,6 +236,27 @@ func (sm *PortalSessionManager) ValidatePortalSession(token, ipAddress string) (
 	return session, nil
 }
 
+// rebindPortalSessionIP moves a portal session to the client IP it is now
+// presented from (log mode only). Like the user-session rebind, a failed write
+// costs bookkeeping rather than availability: the request is still served and
+// the next one retries. Portal sessions have no local validation cache, so
+// nothing needs invalidating; the in-memory session is advanced on success
+// because it is returned to the caller.
+func (sm *PortalSessionManager) rebindPortalSessionIP(token string, session *PortalSession, ipAddress string) {
+	// Portal tokens are stored as digests with the same legacy plaintext
+	// fallback as user sessions, so the predicate must match both forms.
+	query := `UPDATE portal_customer_sessions SET ip_address = ? WHERE session_token IN (?, ?) AND is_active = true`
+	if _, err := sm.db.ExecWrite(query, ipAddress, hashSessionToken(token), token); err != nil {
+		slog.Error("failed to rebind portal session to the new client IP",
+			slog.Int("portal_customer_id", session.PortalCustomerID),
+			slog.Int("session_id", session.ID),
+			slog.String("request_ip", ipAddress),
+			slog.Any("error", err))
+		return
+	}
+	session.IPAddress = ipAddress
+}
+
 // DeletePortalSession invalidates a session
 // last review: ser, 210426, TODO: Remove inline sql
 func (sm *PortalSessionManager) DeletePortalSession(token string) error {

internal/auth/session.go

@@ -54,6 +54,11 @@ type SessionManager struct {
 	db                database.Database
 	opaqueKey         []byte
 	sessionValidation *sessionValidator
+	// ipBinding is the resolved SESSION_IP_BINDING mode (config.SessionIPBinding*)
+	// that session validation applies to a client-IP change. An unknown or
+	// zero value is treated as strict so managers built without config.Load
+	// fail closed.
+	ipBinding string
 }
 
 // Session represents an active user session
@@ -74,28 +79,31 @@ type Session struct {
 // NewSessionManager creates a new session manager with secure cookie handling.
 // If cookieSecret is non-empty, deterministic cookie keys are derived from it
 // so that sessions survive process restarts with the same secret.
+// ipBinding is the resolved SESSION_IP_BINDING mode.
 // last review: ser, 210426
-func NewSessionManager(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret string) *SessionManager {
+func NewSessionManager(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret, ipBinding string) *SessionManager {
 	return NewSessionManagerWithValidationCacheTTL(
 		db,
 		useSecureCookies,
 		useProxy,
 		additionalProxies,
 		cookieSecret,
+		ipBinding,
 		DefaultSessionValidationCacheTTL,
 	)
 }
 
 // NewSessionManagerWithValidationCacheTTL creates a session manager with a
 // bounded local validation cache. A non-positive TTL disables retained cache
 // entries while preserving in-flight request coalescing.
-func NewSessionManagerWithValidationCacheTTL(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret string, validationCacheTTL time.Duration, cacheSizeMB ...int) *SessionManager {
+func NewSessionManagerWithValidationCacheTTL(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret, ipBinding string, validationCacheTTL time.Duration, cacheSizeMB ...int) *SessionManager {
 	return newSessionManagerWithValidationCache(
 		db,
 		useSecureCookies,
 		useProxy,
 		additionalProxies,
 		cookieSecret,
+		ipBinding,
 		validationCacheTTL,
 		"session_validation",
 		cacheSizeMB...,
@@ -105,20 +113,21 @@ func NewSessionManagerWithValidationCacheTTL(db database.Database, useSecureCook
 // NewSessionManagerWithNamedValidationCacheTTL creates a session manager whose
 // validation cache has an explicit diagnostics name. The SSH server uses it so
 // the HTTP and SSH allocations remain independently visible.
-func NewSessionManagerWithNamedValidationCacheTTL(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret string, validationCacheTTL time.Duration, cacheName string, cacheSizeMB int) *SessionManager {
+func NewSessionManagerWithNamedValidationCacheTTL(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret, ipBinding string, validationCacheTTL time.Duration, cacheName string, cacheSizeMB int) *SessionManager {
 	return newSessionManagerWithValidationCache(
 		db,
 		useSecureCookies,
 		useProxy,
 		additionalProxies,
 		cookieSecret,
+		ipBinding,
 		validationCacheTTL,
 		cacheName,
 		cacheSizeMB,
 	)
 }
 
-func newSessionManagerWithValidationCache(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret string, validationCacheTTL time.Duration, cacheName string, cacheSizeMB ...int) *SessionManager {
+func newSessionManagerWithValidationCache(db database.Database, useSecureCookies, useProxy bool, additionalProxies []string, cookieSecret, ipBinding string, validationCacheTTL time.Duration, cacheName string, cacheSizeMB ...int) *SessionManager {
 	var opaqueKey []byte
 	if cookieSecret != "" {
 		opaqueKey = deriveKey(cookieSecret, "windshift-auth-opaque-values", 32)
@@ -131,6 +140,7 @@ func newSessionManagerWithValidationCache(db database.Database, useSecureCookies
 		db:                db,
 		opaqueKey:         opaqueKey,
 		sessionValidation: newSessionValidator(validationCacheTTL, cacheName, cacheSizeMB...),
+		ipBinding:         ipBinding,
 	}
 }
 
@@ -255,6 +265,23 @@ func (sm *SessionManager) RefreshSession(token string, rememberMe bool) error {
 	return nil
 }
 
+// UpdateSessionIP rebinds a session to a new client IP. It is used by the log
+// SESSION_IP_BINDING mode, where a session that moves between networks is
+// followed rather than rejected. Sessions are stored as token digests with a
+// legacy plaintext fallback, so the predicate matches both forms — a
+// plaintext-only predicate would match zero rows for every current session.
+func (sm *SessionManager) UpdateSessionIP(token, ipAddress string) error {
+	query := `UPDATE user_sessions SET ip_address = ? WHERE session_token IN (?, ?) AND is_active = true`
+	_, err := sm.db.ExecWrite(query, ipAddress, hashSessionToken(token), token)
+	if err != nil {
+		return fmt.Errorf("failed to update session IP: %w", err)
+	}
+	// The cached snapshot still carries the previous IP; drop it so the next
+	// request revalidates against the rebound row instead of rebinding again.
+	sm.invalidateSessionValidationToken(token)
+	return nil
+}
+
 // SetSessionCookie sets a secure session cookie
 func (sm *SessionManager) SetSessionCookie(w http.ResponseWriter, r *http.Request, token string, rememberMe bool) error {
 	maxAge := int(DefaultSessionDuration.Seconds())