From 5b1de5f921c1d6dd4740eff73d938410d95d6cf0 Mon Sep 17 00:00:00 2001 From: elky Date: Sat, 5 Sep 2026 03:57:02 +0800 Subject: [PATCH] fix(tunnel): allow exact private relay hosts --- .env.example | 2 + README.md | 1 + apps/aether-gateway/src/tunnel/mod.rs | 59 +++++++++++++++++++++++++-- 3 files changed, 59 insertions(+), 3 deletions(-) diff --git a/.env.example b/.env.example index 999f76094..c50116a15 100644 --- a/.env.example +++ b/.env.example @@ -109,6 +109,8 @@ ADMIN_USERNAME=admin123456 # 跨网关 relay 解析到受控私有地址时才显式开启；默认关闭以防止被篡改的 attachment # 记录诱导网关向内网转发 relay 凭据。该开关不放宽普通 provider 的目标地址策略。 # AETHER_TUNNEL_RELAY_ALLOW_PRIVATE_TARGETS=false +# 更推荐按 relay 主机名精确放行私网部署（逗号分隔，大小写不敏感）；不支持通配符/后缀。 +# AETHER_TUNNEL_RELAY_PRIVATE_HOST_ALLOWLIST=gateway-a.internal,gateway-b.internal # Bark 自建服务默认仅允许公网 HTTPS。确需明文 HTTP 或内网目标时分别显式开启： # AETHER_BARK_ALLOW_HTTP=false # AETHER_BARK_ALLOW_PRIVATE_TARGETS=false diff --git a/README.md b/README.md index 38c5be444..425cd6a30 100644 --- a/README.md +++ b/README.md @@ -204,6 +204,7 @@ Aether Tunnel 是配套的正向代理节点，部署在海外 VPS 上，为墙 - `AETHER_MAX_INTERNAL_BUFFERED_BODY_MB`：heartbeat、管理探测等内部整包响应体上限，默认 `64MB`；显式设为 `0` 表示不再收紧默认值，但仍受 `256MB` 安全硬上限约束 - `AETHER_TUNNEL_NODE_STATUS_QUEUE_CAPACITY`：隧道节点状态上报队列容量，默认 `1024`；满载时拒绝新事件，避免控制面故障导致无界内存增长 - `AETHER_TUNNEL_RELAY_ALLOW_PRIVATE_TARGETS`：跨网关 owner relay 解析到私有/保留地址时的显式运维开关，默认关闭；仅当多网关 relay URL 是受控的内网 HTTPS 地址时设置为 `true`。它不改变普通 provider 请求的 DNS/代理策略，也不允许明文 HTTP 非 loopback relay +- `AETHER_TUNNEL_RELAY_PRIVATE_HOST_ALLOWLIST`：更窄的 owner relay 私网例外，填写逗号分隔的精确主机名（例如 `gateway-a.internal,gateway-b.internal`，忽略大小写和末尾点）；仅这些主机解析出的私有地址会被允许，并且请求仍使用解析后地址 pin。不要填写通配符或 `.internal` 这类后缀 - `AETHER_INTERNAL_GATEWAY_AUTH_SECRET`：旧版 `/api/internal/gateway/*` 高权限控制面的独立 HMAC 密钥，至少 `32` 字节；未配置时该控制面返回 `404`。不要复用 JWT、数据加密或 tunnel relay 密钥，多节点必须使用同一值及共享 Redis 防重放 - `AETHER_GATEWAY_SECURITY_CACHE_TTL_MS`：IP 黑白名单本地缓存时间，默认 `1000ms`，写操作会主动失效相关缓存 - `AETHER_MAX_REDACTED_SYNC_RESPONSE_BODY_MB`：PII 恢复同步响应缓冲上限，默认 `64MB`；显式设为 `0` 表示不再收紧默认值，但仍受 `256MB` 安全硬上限约束 diff --git a/apps/aether-gateway/src/tunnel/mod.rs b/apps/aether-gateway/src/tunnel/mod.rs index 82bdbee1a..bde158308 100644 --- a/apps/aether-gateway/src/tunnel/mod.rs +++ b/apps/aether-gateway/src/tunnel/mod.rs @@ -70,6 +70,11 @@ const TUNNEL_RELAY_BASE_URL_ENV: &str = "AETHER_TUNNEL_RELAY_BASE_URL"; // operator opt-in, just like the tunnel's private upstream target escape // hatch. Loopback HTTP remains supported for the local single-process path. const TUNNEL_RELAY_ALLOW_PRIVATE_TARGETS_ENV: &str = "AETHER_TUNNEL_RELAY_ALLOW_PRIVATE_TARGETS"; +// Prefer this narrow host allowlist for private owner relay deployments. The +// legacy *_ALLOW_PRIVATE_TARGETS switch remains available for operators that +// intentionally trust every private address in their deployment, but an exact +// hostname list limits the blast radius of a stale or corrupted attachment. +const TUNNEL_RELAY_PRIVATE_HOST_ALLOWLIST_ENV: &str = "AETHER_TUNNEL_RELAY_PRIVATE_HOST_ALLOWLIST"; const TUNNEL_ATTACHMENT_TTL_ENV: &str = "AETHER_TUNNEL_ATTACHMENT_TTL_SECS"; const TUNNEL_RELAY_AUTH_SECRET_ENV: &str = "AETHER_TUNNEL_RELAY_AUTH_SECRET"; const TUNNEL_HEARTBEAT_STATE_KEY_PREFIX: &str = "tunnel:heartbeat:session:"; @@ -249,7 +254,7 @@ fn build_owner_forward_target( host, port, addresses, - tunnel_relay_allows_private_targets(), + tunnel_relay_allows_private_targets() || tunnel_relay_private_host_is_allowlisted(host), ) } @@ -322,6 +327,33 @@ fn tunnel_relay_allows_private_targets() -> bool { }) } +/// Return whether a private owner relay hostname was explicitly allowlisted. +/// +/// Entries are comma-separated exact DNS names (case-insensitive); a trailing +/// dot is ignored for DNS canonicalisation. We intentionally do not support +/// arbitrary suffix or wildcard matching: allowing `.internal` would let a +/// compromised attachment redirect traffic to any sibling service in that +/// namespace. The broad `*_ALLOW_PRIVATE_TARGETS=true` switch above remains +/// the explicit escape hatch for deployments that need that behaviour. +fn tunnel_relay_private_host_is_allowlisted(host: &str) -> bool { + let host = host.trim().trim_end_matches('.').to_ascii_lowercase(); + if host.is_empty() { + return false; + } + std::env::var(TUNNEL_RELAY_PRIVATE_HOST_ALLOWLIST_ENV) + .ok() + .is_some_and(|value| tunnel_relay_private_host_matches_allowlist(&host, &value)) +} + +fn tunnel_relay_private_host_matches_allowlist(host: &str, allowlist: &str) -> bool { + let host = host.trim().trim_end_matches('.'); + !host.is_empty() + && allowlist.split(',').any(|entry| { + let entry = entry.trim().trim_end_matches('.'); + !entry.is_empty() && entry.eq_ignore_ascii_case(host) + }) +} + fn build_owner_forward_pinned_client( target: &ResolvedOwnerForwardTarget, ) -> Result { @@ -2746,8 +2778,9 @@ mod tests { current_unix_secs, encode_tunnel_relay_envelope, owner_forward_client_for_url, prepare_owner_relay_request_body, prepare_owner_relay_request_body_with_limits, resolve_owner_forward_target, resolve_tunnel_relay_auth_secret_value, - tunnel_attachment_key, validate_tunnel_relay_transport_url, AppState, GatewayDataState, - TunnelAttachmentDirectory, TunnelAttachmentRecord, MAX_OWNER_FORWARD_DNS_ADDRESSES, + tunnel_attachment_key, tunnel_relay_private_host_matches_allowlist, + validate_tunnel_relay_transport_url, AppState, GatewayDataState, TunnelAttachmentDirectory, + TunnelAttachmentRecord, MAX_OWNER_FORWARD_DNS_ADDRESSES, }; use aether_contracts::tunnel::{ try_decode_tunnel_relay_request_meta, TUNNEL_RELAY_FORWARDED_BY_HEADER, @@ -2916,6 +2949,26 @@ mod tests { .is_ok()); } + #[test] + fn private_relay_host_allowlist_matches_exact_dns_names_only() { + assert!(tunnel_relay_private_host_matches_allowlist( + "gateway-a.internal.", + "gateway-a.internal, gateway-b.internal" + )); + assert!(tunnel_relay_private_host_matches_allowlist( + "GATEWAY-B.INTERNAL", + "gateway-a.internal, gateway-b.internal." + )); + assert!(!tunnel_relay_private_host_matches_allowlist( + "api.gateway-a.internal", + "gateway-a.internal" + )); + assert!(!tunnel_relay_private_host_matches_allowlist( + "gateway-a.internal.evil.example", + ".internal" + )); + } + #[test] fn owner_forward_target_marks_literal_ipv4_and_ipv6_hosts() { let ipv4 = build_owner_forward_target(