require a proxy credential at squid and prove it in the self-check
This commit is contained in:
atlas
mara
parent
52d532ff5a
commit
b7adb90f53
1 changed files with 207 additions and 43 deletions
|
|
@ -1,8 +1,9 @@
|
|||
# Egress proxy for this hive's agents: squid on the host, bound to the bridge
|
||||
# IP, default-deny on the destination hostname. It filters CONNECT targets and
|
||||
# plain-HTTP hosts and never decrypts, so it holds no signing key. No agent is
|
||||
# pointed at it yet; the exporter, journal forwarding and the self-check below
|
||||
# are how a deploy shows it works.
|
||||
# plain-HTTP hosts and never decrypts, so it holds no signing key. A request
|
||||
# for a listed name must carry a per-agent proxy credential, checked against the
|
||||
# users file hive-c0re renders. No agent sends one yet; the exporter, journal
|
||||
# forwarding and the self-check below are how a deploy shows it works.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
|
|
@ -21,6 +22,8 @@ let
|
|||
|
||||
allowed = lib.unique (cfg.allowedDomains ++ [ cfg.selfcheck.canary ]);
|
||||
|
||||
# The squid user the self-check logs in as: `swarm_secret_client::proxy::SELFCHECK_USER`.
|
||||
selfcheckUser = "selfcheck.squid";
|
||||
usersDir = builtins.dirOf cfg.usersFile;
|
||||
|
||||
# Evaluated top to bottom, first match wins. The three destination denies
|
||||
|
|
@ -29,7 +32,10 @@ let
|
|||
# otherwise reach services the bridge firewall keeps agents out of. The
|
||||
# unlisted-name deny comes first because `dstdomain` needs no lookup while
|
||||
# the `dst` ACLs do: an unlisted name is refused at once instead of waiting
|
||||
# on the host resolver, and costs a client no DNS query.
|
||||
# on the host resolver, and costs a client no DNS query. The credential
|
||||
# check sits right before the allow, so a refused destination answers 403
|
||||
# to a client with or without a credential, and only a request that would
|
||||
# otherwise be let through gets the 407 challenge.
|
||||
squidConf = ''
|
||||
http_port ${netCfg.bridgeIp}:${toString port}
|
||||
pid_filename /run/squid/squid.pid
|
||||
|
|
@ -42,8 +48,17 @@ let
|
|||
# Cachemgr scrapes are left out.
|
||||
access_log syslog:daemon.info squid !manager
|
||||
|
||||
# The helper reads the users file on every request and reloads it when its
|
||||
# mtime moves. It exits when the file is missing, which is why the file is
|
||||
# created before squid starts. A positive answer is cached for a minute, so
|
||||
# that is also how long a removed user keeps working.
|
||||
auth_param basic program ${config.services.squid.package}/libexec/basic_ncsa_auth ${cfg.usersFile}
|
||||
auth_param basic realm hyperhive egress
|
||||
auth_param basic credentialsttl 1 minute
|
||||
|
||||
acl SSL_ports port 443
|
||||
acl Safe_ports port 80 443
|
||||
acl authed proxy_auth REQUIRED
|
||||
|
||||
# Host-originated requests: the self-check and the exporter. A local
|
||||
# connect to the bridge IP takes the bridge IP as its source.
|
||||
|
|
@ -71,6 +86,7 @@ let
|
|||
http_access deny to_localhost
|
||||
http_access deny to_linklocal
|
||||
http_access deny to_bridge
|
||||
http_access deny !authed
|
||||
${lib.optionalString (allowed != [ ]) "http_access allow allowed_dst"}
|
||||
http_access deny all
|
||||
'';
|
||||
|
|
@ -103,20 +119,39 @@ let
|
|||
name = "squid-selfcheck";
|
||||
runtimeInputs = [ pkgs.curl ];
|
||||
text = ''
|
||||
# The status squid answers a CONNECT with; 000 when the proxy is down.
|
||||
# The credential comes from the unit's imported credential, and goes to
|
||||
# curl on its stdin so it never appears in a command line. Without one
|
||||
# the requests are anonymous and the self-check reports it.
|
||||
secret=""
|
||||
credential_file="''${CREDENTIALS_DIRECTORY:-/nonexistent}/${cfg.selfcheck.credentialName}"
|
||||
if [ -s "$credential_file" ]; then
|
||||
secret=$(< "$credential_file")
|
||||
fi
|
||||
|
||||
# <host> <auth|anon>: the status squid answers a CONNECT with; 000 when
|
||||
# the proxy is down.
|
||||
connect_status() {
|
||||
curl -sS -m 10 --interface ${netCfg.bridgeIp} -p -x ${proxyUrl} \
|
||||
{
|
||||
if [ "$2" = auth ] && [ -n "$secret" ]; then
|
||||
printf 'proxy-user = "%s:%s"\n' ${selfcheckUser} "$secret"
|
||||
fi
|
||||
} | curl -sS -m 10 -K - --interface ${netCfg.bridgeIp} -p -x ${proxyUrl} \
|
||||
-o /dev/null -w '%{http_connect}' "https://$1/" 2>/dev/null || true
|
||||
}
|
||||
|
||||
allow_status=$(connect_status ${cfg.selfcheck.canary})
|
||||
deny_status=$(connect_status ${denyCanary})
|
||||
allow_status=$(connect_status ${cfg.selfcheck.canary} auth)
|
||||
deny_status=$(connect_status ${denyCanary} auth)
|
||||
anon_status=$(connect_status ${cfg.selfcheck.canary} anon)
|
||||
|
||||
ok=false
|
||||
if [ "$allow_status" = 200 ] && [ "$deny_status" = 403 ]; then
|
||||
if [ "$allow_status" = 200 ] && [ "$deny_status" = 403 ] && [ "$anon_status" = 407 ]; then
|
||||
ok=true
|
||||
fi
|
||||
echo "squid-selfcheck ok=$ok allow_canary=${cfg.selfcheck.canary} allow_status=$allow_status deny_canary=${denyCanary} deny_status=$deny_status"
|
||||
credential=absent
|
||||
if [ -n "$secret" ]; then
|
||||
credential=present
|
||||
fi
|
||||
echo "squid-selfcheck ok=$ok allow_canary=${cfg.selfcheck.canary} allow_status=$allow_status deny_canary=${denyCanary} deny_status=$deny_status anon_status=$anon_status credential=$credential"
|
||||
[ "$ok" = true ]
|
||||
'';
|
||||
};
|
||||
|
|
@ -142,10 +177,24 @@ in
|
|||
type = lib.types.path;
|
||||
default = "/var/lib/hive-squid/users";
|
||||
description = ''
|
||||
The `<user>:<hash>` file hive-c0re renders from the credentials in the
|
||||
swarm secret store: one line per agent of this hive and one for the
|
||||
self-check, as SHA-512 crypt hashes. Created empty, owned by `hive-core`
|
||||
and readable by the `squid` group. Squid doesn't read it yet.
|
||||
The `<user>:<hash>` file squid checks proxy credentials against. hive-c0re
|
||||
renders it from the credentials in the swarm secret store, one line per
|
||||
agent of this hive and one for the self-check, as SHA-512 crypt hashes.
|
||||
An empty file, which is what exists until hive-c0re writes one, makes
|
||||
every login fail, and every request to a listed name answers 407.
|
||||
Owned by `hive-core` and readable by the `squid` group.
|
||||
'';
|
||||
};
|
||||
|
||||
selfcheck.credentialName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "hive-squid.selfcheck";
|
||||
readOnly = true;
|
||||
description = ''
|
||||
Name of the systemd credential the self-check imports its squid
|
||||
password from. `squid-selfcheck-credential` writes it to
|
||||
`/run/credstore/<name>`. Without one the self-check sends no
|
||||
credential and reports `ok=false`.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -181,7 +230,8 @@ in
|
|||
};
|
||||
|
||||
# The directory is setgid so the file hive-c0re renames into it is the
|
||||
# squid group's.
|
||||
# squid group's. The file exists before squid starts, empty: the helper
|
||||
# exits on a missing file and squid then rejects every login.
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${usersDir} 2750 hive-core squid - -"
|
||||
"f ${cfg.usersFile} 0640 hive-core squid - -"
|
||||
|
|
@ -224,10 +274,13 @@ in
|
|||
};
|
||||
|
||||
systemd.services.squid-selfcheck = {
|
||||
description = "Squid allow and deny canaries";
|
||||
description = "Squid allow, deny and credential canaries";
|
||||
after = [ "squid.service" ];
|
||||
serviceConfig = sandbox // {
|
||||
Type = "oneshot";
|
||||
# A glob that matches nothing is not an error: a host with no
|
||||
# credential yet still runs the self-check, and it reports that.
|
||||
ImportCredential = cfg.selfcheck.credentialName;
|
||||
ExecStart = lib.getExe selfcheck;
|
||||
DynamicUser = true;
|
||||
IPAddressAllow = netCfg.bridgeIp;
|
||||
|
|
|
|||
Loading…
Reference in a new issue