External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(guard): scope the internal-mesh whitelist to loopback + docker bridge

Browse Source 
The WAF/IP-ban/rate-limit exemption whitelisted all of RFC1918, so any
LAN client reaching the host-published nginx port resolved to its real
192.168.x.x and rode the exemption. Only the docker agent mesh needs it:
keep 127.0.0.1/::1 + 172.16.0.0/12, drop 10.0.0.0/8 and 192.168.0.0/16.
New middleware tests drive the real XFF resolution path (forwarded LAN
client blocked, direct bridge peer exempt); the remaining ceiling
(host-proxied traffic resolving to loopback/bridge-gateway under
depth-1 XFF trust) is documented instead of claimed away.
This commit is contained in:
Renn F
2026-07-22 03:30:32 +02:00
parent 34a4950918
commit 07bdef3db2
4 changed files with 70 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/test_security.py
+11 -1
View File
@@ -212,10 +212,20 @@ def test_internal_agent_mesh_is_whitelisted() -> None:
(2026-07-20 incident) and wedged every subsequent gateway verb."""
cfg = security.build_security_config()
assert cfg.whitelist is not None
for net in ("127.0.0.1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"):
for net in ("127.0.0.1", "::1", "172.16.0.0/12"):
assert net in cfg.whitelist
def test_internal_mesh_whitelist_excludes_full_rfc1918() -> None:
"""10.0.0.0/8 and 192.168.0.0/16 cover any real LAN client hitting nginx,
not just the docker mesh — an nginx-forwarded 192.168.x.x browser must NOT
ride the same exemption as authenticated agent traffic."""
cfg = security.build_security_config()
assert cfg.whitelist is not None
for net in ("10.0.0.0/8", "192.168.0.0/16"):
assert net not in cfg.whitelist
def test_guard_whitelist_appends_emergency_extras(
monkeypatch: pytest.MonkeyPatch,
) -> None: