- Add cluster.addresses. This is a whitelist of CIDR blocks which define cluster hosts.
- When we recieve a request that has a cluster-based authentication token, require the cluster to be configured and require the remote address to be a cluster member before we accept it.
- This provides a general layer of security for these mechanisms.
- In particular, it means they do not work by default on unconfigured hosts.
- When cluster addresses are configured, and we receive a request to an address not on the list, reject it.
- This provides a general layer of security for getting the Ops side of cluster configuration correct.
- If cluster nodes have public IPs and are listening on them, we'll reject requests.
- Basically, this means that any requests which bypass the LB get rejected.
Details
Details
- Reviewers
btrahan - Maniphest Tasks
- T6706: Allow SSH keys (and other Conduit tokens) to be restricted to specific IP ranges
T2783: Make working-copy operations service-oriented - Commits
- Restricted Diffusion Commit
rPfa7bb8ff7a50: Add `cluster.addresses` and require membership before accepting cluster…
- With addresses not configured, tried to make requests; rejected for using a cluster auth mechanism.
- With addresses configred wrong, tried to make requests; rejected for sending from (or to) an address outside of the cluster.
- With addresses configured correctly, made valid requests.
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Branch
- devkeys1x
- Lint
Lint Passed - Unit
Tests Passed - Build Status
Buildable 3496 Build 3504: [Placeholder Plan] Wait for 30 Seconds