trident-acl-agent: require https for Nebraska server and package URLs - #775
Open
bfjelds (bfjelds) wants to merge 1 commit into
Open
trident-acl-agent: require https for Nebraska server and package URLs#775bfjelds (bfjelds) wants to merge 1 commit into
bfjelds (bfjelds) wants to merge 1 commit into
Conversation
Nebraska's response drives a root-privileged tridentd fetch, so both URLs it supplies must be transport-secured: - `server` (the update-request annotation's Nebraska endpoint) must now be `https` - a plain-`http` (or any other scheme) value is rejected with InvalidRequest, closing off a network-position attacker reading or tampering with the update-check/event-report channel. - The package/image URL Nebraska's response resolves to is only accepted if it is `https` or `oci`; `http` and `file` are rejected, closing an SSRF vector where a compromised/spoofed Nebraska response could otherwise direct tridentd to fetch or open an arbitrary local file or unencrypted network resource. trident-acl-agent has no CA-override configuration of its own: a private CA is expected to be trusted via the node's system trust store, installed at image-build time, not via a runtime agent config knob. Updates docs/Explanation/Trident-ACL-Agent.md accordingly.
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The security restrictions are correctly enforced at validation points, are covered by targeted unit tests, and the docs match the implemented behavior.
Pull request overview
This PR hardens trident-acl-agent’s update plumbing by enforcing transport-secure Nebraska endpoints and preventing Nebraska-driven artifact URL schemes that could enable SSRF or local-file access when forwarded to root-privileged tridentd.
Changes:
- Require
https(and onlyhttps) for the NebraskaserverURL in stage/finalize update requests, returningInvalidRequestotherwise. - Restrict resolved package/artifact URLs from Nebraska offers to schemes
httpsoroci, rejectinghttp/file(and anything else). - Update docs and add/adjust unit tests to reflect and validate the new constraints.
File summaries
| File | Description |
|---|---|
| docs/Explanation/Trident-ACL-Agent.md | Documents https-only Nebraska server requirement and https/oci artifact URL scheme restriction. |
| crates/trident-acl-agent/src/core/nebraska/client.rs | Enforces an allowlist for resolved package URL schemes (https, oci) and adds tests for allowed/blocked schemes. |
| crates/trident-acl-agent/src/annotations/protocol.rs | Tightens request validation to require https for server on stage/finalize and updates tests accordingly. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nebraska's response drives a root-privileged tridentd fetch, so both URLs it supplies must be transport-secured:
server(the update-request annotation's Nebraska endpoint) must now behttps- a plain-http(or any other scheme) value is rejected with InvalidRequest, closing off a network-position attacker reading or tampering with the update-check/event-report channel.httpsoroci;httpandfileare rejected, closing an SSRF vector where a compromised/spoofed Nebraska response could otherwise direct tridentd to fetch or open an arbitrary local file or unencrypted network resource.trident-acl-agent has no CA-override configuration of its own: a private CA is expected to be trusted via the node's system trust store, installed at image-build time, not via a runtime agent config knob.
Updates docs/Explanation/Trident-ACL-Agent.md accordingly.
Validated with pr-e2e with commit targeting pr 731