mirror of
https://github.com/sol1/rustguac.git
synced 2026-10-24 20:52:24 +00:00
Dave Kempe
6f541e37ff
The network allowlists are what fence powerusers creating ad-hoc sessions, and several paths went around them: - POST /api/ssh/probe-host-key dialled any host:port, a port scanner and banner grabber for anything rustguac can reach (guacd, Vault, metadata services). Non-admin probes are now checked against ssh_allowed_networks and dialled at the checked address. - Jump hosts were never checked, though rustguac dials the first one itself. For non-admin ad-hoc sessions it is now fenced by ssh_allowed_networks and pinned. - Ad-hoc Proxmox sessions called any proxmox_url and let guacd dial whatever SPICE proxy that API returned. For non-admin ad-hoc sessions both are now fenced by vnc_allowed_networks, as direct SPICE is. The jump host and Proxmox fences are deliberately limited to non-admin ad-hoc requests: connection entries and admins name bastions and clusters that sit outside the target lists, and on the canary every entry-based Proxmox and jump host session would otherwise have broken. The flag is serde(skip), so a request body cannot set it. The allowlist passed a hostname if any resolved address was allowed and then handed guacd the hostname to resolve again, so a name whose DNS the caller controls could pass the check and connect elsewhere. SSH and VNC now dial the checked address when there are no jump hosts. RDP, SPICE and web keep the hostname (TLS names, Kerberos) and the residual risk is documented. Docs also no longer claim every resolved address must match.