Repository navigation
Additional security fixes - #257
Merged
Merged
Conversation
…and migration leaks
… requests over TLS
…passkeys on endpoint host
…CACert raw slice cloning
… and ServeDeviceVerification
…s when ClientAuth is enabled
…s, and dialQUICStream closure
…dd clickjacking headers
…kup, and QUIC datagram metering
…ertMatches group check, and QUIC IP/ALPN checks
…lti-token Connection header
…, and harden header redaction
…ey, and strengthen WASM OpenPGP S2K
…ver, and URL validation in examples/deviceauth
…p, certmanager serials, and build scripts
…ssion rotation order
… and GET parsing, CA re-issue logging, and cleanups Fixes from the review of the branch: * enforceSSOPolicy: when no SSO rule matches a scoped local handler, use a default rule so unauthenticated users go through the login flow instead of getting a bare 403. * ocspcache: give responses without NextUpdate a NextUpdate of ThisUpdate+24h so they can be cached and served from the cache. * pki: fix GET OCSP parsing for ocspServers URLs without a path, and use the longest matching prefix. * pki: when the CA certificate is re-issued to add the CRLSign key usage, log the old and new fingerprints and replace the old entry in the list of issued certificates instead of appending. * backend.close(nil): close document roots after the HTTP server is closed, not while requests may still be using them. * netw: use atomic pointers for limiters and upstream counters instead of taking a mutex on every Read/Write. * Remove dead code: jwks.Remote.GetKeyForIssuer and TokenManager.IssuerForKey. Keep validateRemotePublicKey until the jwks module dependency is updated to include the same checks. * Clean Connection headers before any header injection, removing the set-strip-set pattern for X-tlsproxy-user-id. * Add setNoFrameHeaders and apply it to all local handlers. * Reject rewriteRules with reserved output claims at config validation. * ManageKeys: single guard for a missing passkey_hash. Behavior changes reverted after evaluation: * Do not clear req.URL.RawPath on path sanitization (broke encoded-slash APIs). * Do not escape '/' in X-Forwarded-Client-Cert Subject values. * Do not skip group-named ACL entries in certMatches. * Accept RSA public exponents >= 3 in PKI CSRs. Tests: add coverage for OCSP caching without NextUpdate, path-less OCSP URLs, RSA e=3 CSRs, reserved rewrite-rule claims, and XFCC on HTTP over raw QUIC streams. Fix CHANGELOG descriptions. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ok up local PKIs by all issued key IDs Go 1.25 changed the default SubjectKeyId derivation in CreateCertificate from SHA-1 to SHA-256 (GODEBUG x509sha256skid). A CA certificate created with an older Go and re-issued now (for the CRLSign key usage, or at half of its lifetime) got a different SubjectKeyId, while the AuthorityKeyId of all previously issued certificates still had the old value. The proxy's pkiMap lookup, keyed by SubjectKeyId, then missed, and client certificates issued by the local PKI were checked through OCSP on every handshake instead of the local revocation list, producing "INF OCSP: ... is GOOD" log entries. * initCA: copy the SubjectKeyId of the existing CA certificate into the new one. The key doesn't change, so the identifier shouldn't either. * Add PKIManager.KeyIDs(), which returns the CA's SubjectKeyId and the distinct AuthorityKeyIds of all issued certificates, and register the PKI in pkiMap under all of them. This also heals deployments whose CA certificate was already re-issued with a different SubjectKeyId. * Add TestCAReissuePreservesSubjectKeyId. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
reAuthorize is called both directly by the test and by the goroutine that Reconfigure starts, so Close() runs concurrently. Use atomic.Bool. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This release fixes additional security and reliability issues found during a follow-up review. See CHANGELOG.md
Type of change
How is this change tested ?