Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

exec / any other methods open when POST is set to 1 and how is DELETE handled ? #114

Open
tobhv opened this issue Jan 25, 2024 · 1 comment
Open

exec / any other methods open when POST is set to 1 and how is DELETE handled ? #114

tobhv opened this issue Jan 25, 2024 · 1 comment

Comments

@tobhv
Copy link

tobhv commented Jan 25, 2024

Hello,

just got started using this container to secure watchtower.
but i see strange behavior when i send requests to the api in the below setup:

version: '2'
services:
  watchtower:
    environment:
      DOCKER_HOST: tcp://socket-proxy:2375
    image: ${MY_CONTAINER_REPO}containrrr/watchtower
    depends_on:
      - socket-proxy
    command: -R updatetest_updatetest_1
    restart: unless-stopped
  socket-proxy:
    image: ${MY_CONTAINER_REPO}tecnativa/docker-socket-proxy:edge
    environment:
      POST: 1
      CONTAINERS: 1
      IMAGES: 1
      NETWORKS: 1
      ALLOW_START: 1
      ALLOW_STOP: 1
      ALLOW_RESTARTS: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

this lets watchtower do its job nicely and the socket-proxy logs show clearly what requests have been done.

however, there is more:
expected behavior:

  • post requests on containers, images etc. are allowed (and matches watchtowers need)
  • requests to volumes / exec or any other endpoint is not allowed.
  • DELETE method is not possible (you do not define it as being allowed in haproxy?)

actual behavior:

  • a get request to volumes is not allowed(good):
curl http://socket-proxy:2375/volumes
<html><body><h1>403 Forbidden</h1>
Request forbidden by administrative rules.
</body></html>
  • a post request to exec is allowed!(bad):
curl --json '{"AttachStdin": false, "AttachStdout": true, "AttachStderr": true, "DetachKeys": "ctrl-p,ctrl-q", "Tty": false, "Cmd": ["hostname"]}' http://socket-proxy:2375/containers/913d03458185f403a03133c3ac4fd537e05e8386cc200e0a37
354bfebf69a3d2/exec
{"Id":"9e72a0b2294259fa05309aeb26af6355f38310212a0e32f7493f1e94f9730e5c"}
  • a delete request is allowed (strange):
    below log from watchtower update action:
socket-proxy_1  | ::ffff:192.168.112.3:52366 [25/Jan/2024:16:39:39.507] dockerfrontend dockerbackend/dockersocket 0/0/0/14/14 204 165 - - ---- 1/1/0/0/0 0/0 "DELETE /v1.25/containers/7ec9c82ebaba98045db83ab80ca618c78d0c5e4f03a09f1ab02a7319abb5b0d6?force=1 HTTP/1.1"

environment:

  • tecnativa/docker-socket-proxy:edge
  • docker 20.10 on debian bookworm
  • let me know if you need more info..
@polarathene
Copy link

  • a post request to exec is allowed!(bad)

That is because there is presently no difference between READ/WRITE, only enable/disable of an endpoint. While most exec operation belong to the /exec endpoint, this one belongs to /containers at /containers/{id}/exec thus the ENV is CONTAINERS=1 and it is a POST request thus POST=1 allows it:

    environment:
      POST: 1
      CONTAINERS: 1

docker-socket-proxy/haproxy.cfg

Line 56 in 0e8d660

http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers } { env(CONTAINERS) -m bool }

docker-socket-proxy/haproxy.cfg

Line 59 in 0e8d660

http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/exec } { env(EXEC) -m bool }

docker-socket-proxy/haproxy.cfg

Line 48 in 0e8d660

http-request deny unless METH_GET || { env(POST) -m bool }

There is a PR to run lua script to separate the read vs write permissions: #126

If that lands you would have CONTAINERS_READ=1 and CONTAINERS_WRITE=0

Likewise due to the referenced rule with POST=1 check, while the name is poorly chosen, it allows any other request like DELETE to be permitted. Since you have CONTAINERS=1 that is granted. With that referenced PR CONTAINERS_WRITE=1 will enable both POST and DELETE requests, there is no further granularity there, although that should be sufficient for most needs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@polarathene @tobhv