graft-source/internal/activitypub/ at 56f559ddbb99fae8506c497eb1084a31d51fa951 · graft.pds.cyberwild.org/graft-source · Tangled

graft.pds.cyberwild.org / graft-source

0

Federated via graft

0

graft-source / internal / activitypub

10 files

at 56f559ddbb99fae8506c497eb1084a31d51fa951

jeanbaptiste Security audit fixes: SSRF hardening, replay protection, resource limits 1mo ago

v2 M4: expose each series' Radicle DID on its ActivityPub profile RepoSyncer.RadicleDID() resolves the local node identity the same way GitSyncer already does for remote setup (rad self --nid), and the actor object now carries it as a PropertyValue attachment — so anyone following from the fediverse can see, right on the profile, which Radicle node actually signs this repo's history. Deliberately scoped down from "AT Proto DID bridging" as discussed: this surfaces the DID as verifiable profile metadata, not a cross-protocol identity resolution (that would need a real DID method resolver and a PDS to test against, neither of which exist here). Verified live: https://graft.cyberwild.org/actors/federation-x now carries the correct did:key: attachment.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

v2 M3: comment bridge — fediverse replies become real comments activity_log now records the forgejo_id/radicle_id of the issue/patch each entry is about, so a reply's inReplyTo can be resolved back to the exact item it's a comment on. Forgejo: CreateIssueComment (POST .../issues/{index}/comments — verified live, and confirmed the same endpoint takes PR comments too). Radicle: CommentIssue and CommentPatch via the rad CLI (verified against `rad issue/patch comment --help` on a live node first, rather than guessing the syntax — patch comments take a revision id, not the patch's own id, which the Patch/Revision struct now also carries). The inbox now handles Create{Note} whose inReplyTo points at one of our own Notes: strips the reply's HTML, prefixes it with the replying account's handle, and posts it as a comment on both the Forgejo and Radicle sides of whichever specific pair logged that entry. Verified live end-to-end without a real fediverse account, using one of graft's own already-published actors as the signed sender (its key never leaves the container — a small Go program run via `pct exec` reads it locally and signs the request there): the reply landed as a comment on both f2's issue and the Radicle issue, correctly attributed.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

httpsig_test.go

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

v2 M2: inbox, follows, and signed delivery to followers - httpsig.go: draft-cavage HTTP Signatures (sign outbound, verify inbound) — the fiddliest part of ActivityPub federation, so it ships with a round-trip test (sign -> receive -> verify) plus a tamper-detection test, rather than trusting it by inspection. - Inbox accepts Follow (verifies the signature against the follower's own published key, records them, replies with a signed Accept) and Undo{Follow} (removes them). Anything else (replies included) is accepted and ignored until the comment bridge, M3. - After each sync pass, DeliverNewActivity signs and POSTs a Create{Note} to every follower's inbox for whatever landed in activity_log since that series' last delivery — tracked per-series so a restart never redelivers history. - /social now shows each series' live follower count. Verified live against real malformed/unreachable-actor requests (400 on bad JSON, 502 on an actor that fails to resolve) with no crash — a real follow from an actual fediverse account is still the outstanding end-to-end check, not yet done.

1 month ago

v2 M3: comment bridge — fediverse replies become real comments activity_log now records the forgejo_id/radicle_id of the issue/patch each entry is about, so a reply's inReplyTo can be resolved back to the exact item it's a comment on. Forgejo: CreateIssueComment (POST .../issues/{index}/comments — verified live, and confirmed the same endpoint takes PR comments too). Radicle: CommentIssue and CommentPatch via the rad CLI (verified against `rad issue/patch comment --help` on a live node first, rather than guessing the syntax — patch comments take a revision id, not the patch's own id, which the Patch/Revision struct now also carries). The inbox now handles Create{Note} whose inReplyTo points at one of our own Notes: strips the reply's HTML, prefixes it with the replying account's handle, and posts it as a comment on both the Forgejo and Radicle sides of whichever specific pair logged that entry. Verified live end-to-end without a real fediverse account, using one of graft's own already-published actors as the signed sender (its key never leaves the container — a small Go program run via `pct exec` reads it locally and signs the request there): the reply landed as a comment on both f2's issue and the Radicle issue, correctly attributed.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago

Security audit fixes: SSRF hardening, replay protection, resource limits Addresses every finding from the full-codebase security audit: - CRITICAL: persistent SSRF via ActivityPub actor/inbox URLs. New internal/activitypub/ssrf.go validates every externally-supplied URL (https only, rejects loopback/private/link-local/metadata addresses) and re-validates the resolved IP at dial time to close the DNS-rebinding gap a resolve-then-connect check would leave open. Wired into FetchActor, NewHandler's client, and DeliverNewActivity's per-follower delivery loop. - CRITICAL: state.db (holds every series' ActivityPub private key in plaintext) was world-readable (644) on the live deployment. Open() now hard-fails if it can't chmod the file to 600. - HIGH: no replay protection on inbound HTTP Signatures. VerifyRequest now rejects requests whose Date header is more than 5 minutes stale. - MEDIUM: unbounded upstream response bodies embedded whole into error messages/logs (Forgejo, AT Proto, ActivityPub clients) — capped at 4 MiB/1 MiB read limits with logged bodies truncated to 500 bytes. - MEDIUM: subprocess calls (git, rad) had no timeout, so one hung command could wedge the whole serial sync loop — bounded to 5 minutes via context.WithTimeout/exec.CommandContext. - MEDIUM: Authorized Integrations detection silently disables graft's own push forever once triggered, with no bound — now falls back to pushing directly after 10 consecutive skipped passes. Also fixes a dashboard accuracy issue: a mirror side with zero graft-logged events read as "nothing synced" even when it plainly held the content — the Forgejo side changes originate on (graft only logs the pushes it makes, never the pushes it reads from), or a side that received content via a path graft doesn't log itself (Radicle's own peer-to-peer gossip, or a Forgejo-to-Forgejo Authorized Integration). Those sides now show a distinct "source" or "replicated" badge instead, with a legend entry for each; "nothing synced" is reserved for a series with truly zero activity anywhere. Also: renamed the dashboard subtitle to "Forgejos & Radicles syncs", dropped the redundant "Activity by repo" heading, moved the "last 3 days" window label to the Recent Activity header, and renamed "Social bridges" to "Social IDs" throughout.

1 month ago