docs: sync read-authentication + bind hardening (GHSA-242f) - #41
Open
projectmentor wants to merge 1 commit into
Open
docs: sync read-authentication + bind hardening (GHSA-242f)#41projectmentor wants to merge 1 commit into
projectmentor wants to merge 1 commit into
Conversation
Document the protocol-2 sync read-authentication + bind-hardening fix for GHSA-242f-7fxg-f7wm (High, CWE-306). Reads were previously open — any tailnet host could pull the whole journal off /sync/chunk; writes were already signed. - SYNC_API.md: new "Request authentication" (Hive-Auth-* signed envelope) and endpoint auth-classification sections; protocol_version 2, advertised_addr, node_id on /hive/info; bind default is the tailnet IP not 0.0.0.0; 401 error code; phased-enforcement rollout runbook. - CLI_REFERENCE.md: hv sync auth [off|permissive|enforce]; HIVE_SYNC_AUTH, HIVE_BIND, HIVE_SYNC_AUTH_WINDOW env vars; dashboard /api/* is loopback-only. - ADVISORIES.md: GHSA-242f entry (unauth journal disclosure -> read-auth + bind). - P2P_DESIGN.md: protocol 2 endpoint auth classes, advertised_addr, bind change. - AGENT_INTEGRATION.md: 1.18 changelog entry. - README.md: sync daemon now signs remote reads and binds the tailnet IP. Docs only — no source/test changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Documents the just-implemented sync read-authentication + bind hardening fix for advisory GHSA-242f-7fxg-f7wm (High, CWE-306), which lands as sync protocol version 2. Docs only — no source or test changes.
Writes to the sync daemon were already authenticated (per-entry Ed25519 signatures on ingest); reads were open — any host that could reach
:9876could pull the entire journal off/sync/chunk, and the default bind was0.0.0.0. The fix requires remote reads to be signed, keeps loopback open, and binds the node's own tailnet IP.Files changed
Hive-Auth-*signed-request envelope:method + path + sorted-query + sha256(body) + timestamp + nonce, freshness windowHIVE_SYNC_AUTH_WINDOW, nonce replay guard, admitted-set check); Endpoint authentication classes table (open-discovery / remote-auth / loopback-only);protocol_version2,advertised_addr,node_idon/hive/info; bind default is the Tailscale IP not0.0.0.0;401error code; Rolling out enforcement runbook.hv sync auth [off|permissive|enforce]subcommand;HIVE_SYNC_AUTH,HIVE_BIND,HIVE_SYNC_AUTH_WINDOWenv vars; dashboard/api/*clarified as loopback-only.advertised_addr, bind change, peer-registry example.1.18changelog entry.Rollout (documented)
Land fix → every node reaches protocol 2 in
permissive(clients sign, nothing breaks) → confirm all peers reportprotocol_version2 (curl <peer>/hive/info) → flip each node toenforce. Offline nodes keep syncing underpermissive.Not touched
docs/THREAT_MODEL.md(its §3 is rewritten by the code-fix PR — avoiding a conflict) andverify.json/verify.json.sig(CI-signed).🤖 Generated with Claude Code