forked from unom/punktfunk
enricobuehler
defdfbdb58
Closes H-3 of the 2026-08-05 review, the last of its six highs. A plugin's
interface was reverse-proxied onto the console's own origin and framed with
`allow-same-origin`, so plugin JS ran as first-party code on that origin: one
`fetch('/api/**', {credentials:'same-origin'})` and the BFF attached the
operator's ADMIN bearer. That reached everything `plugin_may_access` withholds
— arm pairing, read the host PIN, approve a device, read `/hooks`. The "open
in new tab" link was the same escalation with no iframe involved at all.
The fix is not a sandbox attribute, and it is worth writing down why, because
the obvious change is the one that does not work. Dropping `allow-same-origin`
gives the frame an OPAQUE origin; its subresource requests are then cross-site;
the `SameSite=Lax` session cookie stops being sent; every plugin asset 302s to
/login and the frame is blank. Nothing about the new-tab link is helped either.
So the origin moves instead. A second listener on its own port (default
PORT + 1) serves plugin UIs and nothing else:
different ORIGIN — scheme+host+PORT — so the same-origin policy separates the
plugin from the console: it cannot read the console's DOM,
its cross-origin fetch of /api/** is unreadable (no CORS)
and cannot mutate (Sec-Fetch-Site sees same-site).
same SITE — cookie scope ignores the port and SameSite is computed on
the site, so the session cookie still reaches the plugin
listener and plugin pages keep working.
Enforcement is two refusals and both are load-bearing: the console origin
refuses /plugin-ui/**, and the plugin origin refuses everything ELSE — above
all /api/**, which would otherwise hand the admin bearer right back to plugin
JS that is now same-origin with that listener. Both are unconditional: if the
plugin port cannot be bound, plugin UIs are DISABLED and the console says so,
rather than falling back to the arrangement this exists to remove.
Two consequences that would otherwise bite in the field:
The port has to be open. Done for the Windows netsh rule, the firewalld
service and the ufw profile.
A browser stores a self-signed-certificate exception per ORIGIN, including
the port — and a certificate interstitial can never be shown inside an
iframe, so the frame would just sit blank with nothing on screen explaining
why. A `no-cors` probe distinguishes it (a TLS failure rejects; any HTTP
answer, even 401, resolves) and the console renders a card linking the
operator to open the port once in a real tab.
Also here: the health probe moved server-side to the console origin (it used
to rely on being same-origin with the plugin), the postMessage listener now
verifies `event.origin` — a real check rather than a tautology — and
plugin-kit's `postMessage(..., "*")` is documented as load-bearing, since
narrowing it to `location.origin` would now target the plugin's own origin and
silently drop every message.
Verified against a running console with a fake mgmt API and a fake plugin:
console /plugin-ui/** → 404; plugin-origin /api/v1/hooks, /, /login,
/_auth/logout → 404; plugin page loads 200 through its own origin;
unauthenticated plugin origin → 401 (not a redirect to a /login it does not
serve); a forged x-pf-listener header changes nothing on either listener; the
plugin's own Clear-Site-Data / Access-Control-Allow-Origin / Set-Cookie are
dropped by the proxy allowlist; the plugin origin's CSP names the console as
its only frame-ancestors source; and with the port squatted, ui-config reports
`unavailable`, the console still refuses /plugin-ui/**, and the console itself
keeps working.
Still wants on-glass confirmation in a real browser — the cookie and framing
behaviour is reasoned from spec, not observed.
cargo fmt --all --check clean; cargo check -p punktfunk-host --all-targets
green on Windows; web console builds and typechecks.
51 lines
3.1 KiB
Plaintext
51 lines
3.1 KiB
Plaintext
# ufw application profile for the punktfunk host — installed to
|
|
# /etc/ufw/applications.d/punktfunk by the .deb and the Arch/CachyOS package.
|
|
#
|
|
# This is the ufw analogue of the firewalld service definitions
|
|
# (punktfunk-native.xml / punktfunk-gamestream.xml): it turns opening the host's
|
|
# ports into a one-liner on the distros that use ufw instead of firewalld
|
|
# (CachyOS ships ufw enabled; Debian/Ubuntu ship it installed-but-inactive). ufw
|
|
# reads this directory on every command, so no reload is needed after the
|
|
# package drops the file — just:
|
|
#
|
|
# sudo ufw allow punktfunk-native # the secure native punktfunk/1 host (the default)
|
|
# sudo ufw allow punktfunk-gamestream # add GameStream/Moonlight compat (opt-in)
|
|
# sudo ufw allow punktfunk-web # reach the web console from the LAN (if punktfunk-web is installed)
|
|
# sudo ufw app info punktfunk-native # show what a profile opens
|
|
#
|
|
# Same port map as the firewalld services. The punktfunk/1 DATA plane is an
|
|
# ephemeral UDP port chosen per session and is NOT listed here: the host
|
|
# hole-punches, so a deny-inbound firewall still works (it just adds ~2.5 s at
|
|
# session start). To open a fixed one instead, run the host with
|
|
# `serve --data-port 9778` and `sudo ufw allow 9778/udp`.
|
|
|
|
[punktfunk-native]
|
|
title=punktfunk host (native punktfunk/1)
|
|
description=punktfunk/1 native streaming: QUIC control plane + mDNS auto-discovery + mgmt/library API (HTTPS + mTLS)
|
|
ports=9777/udp|5353/udp|47990/tcp
|
|
|
|
[punktfunk-gamestream]
|
|
title=punktfunk host (GameStream/Moonlight)
|
|
description=GameStream/Moonlight compatibility ports (opt-in, trusted LAN only)
|
|
ports=47984,47989,48010/tcp|47998:48010/udp|5353/udp
|
|
|
|
# The mgmt REST API (TCP 47990, in the punktfunk-native profile above) binds all interfaces by
|
|
# default so paired clients can browse the game library over mTLS. Off-loopback it exposes ONLY the
|
|
# read-only status + library endpoints, and only to a paired client certificate; every admin action
|
|
# (arming pairing, removing devices, session control, library edits) is honored over loopback only.
|
|
# Run the host with `--mgmt-bind 127.0.0.1:47990` to keep 47990 loopback-only (then don't open it).
|
|
#
|
|
# The optional web console (the separate punktfunk-web package). Open only if you installed it and
|
|
# want to reach it from another device — it binds all interfaces on TCP 47992 (HTTPS, login-gated),
|
|
# and serves plugin UIs from a SEPARATE ORIGIN on TCP 47993.
|
|
#
|
|
# 47993 is not a second console. A plugin's interface is third-party code, and serving it on the
|
|
# console's own origin let it act as the logged-in operator (security-review 2026-08-05 H-3). Same
|
|
# host, same certificate, different port: a different ORIGIN to the browser, so the same-origin
|
|
# policy is the boundary — but still the same SITE, so the login session still reaches it. It is
|
|
# login-gated exactly like the console, and only needed for plugins that ship a UI.
|
|
[punktfunk-web]
|
|
title=punktfunk web console
|
|
description=The optional punktfunk management web console (HTTPS, login-gated) reachable from the LAN, plus the separate-origin port its plugin UIs are served on
|
|
ports=47992,47993/tcp
|