s1d3sw1ped/steamcache2
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 32 Wiki Activity

ops: Assert Host allowlist reject in validate-check #55

Merged
eva merged 1 commits from ops/host-allowlist-reject-assert into main 2026-09-14 08:41:19 -05:00
Conversation 0 Commits 1 Files Changed 3
+25 -5
blake commented 2026-09-14 08:39:38 -05:00
Collaborator
Copy Link
Copy Source

Why

Empty-upstream Host allowlist is load-bearing: if that gate regresses, the cache becomes an open LAN reverse proxy again. Unit tests already cover hostAllowedForDirectFetch, but make validate-check did not probe the live reject path.

What

  • Extend make validate-check to GET /depot/allowlist-probe/chunk with Host: evil.example and Steam UA; require HTTP 400 and Invalid URL
  • Brief README + validate-config notes on expected reject behavior

Test

  • go test ./steamcache/ -run "TestHostAllowedForDirectFetch|TestDirectFetchRejectsNonSteamHost" — pass
  • Live probe against empty-upstream binary on ephemeral port — 400 Invalid URL

Risks / rollback

Makefile + docs only. Revert commit.

Fixes #37

## Why Empty-upstream Host allowlist is load-bearing: if that gate regresses, the cache becomes an open LAN reverse proxy again. Unit tests already cover `hostAllowedForDirectFetch`, but `make validate-check` did not probe the live reject path. ## What - Extend `make validate-check` to GET `/depot/allowlist-probe/chunk` with `Host: evil.example` and Steam UA; require HTTP 400 and `Invalid URL` - Brief README + validate-config notes on expected reject behavior ## Test - `go test ./steamcache/ -run "TestHostAllowedForDirectFetch|TestDirectFetchRejectsNonSteamHost"` — pass - Live probe against empty-upstream binary on ephemeral port — 400 Invalid URL ## Risks / rollback Makefile + docs only. Revert commit. Fixes #37
blake added 1 commit 2026-09-14 08:39:38 -05:00
ops: Assert Host allowlist reject in validate-check
CI / vulncheck (pull_request) Successful in 16s
Details
CI / check-and-test (pull_request) Successful in 53s
Details
CI / vulncheck (push) Successful in 22s
Details
CI / check-and-test (push) Successful in 1m0s
Details
Release Tag / release (push) Successful in 15s
Details
97af0f829b 
Empty-upstream Host allowlist is load-bearing: if that gate regresses,
the cache becomes an open LAN reverse proxy again. Unit tests already
cover hostAllowedForDirectFetch, but make validate-check did not probe
the live reject path.

Extend validate-check to GET a depot-like path with Host: evil.example
and a Steam User-Agent, requiring HTTP 400 Invalid URL. Document the
expected reject in README and the validate-config comment.

Fixes #37
eva merged commit 97af0f829b into main 2026-09-14 08:41:19 -05:00
eva deleted branch ops/host-allowlist-reject-assert 2026-09-14 08:41:19 -05:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 draft
Draft for review — do not merge without Eva review
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ash blake eva linus moss pike s1d3sw1ped
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: s1d3sw1ped/steamcache2#55
Delete Branch "ops/host-allowlist-reject-assert"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?