Discussion: In PV-access security optionally check host names provided by client without DNS lookup

[goetzpf]

I have found that the p4p gateway always does DNS lookups for host names given in host access groups.

I see that this is more secure than it was with EPICS 3.15 and channel access, where the gateway relied on the host name the client provided, since the client could easily fake this.

However, at our facility, the BESSY II Storage Ring at the Helmholtz-Zentrum Berlin we currently use EPICS 3.15 with it's simple host name matching and have additional security by the many networks with separate gateways. We currently do not need to add every new PC or notebook at the beamline to our DNS system or assign fixed IP numbers. Adding the host name the new PC is configured with to our configuration is sufficient.

Would it be possible to add a switch to the PVAccess gateway so it does not do DNS name lookups and simply compares the host name provided by the client, just as the CA-Gateway with EPICS 3.15 did ?

[bfrk]

Let me clarify this.

Most of our IOC hosts have lots of IOCs running on them. We still distinguish them in the access security configuration because each IOC gets its own "host name" (via /usr/bin/unshare -u sethostname). These "host names" do not correspond to any IP adresses, nor should they. It is thus absolutely essential for us to be able to turn off IP address checking and instead use the "host name" provided by the PV Access client as is, exactly as it is done in EPICS base. (BTW, I wonder why the p4p gateway does not use the mechanism from EPICS base and instead chooses to re-implement it.)

[mdavidsaver]

... each IOC gets its own "host name" (via /usr/bin/unshare -u sethostname). ...

That is clever, although with hindsight it is unfortunate that the username is not overridden instead.

(BTW, I wonder why the p4p gateway does not use the mechanism from EPICS base and instead chooses to re-implement it.)

p4p.gw supports multiple server endpoints within a single process. This allows eg. a bidirectional gateway. I wanted each logical server to have an independent PV list and ACF rules. Unfortunately, the ACF engine in epics-base is a singleton.

As a note, if I did use the Base ACF engine, it would be with the asCheckClientIP global set to 1 by default, so the effect would be the same. I see the use of unverified client provided "credentials" in access control decisions as a legacy behavior. The future should involve verifiable credentials. eg. the Common Name from an x509 certificate verified during a TLS handshake. In your case, this would be an easier way to set per IOC names without messing with linux namespaces

Would it be possible to add a switch to the PVAccess gateway so it does not do DNS name lookups and simply compares the host name provided by the client, just as the CA-Gateway with EPICS 3.15 did ?

Such a change to p4p.gw would be necessary, but not sufficient. p4p.gw is comparing the string provided by the layer below. PVXS would first need to be changed to conditionally pass through the client's professed "host" string in place of the known peer IP:port.

Where in PVXS the ClientCredential peer is initialized on connection:

https://github.com/epics-base/pvxs/blob/1d481d5be1db1e1bcc934c82a8bcec162c3ac31f/src/serverconn.cpp#L74-L75

And where the client's professed "user" is filled in. Currently the "host" is ignored:

https://github.com/epics-base/pvxs/blob/1d481d5be1db1e1bcc934c82a8bcec162c3ac31f/src/serverconn.cpp#L224-L227

I am open to a expert option in pvxs::server::Config to instead pass through client provided "host" string as ClientCredential::peer. Some suitable scary name like bool Config::use_insecure_peer_name=false.

[bfrk]

... each IOC gets its own "host name" (via /usr/bin/unshare -u sethostname). ...

That is clever, although with hindsight it is unfortunate that the username is not overridden instead.

If there were an equally simple way to do that, then this would be a viable alternative for us. Unfortunately I am not aware of any tool that can do that, i.e. modify/fake a user name of an existing user (UID) during the runtime of, and limited to, a particular process. As a last resort, we may hack this into the epics base(s) we are using to create IOCs, probably by modifying osiGetUserName to use some environment variable (if defined).

(BTW, I wonder why the p4p gateway does not use the mechanism from EPICS base and instead chooses to re-implement it.)

p4p.gw supports multiple server endpoints within a single process. This allows eg. a bidirectional gateway. I wanted each logical server to have an independent PV list and ACF rules. Unfortunately, the ACF engine in epics-base is a singleton.

I see.

As a note, if I did use the Base ACF engine, it would be with the asCheckClientIP global set to 1 by default, so the effect would be the same.

But that could then very easily be made configurable by the user. Anyway, this is academic as you can't use the implementation in base.

I see the use of unverified client provided "credentials" in access control decisions as a legacy behavior.

I certainly agree with that assessment in principle. But removing an existing feature, however legacy, without /first/ providing a better (securely verifiable) replacement makes it unnecessarily hard to adopt PVA in existing facilities.

The future should involve verifiable credentials. eg. the Common Name from an x509 certificate verified during a TLS handshake. In your case, this would be an easier way to set per IOC names without messing with linux namespaces

I hope you aren't seriously suggesting that setting up a certificate infrastructure is easier than a simple unshare wrapper call ;-)

And this functionality isn't even implemented yet and I certainly do not have the expertise or the time to do that.

I am open to a expert option in pvxs::server::Config to instead pass through client provided "host" string as ClientCredential::peer. Some suitable scary name like bool Config::use_insecure_peer_name=false.

Thanks for the hints and code locations. If it is more or less a matter of overwriting C->peer in ServerConn::handle_CONNECTION_VALIDATION, then something like the following may basically do the trick. Code untested, but compiles, included here merely to ask if there is anything major that I am missing.

diff --git a/src/config.cpp b/src/config.cpp
index fc292ae..159334d 100644
--- a/src/config.cpp
+++ b/src/config.cpp
@@ -431,6 +431,10 @@ void _fromDefs(Config& self, const std::map<std::string, std::string>& defs, boo
         parse_bool(self.auto_beacon, pickone.name, pickone.val);
     }
 
+    if(pickone({"EPICS_PVAS_USE_INSECURE_PEER_NAME"})) {
+        parse_bool(self.use_insecure_peer_name, pickone.name, pickone.val);
+    }
+
     if(pickone({"EPICS_PVA_CONN_TMO"})) {
         parse_timeout(self.tcpTimeout, pickone.name, pickone.val);
     }
diff --git a/src/pvxs/server.h b/src/pvxs/server.h
index 03fe665..4417d39 100644
--- a/src/pvxs/server.h
+++ b/src/pvxs/server.h
@@ -170,6 +170,9 @@ struct PVXS_API Config {
     unsigned short udp_port = 5076;
     //! Whether to populate the beacon address list automatically.  (recommended)
     bool auto_beacon = true;
+    //! Whether to use the client provided host name for authentication
+    //! instead of the host IP from the network layer.
+    bool use_insecure_peer_name = false;
 
     //! Inactivity timeout interval for TCP connections.  (seconds)
     //! @since 0.2.0
diff --git a/src/serverconn.cpp b/src/serverconn.cpp
index c4e2711..32672d4 100644
--- a/src/serverconn.cpp
+++ b/src/serverconn.cpp
@@ -225,6 +225,11 @@ void ServerConn::handle_CONNECTION_VALIDATION()
                     C->method = selected;
                     C->account = user;
                 });
+                if(iface->server->effective.use_insecure_peer_name) {
+                    auth["host"].as<std::string>([&C, &selected](const std::string& host) {
+                        C->peer = host;
+                    });
+                }
             }
             if(C->method.empty()) {
                 C->account = C->method = "anonymous";