GlcoinCore/ud3tn
1
0
Fork 0
mirror of https://gitlab.com/d3tn/ud3tn.git synced 2026-08-14 12:43:26 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

cmdline, docs: Warn about potentially insecure AAP TCP arguments

Browse source 
As AAP does not provide TLS support, a user exposing it on a TCP socket
should know what they are doing and set up appropriate firewall rules.

Signed-off-by: Felix Walter <felix.walter@d3tn.com>
This commit is contained in:
Felix Walter 2024-09-19 13:41:07 +02:00
parent 955ed80897
commit ddc62e1a11
4 changed files with 30 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

14
README.md
View file

@ -37,26 +37,26 @@ For simple setups with just a single node, µD3TN is ready to use with its defau
```
Mandatory arguments to long options are mandatory for short options, too.
-a, --aap-host HOST IP / hostname of the application agent service
-A, --aap2-host HOST IP / hostname of the AAP 2.0 service
-a, --aap-host HOST IP / hostname of the application agent service (may be insecure!)
-A, --aap2-host HOST IP / hostname of the AAP 2.0 service (may be insecure!)
-b, --bp-version 6|7 bundle protocol version of bundles created via AAP
-c, --cla CLA_OPTIONS configure the CLA subsystem according to the
syntax documented in the man page
syntax documented in the man page
-d, --external-dispatch do not load the internal minimal router, allow for using an AAP 2.0 BDM
-e, --node-id NODE_ID local node identifier (referring to the administrative endpoint)
-h, --help print this text and exit
-l, --lifetime SECONDS lifetime of bundles created via AAP
-L, --log-level higher or lower log level [1, 2, 3, 4] specifies more or less detailed output
-m, --max-bundle-size BYTES bundle fragmentation threshold
-p, --aap-port PORT port number of the application agent service
-P, --aap2-port PORT port number of the AAP 2.0 service
-p, --aap-port PORT port number of the application agent service (may be insecure!)
-P, --aap2-port PORT port number of the AAP 2.0 service (may be insecure!)
-r, --status-reports enable status reporting
-R, --allow-remote-config allow configuration via bundles received from CLAs
-R, --allow-remote-config allow configuration via bundles received from CLAs (insecure!)
-s, --aap-socket PATH path to the UNIX domain socket of the application agent service
-S, --aap2-socket PATH path to the UNIX domain socket of the experimental AAP 2.0 service
-u, --usage print usage summary and exit
-x, --bdm-secret-var VAR restrict AAP 2.0 BDM functions to clients providing the secret in the
given environment variable
given environment variable
Default invocation: ud3tn \
-b 7 \

2
components/ud3tn/cmdline.c
View file

@ -352,7 +352,7 @@ static void print_help_text(void)
" -p, --aap-port PORT port number of the application agent service (may be insecure!)\n"
" -P, --aap2-port PORT port number of the AAP 2.0 service (may be insecure!)\n"
" -r, --status-reports enable status reporting\n"
" -R, --allow-remote-config allow configuration via bundles received from CLAs and authorize all bundles from AAPv1 for BDM configuration\n"
" -R, --allow-remote-config allow configuration via bundles received from CLAs and authorize all bundles from AAPv1 for BDM configuration (insecure!)\n"
" -s, --aap-socket PATH path to the UNIX domain socket of the application agent service\n"
" -S, --aap2-socket PATH path to the UNIX domain socket of the AAP 2.0 service\n"
" -u, --usage print usage summary and exit\n"

6
components/ud3tn/init.c
View file

@ -147,6 +147,9 @@ void start_tasks(const struct ud3tn_cmdline_options *const opt)
abort();
}
if (opt->aap_node && opt->aap_service)
LOG_INFO("INIT: AAP TCP socket configured: Make sure that it is not exposed externally!");
uint64_t max_bundle_size_bytes = cla_get_max_bundle_size_bytes();
if (opt->mbs != 0 && (max_bundle_size_bytes == 0 ||
@ -172,6 +175,9 @@ void start_tasks(const struct ud3tn_cmdline_options *const opt)
abort();
}
if (opt->aap2_node && opt->aap2_service)
LOG_INFO("INIT: AAP 2.0 TCP socket configured: Make sure that it is not exposed externally!");
if (!opt->external_dispatch) {
const int cra_rv = compat_router_agent_setup(
&bundle_agent_interface,

24
doc/ud3tn.1
View file

@ -14,12 +14,16 @@ protocols for POSIX operating systems (well, and for Linux).
.SH OPTIONS
.TP
-a, --aap-host HOST
HOST specifies the IP address or hostname to which the application agent
service should be bound
HOST specifies the IP address or hostname to which the application agent TCP
socket should listen. This argument is only considered if no UNIX domain socket
is configured. Note that you have to make sure that the port is not exposed
externally as AAP does not provide security (e.g. it has no TLS support)!
.TP
-A, --aap2-host HOST
HOST specifies the IP address or hostname to which the AAP 2.0
service should be bound
HOST specifies the IP address or hostname to which the AAP 2.0 TCP
socket should listen. This argument is only considered if no UNIX domain socket
is configured. Note that you have to make sure that the port is not exposed
externally as AAP does not provide security (e.g. it has no TLS support)!
.TP
-b, --bp-version 6|7
provides the Bundle Protocol version (6 or 7) to be used when creating
@ -57,12 +61,16 @@ all maximum bundle sizes reported by the activated CLAs. A value of zero means
\[dq]unlimited\[dq] (2^64 bytes).
.TP
-p, --aap-port PORT
PORT specifies the port number to which the application agent service
should be bound
PORT specifies the TCP port number to which the application agent service
should be bound. This argument is only considered if no UNIX domain socket is
configured. Note that you have to make sure that the port is not exposed
externally as AAP does not provide security (e.g. it has no TLS support)!
.TP
-P, --aap2-port PORT
PORT specifies the port number to which the AAP 2.0 service
should be bound
PORT specifies the TCP port number to which the AAP 2.0 service
should be bound. This argument is only considered if no UNIX domain socket is
configured. Note that you have to make sure that the port is not exposed
externally as AAP does not provide security (e.g. it has no TLS support)!
.TP
-r, --status-reports
enable status reporting