Prepare KarlDNS production deployment

karldns/web/security_headers.py

@@ -0,0 +1,151 @@
+from __future__ import annotations
+
+import logging
+import time
+
+from fastapi import FastAPI, Request
+from fastapi.responses import PlainTextResponse
+from starlette.concurrency import run_in_threadpool
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from ..security import client_ip, is_rate_limited_path, rate_limit_bucket
+from ..settings import DdnsSettings
+from ..store import DdnsStore
+
+ACCESS_LOGGER = logging.getLogger("karldns.access")
+
+
+class RequestBodyTooLargeError(Exception):
+    pass
+
+
+class RequestBodyLimitMiddleware:
+    def __init__(self, app: ASGIApp, max_body_bytes: int) -> None:
+        self.app = app
+        self.max_body_bytes = max_body_bytes
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        received = 0
+
+        async def limited_receive() -> Message:
+            nonlocal received
+            message = await receive()
+            if message["type"] == "http.request":
+                received += len(message.get("body", b""))
+                if received > self.max_body_bytes:
+                    raise RequestBodyTooLargeError
+            return message
+
+        try:
+            await self.app(scope, limited_receive, send)
+        except RequestBodyTooLargeError:
+            response = PlainTextResponse("request body too large", status_code=413)
+            await response(scope, receive, send)
+
+
+
+def install_security_middleware(app: FastAPI, settings: DdnsSettings, store: DdnsStore) -> None:
+    @app.middleware("http")
+    async def security_middleware(request: Request, call_next):
+        started_at = time.perf_counter()
+        try:
+            content_length = int(request.headers.get("content-length", "0") or "0")
+        except ValueError:
+            content_length = 0
+        if content_length > settings.max_request_body_bytes:
+            return PlainTextResponse("request body too large", status_code=413)
+
+        if is_rate_limited_path(request.url.path) or is_admin_path(request.url.path, settings):
+            limit = (
+                settings.admin_rate_limit_per_minute
+                if is_admin_path(request.url.path, settings)
+                else settings.rate_limit_per_minute
+            )
+            key = f"{client_ip(request, settings)}:{rate_limit_bucket(request.url.path)}"
+            allowed = await run_in_threadpool(store.allow_rate_limit, key, limit)
+            if not allowed:
+                await run_in_threadpool(store.increment_metric, "rate_limit_hits_total")
+                return PlainTextResponse("rate limit exceeded", status_code=429)
+
+        response = await call_next(request)
+        if is_secret_response(request):
+            response.headers["Cache-Control"] = "no-store"
+            response.headers["Pragma"] = "no-cache"
+        if is_noindex_response(request):
+            response.headers["X-Robots-Tag"] = "noindex, nofollow"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["Referrer-Policy"] = "same-origin"
+        response.headers["Permissions-Policy"] = "geolocation=(), microphone=(), camera=()"
+        response.headers["Content-Security-Policy"] = content_security_policy(request.url.path)
+        if settings.public_base_url.startswith("https://"):
+            response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        if settings.redacted_access_log:
+            elapsed_ms = (time.perf_counter() - started_at) * 1000
+            ACCESS_LOGGER.info(
+                "%s %s status=%s duration_ms=%.2f",
+                request.method,
+                redacted_access_path(request.url.path),
+                response.status_code,
+                elapsed_ms,
+            )
+        return response
+
+
+def is_admin_path(path: str, settings: DdnsSettings) -> bool:
+    admin_path = settings.admin_path.rstrip("/")
+    return path == admin_path or path.startswith(f"{admin_path}/") or path.startswith("/api/v1/admin/")
+
+
+def is_secret_response(request: Request) -> bool:
+    path = request.url.path
+    settings = request.app.state.settings
+    if is_admin_path(path, settings) or path.startswith("/m/"):
+        return True
+    if path.startswith(("/api/v1/hostnames", "/api/v1/router/")):
+        return True
+    if path.startswith("/api/v1/admin/"):
+        return True
+    return request.method == "POST" and path == "/"
+
+
+def is_noindex_response(request: Request) -> bool:
+    path = request.url.path
+    if request.method != "GET":
+        return True
+    if path in {"/openapi.json", "/healthz"}:
+        return True
+    if path.startswith(("/api/", "/m/")):
+        return True
+    return is_admin_path(path, request.app.state.settings)
+
+
+def content_security_policy(path: str) -> str:
+    script_src = "script-src 'self' 'unsafe-inline'; " if path in {"/", "/privacy"} else "script-src 'self'; "
+    return (
+        "default-src 'self'; "
+        f"{script_src}"
+        "style-src 'self'; "
+        "img-src 'self' data:; "
+        "font-src 'self'; "
+        "connect-src 'self'; "
+        "form-action 'self'; "
+        "frame-ancestors 'none'"
+    )
+
+
+def redacted_access_path(path: str) -> str:
+    secret_prefixes = {
+        "/m": "/m/<secret>",
+        "/api/v1/hostnames": "/api/v1/hostnames/<secret>",
+        "/api/v1/router/register": "/api/v1/router/register/<secret>",
+        "/api/v1/router/update": "/api/v1/router/update/<secret>",
+    }
+    for prefix, replacement in secret_prefixes.items():
+        if path == prefix or path.startswith(f"{prefix}/"):
+            return replacement
+    return path