feat(proxy): allowlist AWS_SIGN_ACCEPT_ENCODING - #1615
Open
kinorai wants to merge 2 commits into
Open
Conversation
backupstore gained AWS_SIGN_ACCEPT_ENCODING, which excludes Accept-Encoding from the SigV4 SignedHeaders set for backup targets reached through a proxy that alters the header in transit. longhorn-manager sends the key through getBackupCredentialEnv, which appends every S3 credential entry unconditionally, whether or not the secret sets it. validateBackupEnv rejects the whole request on a single key outside backupEnvAllowlist, so without this entry every S3 backup and restore fails with: "env key \"AWS_SIGN_ACCEPT_ENCODING\" is not permitted by the backup env allowlist" Add the key to backupEnvAllowlist. It selects a signing option rather than carrying a credential, and it is not a loader variable, so it does not widen the exposure GHSA-wgh7-5vxp-4qr4 closed. This must ship before or with the longhorn-manager change that sends the key. Longhorn 13756 Signed-off-by: kinorai <kinorai@users.noreply.github.com>
This was referenced Aug 16, 2026
|
|
||
| // Selects whether Accept-Encoding is part of the SigV4 signature. It is a | ||
| // signing option, not a credential, and carries no secret. | ||
| btypes.AWSSignAcceptEncoding: {}, |
Author
There was a problem hiding this comment.
Couldn't compile when I opened this. backupstore#316 merged as 12a1fc975d8f, so I bumped and re-vendored in 210d947.
make validate and the test stage both pass in the container, pkg/proxy included. Diff is go.mod, go.sum, vendor/modules.txt and the three backupstore files.
longhorn/backupstore#316 merged as 12a1fc975d8f and defines types.AWSSignAcceptEncoding, which pkg/proxy/env_allowlist.go references. Bump and re-vendor so the package compiles. Longhorn 13756 Signed-off-by: kinorai <kinorai@users.noreply.github.com>
kinorai
force-pushed
the
feat/allowlist-sign-accept-encoding
branch
from
August 20, 2026 13:57
bfc83ed to
210d947
Compare
Member
|
@mergify backport v1.12.x |
🟠 Waiting for conditions to matchDetails
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue(s) this PR fixes:
Issue longhorn/longhorn#13756
What this PR does / why we need it:
backupstoregainedAWS_SIGN_ACCEPT_ENCODING(longhorn/backupstore#316), whichexcludes
Accept-Encodingfrom the SigV4SignedHeadersset for backup targetsreached through a proxy that alters the header in transit.
longhorn-managersends the key throughgetBackupCredentialEnv(longhorn/longhorn-manager#5100), which appends every S3 credential entry
unconditionally, whether or not the secret sets it.
validateBackupEnvrejects thewhole request on a single key outside
backupEnvAllowlist, so without this entryevery S3 backup and restore fails with:
This adds the key to
backupEnvAllowlist, and to the allowlist enumerated byTestSetEnv_AcceptsAllowlistedCredentials.Special notes for your reviewer:
Merge order matters. This must ship before or with the
longhorn-managerchange.The other direction breaks every S3 backup, not only the backups of users who set the
key.
On the security boundary.
AWS_SIGN_ACCEPT_ENCODINGselects a signing option. Itcarries no credential and it is not a loader variable, so it does not widen the
exposure GHSA-wgh7-5vxp-4qr4 closed. Its value is consumed only by
strconv.ParseBoolinbackupstore, and any non-boolean value is rejected there.Dependency.
btypes.AWSSignAcceptEncodingneeds thebackupstorevendor bump, sothis does not compile until longhorn/backupstore#316 merges.
Additional documentation or context
I could not build
./pkg/proxylocally, because the vendoredlonghorn-engine/pkg/qcowneedslibqcow.h, which the Dockerfile builds from source.Instead I type-checked
env_allowlist.goagainst a copy of the post-bumpbackupstore/types, and ranvalidateBackupEnvagainst it directly:AWS_SIGN_ACCEPT_ENCODING=falseis accepted, andLD_PRELOAD=/evil.sois stillrejected. The same check against current
masterfails, which is what this PR fixes.Prepared with AI assistance (Claude Code). Every test and command reported above was run, not estimated.