From d19be12fbbce4da614992920a63caaed44705eb6 Mon Sep 17 00:00:00 2001 From: dawn Date: Tue, 20 Oct 2026 06:52:49 +0300 Subject: [PATCH] idresolver: refuse private addresses unless IDRESOLVER_DEV is set, not the other way round Signed-off-by: dawn --- docker-compose.yml | 6 ++++++ idresolver/resolver.go | 2 +- localinfra/pc/bin/env.sh | 2 ++ spindle/fakes_test.go | 4 ++-- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 08341549e..8d870e5bb 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -288,6 +288,8 @@ services: dockerfile: localinfra/spindle.Dockerfile restart: unless-stopped environment: + # the did resolver refuses private docker addresses without IDRESOLVER_DEV + IDRESOLVER_DEV: "1" SPINDLE_SERVER_HOSTNAME: spindle.tngl.boltless.dev SPINDLE_SERVER_OWNER: did:plc:igzuueb63dytyy3tpaweofuu SPINDLE_SERVER_KEY_PATH: /var/lib/spindle/key.pem @@ -563,6 +565,8 @@ services: dockerfile: localinfra/deliberi.Dockerfile restart: unless-stopped environment: + # the did resolver refuses private docker addresses without IDRESOLVER_DEV + IDRESOLVER_DEV: "1" DELIBERI_DEV: "true" DELIBERI_HOSTNAME: deliberi.tngl.boltless.dev DELIBERI_LISTEN_ADDR: 0.0.0.0:6565 @@ -870,6 +874,8 @@ services: restart: unless-stopped env_file: ./localinfra/certs/migrator.env environment: + # the did resolver refuses private docker addresses without IDRESOLVER_DEV + IDRESOLVER_DEV: "1" MIGRATOR_HOSTNAME: migrator.tngl.boltless.dev MIGRATOR_APP_URL: https://web.tngl.boltless.dev MIGRATOR_PLC_URL: https://plc.tngl.boltless.dev diff --git a/idresolver/resolver.go b/idresolver/resolver.go index 57d8f6007..ee764dc98 100644 --- a/idresolver/resolver.go +++ b/idresolver/resolver.go @@ -33,7 +33,7 @@ func BaseDirectory(plcUrl string) *identity.BaseDirectory { Transport: &http.Transport{ // did documents are fetched for caller-supplied dids, so the transport refuses // non-public addresses; IDRESOLVER_DEV=1 lifts the guard for local plc instances - DialContext: netutil.SSRFDialer(os.Getenv("IDRESOLVER_DEV") != "1").DialContext, + DialContext: netutil.SSRFDialer(os.Getenv("IDRESOLVER_DEV") == "1").DialContext, // would want this around 100ms for services doing lots of handle resolution. Impacts PLC connections as well, but not too bad. IdleConnTimeout: time.Millisecond * 1000, MaxIdleConns: 100, diff --git a/localinfra/pc/bin/env.sh b/localinfra/pc/bin/env.sh index 27bfef69a..98c3a9398 100644 --- a/localinfra/pc/bin/env.sh +++ b/localinfra/pc/bin/env.sh @@ -19,5 +19,7 @@ done set +a export TNGL_PC TNGL_ROOT TNGL_STATE TNGL_CERTS TNGL_OFFLINE_GID +# stack hosts resolve to loopback, which the did resolver refuses without this +export IDRESOLVER_DEV=1 PATH=$TNGL_PC/bin:$PATH export PATH diff --git a/spindle/fakes_test.go b/spindle/fakes_test.go index 475cd63e5..91a78750e 100644 --- a/spindle/fakes_test.go +++ b/spindle/fakes_test.go @@ -314,8 +314,8 @@ type world struct { func newWorld(t *testing.T) *world { t.Helper() - // the resolver only dials the loopback plc below while this is unset - t.Setenv("IDRESOLVER_DEV", "") + // plc is on loopback, the did resolver refuses that outside dev + t.Setenv("IDRESOLVER_DEV", "1") t.Setenv("GIT_CONFIG_GLOBAL", os.DevNull) t.Setenv("GIT_CONFIG_SYSTEM", os.DevNull) t.Setenv("GIT_AUTHOR_NAME", "spindle") -- 2.54.0