feat(device-edge): standardize Core channel on mTLS 443

2026-08-12 01:43:04 +03:00
parent 2eb6116880
commit c2d06bddc7
15 changed files with 51 additions and 37 deletions
@@ -6,7 +6,7 @@
  "transport": {
    "protocol": "http2-bidirectional-stream",
    "tls": "TLSv1.3-mutual-authentication",
-    "edgeListen": "0.0.0.0:8443",
+    "edgeListen": "0.0.0.0:443",
    "endpointSource": "device-control-core.edge-registration",
    "browserAccess": "forbidden",
    "bearerOnlyAuthentication": "forbidden",
@@ -30,7 +30,7 @@
    "allowedEdgeListeners": [
      "management-ssh",
      "raw-device-tcp/9921",
-      "core-channel-mtls/8443"
+      "core-channel-mtls/443"
    ]
  },
  "messageContract": {
@@ -9,7 +9,7 @@
  "runtimeUser": "nodedc-channel",
  "runtimeService": "nodedc-device-edge-channel.service",
  "runtime": "accepted-node-v22.23.2-no-docker",
-  "publicIngress": "tcp/8443-mtls-only",
+  "publicIngress": "tcp/443-mtls-only",
  "health": "127.0.0.1:18222",
  "trackerIngress": "disabled",
  "rawDeviceTcp9921": "closed",
@@ -18,6 +18,7 @@
  "privateKeyBoundary": "runner-managed-host-local-only",
  "peerTrustPrerequisite": "exact-pinned-self-signed-core-certificate-and-fingerprint",
  "tls": "TLSv1.3+h2+mutual-authentication",
+  "networkPrivilege": "CAP_NET_BIND_SERVICE-only-for-non-root-tcp-443",
  "resourceCeilings": {
    "memory": "128M",
    "swap": "0",
@@ -45,10 +46,10 @@
    "edge-server-and-core-client-self-signed-identities-mutually-pinned",
    "core-initiated-channel-accepted",
    "unknown-core-certificate-rejected",
-    "public-8443-only-beside-management-ssh",
+    "public-443-only-beside-management-ssh",
    "tracker-tcp-9921-closed",
    "loopback-health-contract",
    "resource-ceilings-present"
  ],
-  "rollback": "close-8443-stop-channel-restore-exact-accepted-foundation-without-backhaul-or-relay"
+  "rollback": "close-443-stop-channel-restore-exact-accepted-foundation-without-backhaul-or-relay"
 }
@@ -21,7 +21,7 @@ HTTP/2 bidirectional session:
 ARUSNAVI B2
  -> raw TCP/9921
  -> Device Gateway Edge on the VPS
-  -> accepted Core-owned mTLS session on TCP/8443
+  -> accepted Core-owned mTLS session on standard HTTPS TCP/443
  -> Device Gateway Core on Synology
  -> Device Control Core
 ```
@@ -220,7 +220,7 @@ The target Edge exposes only:

 - management SSH according to the separately accepted management policy;
 - raw tracker ingress TCP/9921;
- Core channel TCP/8443 with mandatory mTLS.
+- Core channel TCP/443 with mandatory mTLS; this is not a browser or bearer-token endpoint.

 Synology exposes no public device or backhaul port. The Edge receives no subnet
 route, exit-node capability, Tailscale SSH, Docker socket or generic proxy. The
@@ -266,7 +266,7 @@ function normalizeRegistration(value) {
    || endpoint.pathname !== "/"
    || endpoint.search
    || endpoint.hash
-    || endpoint.port !== "8443"
+    || endpoint.port !== ""
    || endpoint.hostname !== String(value.servername || "").toLowerCase()
    || !isPublicIpv4(endpoint.hostname)
  ) {
@@ -418,7 +418,7 @@ function normalizeEdgeEndpoint(value) {
    || endpoint.pathname !== "/"
    || endpoint.search
    || endpoint.hash
-    || endpoint.port !== "8443"
+    || endpoint.port !== ""
    || !isPublicIpv4(endpoint.hostname)
  ) {
    throw new TypeError("device_edge_channel_endpoint_invalid");
@@ -101,7 +101,7 @@ test("supervisor keeps a failed trust enrollment isolated from other Edges", asy
 function registration(channelGeneration, edgeRegistrationId = "edge:pilot") {
  return {
    edgeRegistrationId,
-    endpoint: "https://155.212.211.15:8443/",
+    endpoint: "https://155.212.211.15/",
    servername: "155.212.211.15",
    channelGeneration,
    trustBundleRef: "edge-trust:moscow-edge",
@@ -150,7 +150,7 @@ test("normalizes only a pinned Core-initiated public Edge channel", () => {
    deploymentRef: "deployment:device-edge/moscow-1",
    lifecycleState: "active",
    channel: {
-      endpoint: "https://155.212.211.15:8443/",
+      endpoint: "https://155.212.211.15/",
      servername: "155.212.211.15",
      generationRef: "channel-generation:1",
      trustBundleRef: "edge-trust:moscow-edge",
@@ -163,14 +163,15 @@ test("normalizes only a pinned Core-initiated public Edge channel", () => {
    },
  });

-  assert.equal(command.channel.endpoint, "https://155.212.211.15:8443/");
+  assert.equal(command.channel.endpoint, "https://155.212.211.15/");
  assert.equal(command.channel.lifecycleState, "active");
  assert.equal(command.channel.certificateIdentities.length, 1);
  for (const endpoint of [
-    "https://127.0.0.1:8443/",
-    "https://192.168.1.1:8443/",
+    "https://127.0.0.1/",
+    "https://192.168.1.1/",
+    "https://155.212.211.15:8443/",
    "https://155.212.211.15:9921/",
-    "http://155.212.211.15:8443/",
+    "http://155.212.211.15/",
  ]) {
    assert.throws(
      () => normalizeInfrastructureManagementCommand("edge.ensure", {
@@ -198,7 +198,7 @@ test("lists only bounded active Edge channel registrations without secrets", asy
    step("from device_edges", {
      rows: [{
        id: edgeId,
-        channel_endpoint: "https://155.212.211.15:8443/",
+        channel_endpoint: "https://155.212.211.15/",
        channel_servername: "155.212.211.15",
        channel_generation_ref: "channel-generation:1",
        channel_trust_bundle_ref: "edge-trust:moscow-edge",
@@ -218,7 +218,7 @@ test("lists only bounded active Edge channel registrations without secrets", asy

  assert.deepEqual(registrations[0], {
    edgeRegistrationId: `edge:${edgeId}`,
-    endpoint: "https://155.212.211.15:8443/",
+    endpoint: "https://155.212.211.15/",
    servername: "155.212.211.15",
    channelGeneration: "channel-generation:1",
    trustBundleRef: "edge-trust:moscow-edge",
@@ -412,7 +412,7 @@ function normalizeConfig(options) {
    channelGeneration,
    trust,
    host: normalizeHost(options.host ?? "127.0.0.1"),
-    port: normalizePort(options.port ?? 8443),
+    port: normalizePort(options.port ?? 443),
    keepaliveMs,
    deadPeerMs,
    acceptanceTimeoutMs: normalizeDuration(
@@ -75,7 +75,7 @@ export async function readRuntimeConfiguration(environment = {}) {
      channelGeneration: config.channelGeneration,
      trustGeneration: config.trustGeneration,
      host: normalizeHost(environment.DEVICE_EDGE_CHANNEL_HOST ?? "0.0.0.0"),
-      port: normalizePort(environment.DEVICE_EDGE_CHANNEL_PORT, 8443),
+      port: normalizePort(environment.DEVICE_EDGE_CHANNEL_PORT, 443),
      tls: Object.freeze({
        key,
        cert,
@@ -13,7 +13,7 @@ table inet nodedc_b2_vps {
    ip6 nexthdr ipv6-icmp accept

    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
-    tcp dport 8443 ct state new limit rate 120/minute burst 120 packets accept
+    tcp dport 443 ct state new limit rate 120/minute burst 120 packets accept
  }

  chain forward {
@@ -9,7 +9,7 @@ User=nodedc-channel
 Group=nodedc-channel
 ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs
 Environment=DEVICE_EDGE_CHANNEL_HOST=0.0.0.0
-Environment=DEVICE_EDGE_CHANNEL_PORT=8443
+Environment=DEVICE_EDGE_CHANNEL_PORT=443
 Environment=DEVICE_EDGE_CHANNEL_HEALTH_HOST=127.0.0.1
 Environment=DEVICE_EDGE_CHANNEL_HEALTH_PORT=18222
 Environment=DEVICE_EDGE_CHANNEL_CONFIG_FILE=/var/lib/nodedc-b2-vps/channel-trust/runtime.json
@@ -37,8 +37,8 @@ LockPersonality=yes
 MemoryDenyWriteExecute=no
 SystemCallArchitectures=native
 RestrictAddressFamilies=AF_INET AF_INET6
-CapabilityBoundingSet=
-AmbientCapabilities=
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
 UMask=0077
 MemoryMax=128M
 MemorySwapMax=0