Merge pull request #1030 from Wikid82/development

feat(orthrus): server-side Docker proxy listener for agent sessions

Author: Wikid82

.github/workflows/nightly-build.yml

@@ -361,6 +361,88 @@ jobs:
           cosign attach sbom --sbom sbom-nightly.json "${{ env.DOCKERHUB_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.resolve_digest.outputs.digest }}"
           echo "✅ SBOM attached to Docker Hub nightly image"
 
+  build-and-push-nightly-orthrus:
+    needs: sync-development-to-nightly
+    if: needs.sync-development-to-nightly.outputs.has_changes == 'true' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    env:
+      ORTHRUS_IMAGE_NAME: wikid82/orthrus
+      HAS_DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN != '' }}
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout nightly branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || 'nightly' }}
+          fetch-depth: 0
+
+      - name: Set lowercase image name
+        run: echo "ORTHRUS_IMAGE_NAME_LC=${ORTHRUS_IMAGE_NAME,,}" >> "$GITHUB_ENV"
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+        with:
+          registry: ${{ env.GHCR_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        if: env.HAS_DOCKERHUB_TOKEN == 'true'
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
+        with:
+          images: |
+            ${{ env.GHCR_REGISTRY }}/${{ env.ORTHRUS_IMAGE_NAME_LC }}
+            ${{ env.DOCKERHUB_REGISTRY }}/${{ env.ORTHRUS_IMAGE_NAME_LC }}
+          tags: |
+            type=raw,value=nightly
+            type=raw,value=nightly-{{date 'YYYY-MM-DD'}}
+            type=sha,prefix=nightly-,format=short
+          labels: |
+            org.opencontainers.image.title=Orthrus Agent Nightly
+            org.opencontainers.image.description=Nightly build of the Orthrus reverse-proxy agent
+
+      - name: Build and push Orthrus nightly image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f  # v7.1.0
+        with:
+          context: ./agent
+          file: ./agent/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=nightly-${{ github.sha }}
+            GIT_COMMIT=${{ github.sha }}
+            BUILD_DATE=${{ github.event.repository.pushed_at }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Record Orthrus nightly image tags
+        run: |
+          {
+            echo "## 🐕 Orthrus Nightly Image Tags"
+            echo '```'
+            echo "${{ steps.meta.outputs.tags }}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
   test-nightly-image:
     needs: build-and-push-nightly
     runs-on: ubuntu-latest

.github/workflows/orthrus-build.yml

@@ -3,7 +3,8 @@ name: Orthrus Agent — Build & Publish
 # Mirrors the trigger and tagging strategy from docker-build.yml so that the
 # Orthrus agent image always receives the same identifiable tags as the main
 # Charon image (e.g. feature-hecate-abc1234), enabling coordinated manual
-# testing on remote servers.
+# testing on remote servers. The push trigger has no paths filter (matching
+# docker-build.yml); paths filtering is only applied to pull_request events.
 
 "on":
   pull_request:
@@ -13,9 +14,6 @@ name: Orthrus Agent — Build & Publish
   push:
     branches: [main, development]
     tags: ['v*']
-    paths:
-      - 'agent/**'
-      - '.github/workflows/orthrus-build.yml'
   workflow_dispatch:
     inputs:
       reason:

.vscode/settings.json

@@ -1,5 +1,6 @@
 {
   "docker.host": "unix:///run/user/1001/docker.sock",
+  "go.goroot": "/home/jeremy/sdk/go1.26.3",
   "gopls": {
     "buildFlags": ["-tags=integration"]
   },

Dockerfile

@@ -37,9 +37,11 @@ ARG NPM_VERSION=11.11.1
 # avoid accidentally pulling a v3 major release. Renovate can still update
 # this ARG to a specific v2.x tag when desired.
 ## Try to build the requested Caddy v2.x tag (Renovate can update this ARG).
-## If the requested tag isn't available, fall back to a known-good v2.11.2 build.
-ARG CADDY_VERSION=2.11.2
-ARG CADDY_CANDIDATE_VERSION=2.11.2
+## If the requested tag isn't available, fall back to a known-good v2.11.3 build.
+# renovate: datasource=go depName=https://github.com/caddyserver/caddy
+ARG CADDY_VERSION=2.11.3
+# renovate: datasource=go depName=https://github.com/caddyserver/caddy
+ARG CADDY_CANDIDATE_VERSION=2.11.3
 ARG CADDY_USE_CANDIDATE=0
 ARG CADDY_PATCH_SCENARIO=B
 # renovate: datasource=go depName=github.com/greenpau/caddy-security
@@ -404,7 +406,7 @@ RUN go get github.com/expr-lang/expr@v${EXPR_LANG_VERSION} && \
     # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
     go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.10 && \
     # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
-    go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.73.0 && \
+    go get github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.74.0 && \
     go get github.com/aws/aws-sdk-go-v2/service/kinesis@v1.43.7 && \
     # renovate: datasource=go depName=github.com/aws/aws-sdk-go-v2/service/s3
     go get github.com/aws/aws-sdk-go-v2/service/s3@v1.101.0 && \

SECURITY.md

@@ -27,7 +27,7 @@ public disclosure.
 
 ## Known Vulnerabilities
 
-Last reviewed: 2026-04-21
+Last reviewed: 2026-05-20
 
 ### [HIGH] CVE-2026-31790 · OpenSSL Vulnerability in Alpine Base Image
 
@@ -195,6 +195,91 @@ attacker-controlled URLs. Charon's application logic does not use busybox wget.
 Monitor Alpine 3.23 for a patched busybox APK. No immediate action required. Practical risk to
 Charon users is negligible since the vulnerable code path is not exercised.
 
+---
+
+### [HIGH] CVE-2026-45135 · Caddy FastCGI Unsafe Unicode Handling in splitPos
+
+| Field        | Value |
+|--------------|-------|
+| **ID**       | CVE-2026-45135 |
+| **Severity** | High · 8.1 |
+| **Status**   | Fix in Dockerfile (v2.11.3) — Pending Image Rebuild |
+
+**What**
+Caddy v2.11.2 contains unsafe Unicode handling in the FastCGI `splitPos` function. A
+network-reachable attacker (no privileges required, high attack complexity) can trigger
+potential confidentiality and integrity impact through malformed Unicode in FastCGI requests.
+
+**Who**
+
+- Discovered by: Automated scan (Trivy image scan)
+- Reported: 2026-05-20
+- Affects: Charon deployments using the FastCGI reverse proxy capability
+
+**Where**
+
+- Component: `github.com/caddyserver/caddy/v2` v2.11.2 (embedded in Charon binary via xcaddy)
+- Versions affected: Caddy < v2.11.3
+
+**When**
+
+- Discovered: 2026-05-20
+- Disclosed (if public): Public
+- Target fix: v2.11.3 (available)
+
+**How**
+Caddy is not a Go module dependency — it is built from source via xcaddy in the Dockerfile
+multi-stage build. The `CADDY_VERSION` ARG in the Dockerfile **is already pinned to 2.11.3**,
+which contains the fix. The vulnerability only affects the stale `charon:local` image built
+before this Dockerfile change. A container image rebuild applies the fix.
+
+**Planned Remediation**
+Rebuild the container image. No code changes required. The fix is already present in the
+Dockerfile (`ARG CADDY_VERSION=2.11.3`).
+
+---
+
+### [HIGH] CVE-2026-32286 · pgproto3 DoS via Negative DataRow Field Length
+
+| Field        | Value |
+|--------------|-------|
+| **ID**       | CVE-2026-32286 |
+| **Severity** | High · 7.5 |
+| **Status**   | Awaiting Upstream |
+
+**What**
+`github.com/jackc/pgproto3/v2` v2.3.3 — `DataRow.Decode` does not validate field length
+before allocation. A malicious or compromised PostgreSQL server can send a DataRow message
+with a negative field length to trigger a panic or excessive memory allocation, causing denial
+of service (CWE-400).
+
+**Who**
+
+- Discovered by: Automated scan (Trivy image scan)
+- Reported: 2026-05-20
+- Affects: Charon deployments connecting to an untrusted PostgreSQL server (non-default)
+
+**Where**
+
+- Component: `github.com/jackc/pgproto3/v2` v2.3.3 (transitive Go dependency)
+- Versions affected: pgproto3/v2 < patched version
+
+**When**
+
+- Discovered: 2026-05-20
+- Disclosed (if public): Public
+- Target fix: When upstream publishes a patched release
+
+**How**
+Exploitation requires a malicious or compromised PostgreSQL server to send a crafted DataRow
+message. Charon's default installation uses SQLite and does not connect to PostgreSQL. Users
+deploying Charon with a PostgreSQL backend (non-standard configuration) may be exposed if the
+database server is untrusted. EPSS score not yet available.
+
+**Planned Remediation**
+Monitor https://github.com/jackc/pgproto3 for a fix release. Upgrade the indirect dependency
+once a patched version is available. Pre-existing; not introduced by PR #1031.
+
 ## Patched Vulnerabilities
 
 ### ✅ [HIGH] CVE-2026-34040 · Docker AuthZ Plugin Bypass via Oversized Request Body
@@ -756,4 +841,4 @@ We recognize security researchers who help improve Charon:
 
 ---
 
-**Last Updated**: 2026-03-24
+**Last Updated**: 2026-05-18

backend/go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/hashicorp/yamux v0.1.2
 	github.com/mattn/go-sqlite3 v1.14.44
 	github.com/moby/moby/client v0.4.1
-	github.com/oschwald/geoip2-golang/v2 v2.1.0
+	github.com/oschwald/geoip2-golang/v2 v2.2.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sirupsen/logrus v1.9.4
@@ -69,7 +69,7 @@ require (
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/oschwald/maxminddb-golang/v2 v2.2.0 // indirect
+	github.com/oschwald/maxminddb-golang/v2 v2.3.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect

backend/go.sum

@@ -114,10 +114,10 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/oschwald/geoip2-golang/v2 v2.1.0 h1:DjnLhNJu9WHwTrmoiQFvgmyJoczhdnm7LB23UBI2Amo=
-github.com/oschwald/geoip2-golang/v2 v2.1.0/go.mod h1:qdVmcPgrTJ4q2eP9tHq/yldMTdp2VMr33uVdFbHBiBc=
-github.com/oschwald/maxminddb-golang/v2 v2.2.0 h1:/2khmIiNvFxgfwGxitper3XBJBs5qTCPQ/H1iR9MgBw=
-github.com/oschwald/maxminddb-golang/v2 v2.2.0/go.mod h1:n/ctYVTFYQypkn5uO1CZnTmj8jdQKIVh/LX7gSaIl0w=
+github.com/oschwald/geoip2-golang/v2 v2.2.0 h1:gdkhpnHQMiH9ymOI+zSB0QKFGH+n4TntNt7vz+TxGPY=
+github.com/oschwald/geoip2-golang/v2 v2.2.0/go.mod h1:xW4tCeQiNU1gqMD1x7zEH2CDNM3d796Ls50yxYDaX0U=
+github.com/oschwald/maxminddb-golang/v2 v2.3.0 h1:PnXjMGjkSQlwOBSyZ7hk6Fd75t7erkAhJNJgEhA3MQU=
+github.com/oschwald/maxminddb-golang/v2 v2.3.0/go.mod h1:NSQvgFwPxODpBTJI5+5Ns1AAucnx7ggW9PSRRifAT1s=
 github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
 github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

backend/internal/api/handlers/crowdsec_coverage_target_test.go

@@ -283,16 +283,16 @@ func TestRegisterBouncerExecutionFailure(t *testing.T) {
 
 // TestGetAcquisitionConfigFileError tests file read error
 func TestGetAcquisitionConfigNotPresent(t *testing.T) {
-        t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", filepath.Join(t.TempDir(), "nonexistent.yaml"))
-        h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
-        r := gin.New()
-        g := r.Group("/api/v1")
-        h.RegisterRoutes(g)
-
-        w := httptest.NewRecorder()
-        req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/acquisition", http.NoBody)
-        r.ServeHTTP(w, req)
-
-        // File won't exist in test env, should give 404
-        require.Equal(t, http.StatusNotFound, w.Code)
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", filepath.Join(t.TempDir(), "nonexistent.yaml"))
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
+	r := gin.New()
+	g := r.Group("/api/v1")
+	h.RegisterRoutes(g)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/acquisition", http.NoBody)
+	r.ServeHTTP(w, req)
+
+	// File won't exist in test env, should give 404
+	require.Equal(t, http.StatusNotFound, w.Code)
 }

backend/internal/api/handlers/crowdsec_stop_lapi_test.go

@@ -167,10 +167,10 @@ func TestGetLAPIDecisions_WithMockServer(t *testing.T) {
 
 	secSvc := createTestSecurityService(t, db)
 	h := &CrowdsecHandler{
-		DB:       db,
-		Security: secSvc,
-		CmdExec:  &mockCommandExecutor{},
-		DataDir:  t.TempDir(),
+		DB:              db,
+		Security:        secSvc,
+		CmdExec:         &mockCommandExecutor{},
+		DataDir:         t.TempDir(),
 		validateLAPIURL: permissiveLAPIURLValidator,
 	}
 
@@ -210,10 +210,10 @@ func TestGetLAPIDecisions_Unauthorized(t *testing.T) {
 
 	secSvc := createTestSecurityService(t, db)
 	h := &CrowdsecHandler{
-		DB:       db,
-		Security: secSvc,
-		CmdExec:  &mockCommandExecutor{},
-		DataDir:  t.TempDir(),
+		DB:              db,
+		Security:        secSvc,
+		CmdExec:         &mockCommandExecutor{},
+		DataDir:         t.TempDir(),
 		validateLAPIURL: permissiveLAPIURLValidator,
 	}
 
@@ -245,10 +245,10 @@ func TestGetLAPIDecisions_NullResponse(t *testing.T) {
 
 	secSvc := createTestSecurityService(t, db)
 	h := &CrowdsecHandler{
-		DB:       db,
-		Security: secSvc,
-		CmdExec:  &mockCommandExecutor{},
-		DataDir:  t.TempDir(),
+		DB:              db,
+		Security:        secSvc,
+		CmdExec:         &mockCommandExecutor{},
+		DataDir:         t.TempDir(),
 		validateLAPIURL: permissiveLAPIURLValidator,
 	}
 
@@ -323,10 +323,10 @@ func TestCheckLAPIHealth_WithMockServer(t *testing.T) {
 
 	secSvc := createTestSecurityService(t, db)
 	h := &CrowdsecHandler{
-		DB:       db,
-		Security: secSvc,
-		CmdExec:  &mockCommandExecutor{},
-		DataDir:  t.TempDir(),
+		DB:              db,
+		Security:        secSvc,
+		CmdExec:         &mockCommandExecutor{},
+		DataDir:         t.TempDir(),
 		validateLAPIURL: permissiveLAPIURLValidator,
 	}
 
@@ -369,10 +369,10 @@ func TestCheckLAPIHealth_FallbackToDecisions(t *testing.T) {
 
 	secSvc := createTestSecurityService(t, db)
 	h := &CrowdsecHandler{
-		DB:       db,
-		Security: secSvc,
-		CmdExec:  &mockCommandExecutor{},
-		DataDir:  t.TempDir(),
+		DB:              db,
+		Security:        secSvc,
+		CmdExec:         &mockCommandExecutor{},
+		DataDir:         t.TempDir(),
 		validateLAPIURL: permissiveLAPIURLValidator,
 	}
 

backend/internal/api/handlers/crowdsec_wave5_test.go

@@ -35,7 +35,6 @@ func TestCrowdsecWave5_GetLAPIDecisions_Unauthorized(t *testing.T) {
 	}))
 	t.Cleanup(server.Close)
 
-
 	require.NoError(t, db.Create(&models.SecurityConfig{UUID: "default", CrowdSecAPIURL: server.URL}).Error)
 
 	h := newTestCrowdsecHandler(t, db, &fakeExec{}, "/bin/false", tmpDir)
@@ -63,7 +62,6 @@ func TestCrowdsecWave5_GetLAPIDecisions_NonJSONContentTypeFallsBack(t *testing.T
 	}))
 	t.Cleanup(server.Close)
 
-
 	require.NoError(t, db.Create(&models.SecurityConfig{UUID: "default", CrowdSecAPIURL: server.URL}).Error)
 
 	h := newTestCrowdsecHandler(t, db, &fakeExec{}, "/bin/false", tmpDir)