Restrict web3signer host allowlist to known DAppNode callers

docker-compose.yml

@@ -25,6 +25,7 @@ services:
     environment:
       JAVA_OPTS: "-Xmx6g"
       EXTRA_OPTS: ""
+      EXTRA_HOST_ALLOWLIST: ""
       WEB3SIGNER_VERTX_WORKER_POOL_SIZE: "20"
     volumes:
       - web3signer_data:/data

services/web3signer/entrypoint.sh

@@ -22,6 +22,39 @@ generate_cors_settings() {
   echo "[INFO - entrypoint] Generated CORS_ORIGINS: ${CORS_ORIGINS}"
 }
 
+# Hostnames (Host header) web3signer accepts on port 9000. Every name another package
+# or the DAppManager uses to reach this service must be listed here, otherwise its
+# requests get a 403. Users can append more (or "*") with EXTRA_HOST_ALLOWLIST.
+generate_host_allowlist() {
+  # localhost/127.0.0.1: web3signer defaults, used by local tooling
+  # web3signer.<domain>: staker-scripts validator URL, rocketpool, keys registered by brain <= 0.1.19
+  HOST_ALLOWLIST="localhost,127.0.0.1,${WEB3SIGNER_DOMAIN},web3signer.${WEB3SIGNER_DOMAIN},brain.${WEB3SIGNER_DOMAIN}"
+
+  # Aliases added by the DAppManager stakers module on dncore, staker and private networks.
+  # signer.<network>.dncore.dappnode: brain >= 0.1.20 (and the remote keys it registers), lido-csm
+  # web3signer.<network>.dncore.dappnode: validator-tracker
+  for alias in signer web3signer; do
+    HOST_ALLOWLIST="${HOST_ALLOWLIST},${alias}.${NETWORK}.dncore.dappnode,${alias}.${NETWORK}.staker.dappnode,${alias}.${NETWORK}.dappnode.private"
+  done
+
+  # Remaining names Docker and the DAppManager give this container: the compose service
+  # name, the private network domain and the container name
+  if [ "${NETWORK}" = "mainnet" ]; then dnp_name="web3signer.dnp.dappnode.eth"; else dnp_name="web3signer-${NETWORK}.dnp.dappnode.eth"; fi
+  HOST_ALLOWLIST="${HOST_ALLOWLIST},web3signer,${WEB3SIGNER_DOMAIN}.private,web3signer.${WEB3SIGNER_DOMAIN}.private,DAppNodePackage-web3signer.${dnp_name}"
+
+  if [ -n "${consensus_domain}" ]; then
+    HOST_ALLOWLIST="${HOST_ALLOWLIST},validator.${consensus_domain}"
+  fi
+
+  # Strip whitespace: FLAGS is word-split, so "a, b" would pass "b" as a stray argument and web3signer would not start
+  extra_hosts=$(printf '%s' "${EXTRA_HOST_ALLOWLIST}" | tr -d '[:space:]')
+  if [ -n "${extra_hosts}" ]; then
+    HOST_ALLOWLIST="${HOST_ALLOWLIST},${extra_hosts}"
+  fi
+
+  echo "[INFO - entrypoint] Generated HOST_ALLOWLIST: ${HOST_ALLOWLIST}"
+}
+
 prepare_keyfiles_dir() {
   # IMPORTANT! The dir defined for --key-store-path must exist and have specific permissions. Should not be created with a docker volume
   mkdir -p "${KEYFILES_DIR}"
@@ -35,7 +68,7 @@ run_web3signer() {
   FLAGS="--key-store-path=$KEYFILES_DIR \
     --http-listen-port=9000 \
     --http-listen-host=0.0.0.0 \
-    --http-host-allowlist=* \
+    --http-host-allowlist=$HOST_ALLOWLIST \
     --http-cors-origins=$CORS_ORIGINS \
     --metrics-enabled=true \
     --metrics-host 0.0.0.0 \
@@ -58,5 +91,6 @@ run_web3signer() {
 }
 
 generate_cors_settings
+generate_host_allowlist
 prepare_keyfiles_dir
 run_web3signer