[Security] Re-enable SMB connectors only with pinned peers and DFS referrals #35

New Issue

2026-07-21T16:40:42+02:00

zemion commented

2026-07-21 16:40:42 +02:00

Outcome

SMB connectors can be enabled only when every transport peer and DFS/referral target is authorized and DNS/IP pinned at connection time.

Context

The SMB implementation associated with #10 is intentionally fail-closed because the current smbclient stack can establish or follow connections outside the pinning boundary. Keeping the feature disabled is the safe green baseline until this contract is enforceable.

Acceptance

No smbclient session is registered while exact peer pinning cannot be enforced.
Initial peers, reconnects, DFS referrals, aliases, and any library-managed secondary connection are revalidated and pinned.
DNS rebinding, referral-to-private, mixed-answer, and peer-change tests fail closed.
Deployment-wide private-network policy is applied consistently.
Target Samba/DFS tests and operator documentation define supported configurations.

## Outcome SMB connectors can be enabled only when every transport peer and DFS/referral target is authorized and DNS/IP pinned at connection time. ## Context The SMB implementation associated with #10 is intentionally fail-closed because the current smbclient stack can establish or follow connections outside the pinning boundary. Keeping the feature disabled is the safe green baseline until this contract is enforceable. ## Acceptance - No smbclient session is registered while exact peer pinning cannot be enforced. - Initial peers, reconnects, DFS referrals, aliases, and any library-managed secondary connection are revalidated and pinned. - DNS rebinding, referral-to-private, mixed-answer, and peer-change tests fail closed. - Deployment-wide private-network policy is applied consistently. - Target Samba/DFS tests and operator documentation define supported configurations.

zemion added the area/security codex/ready module/files

labels 2026-07-29 14:15:02 +02:00

zemion commented

2026-08-04 10:41:53 +02:00

Codex State: progress

Summary

Implemented a Files-owned SMB session/cache boundary with exact connection-time peer pinning for initial connections, reconnects, aliases, and DFS referral targets.
The transport fails closed on mixed/disallowed answers, peer changes, SDK incompatibility, or transport tampering; connector browse/import is enabled through this boundary.

Changed Files

src/govoplan_files/backend/storage/sdk_peer_pinning.py
src/govoplan_files/backend/storage/connector_browse.py
docs/CONNECTOR_BOUNDARY.md

Verification

Files suite: 117 tests passed
SMB initial/reconnect/referral and disallowed-referral contract tests passed
Installed smbprotocol 1.17.0 compatibility was exercised against the pinned transport

Next / Blocked

Run the documented live Samba/DFS topology smoke in an environment with Docker, Podman, or another available container runtime; none is installed in the current workspace.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Implemented a Files-owned SMB session/cache boundary with exact connection-time peer pinning for initial connections, reconnects, aliases, and DFS referral targets. - The transport fails closed on mixed/disallowed answers, peer changes, SDK incompatibility, or transport tampering; connector browse/import is enabled through this boundary. ### Changed Files - `src/govoplan_files/backend/storage/sdk_peer_pinning.py` - `src/govoplan_files/backend/storage/connector_browse.py` - `docs/CONNECTOR_BOUNDARY.md` ### Verification - `Files suite: 117 tests passed` - `SMB initial/reconnect/referral and disallowed-referral contract tests passed` - `Installed smbprotocol 1.17.0 compatibility was exercised against the pinned transport` ### Next / Blocked - Run the documented live Samba/DFS topology smoke in an environment with Docker, Podman, or another available container runtime; none is installed in the current workspace. Suggested status label: `status/in-progress`

zemion added

status

in-progress

area/release and removed

status

ready

area/security labels 2026-08-21 23:18:00 +02:00

zemion commented

2026-08-21 23:18:00 +02:00

Resuming as a verification-only closure candidate. The Files-owned SMB pinning implementation and operator documentation are already present in commits 5248e7d and 92e6494; I am re-running the exact peer, reconnect, alias, DFS-referral, private-network, provider browse/import, tamper, and SDK-compatibility contracts against the current release before reconciling the issue state.

Resuming as a verification-only closure candidate. The Files-owned SMB pinning implementation and operator documentation are already present in commits 5248e7d and 92e6494; I am re-running the exact peer, reconnect, alias, DFS-referral, private-network, provider browse/import, tamper, and SDK-compatibility contracts against the current release before reconciling the issue state.

zemion commented

2026-08-21 23:20:45 +02:00

Implemented and verified. SMB connector sessions fail closed unless the exact peer can be pinned, and the Files-owned smbprotocol transport revalidates initial connections, reconnects, aliases/domain-controller targets, and DFS referral targets. Private-network permission does not bypass per-socket validation; SDK seam drift/tampering fails before a usable session is returned.\n\nEvidence:\n- transport implementation: 5248e7d\n- S3/SMB integration and provider-path coverage: 92e6494\n- corrected operator/dev validation guidance: 62047e7\n- all implementation commits are included in released Files v0.1.20\n- targeted verification: 30 tests passed plus 3 transport subtests (test_sdk_peer_pinning.py, test_connector_providers.py, test_connector_deployment.py)\n- full cross-workspace focused gate passed for the current Files release while closing Files #16\n\nThe bundled Samba target intentionally covers a live single-share browse/import. Reconnect and DFS referral enforcement is exercised by the transport contract suite; operators using an institutional DFS topology must run smoke.py --require-smb against that topology and record the actual peers, as now documented. No Docker/Podman runtime is installed on this runner, so that deployment-specific evidence remains an operator validation rather than an unverified product claim.

Implemented and verified. SMB connector sessions fail closed unless the exact peer can be pinned, and the Files-owned smbprotocol transport revalidates initial connections, reconnects, aliases/domain-controller targets, and DFS referral targets. Private-network permission does not bypass per-socket validation; SDK seam drift/tampering fails before a usable session is returned.\n\nEvidence:\n- transport implementation: `5248e7d`\n- S3/SMB integration and provider-path coverage: `92e6494`\n- corrected operator/dev validation guidance: `62047e7`\n- all implementation commits are included in released Files `v0.1.20`\n- targeted verification: 30 tests passed plus 3 transport subtests (`test_sdk_peer_pinning.py`, `test_connector_providers.py`, `test_connector_deployment.py`)\n- full cross-workspace focused gate passed for the current Files release while closing Files #16\n\nThe bundled Samba target intentionally covers a live single-share browse/import. Reconnect and DFS referral enforcement is exercised by the transport contract suite; operators using an institutional DFS topology must run `smoke.py --require-smb` against that topology and record the actual peers, as now documented. No Docker/Podman runtime is installed on this runner, so that deployment-specific evidence remains an operator validation rather than an unverified product claim.

zemion closed this issue

2026-08-21 23:20:45 +02:00

zemion removed the codex/ready

status

in-progress

labels 2026-08-21 23:20:55 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-files#35