Guest/gate principal collision: safe here, unguarded for self-hosters on a 2-label gate domain #85

New issue

Open

opened 2026-08-22 11:00:24 +00:00 by a73x · 0 comments

a73x commented

2026-08-22 11:00:24 +00:00

(Migrated from git.a73x.sh)

From the pre-launch security audit (finding GATE-1). VERIFIED SAFE on this deployment;
kept open for the self-hoster. Ranked #6 of the outstanding set.

Status here: not exploitable. The production gate principal was extracted black-box
(gate.eitri.sh, three labels), and guest principals can only ever carry exactly one dot
(the RFC1123 name regex is anchored and dot-free, and the connect name is <tenant>.<name>).
So a guest principal cannot collide with this gate's identity.

Why it stays open. eitri ships self-hosting docs. An operator who picks a TWO-label
gate domain gets a gate identity a guest principal could forge, with no warning at boot.

Fixes. Cheap: a boot-time shape check that refuses a gate domain whose label count
could collide with the guest principal namespace. Real: namespace guest principals so a
collision is structurally impossible regardless of the operator's gate domain.

Migrated from git-collab issue e8a9c92a27f3a3e47e214b8be3f8b42fe19a7755.

Original author: a73x dev@a73x.sh.

From the pre-launch security audit (finding GATE-1). VERIFIED SAFE on this deployment; kept open for the self-hoster. Ranked #6 of the outstanding set. **Status here: not exploitable.** The production gate principal was extracted black-box (`gate.eitri.sh`, three labels), and guest principals can only ever carry exactly one dot (the RFC1123 name regex is anchored and dot-free, and the connect name is `<tenant>.<name>`). So a guest principal cannot collide with this gate's identity. **Why it stays open.** eitri ships self-hosting docs. An operator who picks a TWO-label gate domain gets a gate identity a guest principal could forge, with no warning at boot. **Fixes.** Cheap: a boot-time shape check that refuses a gate domain whose label count could collide with the guest principal namespace. Real: namespace guest principals so a collision is structurally impossible regardless of the operator's gate domain. --- Migrated from git-collab issue `e8a9c92a27f3a3e47e214b8be3f8b42fe19a7755`. Original author: a73x <dev@a73x.sh>.