fix(yurthub): reject unauthenticated requests on insecure proxy port

[sultancodesss]

What this PR does

Fixes #2782

Problem

When --enable-dummy-if=true (the default), YurtHub exposes a plain-HTTP proxy on 127.0.0.1:10261 (and 169.254.2.1:10261 for the dummy interface). The proxy handler has no authentication layer on this port.

In RemoteProxy.RoundTrip, requests that carry no Authorization header are forwarded to the Kubernetes API using YurtHub's own node client certificate:

func (rp *RemoteProxy) RoundTrip(req *http.Request) (*http.Response, error) {
    if isBearerRequest(req) {
        return rp.bearerTransport.RoundTrip(req)  // uses bearer token from request
    }
    return rp.currentTransport.RoundTrip(req)     // uses YurtHub's node cert (the bug)
}

Any pod that can route traffic to the dummy IP can therefore cause Kubernetes API calls authenticated as system:node:<node> without supplying any credentials.

Fix

Add a WithRequireAuthorization middleware in pkg/yurthub/proxy/util/util.go that returns 401 Unauthorized for any request arriving on the plain-HTTP proxy port without an Authorization header.

The middleware is wired in pkg/yurthub/server/server.go exclusively for the insecure proxy serving path (YurtHubProxyServerServing). The secure TLS port (YurtHubSecureProxyServerServing) is unaffected -- it already enforces mutual TLS client certificate authentication.

YurtHub's own internal clients are explicitly exempted to preserve existing behaviour:

• The multiplexer manager client (User-Agent: multiplexer-proxy-<node>)
• The shared-informer clients (User-Agent prefix: yurthub)

Testing

Both modified packages build cleanly for linux/amd64:

GOOS=linux GOARCH=amd64 go build ./pkg/yurthub/proxy/util/
GOOS=linux GOARCH=amd64 go build ./pkg/yurthub/server/
GOOS=linux GOARCH=amd64 go build ./cmd/yurthub/...

Related

• Issue: Unauthenticated HTTP proxy on the dummy interface hands YurtHub's node identity to any pod #2782

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud