diff --git a/README.md b/README.md index f7fd442..cad7665 100644 --- a/README.md +++ b/README.md @@ -953,6 +953,7 @@ Notes: - private/reserved IPs are still blocked even when present in `OPENCLAW_LLM_ALLOWED_HOSTS` - `OPENCLAW_ALLOW_INSECURE_BASE_URL=1` is the explicit risk-acceptance override for HTTP or private/reserved IP targets (not recommended) - wildcard entries such as `OPENCLAW_LLM_ALLOWED_HOSTS=*` are not supported + - the same contract applies at request time: `/openclaw/llm/models` refreshes and provider fetches honor the same explicit insecure override - Local providers (`ollama`, `lmstudio`) are loopback-only by design: - valid targets: `localhost` / `127.0.0.1` / `::1` - do **not** enable `OPENCLAW_ALLOW_INSECURE_BASE_URL` just to use local LLM @@ -1446,6 +1447,7 @@ python_embeded\python.exe -c "import os; print(repr(os.environ.get('OPENCLAW_LLM Safer alternative: - keep the LLM behind a reviewed public HTTPS reverse proxy and allowlist that public host, instead of enabling `OPENCLAW_ALLOW_INSECURE_BASE_URL`. +- on current builds, once that override is intentionally enabled and the process is restarted, both Remote Admin validation and `/openclaw/llm/models` should follow the same decision. ### Admin Token: server-side vs UI diff --git a/docs/SECURITY.md b/docs/SECURITY.md index 4d09066..c4309d9 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -251,6 +251,7 @@ OpenClaw validates custom LLM `base_url` settings to prevent Server-Side Request - `OPENCLAW_LLM_ALLOWED_HOSTS` only permits additional exact public hosts; it does not bypass the private/reserved-IP block. - `OPENCLAW_ALLOW_ANY_PUBLIC_LLM_HOST=1` widens to any public host only. - `OPENCLAW_ALLOW_INSECURE_BASE_URL=1` is the explicit risk-acceptance override for HTTP or private/reserved IP targets. + - the same override is enforced consistently for config validation, `/openclaw/llm/models`, and outbound provider requests. - wildcard values such as `OPENCLAW_LLM_ALLOWED_HOSTS="*"` are not supported. - avoid broad bypass flags in production (`OPENCLAW_ALLOW_ANY_PUBLIC_LLM_HOST`, `OPENCLAW_ALLOW_INSECURE_BASE_URL`). diff --git a/docs/deploy/windows.md b/docs/deploy/windows.md index c66d2ea..9897954 100644 --- a/docs/deploy/windows.md +++ b/docs/deploy/windows.md @@ -67,6 +67,7 @@ If Remote Admin is running on this Windows host, but your custom/OpenAI-compatib - `OPENCLAW_ALLOW_ANY_PUBLIC_LLM_HOST=1` still applies only to public hosts. - Private/reserved LAN IPs still require `OPENCLAW_ALLOW_INSECURE_BASE_URL=1`. - `OPENCLAW_LLM_ALLOWED_HOSTS=*` is not supported. +- On current builds, that same override is honored by both Remote Admin validation and `/openclaw/llm/models` refresh requests after a full restart. Recommended verification in the same embedded runtime: diff --git a/docs/release/api_contract.md b/docs/release/api_contract.md index 46c4f21..e469b33 100644 --- a/docs/release/api_contract.md +++ b/docs/release/api_contract.md @@ -107,7 +107,7 @@ Assist payload redaction contract: | :--- | :--- | :--- | :--- | :--- | | `POST` | `/chat` | `/moltbot/llm/chat` | Admin/Local | Unified chat interface for assistant interactions. | | `POST` | `/test` | `/moltbot/llm/test` | Admin | Test LLM connectivity and configuration. | -| `GET` | `/models` | `/moltbot/llm/models` | Admin | List available models from configured provider. | +| `GET` | `/models` | `/moltbot/llm/models` | Admin | List available models from configured provider. Request-time fetch uses the same SSRF contract as saved `base_url` validation, including the explicit insecure override for private-IP/HTTP targets. | ### 1.4 Templates & Assets diff --git a/docs/release/config_secrets_contract.md b/docs/release/config_secrets_contract.md index 9af773e..6b6f96c 100644 --- a/docs/release/config_secrets_contract.md +++ b/docs/release/config_secrets_contract.md @@ -64,6 +64,7 @@ Notes: - Local providers (`ollama`, `lmstudio`) are loopback-only by design and should use `localhost` / `127.0.0.1` / `::1`. - Local loopback provider targets do not require enabling insecure SSRF flags. - `OPENCLAW_LLM_ALLOWED_HOSTS` does not allow private/reserved IPs; those still require `OPENCLAW_ALLOW_INSECURE_BASE_URL=1`. +- The same insecure override applies to config-save validation, `/openclaw/llm/models`, and outbound provider requests. - Wildcard entries such as `*` are not supported in `OPENCLAW_LLM_ALLOWED_HOSTS`. ### 2.2 Security & Authentication diff --git a/docs/security_deployment_guide.md b/docs/security_deployment_guide.md index a0150e7..c518e79 100644 --- a/docs/security_deployment_guide.md +++ b/docs/security_deployment_guide.md @@ -114,11 +114,12 @@ OPENCLAW_ADMIN_TOKEN=change-this-local-admin-token 3. Keep external tools/registry sync/transforms disabled unless explicitly needed. 4. For local LLM providers (Ollama/LM Studio), use loopback URLs only (`localhost`/`127.0.0.1`/`::1`); keep `OPENCLAW_ALLOW_ANY_PUBLIC_LLM_HOST=0` and `OPENCLAW_ALLOW_INSECURE_BASE_URL=0`. 5. `OPENCLAW_LLM_ALLOWED_HOSTS` is only for additional exact public hosts; it does not permit RFC1918/private LAN targets. -6. Keep `OPENCLAW_DEBUG_REASONING_REVEAL=0` unless you are doing short-lived local admin debugging and explicitly need privileged reasoning reveal. -7. Keep `OPENCLAW_LOCALHOST_ALLOW_NO_ORIGIN=0` unless you explicitly need local CLI/no-origin compatibility. -8. Run: +6. The same LLM SSRF contract applies consistently to config validation, `/openclaw/llm/models`, and outbound provider requests. +7. Keep `OPENCLAW_DEBUG_REASONING_REVEAL=0` unless you are doing short-lived local admin debugging and explicitly need privileged reasoning reveal. +8. Keep `OPENCLAW_LOCALHOST_ALLOW_NO_ORIGIN=0` unless you explicitly need local CLI/no-origin compatibility. +9. Run: - `python scripts/check_deployment_profile.py --profile local` -9. If you enable optional high-risk features, document why and time-box the change. +10. If you enable optional high-risk features, document why and time-box the change. ## 4. LAN (Trusted Subnet) @@ -156,11 +157,12 @@ OPENCLAW_LOCALHOST_ALLOW_NO_ORIGIN=0 3. Keep bridge/tools/registry/transforms disabled unless there is a reviewed requirement. 4. Keep `OPENCLAW_LOCALHOST_ALLOW_NO_ORIGIN=0` for LAN deployments. 5. If your LLM is on another LAN/private-IP host, that still counts as an insecure `base_url` target; `OPENCLAW_LLM_ALLOWED_HOSTS` alone is not sufficient. -6. Run: +6. The same LLM SSRF contract applies consistently to config validation, `/openclaw/llm/models`, and outbound provider requests. +7. Run: - `python scripts/check_deployment_profile.py --profile lan` -7. Run the security diagnostics endpoint before production use: +8. Run the security diagnostics endpoint before production use: - `GET /openclaw/security/doctor` (admin boundary). -8. If using mobile/remote admin UI, expose `/openclaw/admin` only inside trusted LAN/VPN boundaries. +9. If using mobile/remote admin UI, expose `/openclaw/admin` only inside trusted LAN/VPN boundaries. ## 5. Public (Internet + Reverse Proxy)