Snap endpoints

[JimMadge]

💻 System information

• Data Safe Haven version: 3.4.0+

🚫 Problematic behaviour

The SRD includes some snap packages. Snaps are automatically updated by the snap daemon. Some set of endpoints will need to be reachable for this to work.

🚂 Possible workarounds, remediations or solutions

This stackoverflow post contains a suggested list of urls.

From The snapcraft website,

Download CDNs

*.snapcraftcontent.com:443
*.cdn.snapcraft.io:443 [deprecated]
public.apps.ubuntu.com:443 [deprecated]

Hopefully this is all that is required. The Snapcraft API may not be needed if you don't intend to publish packages (which we would not want to allow).

[JimMadge]

This looks to be the authoritative answer.

Note that,

snap / snap daemon is the client that downloads/installs/managed packages
snapcraft is the tool for building and publishing snaps

[jemrobinson]

Can you get a list of URLs and IP addresses and add it to the top-level comment on this issue?

[JimMadge]

Are both IPs and URLs needed?

[jemrobinson]

Yes, we use IPs to restrict outbound access at the NSG level and then FQDNs at the Firewall.

[JimMadge]

Ok, I can't find any indication that the IP addresses are guaranteed to be stable.

[jemrobinson]

They don't have to be completely fixed, we just need to know the range of IP addresses that they are drawn from. For example if they use a CDN then all IP addresses that the CDN might resolve to.

[jemrobinson]

We also get a lot of outbound requests to api.snapcraft.io that are denied by the firewall. Do we want to allow these?

[jemrobinson]

Looks like there are some fixed domains here

• storage.snapcraftcontent.com:443
• canonical-lgw01.cdn.snapcraftcontent.com:443
• canonical-lcy01.cdn.snapcraftcontent.com:443
• canonical-lcy02.cdn.snapcraftcontent.com:443
• canonical-bos01.cdn.snapcraftcontent.com:443
• cloudfront.cdn.snapcraftcontent.com:443 [used inside AWS]
• fastly.cdn.snapcraftcontent.com:443 [deprecated]
• fastly-global.cdn.snapcraftcontent.com:443 [deprecated]

[JimMadge]

I'm uncertain about api.snapcraft.io. The network requirements page lists that as one of three endpoints required for API access. This might include publishing packages so could be an egress risk. However, it isn't clear. It could just be snapd using the API to look for new versions of installed snaps.

[jemrobinson]

I think the current requests are coming from an update checker (presumably snapd). The question is: if we allow this, will it represent an egress risk (and similarly, if we don't allow this, will it break snap updates)?

[JimMadge]

Snapcraft also requires:

upload.apps.ubuntu.com:443

Which sounds like an endpoint for publishing, and is only needed for snapcraft. But the docs are not explicit about what these endpoints are for.

The question is: if we allow this, will it represent an egress risk (and similarly, if we don't allow this, will it break snap updates)?

The second of those is easy to test with an Ubuntu VM and some ufw commands. The first isn't.

[JimMadge]

Snap proxy (maybe something for the future).