Dmitry VerkhoturovandUmputun
ff85bbc5ea
The image proxy got an ssrfSafeTransport in commitaca0cff3that resolves DNS first, blocks any IP in private/reserved CIDRs, then dials by IP to defeat DNS rebinding. The TitleExtractor used to construct comments' PostTitle from Locator.URL — a user-supplied field — was missed by that fix and kept using http.DefaultTransport. The hostname allowlist there checks the parsed URL host but never the IP it resolves to, so a domain suffix-matching an allowed host (or 127.0.0.1 itself when AllowedHosts is empty) reaches the metadata service or any other internal endpoint. The same gosec rule (G704) was excluded globally in .golangci.yml as part ofaca0cff3, so this gap was not caught by the linter either. Extract the transport into a new safehttp package so it lives in one place and can be reused, then pass safehttp.Transport() into the TitleExtractor's http.Client at construction (cmd/server.go). The image proxy switches to safehttp.Transport() too — same behaviour, no longer duplicated. Reproduction in title_test.go uses the production-style client to hit an httptest.Server (always 127.0.0.1) and asserts the dialer refuses even though "127.0.0.1" is in the allowed-domains list. A control case shows the same setup without safehttp.Transport returns the page — making the original vulnerability explicit.
83 lines
2.4 KiB
Go
83 lines
2.4 KiB
Go
// Package safehttp provides HTTP transports hardened against SSRF: outbound
|
|
// connections are dialed using a pre-resolved IP, with a check that all
|
|
// resolved IPs sit outside private/reserved ranges. This blocks both naive
|
|
// SSRF (private IP literals in user-supplied URLs) and DNS rebinding.
|
|
package safehttp
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net"
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
// Transport returns an *http.Transport whose DialContext refuses any address
|
|
// that resolves to a private/reserved IP, choosing the IP itself for the dial
|
|
// to defeat DNS rebinding (an attacker cannot have the resolver hand back a
|
|
// public IP at the check and a private one at the connect).
|
|
func Transport() *http.Transport {
|
|
dialer := &net.Dialer{Timeout: 30 * time.Second}
|
|
return &http.Transport{
|
|
DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
|
|
host, port, err := net.SplitHostPort(addr)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("invalid address %s: %w", addr, err)
|
|
}
|
|
|
|
ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("can't resolve host %s: %w", host, err)
|
|
}
|
|
if len(ips) == 0 {
|
|
return nil, fmt.Errorf("no IP addresses resolved for host %s", host)
|
|
}
|
|
|
|
for _, ip := range ips {
|
|
if IsPrivateIP(ip.IP) {
|
|
return nil, fmt.Errorf("access to private address is not allowed")
|
|
}
|
|
}
|
|
|
|
var lastErr error
|
|
for _, ip := range ips {
|
|
conn, dialErr := dialer.DialContext(ctx, network, net.JoinHostPort(ip.String(), port))
|
|
if dialErr == nil {
|
|
return conn, nil
|
|
}
|
|
lastErr = dialErr
|
|
}
|
|
return nil, fmt.Errorf("can't connect to %s: %w", host, lastErr)
|
|
},
|
|
}
|
|
}
|
|
|
|
// privateCIDRs holds pre-parsed private/reserved CIDR blocks.
|
|
var privateCIDRs = func() []*net.IPNet {
|
|
cidrs := []string{
|
|
"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
|
|
"100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
|
|
"::1/128", "fc00::/7", "fe80::/10",
|
|
}
|
|
blocks := make([]*net.IPNet, 0, len(cidrs))
|
|
for _, cidr := range cidrs {
|
|
_, block, _ := net.ParseCIDR(cidr)
|
|
blocks = append(blocks, block)
|
|
}
|
|
return blocks
|
|
}()
|
|
|
|
// IsPrivateIP reports whether ip falls in any private, loopback, link-local,
|
|
// CGNAT, or reserved range — including IPv4 and IPv6 unspecified addresses.
|
|
func IsPrivateIP(ip net.IP) bool {
|
|
if ip.IsUnspecified() {
|
|
return true
|
|
}
|
|
for _, block := range privateCIDRs {
|
|
if block.Contains(ip) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|