fix(ssrf): allow configured web_search backend hostname to resolve to internal IPs

The SSRF dial guard blocked legitimate container-internal SearXNG backends
(e.g. http://searxng:8080 resolving to 172.18.0.3). Add an optional hostname
allowlist to ssrfGuardedDial/ssrfGuardedTransport and pass the configured
web_search base_url host through so operator-configured backends are reachable
while SSRF/DNS-rebinding protection remains in place for all other hosts.

- cmd/odek/ssrf_guard.go: variadic allowedHosts bypasses internal-IP block
- cmd/odek/web_search_tool.go: parse BaseURL hostname and pass to transport
- cmd/odek/ssrf_guard_test.go: add tests for allowed internal backend

Author: jkyberneees

cmd/odek/ssrf_guard.go

@@ -39,7 +39,20 @@ type ipLookupFunc func(ctx context.Context, host string) ([]net.IPAddr, error)
 // surfaced them to the policy gate as SystemWrite, so honouring that decision
 // here preserves explicitly-allowed localhost access (and keeps httptest-backed
 // tests working). Every other host is resolved via lookup and validated.
-func ssrfGuardedDial(base dialFunc, lookup ipLookupFunc) dialFunc {
+//
+// allowedHosts lists hostnames (without ports) that the operator explicitly
+// trusts, e.g. the configured web_search base_url. These hosts bypass the
+// internal-IP block so that container-internal services such as SearXNG can be
+// reached by name, while still being pinned to the resolved IP so the kernel
+// cannot re-resolve to a rebound address.
+func ssrfGuardedDial(base dialFunc, lookup ipLookupFunc, allowedHosts ...string) dialFunc {
+	allowed := make(map[string]struct{}, len(allowedHosts))
+	for _, h := range allowedHosts {
+		if h != "" {
+			allowed[h] = struct{}{}
+		}
+	}
+
 	return func(ctx context.Context, network, addr string) (net.Conn, error) {
 		host, port, err := net.SplitHostPort(addr)
 		if err != nil {
@@ -50,6 +63,8 @@ func ssrfGuardedDial(base dialFunc, lookup ipLookupFunc) dialFunc {
 			return base(ctx, network, addr)
 		}
 
+		_, hostAllowed := allowed[host]
+
 		ips, err := lookup(ctx, host)
 		if err != nil {
 			return nil, err
@@ -60,9 +75,13 @@ func ssrfGuardedDial(base dialFunc, lookup ipLookupFunc) dialFunc {
 		// Validate every answer before dialing any of them: an attacker can
 		// return a safe IP alongside an internal one hoping the dialer picks
 		// the internal address. Refuse the whole set if any is internal.
-		for _, ipa := range ips {
-			if danger.IsBlockedIP(ipa.IP) {
-				return nil, fmt.Errorf("blocked connection to %q: resolves to internal address %s (possible SSRF / DNS rebinding)", host, ipa.IP)
+		// Operator-allowed hosts bypass this check so configured internal
+		// backends (e.g. SearXNG under Docker) remain reachable.
+		if !hostAllowed {
+			for _, ipa := range ips {
+				if danger.IsBlockedIP(ipa.IP) {
+					return nil, fmt.Errorf("blocked connection to %q: resolves to internal address %s (possible SSRF / DNS rebinding)", host, ipa.IP)
+				}
 			}
 		}
 		// Pin to validated IPs — never hand the hostname back to the kernel,
@@ -81,20 +100,22 @@ func ssrfGuardedDial(base dialFunc, lookup ipLookupFunc) dialFunc {
 }
 
 // ssrfGuardedTransport returns an *http.Transport whose DialContext is the SSRF
-// guard above, backed by the real dialer and resolver. It clones the default
-// transport when possible so it inherits sane defaults (env proxy handling,
-// idle-conn limits, HTTP/2, TLS handshake timeout); if a third-party package
-// has swapped http.DefaultTransport for a non-*http.Transport RoundTripper, it
-// falls back to a fresh transport with explicit proxy handling rather than
-// panicking on the type assertion — this runs at startup, so it must fail safe.
-func ssrfGuardedTransport() *http.Transport {
+// guard above, backed by the real dialer and resolver. allowedHosts are
+// operator-trusted hostnames (e.g. the web_search base_url host) that may
+// resolve to internal addresses. It clones the default transport when possible
+// so it inherits sane defaults (env proxy handling, idle-conn limits, HTTP/2,
+// TLS handshake timeout); if a third-party package has swapped
+// http.DefaultTransport for a non-*http.Transport RoundTripper, it falls back
+// to a fresh transport with explicit proxy handling rather than panicking on
+// the type assertion — this runs at startup, so it must fail safe.
+func ssrfGuardedTransport(allowedHosts ...string) *http.Transport {
 	base := &net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}
 	tr, ok := http.DefaultTransport.(*http.Transport)
 	if ok {
 		tr = tr.Clone()
 	} else {
 		tr = &http.Transport{Proxy: http.ProxyFromEnvironment}
 	}
-	tr.DialContext = ssrfGuardedDial(base.DialContext, net.DefaultResolver.LookupIPAddr)
+	tr.DialContext = ssrfGuardedDial(base.DialContext, net.DefaultResolver.LookupIPAddr, allowedHosts...)
 	return tr
 }

cmd/odek/ssrf_guard_test.go

@@ -115,6 +115,35 @@ func TestSSRFGuardedDial_ExternalPinnedToValidatedIP(t *testing.T) {
 	}
 }
 
+func TestSSRFGuardedDial_AllowedHostPermitsInternal(t *testing.T) {
+	// The configured web_search backend (e.g. SearXNG under Docker) may resolve
+	// to a private container IP. An explicit allowlist lets it through while
+	// still pinning the dial to the resolved IP.
+	var dialed []string
+	guard := ssrfGuardedDial(recordingDial(&dialed), stubLookup("172.18.0.3"), "searxng")
+
+	if _, err := guard(context.Background(), "tcp", "searxng:8080"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(dialed) != 1 || dialed[0] != "172.18.0.3:8080" {
+		t.Errorf("dialed = %v, want [172.18.0.3:8080] (allowed internal backend pinned to IP)", dialed)
+	}
+}
+
+func TestSSRFGuardedDial_AllowedHostPortIgnored(t *testing.T) {
+	// The allowlist matches the hostname only; different ports on the same host
+	// are still allowed.
+	var dialed []string
+	guard := ssrfGuardedDial(recordingDial(&dialed), stubLookup("172.18.0.3"), "searxng")
+
+	if _, err := guard(context.Background(), "tcp", "searxng:9090"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(dialed) != 1 || dialed[0] != "172.18.0.3:9090" {
+		t.Errorf("dialed = %v, want [172.18.0.3:9090]", dialed)
+	}
+}
+
 // TestBrowser_SSRF_ResolvesInternal exercises the guard through the real
 // browser navigate path: the hostname classifies as NetworkEgress (so the
 // policy gate lets it through) but resolves to the cloud-metadata IP, and the

cmd/odek/web_search_tool.go

@@ -46,10 +46,19 @@ func newWebSearchTool(dc danger.DangerousConfig, cfg config.WebSearchConfig) *we
 		timeout = 15
 	}
 	t := &webSearchTool{dangerousConfig: dc, cfg: cfg}
+
+	// The configured SearXNG backend is trusted by the operator. Allow its
+	// hostname to resolve to internal Docker addresses (e.g. 172.18.0.3) without
+	// tripping the SSRF / DNS-rebinding guard.
+	allowedHost := ""
+	if u, err := url.Parse(cfg.BaseURL); err == nil && u.Host != "" {
+		allowedHost = u.Hostname()
+	}
+
 	t.client = &http.Client{
 		Timeout:       time.Duration(timeout) * time.Second,
 		CheckRedirect: t.checkRedirect,
-		Transport:     ssrfGuardedTransport(),
+		Transport:     ssrfGuardedTransport(allowedHost),
 	}
 	return t
 }