|
| 1 | +package storage |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "errors" |
| 6 | + "fmt" |
| 7 | + "net" |
| 8 | + "net/http" |
| 9 | + "net/netip" |
| 10 | + "net/url" |
| 11 | + "regexp" |
| 12 | + "strings" |
| 13 | + "time" |
| 14 | +) |
| 15 | + |
| 16 | +type storageEndpointRequestResolver interface { |
| 17 | + LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error) |
| 18 | +} |
| 19 | + |
| 20 | +type storageEndpointRequestGuard struct { |
| 21 | + resolver storageEndpointRequestResolver |
| 22 | + dialContext func(ctx context.Context, network, address string) (net.Conn, error) |
| 23 | +} |
| 24 | + |
| 25 | +var storageAmbiguousNumericHostPattern = regexp.MustCompile(`(?i)^(0x[0-9a-f]+|[0-9]+)(\.(0x[0-9a-f]+|[0-9]+)){0,3}$`) |
| 26 | + |
| 27 | +func applyStorageEndpointRequestGuard(client *http.Client, transport *http.Transport, enabled bool) { |
| 28 | + if !enabled { |
| 29 | + return |
| 30 | + } |
| 31 | + guard := newStorageEndpointRequestGuard() |
| 32 | + transport.DialContext = guard.guardedDialContext |
| 33 | + client.CheckRedirect = guard.checkRedirect |
| 34 | +} |
| 35 | + |
| 36 | +func newStorageEndpointRequestGuard() storageEndpointRequestGuard { |
| 37 | + dialer := &net.Dialer{ |
| 38 | + Timeout: 30 * time.Second, |
| 39 | + KeepAlive: 30 * time.Second, |
| 40 | + } |
| 41 | + return storageEndpointRequestGuard{ |
| 42 | + resolver: net.DefaultResolver, |
| 43 | + dialContext: dialer.DialContext, |
| 44 | + } |
| 45 | +} |
| 46 | + |
| 47 | +func (g storageEndpointRequestGuard) guardedDialContext(ctx context.Context, network, address string) (net.Conn, error) { |
| 48 | + host, port, err := net.SplitHostPort(address) |
| 49 | + if err != nil { |
| 50 | + return nil, fmt.Errorf("storage request destination %q is invalid: %w", address, err) |
| 51 | + } |
| 52 | + |
| 53 | + addrs, err := g.resolveAllowedAddrs(ctx, network, host) |
| 54 | + if err != nil { |
| 55 | + return nil, err |
| 56 | + } |
| 57 | + |
| 58 | + dialErrs := make([]error, 0, len(addrs)) |
| 59 | + for _, addr := range addrs { |
| 60 | + if !networkAllowsEndpointAddress(network, addr) { |
| 61 | + continue |
| 62 | + } |
| 63 | + conn, err := g.dialContext(ctx, network, net.JoinHostPort(addr.String(), port)) |
| 64 | + if err == nil { |
| 65 | + return conn, nil |
| 66 | + } |
| 67 | + dialErrs = append(dialErrs, err) |
| 68 | + } |
| 69 | + |
| 70 | + if len(dialErrs) == 0 { |
| 71 | + return nil, fmt.Errorf("storage request destination %q has no addresses compatible with network %q", address, network) |
| 72 | + } |
| 73 | + return nil, fmt.Errorf("storage request destination %q could not be reached: %w", address, errors.Join(dialErrs...)) |
| 74 | +} |
| 75 | + |
| 76 | +func (g storageEndpointRequestGuard) checkRedirect(req *http.Request, via []*http.Request) error { |
| 77 | + if len(via) >= 10 { |
| 78 | + return fmt.Errorf("stopped after 10 redirects") |
| 79 | + } |
| 80 | + return g.validateURL(req.Context(), req.URL) |
| 81 | +} |
| 82 | + |
| 83 | +func (g storageEndpointRequestGuard) validateURL(ctx context.Context, u *url.URL) error { |
| 84 | + if u == nil { |
| 85 | + return fmt.Errorf("storage request redirect target is missing") |
| 86 | + } |
| 87 | + host := normalizeStorageEndpointRequestHost(u.Hostname()) |
| 88 | + if host == "" { |
| 89 | + return fmt.Errorf("storage request redirect target must include a host") |
| 90 | + } |
| 91 | + _, err := g.resolveAllowedAddrs(ctx, "ip", host) |
| 92 | + return err |
| 93 | +} |
| 94 | + |
| 95 | +func (g storageEndpointRequestGuard) resolveAllowedAddrs(ctx context.Context, network, host string) ([]netip.Addr, error) { |
| 96 | + host = normalizeStorageEndpointRequestHost(host) |
| 97 | + if host == "" { |
| 98 | + return nil, fmt.Errorf("storage request destination must include a host") |
| 99 | + } |
| 100 | + if host == "localhost" || strings.HasSuffix(host, ".localhost") { |
| 101 | + return nil, fmt.Errorf("storage request destination host %q is not allowed", host) |
| 102 | + } |
| 103 | + if addr, err := netip.ParseAddr(host); err == nil { |
| 104 | + addr = addr.Unmap() |
| 105 | + if isForbiddenStorageEndpointRequestAddress(addr) { |
| 106 | + return nil, fmt.Errorf("storage request destination host %q is not allowed", host) |
| 107 | + } |
| 108 | + return []netip.Addr{addr}, nil |
| 109 | + } |
| 110 | + if storageAmbiguousNumericHostPattern.MatchString(host) { |
| 111 | + return nil, fmt.Errorf("storage request destination host %q uses ambiguous numeric IP encoding", host) |
| 112 | + } |
| 113 | + if strings.Contains(host, ":") { |
| 114 | + return nil, fmt.Errorf("storage request destination host %q uses ambiguous IP encoding", host) |
| 115 | + } |
| 116 | + if g.resolver == nil { |
| 117 | + return nil, fmt.Errorf("storage request destination resolver is required") |
| 118 | + } |
| 119 | + |
| 120 | + addrs, err := g.resolver.LookupNetIP(ctx, resolverNetworkForEndpointDial(network), host) |
| 121 | + if err != nil { |
| 122 | + return nil, fmt.Errorf("storage request destination host %q could not be resolved: %w", host, err) |
| 123 | + } |
| 124 | + if len(addrs) == 0 { |
| 125 | + return nil, fmt.Errorf("storage request destination host %q did not resolve to any IP addresses", host) |
| 126 | + } |
| 127 | + for _, addr := range addrs { |
| 128 | + if isForbiddenStorageEndpointRequestAddress(addr) { |
| 129 | + return nil, fmt.Errorf("storage request destination host %q resolves to forbidden address %s", host, addr) |
| 130 | + } |
| 131 | + } |
| 132 | + return addrs, nil |
| 133 | +} |
| 134 | + |
| 135 | +func normalizeStorageEndpointRequestHost(host string) string { |
| 136 | + host = strings.ToLower(strings.TrimSpace(host)) |
| 137 | + host = strings.TrimSuffix(host, ".") |
| 138 | + return host |
| 139 | +} |
| 140 | + |
| 141 | +func isForbiddenStorageEndpointRequestAddress(addr netip.Addr) bool { |
| 142 | + addr = addr.Unmap() |
| 143 | + return !addr.IsValid() || |
| 144 | + addr.IsLoopback() || |
| 145 | + addr.IsLinkLocalUnicast() || |
| 146 | + addr.IsUnspecified() || |
| 147 | + addr.IsMulticast() |
| 148 | +} |
| 149 | + |
| 150 | +func networkAllowsEndpointAddress(network string, addr netip.Addr) bool { |
| 151 | + addr = addr.Unmap() |
| 152 | + switch { |
| 153 | + case strings.HasSuffix(network, "4"): |
| 154 | + return addr.Is4() |
| 155 | + case strings.HasSuffix(network, "6"): |
| 156 | + return addr.Is6() |
| 157 | + default: |
| 158 | + return true |
| 159 | + } |
| 160 | +} |
| 161 | + |
| 162 | +func resolverNetworkForEndpointDial(network string) string { |
| 163 | + switch { |
| 164 | + case strings.HasSuffix(network, "4"): |
| 165 | + return "ip4" |
| 166 | + case strings.HasSuffix(network, "6"): |
| 167 | + return "ip6" |
| 168 | + default: |
| 169 | + return "ip" |
| 170 | + } |
| 171 | +} |
0 commit comments