fix(egress): use dedicated fwmark and harden response validation

- Use separate CredentialFetchMark (0x2) for HTTP source transport so
  it bypasses iptables transparent redirect but NOT nft egress policy
- Validate rotated URLs from provider responses before caching
- Clear bootstrap headers when provider rotates URL without headers
- Reject all control characters in header values, not just CR/LF

Author: Pangjiping

components/egress/pkg/constants/constants.go

@@ -17,6 +17,11 @@ package constants
 const (
 	MarkValue = 0x1
 	MarkHex   = "0x1"
+
+	// CredentialFetchMarkValue bypasses iptables transparent HTTP redirect
+	// without bypassing nft egress policy (unlike MarkValue which does both).
+	CredentialFetchMarkValue = 0x2
+	CredentialFetchMarkHex   = "0x2"
 )
 
 const (

components/egress/pkg/credentialvault/source_http.go

@@ -144,7 +144,13 @@ func (s *httpSource) fetch(ctx context.Context) (string, error) {
 		s.expiresAt = time.Time{}
 	}
 	if result.URL != "" {
-		s.nextURL = result.URL
+		if validateHTTPSourceURL(result.URL) == nil {
+			s.nextURL = result.URL
+			if result.Headers == nil {
+				s.nextHeaders = nil
+				s.headersRotated = true
+			}
+		}
 	}
 	if result.Headers != nil {
 		s.nextHeaders = result.Headers
@@ -170,31 +176,17 @@ func httpSourceFactory(raw json.RawMessage) (CredentialSource, error) {
 	if cfg.URL == "" {
 		return nil, fmt.Errorf("http credential source url cannot be empty")
 	}
-	parsed, err := url.Parse(cfg.URL)
-	if err != nil {
-		return nil, fmt.Errorf("http credential source url: %w", err)
-	}
-	if parsed.Scheme != "https" && parsed.Scheme != "http" {
-		return nil, fmt.Errorf("http credential source url must use http or https scheme, got %q", parsed.Scheme)
-	}
-	if parsed.Host == "" {
-		return nil, fmt.Errorf("http credential source url must include a host")
+	if err := validateHTTPSourceURL(cfg.URL); err != nil {
+		return nil, err
 	}
 	if cfg.Method == "" {
 		cfg.Method = http.MethodGet
 	}
 	if _, err := http.NewRequest(cfg.Method, cfg.URL, nil); err != nil {
 		return nil, fmt.Errorf("http credential source: invalid method or url: %w", err)
 	}
-	for name, value := range cfg.Headers {
-		if !headerFieldNamePattern.MatchString(name) {
-			return nil, fmt.Errorf("http credential source: invalid header name %q", name)
-		}
-		for i := range value {
-			if value[i] == '\r' || value[i] == '\n' {
-				return nil, fmt.Errorf("http credential source: header %q value contains CR/LF", name)
-			}
-		}
+	if err := validateHTTPSourceHeaders(cfg.Headers); err != nil {
+		return nil, err
 	}
 	return &httpSource{
 		initialURL:     cfg.URL,
@@ -209,3 +201,32 @@ func httpSourceFactory(raw json.RawMessage) (CredentialSource, error) {
 		},
 	}, nil
 }
+
+func validateHTTPSourceHeaders(headers map[string]string) error {
+	for name, value := range headers {
+		if !headerFieldNamePattern.MatchString(name) {
+			return fmt.Errorf("http credential source: invalid header name %q", name)
+		}
+		for i := range value {
+			b := value[i]
+			if b < 0x20 || b == 0x7f {
+				return fmt.Errorf("http credential source: header %q value contains invalid character 0x%02x", name, b)
+			}
+		}
+	}
+	return nil
+}
+
+func validateHTTPSourceURL(raw string) error {
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		return fmt.Errorf("http credential source url: %w", err)
+	}
+	if parsed.Scheme != "https" && parsed.Scheme != "http" {
+		return fmt.Errorf("http credential source url must use http or https scheme, got %q", parsed.Scheme)
+	}
+	if parsed.Host == "" {
+		return fmt.Errorf("http credential source url must include a host")
+	}
+	return nil
+}

components/egress/pkg/credentialvault/source_http_test.go

@@ -309,7 +309,44 @@ func TestHttpSourceFactoryRejectsHeaderValueWithCRLF(t *testing.T) {
 		"url":     "https://vault.example.com/cred",
 		"headers": map[string]string{"X-Auth": "value\r\ninjection"},
 	}))
-	require.ErrorContains(t, err, "CR/LF")
+	require.ErrorContains(t, err, "invalid character")
+}
+
+func TestHttpSourceFactoryRejectsHeaderValueWithControlChar(t *testing.T) {
+	_, err := httpSourceFactory(mustMarshal(map[string]any{
+		"type":    "http",
+		"url":     "https://vault.example.com/cred",
+		"headers": map[string]string{"X-Auth": "value\x00null"},
+	}))
+	require.ErrorContains(t, err, "invalid character")
+}
+
+func TestHttpSourceURLOnlyRotationClearsBootstrapHeaders(t *testing.T) {
+	var calls atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		n := calls.Add(1)
+		if n == 1 {
+			require.Equal(t, "boot", r.Header.Get("X-Auth"))
+			fmt.Fprintf(w, `{"value":"first","url":"http://%s/refreshed","ttl":0}`, r.Host)
+			return
+		}
+		require.Equal(t, "", r.Header.Get("X-Auth"), "bootstrap header should not leak to rotated URL")
+		fmt.Fprintf(w, `{"value":"second","ttl":0}`)
+	}))
+	defer srv.Close()
+
+	src, err := httpSourceFactory(mustMarshal(map[string]any{
+		"type":    "http",
+		"url":     srv.URL,
+		"headers": map[string]string{"X-Auth": "boot"},
+	}))
+	require.NoError(t, err)
+
+	_, err = src.Resolve(context.Background())
+	require.NoError(t, err)
+
+	_, err = src.Resolve(context.Background())
+	require.NoError(t, err)
 }
 
 func TestHttpSourceRejectsRedirects(t *testing.T) {

components/egress/pkg/credentialvault/source_http_transport_linux.go

@@ -32,7 +32,7 @@ func httpSourceTransport() http.RoundTripper {
 			// Best-effort: requires CAP_NET_ADMIN. In environments without
 			// iptables transparent redirect (tests, dev), the mark is
 			// unnecessary and the error is harmless.
-			_ = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, constants.MarkValue)
+			_ = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, constants.CredentialFetchMarkValue)
 		})
 		return nil
 	}

components/egress/pkg/iptables/transparent.go

@@ -30,7 +30,7 @@ func transparentHTTPRules(localPort int, mitmUID uint32, op string) [][]string {
 	uid := strconv.FormatUint(uint64(mitmUID), 10)
 	loopRules := [][]string{
 		{"iptables", "-t", "nat", op, "OUTPUT", "-p", "tcp", "-d", "127.0.0.0/8", "-j", "RETURN"},
-		{"iptables", "-t", "nat", op, "OUTPUT", "-p", "tcp", "-m", "mark", "--mark", constants.MarkHex, "-j", "RETURN"},
+		{"iptables", "-t", "nat", op, "OUTPUT", "-p", "tcp", "-m", "mark", "--mark", constants.CredentialFetchMarkHex, "-j", "RETURN"},
 	}
 	redir := [][]string{
 		{