Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)

internal/config/config.go

@@ -128,6 +128,22 @@ type Config struct {
 	// clients.
 	TrustedProxies []netip.Prefix
 
+	// AllowedEgressCIDRs is the set of networks a delivery target
+	// may reach even though the SSRF guard's default blocklist
+	// covers them. It is empty unless ALLOWED_EGRESS_CIDRS is set,
+	// and empty means every private/reserved range stays refused.
+	//
+	// This only ever adds destinations to what the guard would
+	// otherwise refuse. The guard itself is always on: there is no
+	// setting that disables SSRF protection, and delivery's
+	// alwaysBlockedNetworks stays blocked no matter what is listed
+	// here. That set is link-local plus the cloud metadata
+	// endpoints outside it that disclose credentials or user data
+	// at a provider-fixed address; it is not exhaustive of every
+	// cloud's metadata address. See alwaysBlockedNetworks for the
+	// authoritative list and the criterion it is built from.
+	AllowedEgressCIDRs []netip.Prefix
+
 	params *ConfigParams
 	log    *slog.Logger
 }
@@ -472,6 +488,11 @@ func loadFromEnv() (*Config, error) {
 		return nil, err
 	}
 
+	allowedEgressCIDRs, err := envPrefixList("ALLOWED_EGRESS_CIDRS")
+	if err != nil {
+		return nil, err
+	}
+
 	metricsUsername, metricsPassword, err := resolveMetricsAuth()
 	if err != nil {
 		return nil, err
@@ -490,9 +511,49 @@ func loadFromEnv() (*Config, error) {
 		SessionIdleTimeout:     sessionIdleTimeout,
 		ReceiverRateLimit:      receiverRateLimit,
 		TrustedProxies:         trustedProxies,
+		AllowedEgressCIDRs:     allowedEgressCIDRs,
 	}, nil
 }
 
+// PrefixStrings renders a prefix list as its CIDR strings, for
+// logging a list an operator has to be able to read back.
+func PrefixStrings(prefixes []netip.Prefix) []string {
+	out := make([]string, 0, len(prefixes))
+
+	for _, prefix := range prefixes {
+		out = append(out, prefix.String())
+	}
+
+	return out
+}
+
+// warnEgressAllowlist logs the effective ALLOWED_EGRESS_CIDRS
+// whenever it is non-empty.
+//
+// It prints the blocks themselves rather than a count, because
+// this is the one setting that lets a delivery target reach the
+// host's own network: an operator reading the startup log has to
+// be able to see exactly which hole is open. Silence means the
+// list is empty and the SSRF guard is refusing every
+// private/reserved range, which is the default.
+func (c *Config) warnEgressAllowlist(log *slog.Logger) {
+	if len(c.AllowedEgressCIDRs) == 0 {
+		return
+	}
+
+	log.Warn(
+		"ALLOWED_EGRESS_CIDRS lets delivery targets reach these "+
+			"otherwise-blocked private/reserved networks. Anyone "+
+			"who can create a delivery target can now make this "+
+			"process issue requests into them, and read back the "+
+			"response. Link-local and the known cloud instance "+
+			"metadata endpoints outside it stay blocked "+
+			"regardless of what is listed here.",
+		"allowedEgressCIDRs",
+		strings.Join(PrefixStrings(c.AllowedEgressCIDRs), ","),
+	)
+}
+
 // warnSharedRateLimitBucket logs a startup warning whenever
 // TRUSTED_PROXIES is empty, in any environment.
 //
@@ -574,11 +635,13 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 		"sessionIdleTimeout", s.SessionIdleTimeout.String(),
 		"receiverRateLimit", s.ReceiverRateLimit,
 		"trustedProxies", len(s.TrustedProxies),
+		"allowedEgressCIDRs", len(s.AllowedEgressCIDRs),
 		"hasSentryDSN", s.SentryDSN != "",
 		"hasMetricsAuth", s.MetricsAuthEnabled(),
 	)
 
 	s.warnSharedRateLimitBucket(log)
+	s.warnEgressAllowlist(log)
 
 	return s, nil
 }