sneak
76a6518282
All checks were successful
check / check (push) Successful in 3m28s
The SSRF blocklist had no escape hatch, so the thing webhooker is mostly for — taking a public webhook and forwarding it to something on your own network — could not be configured at all. Every private address, Docker sibling and loopback service was permanently unreachable as a delivery destination. ALLOWED_EGRESS_CIDRS (default empty) names blocks that delivery targets may reach despite the default blocklist. It is an allowlist and only ever adds destinations: there is no boolean, and no value disables SSRF protection wholesale. Empty, the guard behaves exactly as before. A fixed set of addresses is refused before the allowlist is consulted, so no supplied CIDR opens one — not the exact address, not a supernet, not 0.0.0.0/0 or ::/0. It is the two link-local blocks (169.254.0.0/16, fe80::/10) plus host routes for the cloud metadata endpoints that sit outside them: AWS's IPv6 IMDS at fd00:ec2::254, which lives in ordinary ULA space, and Alibaba's 100.100.100.200, which lives in CGNAT. Allowlisting fd00::/8 or 100.64.0.0/10 (Tailscale's range) is an ordinary thing for an operator to do and must not reopen instance-credential theft. The IPv4-compatible (::a9fe:a9fe) and NAT64 (64:ff9b::a9fe:a9fe) spellings of 169.254.169.254 are listed too, because To4() does not normalise them into the link-local block the way it does the IPv4-mapped form. Reaching any of these is credential theft rather than delivery to an internal service. The policy now lives in one function, Guard.checkIP, which both target-creation validation and the delivery dialer call. The two paths previously decided separately, which is how they came to disagree about a destination. The guard is built once from config and injected via fx into both the handlers and the delivery engine, so there is a single instance and a single answer. A set-but-unparseable value aborts startup naming the variable, reusing the existing envPrefixList parser. A non-empty list is logged at startup with the blocks spelled out, not counted, so the hole is visible in the log of any deployment that has one. Tests: an allowlisted loopback CIDR both validates and delivers to a live server (and the same URL still fails without the allowlist); a private address outside the listed block stays refused on both paths; every unconditionally blocked address stays refused on both paths under an allowlist that covers it, and the set itself is pinned entry by entry; public addresses are unaffected either way; and config coverage for parsing, startup abort, and the warning's contents.
114 lines
2.5 KiB
Go
114 lines
2.5 KiB
Go
package delivery_test
|
|
|
|
import (
|
|
"context"
|
|
"log/slog"
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"sneak.berlin/go/webhooker/internal/delivery"
|
|
)
|
|
|
|
// newSSRFTestEngine builds an Engine whose shared client
|
|
// carries the SSRF-safe transport, mirroring production.
|
|
func newSSRFTestEngine() *delivery.Engine {
|
|
log := slog.New(slog.DiscardHandler)
|
|
|
|
client := &http.Client{
|
|
Timeout: 30 * time.Second,
|
|
Transport: delivery.NewTestGuard().
|
|
NewSSRFSafeTransport(),
|
|
}
|
|
|
|
return delivery.NewTestEngine(log, client, 1)
|
|
}
|
|
|
|
// TestClientForConfig_TimeoutKeepsSSRFGuard asserts that a
|
|
// client returned by clientForConfig for a config with a
|
|
// per-target timeout still refuses connections to
|
|
// private/reserved addresses (the timeout must not drop the
|
|
// SSRF-safe transport).
|
|
func TestClientForConfig_TimeoutKeepsSSRFGuard(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
engine := newSSRFTestEngine()
|
|
|
|
blocked := []string{
|
|
loopbackHookURL,
|
|
metadataURL,
|
|
"http://[fe80::1]/hook",
|
|
}
|
|
|
|
for _, target := range blocked {
|
|
t.Run(target, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
cfg := &delivery.HTTPTargetConfig{
|
|
URL: target,
|
|
Timeout: 5,
|
|
}
|
|
|
|
client := engine.ExportClientForConfig(cfg)
|
|
|
|
require.NotSame(t, engine.ExportClient(), client,
|
|
"a per-target timeout must yield a "+
|
|
"distinct client",
|
|
)
|
|
|
|
assert.Equal(t,
|
|
5*time.Second, client.Timeout,
|
|
"the per-target timeout must be applied",
|
|
)
|
|
|
|
assert.Same(t,
|
|
engine.ExportClient().Transport,
|
|
client.Transport,
|
|
"the SSRF-safe transport must be reused, "+
|
|
"not dropped",
|
|
)
|
|
|
|
req, err := http.NewRequestWithContext(
|
|
context.Background(),
|
|
http.MethodPost, target, nil,
|
|
)
|
|
require.NoError(t, err)
|
|
|
|
resp, doErr := client.Do(req)
|
|
if resp != nil {
|
|
_ = resp.Body.Close()
|
|
}
|
|
|
|
require.Error(t, doErr,
|
|
"request to %s must be blocked", target,
|
|
)
|
|
|
|
assert.Contains(t, doErr.Error(), "blocked",
|
|
"error must come from the SSRF guard",
|
|
)
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestClientForConfig_NoTimeoutUnchanged asserts that with
|
|
// no per-target timeout the shared SSRF-safe client is
|
|
// returned unchanged.
|
|
func TestClientForConfig_NoTimeoutUnchanged(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
engine := newSSRFTestEngine()
|
|
|
|
cfg := &delivery.HTTPTargetConfig{
|
|
URL: "https://example.com/hook",
|
|
}
|
|
|
|
client := engine.ExportClientForConfig(cfg)
|
|
|
|
assert.Same(t, engine.ExportClient(), client,
|
|
"without a per-target timeout the shared client "+
|
|
"must be returned unchanged",
|
|
)
|
|
}
|