116 lines
4.3 KiB
TypeScript
116 lines
4.3 KiB
TypeScript
import { lookup } from 'node:dns/promises';
|
|
import { isIP } from 'node:net';
|
|
|
|
// Block telemetry endpoints from pointing at internal/loopback addresses.
|
|
// Required because the admin UI lets an authenticated admin set an arbitrary
|
|
// URL; without this an attacker with a session (or a hostile admin in a
|
|
// multi-tenant deploy) could redirect heartbeats at internal hosts.
|
|
//
|
|
// Set BULWARK_TELEMETRY_ALLOW_PRIVATE=1 to bypass - useful only for local
|
|
// dev where the collector is on the loopback.
|
|
|
|
const PRIVATE_V4: RegExp[] = [
|
|
/^0\./, // 0.0.0.0/8
|
|
/^10\./, // 10.0.0.0/8
|
|
/^127\./, // loopback
|
|
/^169\.254\./, // link-local + cloud metadata
|
|
/^172\.(1[6-9]|2\d|3[0-1])\./, // 172.16.0.0/12
|
|
/^192\.168\./, // 192.168.0.0/16
|
|
/^192\.0\.0\./, // IETF reserved
|
|
/^198\.(1[8-9])\./, // benchmarking 198.18.0.0/15
|
|
/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./, // 100.64.0.0/10 CGNAT
|
|
/^22[4-9]\./, // 224.0.0.0/4 multicast
|
|
/^23\d\./,
|
|
/^2[4-5]\d\./, // 240.0.0.0/4 reserved
|
|
];
|
|
|
|
function isPrivateV4(ip: string): boolean {
|
|
return PRIVATE_V4.some((re) => re.test(ip));
|
|
}
|
|
|
|
function isPrivateV6(ip: string): boolean {
|
|
const lower = ip.toLowerCase();
|
|
if (lower === '::1' || lower === '::') return true;
|
|
if (/^fe[89ab][0-9a-f]:/.test(lower)) return true; // fe80::/10 link-local
|
|
if (/^f[cd][0-9a-f]{2}:/.test(lower)) return true; // fc00::/7 ULA
|
|
const mapped = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
|
|
if (mapped) return isPrivateV4(mapped[1]);
|
|
return false;
|
|
}
|
|
|
|
export function isPrivateAddress(ip: string): boolean {
|
|
const family = isIP(ip);
|
|
if (family === 4) return isPrivateV4(ip);
|
|
if (family === 6) return isPrivateV6(ip);
|
|
return false;
|
|
}
|
|
|
|
const BAD_HOSTS = new Set([
|
|
'localhost',
|
|
'localhost.localdomain',
|
|
'ip6-localhost',
|
|
'ip6-loopback',
|
|
]);
|
|
|
|
function bypassEnabled(): boolean {
|
|
return process.env.BULWARK_TELEMETRY_ALLOW_PRIVATE === '1';
|
|
}
|
|
|
|
export type EndpointCheck = { ok: true } | { ok: false; reason: string };
|
|
|
|
// Sync URL/host shape check. Catches the obvious cases without DNS.
|
|
export function validateEndpointUrl(raw: string): EndpointCheck {
|
|
let url: URL;
|
|
try {
|
|
url = new URL(raw);
|
|
} catch {
|
|
return { ok: false, reason: 'invalid URL' };
|
|
}
|
|
if (url.protocol !== 'http:' && url.protocol !== 'https:') {
|
|
return { ok: false, reason: 'must be http(s)://' };
|
|
}
|
|
if (bypassEnabled()) return { ok: true };
|
|
|
|
const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, '');
|
|
if (!host) return { ok: false, reason: 'host required' };
|
|
if (BAD_HOSTS.has(host)) {
|
|
return { ok: false, reason: 'localhost endpoints are not allowed' };
|
|
}
|
|
if (host.endsWith('.local') || host.endsWith('.internal') || host.endsWith('.localhost')) {
|
|
return { ok: false, reason: 'private TLDs are not allowed' };
|
|
}
|
|
if (isIP(host) && isPrivateAddress(host)) {
|
|
return { ok: false, reason: 'private/loopback IP is not allowed' };
|
|
}
|
|
return { ok: true };
|
|
}
|
|
|
|
// Async check that additionally resolves DNS hostnames. Use this on
|
|
// set-endpoint AND immediately before fetch to defeat DNS-rebinding tricks
|
|
// where a hostname resolves to a public IP at validation time and a private
|
|
// one at fetch time.
|
|
export async function resolveEndpointAllowed(raw: string): Promise<EndpointCheck> {
|
|
const initial = validateEndpointUrl(raw);
|
|
if (!initial.ok) return initial;
|
|
if (bypassEnabled()) return { ok: true };
|
|
|
|
const host = new URL(raw).hostname.toLowerCase().replace(/^\[|\]$/g, '');
|
|
if (isIP(host)) return { ok: true };
|
|
|
|
try {
|
|
const addrs = await lookup(host, { all: true });
|
|
for (const a of addrs) {
|
|
if (isPrivateAddress(a.address)) {
|
|
return { ok: false, reason: `host ${host} resolves to private address ${a.address}` };
|
|
}
|
|
}
|
|
return { ok: true };
|
|
} catch {
|
|
// Don't block on transient DNS failures - fetch will fail loudly anyway,
|
|
// and we don't want to lock admins out of their config when the resolver
|
|
// is flaky. The literal-IP check above already covers the direct-attack
|
|
// case.
|
|
return { ok: true };
|
|
}
|
|
}
|