feat: simplify SSRF protection

src/config.rs

@@ -7,8 +7,8 @@ use moka::future::Cache;
 use tokio::sync::mpsc::Sender;
 
 use crate::{
+    dns::ValidateDnsResolver,
     endpoints::mods::IndexQueryParams,
-    pin_dns::PinDnsResolver,
     s3_worker::S3WorkerTask,
     storage::{LocalBackend, PrivateDisk, PublicDisk, S3Backend, S3Configuration},
     types::{
@@ -36,7 +36,7 @@ pub struct AppData {
 
     mods_cache: Cache<IndexQueryParams, ApiResponse<PaginatedData<Mod>>>,
     http_client: reqwest::Client,
-    pin_dns_http_client: reqwest::Client,
+    check_dns_http_client: reqwest::Client,
 
     s3_sender: OnceLock<Sender<S3WorkerTask>>,
 }
@@ -86,12 +86,12 @@ pub async fn build_config() -> anyhow::Result<AppData> {
         None
     };
 
-    let pin_dns_http_client = reqwest::Client::builder()
-        .dns_resolver(Arc::new(PinDnsResolver))
+    let check_dns_http_client = reqwest::Client::builder()
+        .dns_resolver(Arc::new(ValidateDnsResolver))
         .pool_max_idle_per_host(4)
         .connect_timeout(Duration::from_secs(10))
-        .read_timeout(Duration::from_secs(30))
-        .redirect(reqwest::redirect::Policy::none())
+        .read_timeout(Duration::from_secs(10))
+        .timeout(Duration::from_secs(30))
         .build()?;
 
     Ok(AppData {
@@ -124,7 +124,7 @@ pub async fn build_config() -> anyhow::Result<AppData> {
             .connect_timeout(Duration::from_secs(10))
             .read_timeout(Duration::from_secs(30))
             .build()?,
-        pin_dns_http_client,
+        check_dns_http_client,
         s3_sender: OnceLock::new(),
     })
 }
@@ -204,19 +204,14 @@ impl AppData {
         &self.http_client
     }
 
-    /// Client that allows pinning DNS queries to a certain ip address.
+    /// Client that validates passed host, denies all private resolved IP addresses.
     /// Useful for preventing Server Side Request Forgery.
     ///
-    /// To pin an address, you have to use pin_dns::PINNED_ADDRS.
-    ///
     /// Basically, if you have a URL as user input, *always* use this client.
     ///
-    /// The downside is that you get worse DNS performance, doesn't matter when
-    /// security is involved though.
-    ///
     /// For an example, check mod_zip::download()
-    pub fn pin_dns_http_client(&self) -> &reqwest::Client {
-        &self.pin_dns_http_client
+    pub fn check_dns_http_client(&self) -> &reqwest::Client {
+        &self.check_dns_http_client
     }
 
     pub fn init_s3_sender(&self, sender: Sender<S3WorkerTask>) {

src/dns.rs

@@ -0,0 +1,115 @@
+use std::net::{IpAddr, Ipv4Addr, SocketAddr};
+
+use reqwest::dns::{Name, Resolve, Resolving};
+
+#[derive(Clone, Default, Debug)]
+pub struct ValidateDnsResolver;
+
+impl Resolve for ValidateDnsResolver {
+    fn resolve(&self, name: Name) -> Resolving {
+        Box::pin(async move {
+            tracing::debug!("resolving {}", name.as_str());
+
+            Ok(Box::new(parse_name_to_ips(&name).await.into_iter())
+                as Box<dyn Iterator<Item = SocketAddr> + Send>)
+        })
+    }
+}
+
+async fn parse_name_to_ips(name: &Name) -> Vec<SocketAddr> {
+    let lookup = tokio::net::lookup_host(name.as_str()).await;
+
+    match lookup {
+        Err(e) => {
+            tracing::warn!("Failed to lookup host {}: {:?}", name.as_str(), e);
+            vec![]
+        }
+        Ok(iter) => iter.filter(|addr| !is_disallowed_ip(addr.ip())).collect(),
+    }
+}
+
+/// Most of this function has been stolen from IpAddr::is_global().
+///
+/// Since that's still an unstable rust feature, we'll use this for now.
+fn is_disallowed_ip(ip: IpAddr) -> bool {
+    match ip {
+        IpAddr::V4(v4) => {
+            v4.is_loopback() // 127.0.0.0/8
+                || v4.is_private() // 10.0.0.0/8 | 192.168.0.0/16 | 172.16.0.0/12
+                || v4.is_link_local() // covers 169.254.169.254 cloud metadata
+                || v4.is_unspecified() // 0.0.0.0
+                || v4.is_broadcast() // 255.255.255.255
+                || v4.is_documentation() // 192.0.2.0/24 | 198.51.100.0/24 | 203.0.113.0/24
+                || v4.is_multicast() // 224.0.0.0/4
+                || is_shared_nat(v4) // 100.64.0.0/10 CGNAT
+                || is_ietf_protocol_assignment(v4) // 192.0.0.0/24, (except 192.0.0.9, 192.0.0.10)
+                || is_reserved(v4) // 240.0.0.0/4
+                || is_benchmarking(v4) // 198.18.0.0/15
+        }
+        IpAddr::V6(v6) => {
+            v6.is_loopback() // ::1
+            || v6.is_unspecified() // ::
+            || v6.is_unique_local() // fc00::/7
+            || v6.is_unicast_link_local() // fe80::/10
+            || (v6.segments()[0] == 0x2001 && v6.segments()[1] == 0xdb8) // 2001:db8::/32 documentation
+            || v6.is_multicast() // ff00::/8
+            || v6
+                .to_ipv4_mapped()
+                .is_some_and(|v4| is_disallowed_ip(IpAddr::V4(v4)))
+        }
+    }
+}
+
+/// Denies ipv4 like `100.64.0.0/10`, used for CGNAT
+fn is_shared_nat(v4: Ipv4Addr) -> bool {
+    let o = v4.octets();
+    o[0] == 100 && (o[1] & 0b1100_0000) == 0b0100_0000
+}
+
+fn is_ietf_protocol_assignment(v4: Ipv4Addr) -> bool {
+    v4.octets()[0] == 192
+        && v4.octets()[1] == 0
+        && v4.octets()[2] == 0
+        && v4.octets()[3] != 9
+        && v4.octets()[3] != 10
+}
+
+fn is_reserved(v4: Ipv4Addr) -> bool {
+    (v4.octets()[0] & 0xf0) == 240
+}
+
+fn is_benchmarking(v4: Ipv4Addr) -> bool {
+    v4.octets()[0] == 198 && (v4.octets()[1] & 0xfe) == 18
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::net::IpAddr;
+
+    #[test]
+    fn flags_private_and_special_ranges() {
+        let cases: &[(&str, bool)] = &[
+            ("127.0.0.1", true),
+            ("10.0.0.5", true),
+            ("172.16.0.1", true),
+            ("192.168.1.1", true),
+            ("169.254.169.254", true), // cloud metadata
+            ("100.64.0.1", true),      // CGNAT
+            ("8.8.8.8", false),
+            ("1.1.1.1", false),
+        ];
+        for (ip, expected) in cases {
+            let addr: IpAddr = ip.parse().unwrap();
+            assert_eq!(is_disallowed_ip(addr), *expected, "failed for {ip}");
+        }
+    }
+
+    #[test]
+    fn flags_ipv6_special_ranges() {
+        assert!(is_disallowed_ip("::1".parse().unwrap()));
+        assert!(is_disallowed_ip("fc00::1".parse().unwrap()));
+        assert!(is_disallowed_ip("fe80::1".parse().unwrap()));
+        assert!(!is_disallowed_ip("2606:4700:4700::1111".parse().unwrap())); // public
+    }
+}

src/endpoints/mod_versions.rs

@@ -354,7 +354,7 @@ pub async fn create_version(
         .collect();
 
     let bytes = download_mod(
-        data.pin_dns_http_client(),
+        data.check_dns_http_client(),
         &download_link,
         data.max_download_mb(),
     )
@@ -580,7 +580,7 @@ pub async fn update_version(
         }
 
         let bytes = mod_zip::download_mod_hash_comp(
-            data.pin_dns_http_client(),
+            data.check_dns_http_client(),
             &version.download_link,
             &version.hash,
             data.max_download_mb(),

src/endpoints/mods.rs

@@ -218,7 +218,7 @@ pub async fn create(
     let dev = auth.developer()?;
     let mut pool = data.db().acquire().await?;
     let bytes = mod_zip::download_mod(
-        data.pin_dns_http_client(),
+        data.check_dns_http_client(),
         &payload.download_link,
         data.max_download_mb(),
     )

src/main.rs

@@ -13,14 +13,14 @@ mod auth;
 mod cli;
 mod config;
 mod database;
+mod dns;
 mod endpoints;
 mod events;
 mod extractors;
 mod jobs;
 mod logging;
 mod mod_zip;
 mod openapi;
-mod pin_dns;
 mod s3_worker;
 mod storage;
 mod types;