net: block private and link-local URLs

1 files changed, 130 insertions, 0 deletions

diff --git a/src/net.rs b/src/net.rs
new file mode 100644
index 0000000..dc9b7f2
--- /dev/null
+++ b/src/net.rs
@@ -0,0 +1,130 @@
+//! Network egress checks for user-supplied URLs.
+//!
+//! The bot can be asked to fetch arbitrary URLs (`/download`, `/music`, cron
+//! audio). Without a check, that is a server-side request forgery primitive:
+//! loopback services, Docker host gateways, private LANs, and cloud metadata
+//! (`169.254.169.254`) are all reachable from the container.
+//!
+//! This is a best-effort DNS check. It raises the bar substantially, but a
+//! determined attacker can still use DNS rebinding between this check and the
+//! actual request; combine it with network egress rules for full protection.
+
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+
+use crate::error::{Error, Result};
+
+/// Validate that `url` is an `http(s)` URL whose host resolves only to public
+/// addresses. Call this before handing a user-supplied URL to reqwest, ffmpeg,
+/// or yt-dlp.
+pub async fn ensure_public_http_url(url: &str) -> Result<()> {
+    let parsed = reqwest::Url::parse(url)
+        .map_err(|e| Error::Custom(format!("Invalid URL: {e}")))?;
+    if !matches!(parsed.scheme(), "http" | "https") {
+        return Err(Error::Custom("Only http:// and https:// URLs are allowed".into()));
+    }
+
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| Error::Custom("URL has no host".into()))?;
+    // `host_str` keeps IPv6 brackets.
+    let host = host.trim_start_matches('[').trim_end_matches(']');
+    let port = parsed.port_or_known_default().unwrap_or(80);
+
+    let mut resolved = false;
+    let addresses = tokio::net::lookup_host((host, port))
+        .await
+        .map_err(|e| Error::Custom(format!("Could not resolve {host}: {e}")))?;
+    for address in addresses {
+        resolved = true;
+        if !is_public_ip(address.ip()) {
+            return Err(Error::Custom(format!(
+                "Refusing to fetch a private or local address ({})",
+                address.ip()
+            )));
+        }
+    }
+    if !resolved {
+        return Err(Error::Custom(format!("Could not resolve {host}")));
+    }
+    Ok(())
+}
+
+fn is_public_ip(ip: IpAddr) -> bool {
+    match ip {
+        IpAddr::V4(v4) => is_public_v4(v4),
+        IpAddr::V6(v6) => {
+            if let Some(v4) = v6.to_ipv4_mapped() {
+                return is_public_v4(v4);
+            }
+            !(v6.is_loopback()
+                || v6.is_unspecified()
+                || v6.is_multicast()
+                // fc00::/7 unique-local
+                || (v6.segments()[0] & 0xfe00) == 0xfc00
+                // fe80::/10 link-local
+                || (v6.segments()[0] & 0xffc0) == 0xfe80
+                // 2001:db8::/32 documentation
+                || (v6.segments()[0] == 0x2001 && v6.segments()[1] == 0x0db8))
+        }
+    }
+}
+
+fn is_public_v4(ip: Ipv4Addr) -> bool {
+    let octets = ip.octets();
+    !(ip.is_private()
+        || ip.is_loopback()
+        || ip.is_link_local()
+        || ip.is_broadcast()
+        || ip.is_documentation()
+        || ip.is_unspecified()
+        || ip.is_multicast()
+        // 0.0.0.0/8, 240.0.0.0/4 and other non-routable special ranges.
+        || octets[0] == 0
+        || octets[0] >= 240
+        // 100.64.0.0/10 carrier-grade NAT
+        || (octets[0] == 100 && (64..=127).contains(&octets[1]))
+        // 192.0.0.0/24 IETF protocol assignments
+        || (octets[0] == 192 && octets[1] == 0 && octets[2] == 0)
+        // 198.18.0.0/15 benchmarking
+        || (octets[0] == 198 && (octets[1] == 18 || octets[1] == 19)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn private_and_special_ranges_are_blocked() {
+        for ip in [
+            "127.0.0.1",
+            "10.0.0.1",
+            "172.16.5.4",
+            "192.168.1.1",
+            "169.254.169.254",
+            "0.0.0.0",
+            "100.64.0.1",
+            "198.18.0.1",
+            "224.0.0.1",
+            "255.255.255.255",
+            "::1",
+            "fe80::1",
+            "fc00::1",
+            "::ffff:127.0.0.1",
+        ] {
+            assert!(
+                !is_public_ip(ip.parse().unwrap()),
+                "{ip} should not be considered public"
+            );
+        }
+    }
+
+    #[test]
+    fn public_ranges_are_allowed() {
+        for ip in ["1.1.1.1", "8.8.8.8", "2606:4700:4700::1111"] {
+            assert!(
+                is_public_ip(ip.parse().unwrap()),
+                "{ip} should be public"
+            );
+        }
+    }
+}