316 lines
10 KiB
Go
316 lines
10 KiB
Go
package credential
|
||
|
||
import (
|
||
"context"
|
||
"errors"
|
||
"fmt"
|
||
"net"
|
||
"net/http"
|
||
"net/netip"
|
||
"net/url"
|
||
"os"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
"unicode"
|
||
)
|
||
|
||
const (
|
||
defaultTimeoutMS = 3000
|
||
minTimeoutMS = 1000
|
||
maxTimeoutMS = 30000
|
||
)
|
||
|
||
func ValidateSecret(value string, maxLength int) (string, error) {
|
||
value = strings.TrimSpace(value)
|
||
if value == "" || len(value) > maxLength || strings.IndexFunc(value, unicode.IsControl) >= 0 {
|
||
return "", errors.New("invalid credential")
|
||
}
|
||
return value, nil
|
||
}
|
||
|
||
func NormalizeHTTPSURL(raw string) (string, error) {
|
||
raw = strings.TrimSpace(raw)
|
||
if raw == "" || len(raw) > 2048 || strings.Contains(raw, "#") {
|
||
return "", errors.New("invalid endpoint")
|
||
}
|
||
|
||
endpoint, err := url.ParseRequestURI(raw)
|
||
if err != nil || endpoint.Scheme != "https" || endpoint.Hostname() == "" || endpoint.User != nil || endpoint.Fragment != "" {
|
||
return "", errors.New("invalid endpoint")
|
||
}
|
||
if port := endpoint.Port(); port != "" {
|
||
value, err := strconv.Atoi(port)
|
||
if err != nil || value < 1 || value > 65535 {
|
||
return "", errors.New("invalid endpoint")
|
||
}
|
||
}
|
||
host := strings.TrimSuffix(strings.ToLower(endpoint.Hostname()), ".")
|
||
if host == "localhost" || strings.HasSuffix(host, ".localhost") {
|
||
return "", errors.New("invalid endpoint")
|
||
}
|
||
if address, err := netip.ParseAddr(host); err == nil && !IsPublicRemoteIP(address) {
|
||
return "", errors.New("invalid endpoint")
|
||
}
|
||
return endpoint.String(), nil
|
||
}
|
||
|
||
func IsPublicRemoteIP(address netip.Addr) bool {
|
||
address = address.Unmap()
|
||
if !address.IsValid() || !address.IsGlobalUnicast() || address.IsPrivate() || address.IsLoopback() || address.IsLinkLocalUnicast() || address.IsLinkLocalMulticast() || address.IsMulticast() || address.IsUnspecified() {
|
||
return false
|
||
}
|
||
if address.Is6() && !globalIPv6UnicastPrefix.Contains(address) {
|
||
return false
|
||
}
|
||
for _, prefix := range restrictedRemotePrefixes {
|
||
if prefix.Contains(address) {
|
||
return false
|
||
}
|
||
}
|
||
return true
|
||
}
|
||
|
||
var globalIPv6UnicastPrefix = netip.MustParsePrefix("2000::/3")
|
||
|
||
var restrictedRemotePrefixes = []netip.Prefix{
|
||
netip.MustParsePrefix("0.0.0.0/8"),
|
||
netip.MustParsePrefix("100.64.0.0/10"),
|
||
netip.MustParsePrefix("192.0.0.0/24"),
|
||
netip.MustParsePrefix("192.0.2.0/24"),
|
||
netip.MustParsePrefix("192.88.99.0/24"),
|
||
netip.MustParsePrefix("198.18.0.0/15"),
|
||
netip.MustParsePrefix("198.51.100.0/24"),
|
||
netip.MustParsePrefix("203.0.113.0/24"),
|
||
netip.MustParsePrefix("240.0.0.0/4"),
|
||
netip.MustParsePrefix("2001::/23"),
|
||
netip.MustParsePrefix("2001:db8::/32"),
|
||
netip.MustParsePrefix("2002::/16"),
|
||
netip.MustParsePrefix("3fff::/20"),
|
||
}
|
||
|
||
func NewRestrictedHTTPClient(timeoutMS int) *http.Client {
|
||
return NewRestrictedHTTPClientForTargets(timeoutMS, nil)
|
||
}
|
||
|
||
// NetworkTarget 描述插件允许访问的网络目标。
|
||
type NetworkTarget struct {
|
||
Scheme string
|
||
Host string
|
||
Port int
|
||
}
|
||
|
||
// NewRestrictedHTTPClientForTargets 创建仅允许访问授权目标的 HTTP 客户端。
|
||
func NewRestrictedHTTPClientForTargets(timeoutMS int, targets []NetworkTarget) *http.Client {
|
||
return newRestrictedHTTPClientForTargets(timeoutMS, targets, os.Getenv("SMAIL_PLUGIN_SANDBOX") == "1")
|
||
}
|
||
|
||
// NormalizeTelegramProxyURL 仅接受超管指定的本机 HTTP 代理，不解析代理域名。
|
||
func NormalizeTelegramProxyURL(raw string) (string, error) {
|
||
raw = strings.TrimSpace(raw)
|
||
if raw == "" {
|
||
return "", nil
|
||
}
|
||
endpoint, err := url.Parse(raw)
|
||
if err != nil || endpoint.Scheme != "http" || endpoint.User != nil || endpoint.Path != "" ||
|
||
endpoint.RawQuery != "" || endpoint.ForceQuery || strings.ContainsRune(raw, '#') || len(raw) > 256 {
|
||
return "", errors.New("Telegram 代理仅支持带端口的本机 HTTP 地址，如 http://127.0.0.1:9000")
|
||
}
|
||
address, addressErr := netip.ParseAddr(endpoint.Hostname())
|
||
port, portErr := strconv.Atoi(endpoint.Port())
|
||
if addressErr != nil || !address.IsLoopback() || address.Zone() != "" || portErr != nil || port < 1 || port > 65535 {
|
||
return "", errors.New("Telegram 代理仅支持带端口的本机 HTTP 地址，如 http://127.0.0.1:9000")
|
||
}
|
||
return "http://" + net.JoinHostPort(address.String(), strconv.Itoa(port)), nil
|
||
}
|
||
|
||
// NewTelegramHTTPClient 将代理权限限定为 Telegram；沙箱始终由主进程代为出站。
|
||
func NewTelegramHTTPClient(timeoutMS int, proxyURL string) (*http.Client, error) {
|
||
return newTelegramHTTPClient(timeoutMS, proxyURL, os.Getenv("SMAIL_PLUGIN_SANDBOX") == "1")
|
||
}
|
||
|
||
func newTelegramHTTPClient(timeoutMS int, proxyURL string, sandbox bool) (*http.Client, error) {
|
||
proxyURL, err := NormalizeTelegramProxyURL(proxyURL)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
targets := []NetworkTarget{{Scheme: "https", Host: "api.telegram.org", Port: 443}}
|
||
client := newRestrictedHTTPClientForTargets(timeoutMS, targets, sandbox)
|
||
if proxyURL == "" || sandbox {
|
||
return client, nil
|
||
}
|
||
endpoint, _ := url.Parse(proxyURL)
|
||
transport := client.Transport.(restrictedRoundTripper).transport.(*http.Transport)
|
||
transport.Proxy = http.ProxyURL(endpoint)
|
||
transport.DialContext = func(ctx context.Context, network, address string) (net.Conn, error) {
|
||
if address != endpoint.Host {
|
||
return nil, errors.New("Telegram 代理连接目标不匹配")
|
||
}
|
||
return (&net.Dialer{Timeout: 5 * time.Second}).DialContext(ctx, network, endpoint.Host)
|
||
}
|
||
// HTTPS CONNECT 后仍验证 Telegram 的系统可信证书，不接受其他目标或明文请求。
|
||
return client, nil
|
||
}
|
||
|
||
func newRestrictedHTTPClientForTargets(timeoutMS int, targets []NetworkTarget, sandbox bool) *http.Client {
|
||
timeout := time.Duration(NormalizeTimeoutMS(timeoutMS)) * time.Millisecond
|
||
allowedTargets := normalizeNetworkTargets(targets)
|
||
transport := &http.Transport{
|
||
Proxy: nil,
|
||
DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
|
||
return restrictedDialContext(ctx, network, address, allowedTargets)
|
||
},
|
||
ForceAttemptHTTP2: true,
|
||
TLSHandshakeTimeout: timeout,
|
||
ResponseHeaderTimeout: timeout,
|
||
IdleConnTimeout: 30 * time.Second,
|
||
}
|
||
var outbound http.RoundTripper = transport
|
||
if sandbox {
|
||
outbound = newPluginEgressTransport(timeout)
|
||
}
|
||
return &http.Client{
|
||
Timeout: timeout,
|
||
Transport: restrictedRoundTripper{transport: outbound, targets: allowedTargets},
|
||
CheckRedirect: func(request *http.Request, via []*http.Request) error {
|
||
if len(via) >= 10 {
|
||
return errors.New("too many redirects")
|
||
}
|
||
return validateRestrictedRequest(request, allowedTargets, "redirect target is not authorized")
|
||
},
|
||
}
|
||
}
|
||
|
||
type restrictedRoundTripper struct {
|
||
transport http.RoundTripper
|
||
targets []NetworkTarget
|
||
}
|
||
|
||
func (r restrictedRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
|
||
if err := validateRestrictedRequest(request, r.targets, "remote target is not authorized"); err != nil {
|
||
closeRequestBody(request)
|
||
return nil, err
|
||
}
|
||
return r.transport.RoundTrip(request)
|
||
}
|
||
|
||
func (r restrictedRoundTripper) CloseIdleConnections() {
|
||
if transport, ok := r.transport.(interface{ CloseIdleConnections() }); ok {
|
||
transport.CloseIdleConnections()
|
||
}
|
||
}
|
||
|
||
func closeRequestBody(request *http.Request) {
|
||
if request != nil && request.Body != nil {
|
||
_ = request.Body.Close()
|
||
}
|
||
}
|
||
|
||
func validateRestrictedRequest(request *http.Request, targets []NetworkTarget, targetError string) error {
|
||
if request == nil || request.URL == nil {
|
||
return errors.New("invalid endpoint")
|
||
}
|
||
if _, err := NormalizeHTTPSURL(request.URL.String()); err != nil {
|
||
return err
|
||
}
|
||
if !matchesNetworkTarget(request.URL, targets) {
|
||
return errors.New(targetError)
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func normalizeNetworkTargets(targets []NetworkTarget) []NetworkTarget {
|
||
result := make([]NetworkTarget, 0, len(targets))
|
||
for _, target := range targets {
|
||
scheme := strings.ToLower(strings.TrimSpace(target.Scheme))
|
||
host := strings.TrimSuffix(strings.ToLower(strings.TrimSpace(target.Host)), ".")
|
||
port := target.Port
|
||
if port == 0 {
|
||
if scheme == "https" {
|
||
port = 443
|
||
} else {
|
||
port = 80
|
||
}
|
||
}
|
||
if (scheme != "https" && scheme != "http") || host == "" || port < 1 || port > 65535 {
|
||
continue
|
||
}
|
||
result = append(result, NetworkTarget{Scheme: scheme, Host: host, Port: port})
|
||
}
|
||
return result
|
||
}
|
||
|
||
func matchesNetworkTarget(endpoint *url.URL, targets []NetworkTarget) bool {
|
||
if len(targets) == 0 {
|
||
return true
|
||
}
|
||
port := 443
|
||
if strings.EqualFold(endpoint.Scheme, "http") {
|
||
port = 80
|
||
}
|
||
if endpoint.Port() != "" {
|
||
port, _ = strconv.Atoi(endpoint.Port())
|
||
}
|
||
host := strings.TrimSuffix(strings.ToLower(endpoint.Hostname()), ".")
|
||
scheme := strings.ToLower(endpoint.Scheme)
|
||
for _, target := range targets {
|
||
if target.Scheme == scheme && target.Host == host && target.Port == port {
|
||
return true
|
||
}
|
||
}
|
||
return false
|
||
}
|
||
|
||
func restrictedDialContext(ctx context.Context, network, address string, targets []NetworkTarget) (net.Conn, error) {
|
||
host, port, err := net.SplitHostPort(address)
|
||
if err != nil {
|
||
return nil, errors.New("invalid remote address")
|
||
}
|
||
if _, err := strconv.Atoi(port); err != nil || (len(targets) > 0 && !matchesNetworkTarget(&url.URL{Scheme: "https", Host: net.JoinHostPort(host, port)}, targets) && !matchesNetworkTarget(&url.URL{Scheme: "http", Host: net.JoinHostPort(host, port)}, targets)) {
|
||
return nil, errors.New("remote target is not authorized")
|
||
}
|
||
resolved, err := net.DefaultResolver.LookupIPAddr(ctx, host)
|
||
if err != nil || len(resolved) == 0 {
|
||
return nil, errors.New("remote address resolution failed")
|
||
}
|
||
approved := make([]netip.Addr, 0, len(resolved))
|
||
for _, item := range resolved {
|
||
candidate, ok := netip.AddrFromSlice(item.IP)
|
||
if !ok || !IsPublicRemoteIP(candidate) {
|
||
return nil, errors.New("remote address is not public")
|
||
}
|
||
candidate = candidate.Unmap()
|
||
if network == "tcp4" && !candidate.Is4() || network == "tcp6" && !candidate.Is6() {
|
||
continue
|
||
}
|
||
approved = append(approved, candidate)
|
||
}
|
||
if len(approved) == 0 {
|
||
return nil, errors.New("remote address is unavailable")
|
||
}
|
||
|
||
dialer := &net.Dialer{Timeout: 5 * time.Second, KeepAlive: 30 * time.Second}
|
||
var lastErr error
|
||
for _, candidate := range approved {
|
||
connection, err := dialer.DialContext(ctx, network, net.JoinHostPort(candidate.String(), port))
|
||
if err == nil {
|
||
return connection, nil
|
||
}
|
||
lastErr = err
|
||
}
|
||
return nil, fmt.Errorf("connect to remote endpoint: %w", lastErr)
|
||
}
|
||
|
||
func NormalizeTimeoutMS(value int) int {
|
||
if value <= 0 {
|
||
return defaultTimeoutMS
|
||
}
|
||
if value < minTimeoutMS {
|
||
return minTimeoutMS
|
||
}
|
||
if value > maxTimeoutMS {
|
||
return maxTimeoutMS
|
||
}
|
||
return value
|
||
}
|