Privatae
421 lines
14 KiB
Go
421 lines
14 KiB
Go
package main
|
|
|
|
import (
|
|
"bufio"
|
|
"errors"
|
|
"io"
|
|
"net"
|
|
"net/http/httputil"
|
|
"strconv"
|
|
"strings"
|
|
)
|
|
|
|
// ONE plain-HTTP request per egress connection, read the way the Host's egress
|
|
// gate reads it (its strict request parse and its authority parse: the same
|
|
// refusals, the same normalised host, the same rebuilt head).
|
|
//
|
|
// Everything the lane writes to a destination is what it checked, and nothing
|
|
// more:
|
|
// - the head is parsed strictly and REBUILT, so the destination reads the same
|
|
// host, port and body length the lane vetted: never a second reading of the
|
|
// Host's bytes (a Host header naming another site, a query or userinfo glued
|
|
// to the host, a padded Transfer-Encoding);
|
|
// - the request goes out with `Connection: close`, its body is framed by
|
|
// Content-Length or chunked encoding, and a byte the Host sends after the
|
|
// body closes the connection with nothing of it forwarded. Before this the
|
|
// lane wrote the first head and then spliced the whole connection, so every
|
|
// later request on a keep-alive connection reached the destination unread.
|
|
//
|
|
// An honest client sends its next request only after the response, which the
|
|
// destination closes behind `Connection: close`, so it opens a new connection
|
|
// and meets the vetting again.
|
|
|
|
// egressHostChars are the characters a host name may have here (lower-cased).
|
|
const egressHostChars = "abcdefghijklmnopqrstuvwxyz0123456789-._"
|
|
|
|
// egressTokenChars are RFC 9110 token characters: methods and header names.
|
|
const egressTokenChars = "!#$%&'*+-.^_`|~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
|
|
|
|
// egressHopByHop are headers that belong to one hop. The lane speaks for itself
|
|
// on the next one, and a proxy credential never goes on to the destination.
|
|
var egressHopByHop = map[string]bool{
|
|
"connection": true, "proxy-connection": true, "keep-alive": true, "upgrade": true,
|
|
"te": true, "trailer": true, "proxy-authorization": true, "proxy-authenticate": true,
|
|
}
|
|
|
|
// egressTrailerLimit bounds the trailer section of a chunked body, which is
|
|
// read to its end and dropped (the gate's limit).
|
|
const egressTrailerLimit = 8192
|
|
|
|
// egressRefusal is a request the lane refuses before it dials anything.
|
|
type egressRefusal struct{ status, body string }
|
|
|
|
func egressBad(body string) *egressRefusal {
|
|
return &egressRefusal{"400 Bad Request", body}
|
|
}
|
|
|
|
const egressNoHost = "The bastion could not read where this request is going (no host in the " +
|
|
"request line or in a Host header), so it sent nothing."
|
|
|
|
// egressUnreachable is the body of a 502: the destination passed the vetting,
|
|
// and no address of it answered from this machine.
|
|
const egressUnreachable = "The bastion could not reach that destination from this machine's own " +
|
|
"connection, so nothing was sent."
|
|
|
|
// egressHostPort is host and port as the vetting takes them.
|
|
func egressHostPort(host string, port int) string {
|
|
return net.JoinHostPort(host, strconv.Itoa(port))
|
|
}
|
|
|
|
// writeEgressRefusal answers the Host with a status and a short plain-text
|
|
// body saying why, and closes the exchange. why, when set, also goes in
|
|
// X-Privatae-Refused, the header the Host already reads.
|
|
func writeEgressRefusal(w io.Writer, status, body, why string) {
|
|
body += "\n"
|
|
var b strings.Builder
|
|
b.WriteString("HTTP/1.1 " + status + "\r\n")
|
|
b.WriteString("Content-Type: text/plain; charset=utf-8\r\n")
|
|
b.WriteString("Content-Length: " + strconv.Itoa(len(body)) + "\r\n")
|
|
b.WriteString("Connection: close\r\n")
|
|
if why != "" {
|
|
b.WriteString("X-Privatae-Refused: " + strings.NewReplacer("\r", " ", "\n", " ").Replace(why) + "\r\n")
|
|
}
|
|
b.WriteString("\r\n")
|
|
b.WriteString(body)
|
|
_, _ = io.WriteString(w, b.String())
|
|
}
|
|
|
|
// parseEgressAuthority: (host, port, true) from "host", "host:port", "[v6]" or
|
|
// "[v6]:port", or false when the lane can't read it exactly as the destination
|
|
// would. Refused rather than guessed: userinfo ("a@b"), an unbracketed IPv6
|
|
// literal, characters no host name has, a non-numeric or out-of-range port.
|
|
// The host is lower-cased and loses one trailing dot.
|
|
func parseEgressAuthority(s string, defaultPort int) (string, int, bool) {
|
|
s = strings.TrimSpace(s)
|
|
if s == "" || strings.Contains(s, "@") {
|
|
return "", 0, false
|
|
}
|
|
var host string
|
|
port := defaultPort
|
|
digits := func(p string) bool {
|
|
if len(p) == 0 || len(p) > 5 {
|
|
return false
|
|
}
|
|
for _, c := range p {
|
|
if c < '0' || c > '9' {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|
|
if strings.HasPrefix(s, "[") {
|
|
end := strings.IndexByte(s, ']')
|
|
if end < 0 {
|
|
return "", 0, false
|
|
}
|
|
// An IPv6 literal, IPv4-mapped forms included (the vetting judges the
|
|
// address they map to); a bare IPv4 address in brackets or a zone is
|
|
// not one.
|
|
inner := s[1:end]
|
|
ip := net.ParseIP(inner)
|
|
if ip == nil || !strings.Contains(inner, ":") || strings.Contains(inner, "%") {
|
|
return "", 0, false
|
|
}
|
|
host = ip.String()
|
|
rest := s[end+1:]
|
|
switch {
|
|
case rest == "":
|
|
case strings.HasPrefix(rest, ":") && digits(rest[1:]):
|
|
port, _ = strconv.Atoi(rest[1:])
|
|
default:
|
|
return "", 0, false
|
|
}
|
|
} else {
|
|
if strings.Count(s, ":") > 1 {
|
|
return "", 0, false
|
|
}
|
|
h, p, hasPort := strings.Cut(s, ":")
|
|
if hasPort {
|
|
if !digits(p) {
|
|
return "", 0, false
|
|
}
|
|
port, _ = strconv.Atoi(p)
|
|
}
|
|
h = strings.ToLower(h)
|
|
h = strings.TrimSuffix(h, ".")
|
|
if h == "" || strings.HasPrefix(h, ".") || strings.Contains(h, "..") {
|
|
return "", 0, false
|
|
}
|
|
for _, c := range h {
|
|
if !strings.ContainsRune(egressHostChars, c) {
|
|
return "", 0, false
|
|
}
|
|
}
|
|
host = h
|
|
}
|
|
if port <= 0 || port >= 65536 {
|
|
return "", 0, false
|
|
}
|
|
return host, port, true
|
|
}
|
|
|
|
// fmtEgressAuthority writes host[:port] back, the port left out when it is the
|
|
// scheme's default.
|
|
func fmtEgressAuthority(host string, port, defaultPort int) string {
|
|
h := host
|
|
if strings.Contains(host, ":") {
|
|
h = "[" + host + "]"
|
|
}
|
|
if port == defaultPort {
|
|
return h
|
|
}
|
|
return h + ":" + strconv.Itoa(port)
|
|
}
|
|
|
|
// egressRequest is the one plain-HTTP request the lane forwards.
|
|
type egressRequest struct {
|
|
host string
|
|
port int
|
|
head []byte // rebuilt, CRLF, ends at its blank line
|
|
chunked bool
|
|
length int64
|
|
}
|
|
|
|
func egressTokenOK(s string) bool {
|
|
if s == "" {
|
|
return false
|
|
}
|
|
for _, c := range s {
|
|
if !strings.ContainsRune(egressTokenChars, c) {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|
|
|
|
// parseEgressRequest reads the one request in head (the request line and
|
|
// headers through their blank line, as handleEgressConn read them) and
|
|
// rebuilds it, or refuses it. CONNECT never comes here.
|
|
func parseEgressRequest(head string) (egressRequest, *egressRefusal) {
|
|
lines := strings.Split(head, "\n")
|
|
// The read stops at the first blank line, so the head ends "\n", blank, "\n":
|
|
// drop the empty tail after the last "\n" and the blank line itself.
|
|
if len(lines) < 3 {
|
|
return egressRequest{}, egressBad("The request ended before its headers did, so the bastion sent nothing.")
|
|
}
|
|
lines = lines[:len(lines)-2]
|
|
for i, ln := range lines {
|
|
lines[i] = strings.TrimSuffix(ln, "\r")
|
|
if strings.ContainsAny(lines[i], "\r\x00") {
|
|
return egressRequest{}, egressBad("The request's headers carry a stray carriage return or NUL, so the bastion sent nothing.")
|
|
}
|
|
}
|
|
parts := strings.Split(lines[0], " ")
|
|
if len(parts) != 3 || parts[0] == "" || parts[1] == "" || parts[2] == "" || !egressTokenOK(parts[0]) {
|
|
return egressRequest{}, egressBad("The request line is not 'METHOD target HTTP/1.x', so the bastion sent nothing.")
|
|
}
|
|
method, rawTarget, version := strings.ToUpper(parts[0]), parts[1], parts[2]
|
|
if version != "HTTP/1.1" && version != "HTTP/1.0" {
|
|
return egressRequest{}, egressBad("The bastion forwards HTTP/1.0 and HTTP/1.1 only, so it sent nothing.")
|
|
}
|
|
type header struct{ name, value string }
|
|
var headers []header
|
|
for _, ln := range lines[1:] {
|
|
if strings.HasPrefix(ln, " ") || strings.HasPrefix(ln, "\t") {
|
|
return egressRequest{}, egressBad("A header is folded onto a second line (obsolete line folding), so the bastion sent nothing.")
|
|
}
|
|
name, value, ok := strings.Cut(ln, ":")
|
|
if !ok || !egressTokenOK(name) {
|
|
return egressRequest{}, egressBad("A header line is not 'Name: value' (no space may come before the colon), so the bastion sent nothing.")
|
|
}
|
|
headers = append(headers, header{name, strings.Trim(value, " \t")})
|
|
}
|
|
values := func(n string) []string {
|
|
var out []string
|
|
for _, h := range headers {
|
|
if strings.EqualFold(h.name, n) {
|
|
out = append(out, h.value)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
hosts := values("host")
|
|
if len(hosts) > 1 {
|
|
return egressRequest{}, egressBad("The request carries more than one Host header, so the bastion sent nothing.")
|
|
}
|
|
var host, target, authority string
|
|
var port int
|
|
if scheme, after, abs := strings.Cut(rawTarget, "://"); abs {
|
|
if strings.ToLower(scheme) != "http" {
|
|
// https:// in absolute form asks the lane to make the TLS connection,
|
|
// which it does not do: it used to send the request in plain text to
|
|
// port 80. Every client sends https as a CONNECT.
|
|
return egressRequest{}, egressBad("The bastion forwards plain http:// requests only; send https as a CONNECT. Nothing was sent.")
|
|
}
|
|
cut := len(after)
|
|
for _, sep := range []string{"/", "?", "#"} {
|
|
if i := strings.Index(after, sep); i >= 0 && i < cut {
|
|
cut = i
|
|
}
|
|
}
|
|
var ok bool
|
|
if host, port, ok = parseEgressAuthority(after[:cut], 80); !ok {
|
|
return egressRequest{}, egressBad(egressNoHost)
|
|
}
|
|
path, _, _ := strings.Cut(after[cut:], "#")
|
|
if !strings.HasPrefix(path, "/") {
|
|
path = "/" + path
|
|
}
|
|
authority = fmtEgressAuthority(host, port, 80)
|
|
target = "http://" + authority + path
|
|
} else {
|
|
if !strings.HasPrefix(rawTarget, "/") && rawTarget != "*" {
|
|
return egressRequest{}, egressBad(egressNoHost)
|
|
}
|
|
hostHdr := ""
|
|
if len(hosts) == 1 {
|
|
hostHdr = hosts[0]
|
|
}
|
|
var ok bool
|
|
if host, port, ok = parseEgressAuthority(hostHdr, 80); !ok {
|
|
return egressRequest{}, egressBad(egressNoHost)
|
|
}
|
|
authority = fmtEgressAuthority(host, port, 80)
|
|
target = rawTarget
|
|
}
|
|
|
|
// Body framing (RFC 9112 section 6). Every reading two parsers could disagree
|
|
// on is refused: both length headers, an unknown or doubled coding, a coding
|
|
// on HTTP/1.0, Content-Length values that differ.
|
|
req := egressRequest{host: host, port: port}
|
|
te, cl := values("transfer-encoding"), values("content-length")
|
|
if len(te) > 0 {
|
|
var codings []string
|
|
for _, v := range te {
|
|
for _, c := range strings.Split(v, ",") {
|
|
codings = append(codings, strings.ToLower(strings.TrimSpace(c)))
|
|
}
|
|
}
|
|
if len(cl) > 0 || version == "HTTP/1.0" || len(codings) != 1 || codings[0] != "chunked" {
|
|
return egressRequest{}, egressBad("The request's body length is ambiguous (Transfer-Encoding with " +
|
|
"Content-Length, on HTTP/1.0, or a coding other than chunked), so the bastion sent nothing.")
|
|
}
|
|
req.chunked = true
|
|
} else if len(cl) > 0 {
|
|
seen := map[string]bool{}
|
|
for _, v := range cl {
|
|
for _, c := range strings.Split(v, ",") {
|
|
seen[strings.TrimSpace(c)] = true
|
|
}
|
|
}
|
|
var one string
|
|
for k := range seen {
|
|
one = k
|
|
}
|
|
n, err := strconv.ParseInt(one, 10, 64)
|
|
if len(seen) != 1 || one == "" || len(one) > 18 || err != nil || n < 0 || strings.TrimLeft(one, "0123456789") != "" {
|
|
return egressRequest{}, egressBad("The request's Content-Length is not one number, so the bastion sent nothing.")
|
|
}
|
|
req.length = n
|
|
}
|
|
|
|
named := map[string]bool{}
|
|
for _, v := range values("connection") {
|
|
for _, t := range strings.Split(v, ",") {
|
|
named[strings.ToLower(strings.TrimSpace(t))] = true
|
|
}
|
|
}
|
|
var b strings.Builder
|
|
b.WriteString(method + " " + target + " " + version + "\r\n")
|
|
b.WriteString("Host: " + authority + "\r\n")
|
|
for _, h := range headers {
|
|
lk := strings.ToLower(h.name)
|
|
if egressHopByHop[lk] || named[lk] || lk == "host" || lk == "content-length" || lk == "transfer-encoding" {
|
|
continue
|
|
}
|
|
b.WriteString(h.name + ": " + h.value + "\r\n")
|
|
}
|
|
if req.chunked {
|
|
b.WriteString("Transfer-Encoding: chunked\r\n")
|
|
} else if len(cl) > 0 {
|
|
b.WriteString("Content-Length: " + strconv.FormatInt(req.length, 10) + "\r\n")
|
|
}
|
|
b.WriteString("Connection: close\r\n\r\n")
|
|
req.head = []byte(b.String())
|
|
return req, nil
|
|
}
|
|
|
|
// forwardEgressBody copies the one request body from src to dst, framed as the
|
|
// rebuilt head says. A chunked body goes out re-encoded (plain sizes, no
|
|
// extensions, trailers read and dropped), so the destination parses exactly the
|
|
// body this parser found.
|
|
func forwardEgressBody(dst io.Writer, src *bufio.Reader, req egressRequest) error {
|
|
if !req.chunked {
|
|
if req.length == 0 {
|
|
return nil
|
|
}
|
|
_, err := io.CopyN(dst, src, req.length)
|
|
return err
|
|
}
|
|
cw := httputil.NewChunkedWriter(dst)
|
|
if _, err := io.Copy(cw, httputil.NewChunkedReader(src)); err != nil {
|
|
return err
|
|
}
|
|
// The trailer section, read to its blank line within a bound, and dropped.
|
|
read := 0
|
|
for {
|
|
line, err := src.ReadSlice('\n')
|
|
read += len(line)
|
|
if err != nil || read > egressTrailerLimit {
|
|
return errors.New("chunked body: bad trailer section")
|
|
}
|
|
if string(line) == "\r\n" || string(line) == "\n" {
|
|
break
|
|
}
|
|
}
|
|
if err := cw.Close(); err != nil {
|
|
return err
|
|
}
|
|
_, err := io.WriteString(dst, "\r\n")
|
|
return err
|
|
}
|
|
|
|
// oneEgressExchange writes the one rebuilt request and its body to upstream,
|
|
// and carries the destination's answer back until the destination closes.
|
|
// Nothing the Host sends after the body is forwarded: its first byte closes
|
|
// both sides.
|
|
func oneEgressExchange(clientReader *bufio.Reader, client, upstream net.Conn, req egressRequest) {
|
|
answered := make(chan struct{})
|
|
go func() {
|
|
_, _ = io.Copy(client, upstream)
|
|
close(answered)
|
|
_ = client.Close()
|
|
}()
|
|
defer func() {
|
|
_ = upstream.Close()
|
|
<-answered
|
|
}()
|
|
if _, err := upstream.Write(req.head); err != nil {
|
|
return
|
|
}
|
|
if err := forwardEgressBody(upstream, clientReader, req); err != nil {
|
|
return
|
|
}
|
|
// The request is complete. A further byte is a second request on this
|
|
// connection: never forwarded, and the connection closes. End of stream
|
|
// from the Host is passed on, as the splice did.
|
|
go func() {
|
|
var one [1]byte
|
|
if n, _ := clientReader.Read(one[:]); n > 0 {
|
|
_ = upstream.Close()
|
|
_ = client.Close()
|
|
return
|
|
}
|
|
if cw, ok := upstream.(interface{ CloseWrite() error }); ok {
|
|
_ = cw.CloseWrite()
|
|
}
|
|
}()
|
|
<-answered
|
|
}
|