feat: SSRF guard for the document-fetch worker #4

Merged

AzSiAz merged 17 commits from feat/ssrf-guard into main

2026-07-11 18:20:02 +02:00

AzSiAz commented

2026-07-11 17:54:19 +02:00

Owner

Objet

Ferme un SSRF exploitable : un utilisateur authentifié pouvait faire fetcher au
worker n'importe quelle cible interne (loopback, RFC1918, metadata, services
K8s…). Approche à la Discourse/Mastodon : garde applicatif primaire + couche
réseau (NetworkPolicy/Cilium) en backstop opt-in.

Changements

indara-core::net : is_public_ip (plages privées/réservées + dé-mapping
IPv4-in-IPv6 dont ::a.b.c.d), validate_url, host_is_literal_private_ip.
indara-jobs : PublicOnlyResolver (DNS public fixe, filtrage IP, pinning
anti-rebinding), build_fetch_client (redirections auto off), boucle de
redirection revalidant chaque hop (schéma/credentials/host + IP littérale),
classification fatale des hosts bloqués.
apps/server : fast-fail 400 à l'API (credentials, IP littérale privée).
charts/indara : NetworkPolicy + CiliumNetworkPolicy egress opt-in,
worker.fetchDns en source unique (env app + règles egress).
Config : INDARA_FETCH_DNS, INDARA_FETCH_MAX_REDIRECTS. README documenté.

Point de sécurité notable

La revue whole-branch a rattrapé un bypass critique : reqwest ne consulte le
résolveur custom que pour les hosts par nom, pas les IP littérales — donc un
302 vers une IP privée littérale contournait le garde. Corrigé par un check
host_is_literal_private_ip à chaque hop (worker autoritaire indép. de l'API),
avec test comportemental.

Vérification

cargo test --workspace vert, cargo build --workspace clean, helm template
(flags on/off) OK. Design & plan : docs/superpowers/specs|plans/2026-07-11-ssrf-*.

## Objet Ferme un SSRF exploitable : un utilisateur authentifié pouvait faire fetcher au worker n'importe quelle cible interne (loopback, RFC1918, metadata, services K8s…). Approche à la Discourse/Mastodon : garde applicatif primaire + couche réseau (NetworkPolicy/Cilium) en backstop opt-in. ## Changements - `indara-core::net` : `is_public_ip` (plages privées/réservées + dé-mapping IPv4-in-IPv6 dont `::a.b.c.d`), `validate_url`, `host_is_literal_private_ip`. - `indara-jobs` : `PublicOnlyResolver` (DNS public fixe, filtrage IP, pinning anti-rebinding), `build_fetch_client` (redirections auto off), boucle de redirection revalidant chaque hop (schéma/credentials/host + IP littérale), classification fatale des hosts bloqués. - `apps/server` : fast-fail 400 à l'API (credentials, IP littérale privée). - `charts/indara` : NetworkPolicy + CiliumNetworkPolicy egress opt-in, `worker.fetchDns` en source unique (env app + règles egress). - Config : `INDARA_FETCH_DNS`, `INDARA_FETCH_MAX_REDIRECTS`. README documenté. ## Point de sécurité notable La revue whole-branch a rattrapé un bypass critique : reqwest ne consulte le résolveur custom que pour les hosts par nom, pas les IP littérales — donc un `302` vers une IP privée littérale contournait le garde. Corrigé par un check `host_is_literal_private_ip` à chaque hop (worker autoritaire indép. de l'API), avec test comportemental. ## Vérification `cargo test --workspace` vert, `cargo build --workspace` clean, `helm template` (flags on/off) OK. Design & plan : `docs/superpowers/specs|plans/2026-07-11-ssrf-*`.

AzSiAz self-assigned this

2026-07-11 17:54:19 +02:00

AzSiAz added 13 commits

2026-07-11 17:54:19 +02:00

docs: add SSRF guard design spec 36f15ed0e2

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs: add SSRF guard implementation plan 7c2b11bdc6

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(core): add public-IP and URL validation helpers for SSRF guard 22568c42ca

feat(jobs): add public-only reqwest DNS resolver (SSRF guard) c99502e696

feat(core): add fetch DNS servers and max-redirects to WorkerConfig 556f776e76

feat(jobs): follow redirects manually and revalidate each hop f25ca77db9

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(jobs): mark blocked hosts and redirect loops as fatal fetch failures 4a49574090

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(worker): use SSRF-guarded fetch client with pinned public DNS 22b26d24b9

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(server): reject credentials and literal private IPs at the API 68a3b8a437

feat(chart): add egress NetworkPolicy and CiliumNetworkPolicy for the worker 1b6238995b

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs: document worker SSRF guard and egress options 570f803b4b

docs: translate SSRF guard README section to English 481fac8cdd

fix(jobs): block literal private-IP hops and close ::a.b.c.d gap (SSRF) 00406af49a

AzSiAz added 4 commits

2026-07-11 18:15:22 +02:00

test: add is_public_ip edge-case assertions (0/8 host, benchmarking/CGNAT edges, Teredo) 57d744727f

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

refactor: make is_blocked_address testable and preserve per-server DNS ports 648bf5661b

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix: precise redirect-target diagnostics and extract API url validation 4524b971bc

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix(jobs): handle 3xx without Location as fatal instead of panicking f6404b9f91

A redirect response with no Location header fell through to
classify_fetch_response, whose error path calls error_for_status_ref()
and expects a reqwest::Error — but that returns Ok for a 3xx, so
expect_err panicked. Now handled in the redirect loop as a fatal
BadRedirect, and classify_fetch_response no longer panics on an
unexpected non-final status.

AzSiAz merged commit 5e98b5c31d into main

2026-07-11 18:20:02 +02:00

AzSiAz referenced this pull request from a commit

2026-07-11 18:20:03 +02:00

Merge pull request 'feat: SSRF guard for the document-fetch worker' (#4) from feat/ssrf-guard into main

AzSiAz deleted branch feat/ssrf-guard

2026-07-11 18:20:14 +02:00