diff --git a/Cargo.lock b/Cargo.lock index 409b67bf1..7be1a185b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9604,6 +9604,7 @@ dependencies = [ "tokio", "tower", "tracing", + "url", ] [[package]] diff --git a/crates/ecstore/src/bucket/bucket_target_sys.rs b/crates/ecstore/src/bucket/bucket_target_sys.rs index 5b1c53aeb..b6ae0ccfb 100644 --- a/crates/ecstore/src/bucket/bucket_target_sys.rs +++ b/crates/ecstore/src/bucket/bucket_target_sys.rs @@ -41,6 +41,7 @@ use http::{HeaderMap, HeaderName, HeaderValue, StatusCode}; use reqwest::Client as HttpClient; use rustfs_config::{DEFAULT_TRUST_LEAF_CERT_AS_CA, ENV_TRUST_LEAF_CERT_AS_CA, RUSTFS_CA_CERT, RUSTFS_TLS_CERT}; use rustfs_filemeta::{ReplicationStatusType, ReplicationType}; +use rustfs_utils::egress::validate_outbound_url; use rustfs_utils::http::{ AMZ_BUCKET_REPLICATION_STATUS, AMZ_OBJECT_LOCK_BYPASS_GOVERNANCE, AMZ_OBJECT_LOCK_LEGAL_HOLD, AMZ_OBJECT_LOCK_MODE, AMZ_OBJECT_LOCK_RETAIN_UNTIL_DATE, AMZ_STORAGE_CLASS, AMZ_WEBSITE_REDIRECT_LOCATION, is_amz_header, is_minio_header, @@ -646,6 +647,16 @@ impl BucketTargetSys { } else { format!("http://{}", target.endpoint) }; + let parsed_endpoint = Url::parse(&endpoint).map_err(|err| BucketTargetError::RemoteTargetConnectionErr { + bucket: target.target_bucket.clone(), + access_key: credentials.access_key.clone(), + error: format!("invalid target endpoint: {err}"), + })?; + validate_outbound_url(&parsed_endpoint).map_err(|err| BucketTargetError::RemoteTargetConnectionErr { + bucket: target.target_bucket.clone(), + access_key: credentials.access_key.clone(), + error: format!("target endpoint is not allowed: {err}"), + })?; let mut config_builder = S3Config::builder() .endpoint_url(endpoint.clone()) @@ -1640,4 +1651,27 @@ mod tests { "delete-marker version purges must not masquerade as delete-marker creations" ); } + + #[tokio::test] + async fn get_remote_target_client_internal_rejects_loopback_endpoint() { + let sys = BucketTargetSys::default(); + let err = sys + .get_remote_target_client_internal(&BucketTarget { + endpoint: "127.0.0.1:9000".to_string(), + secure: true, + target_bucket: "bucket".to_string(), + region: "us-east-1".to_string(), + credentials: Some(Credentials { + access_key: "access".to_string(), + secret_key: "secret".to_string(), + session_token: None, + expiration: None, + }), + ..Default::default() + }) + .await + .expect_err("loopback endpoint should be rejected"); + + assert!(err.to_string().contains("not allowed")); + } } diff --git a/crates/ecstore/src/tier/warm_backend_s3.rs b/crates/ecstore/src/tier/warm_backend_s3.rs index dd9eb61f8..5dd46a222 100644 --- a/crates/ecstore/src/tier/warm_backend_s3.rs +++ b/crates/ecstore/src/tier/warm_backend_s3.rs @@ -36,6 +36,7 @@ use crate::tier::{ tier_config::TierS3, warm_backend::{WarmBackend, WarmBackendGetOpts, build_transition_put_options}, }; +use rustfs_utils::egress::validate_outbound_url; use rustfs_utils::path::SLASH_SEPARATOR; pub struct WarmBackendS3 { @@ -54,6 +55,7 @@ impl WarmBackendS3 { return Err(std::io::Error::other(err.to_string())); } }; + validate_outbound_url(&u).map_err(|err| std::io::Error::other(format!("tier endpoint is not allowed: {err}")))?; if conf.aws_role_web_identity_token_file == "" && conf.aws_role_arn != "" || conf.aws_role_web_identity_token_file != "" && conf.aws_role_arn == "" @@ -120,6 +122,28 @@ impl WarmBackendS3 { } } +#[cfg(test)] +mod tests { + use super::*; + + #[tokio::test] + async fn new_rejects_loopback_endpoint_before_network_setup() { + let conf = TierS3 { + endpoint: "https://127.0.0.1:9000".to_string(), + bucket: "tier-bucket".to_string(), + access_key: "access".to_string(), + secret_key: "secret".to_string(), + region: "us-east-1".to_string(), + ..Default::default() + }; + + match WarmBackendS3::new(&conf, "tier").await { + Ok(_) => panic!("loopback endpoint should be rejected"), + Err(err) => assert!(err.to_string().contains("not allowed")), + } + } +} + #[async_trait::async_trait] impl WarmBackend for WarmBackendS3 { async fn put_with_meta( diff --git a/crates/keystone/Cargo.toml b/crates/keystone/Cargo.toml index e43b26777..83833ddaa 100644 --- a/crates/keystone/Cargo.toml +++ b/crates/keystone/Cargo.toml @@ -36,7 +36,8 @@ time = { workspace = true } moka = { workspace = true } rustfs-credentials = { workspace = true } rustfs-policy = { workspace = true } -rustfs-utils = { workspace = true } +rustfs-utils = { workspace = true, features = ["egress"] } +url = { workspace = true } # Middleware dependencies tower = { workspace = true } http = { workspace = true } diff --git a/crates/keystone/src/config.rs b/crates/keystone/src/config.rs index 9f69532cb..85f06686c 100644 --- a/crates/keystone/src/config.rs +++ b/crates/keystone/src/config.rs @@ -13,9 +13,11 @@ // limitations under the License. use crate::{KeystoneError, KeystoneVersion, Result}; +use rustfs_utils::egress::validate_outbound_url; use rustfs_utils::{get_env_bool, get_env_opt_str, get_env_str, get_env_u64}; use serde::{Deserialize, Serialize}; use std::time::Duration; +use url::Url; /// Keystone integration configuration #[derive(Debug, Clone, Serialize, Deserialize)] @@ -164,6 +166,9 @@ impl KeystoneConfig { return Err(KeystoneError::ConfigError("auth_url is required".to_string())); } + let parsed = Url::parse(&self.auth_url).map_err(|err| KeystoneError::ConfigError(format!("invalid auth_url: {err}")))?; + validate_outbound_url(&parsed).map_err(|err| KeystoneError::ConfigError(format!("auth_url is not allowed: {err}")))?; + // Validate version self.get_version()?; @@ -266,4 +271,16 @@ mod tests { }, ); } + + #[test] + fn test_validate_rejects_loopback_auth_url() { + let config = KeystoneConfig { + enable: true, + auth_url: "https://127.0.0.1:5000".to_string(), + ..Default::default() + }; + + let err = config.validate().expect_err("loopback auth_url should be rejected"); + assert!(err.to_string().contains("not allowed")); + } }