restrict report generation egress, disable browser telemetry and escape recipient data

Signed-off-by: RonniSkansing <rskansing@gmail.com>

backend/remotebrowser/ssrfproxy.go

@@ -0,0 +1,356 @@
+package remotebrowser
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"sync/atomic"
+	"syscall"
+	"time"
+)
+
+// The report PDF renderer runs a headless browser over operator authored report
+// templates that may embed arbitrary external resources (images, scripts, styles).
+// Those resources are fetched by the browser, so without a guard an injected or
+// operator supplied URL pointing at an internal address turns the render into a
+// server side request forgery against loopback, link local metadata, or private
+// networks.
+//
+// guardedProxy is a small forward proxy the report browser is pointed at. It
+// permits arbitrary public destinations but refuses any request whose target
+// resolves to an internal address. It resolves the host and connects to that
+// exact resolved address in one step, so a DNS record that flips to an internal
+// address between resolution and connect (rebinding) cannot move the connection
+// onto an internal host. It fails closed: any resolution or dial problem blocks
+// the request rather than letting it through.
+//
+// The browser must also be started with proxy bypass for loopback removed, or it
+// connects to loopback and link local metadata directly, skipping this guard.
+type guardedProxy struct {
+	ln        net.Listener
+	srv       *http.Server
+	transport *http.Transport
+	blocked   atomic.Int64 // requests refused by policy (observability and tests)
+}
+
+// blockedCIDRs are ranges that must never be reached from the report browser.
+// This is an explicit deny list layered on top of the IsGlobalUnicast allowlist
+// in isInternalIP, covering reserved and special use ranges that are still
+// classified as global unicast (RFC1918 and the reserved v4/v6 blocks below).
+var blockedCIDRs = parseCIDRs(
+	// IPv4
+	"0.0.0.0/8",          // this host on this network
+	"10.0.0.0/8",         // private
+	"100.64.0.0/10",      // carrier grade NAT (some metadata services)
+	"127.0.0.0/8",        // loopback
+	"169.254.0.0/16",     // link local incl 169.254.169.254 metadata
+	"172.16.0.0/12",      // private
+	"192.0.0.0/24",       // IETF protocol assignments incl 192.0.0.170 NAT64 discovery
+	"192.168.0.0/16",     // private
+	"198.18.0.0/15",      // benchmarking
+	"240.0.0.0/4",        // reserved
+	"255.255.255.255/32", // limited broadcast
+	"192.88.99.0/24", // 6to4 relay anycast
+	// IPv6
+	"::1/128",      // loopback
+	"::/128",       // unspecified
+	"64:ff9b::/96", // NAT64
+	"2001::/32",    // Teredo (a v4 in v6 transition range, unused for content)
+	"fc00::/7",     // unique local
+	"fe80::/10",    // link local
+	"fec0::/10",    // deprecated site local
+)
+
+func parseCIDRs(cidrs ...string) []*net.IPNet {
+	out := make([]*net.IPNet, 0, len(cidrs))
+	for _, c := range cidrs {
+		_, n, err := net.ParseCIDR(c)
+		if err == nil {
+			out = append(out, n)
+		}
+	}
+	return out
+}
+
+// isInternalIP reports whether an address must never be reached from the report
+// browser. It is deny by default: only global unicast public addresses are
+// allowed. Unknown or unparsable addresses are treated as internal so the caller
+// fails closed. IPv6 forms that embed an IPv4 address (mapped, 6to4, NAT64, and
+// the deprecated v4 compatible form) are unwrapped so an internal v4 target
+// cannot be smuggled inside a v6 address.
+func isInternalIP(ip net.IP) bool {
+	if ip == nil {
+		return true
+	}
+	if v4 := ip.To4(); v4 != nil {
+		ip = v4
+	}
+	if len(ip) == net.IPv6len {
+		if embedded := embeddedV4(ip); embedded != nil && isInternalIP(embedded) {
+			return true
+		}
+	}
+	// deny anything that is not a global unicast address: loopback, link local,
+	// unspecified, multicast, and broadcast all fall here.
+	if !ip.IsGlobalUnicast() {
+		return true
+	}
+	for _, n := range blockedCIDRs {
+		if n.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// embeddedV4 returns the IPv4 address wrapped inside a v6 6to4, NAT64, or v4
+// compatible address, or nil if none is embedded. IPv4 mapped addresses are
+// already handled by To4 in the caller.
+func embeddedV4(ip net.IP) net.IP {
+	if len(ip) != net.IPv6len {
+		return nil
+	}
+	// 6to4 2002:AABB:CCDD::/16
+	if ip[0] == 0x20 && ip[1] == 0x02 {
+		return net.IPv4(ip[2], ip[3], ip[4], ip[5])
+	}
+	// NAT64 64:ff9b::/96
+	if ip[0] == 0x00 && ip[1] == 0x64 && ip[2] == 0xff && ip[3] == 0x9b {
+		return net.IPv4(ip[12], ip[13], ip[14], ip[15])
+	}
+	// deprecated IPv4 compatible ::a.b.c.d (first 12 bytes zero, not the
+	// unspecified or loopback addresses)
+	for i := 0; i < 12; i++ {
+		if ip[i] != 0 {
+			return nil
+		}
+	}
+	if ip[12] == 0 && ip[13] == 0 && ip[14] == 0 && (ip[15] == 0 || ip[15] == 1) {
+		return nil
+	}
+	return net.IPv4(ip[12], ip[13], ip[14], ip[15])
+}
+
+// dialGuarded resolves the host in addr, selects a public address, and connects
+// to that exact address. If no resolved address is public it returns an error and
+// no connection is made.
+func dialGuarded(ctx context.Context, network, addr string) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		// malformed target, not a policy decision: fail closed but do not label it a block.
+		return nil, &net.OpError{Op: "dial", Err: errUnresolvable}
+	}
+	var candidates []net.IP
+	if literal := net.ParseIP(host); literal != nil {
+		candidates = []net.IP{literal}
+	} else {
+		resolver := &net.Resolver{}
+		ips, resErr := resolver.LookupIP(ctx, "ip", host)
+		if resErr != nil {
+			// could not resolve, not a policy decision: fail closed, do not count as a block.
+			return nil, &net.OpError{Op: "dial", Err: errUnresolvable}
+		}
+		candidates = ips
+	}
+	for _, ip := range candidates {
+		if isInternalIP(ip) {
+			continue
+		}
+		d := net.Dialer{
+			Timeout: 8 * time.Second,
+			// recheck the concrete address at connect time as a second layer.
+			Control: func(_, address string, _ syscall.RawConn) error {
+				h, _, _ := net.SplitHostPort(address)
+				if isInternalIP(net.ParseIP(h)) {
+					return errBlocked
+				}
+				return nil
+			},
+		}
+		return d.DialContext(ctx, "tcp", net.JoinHostPort(ip.String(), port))
+	}
+	return nil, &net.OpError{Op: "dial", Err: errBlocked}
+}
+
+// errBlocked marks a destination refused by policy (its address is internal).
+// errUnresolvable marks a target that could not be parsed or resolved: also fails
+// closed, but is reported as an upstream error rather than a policy block so the
+// blocked counter and the 403 response mean only genuine internal refusals.
+var (
+	errBlocked      = blockedError("destination blocked by report render policy")
+	errUnresolvable = blockedError("destination could not be resolved")
+)
+
+type blockedError string
+
+func (e blockedError) Error() string { return string(e) }
+
+// startGuardedProxy starts the proxy on an ephemeral loopback port.
+func startGuardedProxy() (*guardedProxy, error) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, err
+	}
+	p := &guardedProxy{
+		ln: ln,
+		transport: &http.Transport{
+			DialContext:           dialGuarded,
+			ForceAttemptHTTP2:     false,
+			MaxIdleConns:          32,
+			IdleConnTimeout:       20 * time.Second,
+			TLSHandshakeTimeout:   8 * time.Second,
+			ResponseHeaderTimeout: 15 * time.Second,
+		},
+	}
+	p.srv = &http.Server{
+		Handler:           p,
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+	go func() { _ = p.srv.Serve(ln) }()
+	return p, nil
+}
+
+// addr is the host:port the browser must be pointed at.
+func (p *guardedProxy) addr() string { return p.ln.Addr().String() }
+
+func (p *guardedProxy) close() {
+	_ = p.srv.Close()
+	p.transport.CloseIdleConnections()
+}
+
+// blockedRequests is the number of requests refused by policy so far.
+func (p *guardedProxy) blockedRequests() int64 { return p.blocked.Load() }
+
+// hopByHopHeaders are removed before forwarding in either direction per RFC 7230.
+var hopByHopHeaders = []string{
+	"Connection", "Proxy-Connection", "Keep-Alive", "Proxy-Authenticate",
+	"Proxy-Authorization", "Te", "Trailer", "Transfer-Encoding", "Upgrade",
+}
+
+func removeHopByHop(h http.Header) {
+	for _, k := range hopByHopHeaders {
+		h.Del(k)
+	}
+}
+
+func (p *guardedProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodConnect {
+		p.handleConnect(w, r)
+		return
+	}
+	if !r.URL.IsAbs() {
+		http.Error(w, "proxy requires absolute URI", http.StatusBadRequest)
+		return
+	}
+	out := r.Clone(r.Context())
+	out.RequestURI = ""
+	removeHopByHop(out.Header)
+	resp, err := p.transport.RoundTrip(out)
+	if err != nil {
+		if errors.Is(err, errBlocked) {
+			p.blocked.Add(1)
+			http.Error(w, "blocked by policy", http.StatusForbidden)
+		} else {
+			http.Error(w, "upstream error", http.StatusBadGateway)
+		}
+		return
+	}
+	defer resp.Body.Close()
+	removeHopByHop(resp.Header)
+	for k, vs := range resp.Header {
+		for _, v := range vs {
+			w.Header().Add(k, v)
+		}
+	}
+	w.WriteHeader(resp.StatusCode)
+	_, _ = io.Copy(w, resp.Body) // stream, never buffer whole bodies
+}
+
+// tunnelIdleTimeout bounds how long a CONNECT tunnel may sit with no data before
+// it is torn down, so a slow or idle peer cannot hold a connection and goroutine
+// indefinitely.
+const tunnelIdleTimeout = 30 * time.Second
+
+// handleConnect gates and tunnels a CONNECT (used for https). The target host is
+// resolved and pinned by dialGuarded; the tunnel then streams opaque bytes.
+func (p *guardedProxy) handleConnect(w http.ResponseWriter, r *http.Request) {
+	upstream, err := dialGuarded(r.Context(), "tcp", r.Host)
+	if err != nil {
+		if errors.Is(err, errBlocked) {
+			p.blocked.Add(1)
+			http.Error(w, "blocked by policy", http.StatusForbidden)
+		} else {
+			http.Error(w, "upstream error", http.StatusBadGateway)
+		}
+		return
+	}
+	hij, ok := w.(http.Hijacker)
+	if !ok {
+		_ = upstream.Close()
+		http.Error(w, "no hijack", http.StatusInternalServerError)
+		return
+	}
+	client, _, err := hij.Hijack()
+	if err != nil {
+		_ = upstream.Close()
+		return
+	}
+	_, _ = client.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
+	tunnelPipe(client, upstream)
+}
+
+// tunnelPipe streams bytes both ways between a CONNECT client and its upstream.
+// It tears the tunnel down only after the whole tunnel has been idle (no data in
+// either direction) for tunnelIdleTimeout, so a legitimate one directional
+// transfer such as a large download is never killed while it is still
+// progressing, while an idle tunnel cannot hold a connection open forever.
+func tunnelPipe(client, upstream net.Conn) {
+	var lastActivity atomic.Int64
+	lastActivity.Store(time.Now().UnixNano())
+	stop := make(chan struct{})
+
+	go func() {
+		ticker := time.NewTicker(tunnelIdleTimeout / 3)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-stop:
+				return
+			case <-ticker.C:
+				if time.Since(time.Unix(0, lastActivity.Load())) >= tunnelIdleTimeout {
+					_ = client.Close()
+					_ = upstream.Close()
+					return
+				}
+			}
+		}
+	}()
+
+	pipe := func(dst, src net.Conn) {
+		buf := make([]byte, 32*1024)
+		for {
+			n, err := src.Read(buf)
+			if n > 0 {
+				lastActivity.Store(time.Now().UnixNano())
+				if _, werr := dst.Write(buf[:n]); werr != nil {
+					return
+				}
+			}
+			if err != nil {
+				return
+			}
+		}
+	}
+
+	go func() {
+		pipe(upstream, client)
+		_ = client.Close()
+		_ = upstream.Close()
+	}()
+	pipe(client, upstream)
+	_ = client.Close()
+	_ = upstream.Close()
+	close(stop)
+}