@sproutboat/wire 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @sproutboat/wire
 
+## 0.11.0
+
+### Minor Changes
+
+- 4dd16b7: `fetch()` reaches any public address and never a private or reserved one (baronunread/sproutboat#174). The `outbound` allowlist is gone.
+  
+  - Both backends, the broker and the standalone client, check the address they resolved, not the hostname, so DNS rebinding can't get past the check. The broker connects to the vetted address and verifies TLS against the name.
+  - Blocked: loopback, RFC 1918, link-local and cloud metadata, CGNAT, benchmarking, documentation, multicast and reserved ranges, IPv6 ULA and link-local, and the IPv4 address inside IPv4-mapped, NAT64 and 6to4 addresses.
+  - An operator can let addresses through with `SB_EGRESS_ALLOW` (`*` or exact addresses) in the broker's or the binary's environment. Handler code can't.
+  - `@sproutboat/runtime`: `URL.hostname` and `URL.port` handle IPv6 literals (`[::1]:9` used to give hostname `[`). Every sprout gets `fetch()`, with no binding needed. `validateHttpSyncSource` no longer takes an `outboundAllowed` argument, and `Bindings` loses `outbound`.
+  - `@sproutboat/wire`: `Bindings` loses `outbound`.
+  - `@sproutboat/config`: `outbound` is accepted but ignored, with a warning in the new `warnings` field of a successful parse (`OUTBOUND_IGNORED`). It will be refused in a later minor release.
+
+### Patch Changes
+
+- Updated dependencies [4dd16b7]
+  - @sproutboat/runtime@0.14.0
+
 ## 0.10.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/wire",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -11,7 +11,8 @@
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "dependencies": {
-    "@sproutboat/assets": "^0.3.0"
+    "@sproutboat/assets": "^0.3.0",
+    "@sproutboat/runtime": "^0.14.0"
   },
   "exports": {
     ".": "./src/index.ts",

package/src/broker.test.ts

@@ -29,7 +29,8 @@ afterEach(() => {
 });
 
 function make(opts: Parameters<typeof createBroker>[0] = {}): Broker {
-  const b = createBroker(opts);
+  // A public address, so fetch tests are about fetch and not about DNS (#174).
+  const b = createBroker({ resolveImpl: async () => [{ address: "93.184.216.34" }], ...opts });
   brokers.push(b);
   return b;
 }
@@ -151,20 +152,70 @@ test("secrets resolve only when both bound and present", async () => {
   await expect(b.dispatch({ op: "secret.get", name: "UNBOUND" })).rejects.toThrow("not bound");
 });
 
-test("fetch is gated by the exact-host allowlist", async () => {
+test("fetch reaches any public host, with no allowlist (#174)", async () => {
   const calls: string[] = [];
   const fetchImpl: FetchLike = async (url) => {
     calls.push(String(url));
     return new Response("body", { status: 200, headers: { "x-mark": "1" } });
   };
-  const b = make({ bindings: { outbound: ["api.example.com"] }, fetchImpl });
-
-  await expect(b.dispatch({ op: "fetch", url: "https://evil.example.com/x" })).rejects.toThrow("allowlist");
-  expect(calls).toEqual([]);
+  const b = make({ fetchImpl });
 
+  await expect(b.dispatch({ op: "fetch", url: "ftp://api.example.com/x" })).rejects.toThrow("unsupported protocol");
   const res = await b.dispatch({ op: "fetch", url: "https://api.example.com/x" });
   expect(res).toMatchObject({ ok: true, status: 200, body: "body" });
-  expect(calls).toEqual(["https://api.example.com/x"]);
+  expect(calls).toEqual(["https://93.184.216.34/x"]);
+});
+
+test("#174: fetch never connects to a private address, whatever the name says", async () => {
+  const calls: string[] = [];
+  const fetchImpl: FetchLike = async (url) => {
+    calls.push(String(url));
+    return new Response("ok");
+  };
+  const resolving = (addresses: string[]) => async () => addresses.map((address) => ({ address }));
+
+  // A public-looking name that resolves somewhere private is refused before connect.
+  for (const address of ["127.0.0.1", "169.254.169.254", "10.0.0.7", "::1", "64:ff9b::7f00:1"]) {
+    const b = make({ fetchImpl, resolveImpl: resolving([address]), egressAllow: [] });
+    await expect(b.dispatch({ op: "fetch", url: "https://api.example.com/x" })).rejects.toThrow(
+      `api.example.com resolves to ${address}, a private or reserved address`,
+    );
+  }
+  expect(calls).toEqual([]);
+
+  // A mixed answer connects to the public address, not the first one.
+  const mixed = make({ fetchImpl, resolveImpl: resolving(["10.0.0.7", "2606:4700::1111"]), egressAllow: [] });
+  await mixed.dispatch({ op: "fetch", url: "https://api.example.com/x" });
+  expect(calls).toEqual(["https://[2606:4700::1111]/x"]);
+
+  // The operator, not the handler, can let one address through.
+  const allowed = make({ fetchImpl, resolveImpl: resolving(["10.0.0.7"]), egressAllow: ["10.0.0.7"] });
+  expect(await allowed.dispatch({ op: "fetch", url: "https://api.example.com/x" })).toMatchObject({ status: 200 });
+});
+
+test("#174: the pinned connection still sends the name as Host and verifies TLS against it", async () => {
+  const inits: RequestInit[] = [];
+  const fetchImpl: FetchLike = async (_url, init) => {
+    inits.push(init ?? {});
+    return new Response("ok");
+  };
+  const b = make({ fetchImpl });
+  await b.dispatch({ op: "fetch", url: "https://api.example.com/x" });
+  expect(new Headers(inits[0].headers).get("host")).toBe("api.example.com");
+  expect(inits[0]).toMatchObject({ tls: { serverName: "api.example.com" } });
+});
+
+test("#174: a real request reaches an allowed local upstream through the pinned address", async () => {
+  const upstream = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: (req) => new Response(req.headers.get("host")) });
+  try {
+    const host = `localhost:${upstream.port}`;
+    const b = make({ resolveImpl: undefined, egressAllow: ["127.0.0.1"] });
+    expect(await b.dispatch({ op: "fetch", url: `http://${host}/` })).toMatchObject({ status: 200, body: host });
+    const blocked = make({ resolveImpl: undefined, egressAllow: [] });
+    await expect(blocked.dispatch({ op: "fetch", url: `http://${host}/` })).rejects.toThrow("SB_EGRESS_ALLOW=");
+  } finally {
+    upstream.stop(true);
+  }
 });
 
 test("#232: a binary fetch request body is sent as its bytes, a text body as UTF-8", async () => {
@@ -173,7 +224,7 @@ test("#232: a binary fetch request body is sent as its bytes, a text body as UTF
     seen.push(new Uint8Array(await new Response(init?.body).arrayBuffer()));
     return new Response("ok");
   };
-  const b = make({ bindings: { outbound: ["api.example.com"] }, fetchImpl });
+  const b = make({ fetchImpl });
   // The runtime sends a binary body one char per byte, flagged bodyBinary.
   const raw = Array.from({ length: 256 }, (_, i) => String.fromCharCode(i)).join("");
   await b.dispatch({ op: "fetch", url: "https://api.example.com/up", method: "POST", body: raw, bodyBinary: true });
@@ -186,7 +237,7 @@ test("#232: a v1 fetch returns the upstream body as raw bytes; v0 keeps decoded
   const binary = Uint8Array.from({ length: 256 }, (_, i) => i);
   const fetchImpl: FetchLike = async (url) =>
     new Response(String(url).endsWith("/bin") ? binary : "café", { status: 200 });
-  const b = make({ bindings: { outbound: ["api.example.com"] }, fetchImpl });
+  const b = make({ fetchImpl });
 
   const raw = decodeV1Frame(
     await b.handleFrame(encodeV1({ v: 1, token: "tok", op: "fetch", url: "https://api.example.com/bin" })),
@@ -1111,21 +1162,21 @@ test("service: declared but not deployed says so, instead of a bare 502", async
   );
 });
 
-test("service: a call is not subject to the outbound allowlist", async () => {
-  // The target is reached internally through the edge, so a project with no
-  // `outbound` hosts can still call a service binding.
+test("service: a call reaches the edge on loopback, which plain fetch() may not", async () => {
+  // The target is reached internally through the edge, so the private-address
+  // block (#174) does not apply to it.
   const fetchImpl: FetchLike = async () => new Response("ok", { status: 200 });
   const b = make({
-    bindings: { ...svcBindings, outbound: [] },
+    bindings: svcBindings,
     services: { AUTH: "auth-api.andrea.example.com" },
     edgeUrl: "http://127.0.0.1:8080/",
     fetchImpl,
+    resolveImpl: async () => [{ address: "127.0.0.1" }],
+    egressAllow: [],
   });
   expect((await b.dispatch({ op: "service.fetch", binding: "AUTH", url: "https://service/" })).status).toBe(200);
-  // ...while real egress to the same host is still refused.
-  await expect(b.dispatch({ op: "fetch", url: "https://auth-api.andrea.example.com/" })).rejects.toThrow(
-    /outbound allowlist/,
-  );
+  // ...while real egress to the same place is refused.
+  await expect(b.dispatch({ op: "fetch", url: "http://127.0.0.1:8080/" })).rejects.toThrow("private or reserved");
 });
 
 // --- v1 frames (#63) --------------------------------------------------------

package/src/broker.ts

@@ -13,9 +13,9 @@
  *   reply payload   : "<json>"
  *
  * ponytail: one SQLite file for KV, secrets from a plain JSON file, fetch
- * allowlisted by exact host. Encryption at rest, per-key TTLs, redirect
- * re-validation and private-IP blocking are v2 — the exact-host allowlist is
- * the only SSRF control today.
+ * to any public address, never a private one (#174).
+ * Encryption at rest and per-key TTLs are v2; redirects are never followed,
+ * so there is nothing to re-validate.
  */
 import { Database, type Statement } from "bun:sqlite";
 import { createHash, randomBytes } from "node:crypto";
@@ -24,13 +24,15 @@ import { open } from "node:fs/promises";
 import { dirname, join, normalize, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { resolveAssetKey, type AssetManifest } from "@sproutboat/assets";
+import { egressAllowList, egressRefusal } from "@sproutboat/runtime";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import { isSafeInteger } from "./json";
 import { isBoolean, isString, jsonObject, parseJsonValue, type JsonObject, type JsonValue } from "./json";
 
 export type Bindings = {
   kv: string[];
   secrets: string[];
-  outbound: string[];
   d1: string[];
   r2: string[];
   queues: string[];
@@ -117,6 +119,11 @@ export type BrokerOptions = {
   assetsDir?: string;
   /** Injected in tests; defaults to the global `fetch`. */
   fetchImpl?: FetchLike;
+  /** Injected in tests; defaults to `dns.lookup` with every address. */
+  resolveImpl?: (hostname: string) => Promise<Array<{ address: string }>>;
+  /** #174 — private addresses `fetch()` may reach anyway. Defaults to
+   *  `SB_EGRESS_ALLOW` (`*` or comma-separated exact addresses). */
+  egressAllow?: string[];
 };
 
 type SqlParam = string | number | null;
@@ -214,7 +221,6 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   const bindings: Bindings = {
     kv: [],
     secrets: [],
-    outbound: [],
     d1: [],
     r2: [],
     queues: [],
@@ -255,6 +261,8 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   const replayed = new Map<string, Frame>();
   const serviceHosts = opts.services ?? {};
   const doFetch = opts.fetchImpl ?? fetch;
+  const resolveHost = opts.resolveImpl ?? ((hostname: string) => lookup(hostname, { all: true }));
+  const egressAllow = opts.egressAllow ?? egressAllowList(process.env.SB_EGRESS_ALLOW);
 
   const dbPath = opts.db ?? ":memory:";
   const inMemory = dbPath === ":memory:" || dbPath === "";
@@ -1129,7 +1137,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
    *
    * The size is the remote host's choice, and the body is held whole: measured
    * on a standalone binary, a 100 MB response took resident memory from 43 MB
-   * to 321 MB. One allowlisted upstream having a bad day should not be able to
+   * to 321 MB. One upstream having a bad day should not be able to
    * end the process. 32 MiB by default, and the same variable the embedded
    * transport reads so both backends agree.
    */
@@ -1179,7 +1187,6 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
       throw new Error(`invalid url: ${str(msg.url)}`);
     }
     if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`unsupported protocol: ${url.protocol}`);
-    if (!bindings.outbound.includes(url.host)) throw new Error(`host not in outbound allowlist: ${url.host}`);
 
     const headers = new Headers();
     if (Array.isArray(msg.headers)) {
@@ -1187,13 +1194,37 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
         if (Array.isArray(pair) && pair.length === 2) headers.set(str(pair[0]), str(pair[1]));
       }
     }
+    // #174 — resolve, vet every address, then connect to the vetted one, never
+    // the name: handing the name to fetch() would resolve it again, and DNS
+    // rebinding lives in that gap. TLS still verifies against the name.
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    let addresses: Array<{ address: string }>;
+    try {
+      addresses = await resolveHost(hostname);
+    } catch {
+      throw new Error(`could not resolve ${url.hostname}`);
+    }
+    let refusal: string | null = null;
+    const vetted = addresses.find(({ address }) => {
+      const why = egressRefusal(url.hostname, address, egressAllow);
+      refusal ??= why;
+      return why === null;
+    });
+    if (!vetted) throw new Error(refusal ?? `could not resolve ${url.hostname}`);
+    const pinned = new URL(url);
+    pinned.hostname = isIP(vetted.address) === 6 ? `[${vetted.address}]` : vetted.address;
+    headers.set("host", url.host);
+
     const method = str(msg.method || "GET").toUpperCase();
-    const res = await doFetch(url, {
+    const init: RequestInit & { tls?: { serverName: string } } = {
       method,
       headers,
       body: method === "GET" || method === "HEAD" ? undefined : upstreamBody(msg),
       redirect: "manual",
-    });
+    };
+    // Bun's TLS option: SNI and certificate checks against the name, not the address.
+    if (url.protocol === "https:" && !isIP(hostname)) init.tls = { serverName: hostname };
+    const res = await doFetch(pinned, init);
     const outHeaders: Array<[string, string]> = [];
     res.headers.forEach((v, k) => outHeaders.push([k, v]));
     return { reply: { ok: true, status: res.status, headers: outHeaders }, bytes: await readCapped(res, url.host) };