251 lines
8.2 KiB
Rust
251 lines
8.2 KiB
Rust
//! Explicit network ACLs. Peer IP is default; only the central explicit trusted-proxy policy may resolve a forwarded client IP.
|
|
use anyhow::{ensure, Context, Result};
|
|
use ipnet::IpNet;
|
|
use serde::{Deserialize, Serialize};
|
|
use std::net::IpAddr;
|
|
|
|
#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
|
|
#[serde(rename_all = "lowercase")]
|
|
pub enum Action {
|
|
Allow,
|
|
Deny,
|
|
}
|
|
fn deny() -> Action {
|
|
Action::Deny
|
|
}
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct Rule {
|
|
pub network: String,
|
|
pub action: Action,
|
|
}
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct Acl {
|
|
#[serde(default = "deny")]
|
|
pub default: Action,
|
|
#[serde(default)]
|
|
pub rules: Vec<Rule>,
|
|
}
|
|
#[derive(Debug, Clone)]
|
|
pub struct CompiledAcl {
|
|
default: Action,
|
|
rules: Vec<(IpNet, Action)>,
|
|
}
|
|
impl Acl {
|
|
pub fn compile(&self) -> Result<CompiledAcl> {
|
|
ensure!(self.rules.len() <= 128, "ACL supports at most 128 rules");
|
|
let mut rules = Vec::with_capacity(self.rules.len());
|
|
for rule in &self.rules {
|
|
ensure!(rule.network.len() <= 64, "ACL network is too long");
|
|
let network: IpNet = rule
|
|
.network
|
|
.parse()
|
|
.context("ACL requires an IPv4/IPv6 CIDR")?;
|
|
if let IpNet::V6(net) = network {
|
|
ensure!(
|
|
net.addr().to_ipv4_mapped().is_none(),
|
|
"use IPv4 CIDR instead of IPv4-mapped IPv6 in ACL rules"
|
|
);
|
|
}
|
|
rules.push((network, rule.action));
|
|
}
|
|
Ok(CompiledAcl {
|
|
default: self.default,
|
|
rules,
|
|
})
|
|
}
|
|
}
|
|
impl CompiledAcl {
|
|
/// Explicit deny beats all matching allow rules. Otherwise, allow or the default applies.
|
|
/// Host policy and route policy are both evaluated, so route allow cannot override host deny.
|
|
pub fn allows(&self, peer: IpAddr) -> bool {
|
|
let peer = match peer {
|
|
IpAddr::V6(v6) => v6.to_ipv4_mapped().map(IpAddr::V4).unwrap_or(peer),
|
|
_ => peer,
|
|
};
|
|
let mut allowed = false;
|
|
for (network, action) in &self.rules {
|
|
if network.contains(&peer) {
|
|
if *action == Action::Deny {
|
|
return false;
|
|
}
|
|
allowed = true;
|
|
}
|
|
}
|
|
allowed || self.default == Action::Allow
|
|
}
|
|
}
|
|
/// Validate the already-decoded routing representation used internally after
|
|
/// matching/rewriting. Encoded spaces from a valid request are literal spaces
|
|
/// at this stage; reserved separators, percent and dot-segment ambiguity stay
|
|
/// forbidden.
|
|
pub fn validate_decoded_routing_path(path: &str) -> Result<()> {
|
|
ensure!(
|
|
path.starts_with('/') && path.len() <= 8192,
|
|
"invalid path length or form"
|
|
);
|
|
ensure!(
|
|
!path
|
|
.bytes()
|
|
.any(|b| b < 32 || b == 127 || matches!(b, b'\\' | b'%' | b'?' | b'#' | b';')),
|
|
"invalid decoded path character"
|
|
);
|
|
ensure!(
|
|
!path.split('/').any(|part| part == "." || part == ".."),
|
|
"ambiguous path segments"
|
|
);
|
|
Ok(())
|
|
}
|
|
|
|
/// Routing/ACL use one decoded representation; upstream still receives the original path.
|
|
/// Reject encoded separators, percent (double decoding), controls, ambiguous dot segments,
|
|
/// matrix parameters and malformed UTF-8. Repeated literal separators are
|
|
/// collapsed for routing/ACL decisions (matching nginx's default merge_slashes
|
|
/// behavior), while the upstream request still retains its original target.
|
|
/// No silent fallback to a less-restrictive route.
|
|
pub fn routing_path(raw: &str) -> Result<String> {
|
|
ensure!(
|
|
raw.starts_with('/') && raw.len() <= 8192,
|
|
"invalid path length or form"
|
|
);
|
|
let mut out = Vec::with_capacity(raw.len());
|
|
let bytes = raw.as_bytes();
|
|
let mut index = 0;
|
|
while index < bytes.len() {
|
|
let b = bytes[index];
|
|
if b == b'%' {
|
|
ensure!(index + 2 < bytes.len(), "truncated path escape");
|
|
let digit = |value: u8| (value as char).to_digit(16).map(|v| v as u8);
|
|
let high = digit(bytes[index + 1]).context("invalid path escape")?;
|
|
let low = digit(bytes[index + 2]).context("invalid path escape")?;
|
|
let decoded = (high << 4) | low;
|
|
ensure!(
|
|
decoded >= 32
|
|
&& decoded != 127
|
|
&& !matches!(decoded, b'/' | b'\\' | b'%' | b'?' | b'#' | b';'),
|
|
"ambiguous encoded path character"
|
|
);
|
|
out.push(decoded);
|
|
index += 3;
|
|
} else {
|
|
ensure!(
|
|
b > 32 && b != 127 && !matches!(b, b'\\' | b'?' | b'#' | b';'),
|
|
"invalid path character"
|
|
);
|
|
if b != b'/' || out.last().copied() != Some(b'/') {
|
|
out.push(b);
|
|
}
|
|
index += 1;
|
|
}
|
|
}
|
|
let path = String::from_utf8(out).context("invalid path UTF-8")?;
|
|
ensure!(
|
|
!path.split('/').any(|part| part == "." || part == ".."),
|
|
"ambiguous path segments"
|
|
);
|
|
Ok(path)
|
|
}
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
#[test]
|
|
fn deny_overrides_allow_and_cidr_boundaries_hold() {
|
|
let acl = Acl {
|
|
default: Action::Deny,
|
|
rules: vec![
|
|
Rule {
|
|
network: "10.0.0.0/8".into(),
|
|
action: Action::Allow,
|
|
},
|
|
Rule {
|
|
network: "10.2.0.0/16".into(),
|
|
action: Action::Deny,
|
|
},
|
|
],
|
|
}
|
|
.compile()
|
|
.unwrap();
|
|
assert!(acl.allows("10.1.0.1".parse().unwrap()));
|
|
assert!(!acl.allows("10.2.3.4".parse().unwrap()));
|
|
assert!(!acl.allows("11.0.0.1".parse().unwrap()));
|
|
assert!(acl.allows("::ffff:10.1.0.1".parse().unwrap()));
|
|
}
|
|
#[test]
|
|
fn ipv6_and_invalid_networks() {
|
|
let acl = Acl {
|
|
default: Action::Deny,
|
|
rules: vec![Rule {
|
|
network: "fd00::/8".into(),
|
|
action: Action::Allow,
|
|
}],
|
|
}
|
|
.compile()
|
|
.unwrap();
|
|
assert!(acl.allows("fd00::1".parse().unwrap()));
|
|
assert!(!acl.allows("fe00::1".parse().unwrap()));
|
|
let bad = Acl {
|
|
default: Action::Allow,
|
|
rules: vec![Rule {
|
|
network: "not-cidr".into(),
|
|
action: Action::Allow,
|
|
}],
|
|
};
|
|
assert!(bad.compile().is_err());
|
|
}
|
|
#[test]
|
|
fn repeated_slashes_are_normalized_for_routing() {
|
|
assert_eq!(
|
|
routing_path("/static/js//events.js").unwrap(),
|
|
"/static/js/events.js"
|
|
);
|
|
for path in [
|
|
"/%2e%2e/secret",
|
|
"/a/%2E%2E/b",
|
|
"/a%2fb",
|
|
"/a%5cb",
|
|
"/bad%",
|
|
"/bad%2",
|
|
] {
|
|
assert!(routing_path(path).is_err(), "{path}");
|
|
}
|
|
assert_eq!(routing_path("//admin///users").unwrap(), "/admin/users");
|
|
}
|
|
#[test]
|
|
fn decoded_rewrite_paths_keep_encoded_spaces_but_reject_ambiguity() {
|
|
assert!(validate_decoded_routing_path("/Ubuntu 14.04 LTS/").is_ok());
|
|
for path in ["/a/../b", "/a%2fb", "/a;b", "/a?b", "/a\\b"] {
|
|
assert!(validate_decoded_routing_path(path).is_err(), "{path}");
|
|
}
|
|
}
|
|
#[test]
|
|
fn paths_cannot_escape_a_restricted_prefix() {
|
|
assert_eq!(routing_path("/%61dmin/users").unwrap(), "/admin/users");
|
|
assert_eq!(routing_path("/caf%C3%A9").unwrap(), "/caf\u{e9}");
|
|
assert_eq!(
|
|
routing_path("/Ubuntu%2014.04%20LTS/").unwrap(),
|
|
"/Ubuntu 14.04 LTS/"
|
|
);
|
|
assert_eq!(
|
|
routing_path("/static/js//events.js").unwrap(),
|
|
"/static/js/events.js"
|
|
);
|
|
assert_eq!(routing_path("//admin///users").unwrap(), "/admin/users");
|
|
for path in [
|
|
"/api/../admin",
|
|
"/api/%2e%2e/admin",
|
|
"/%2fadmin",
|
|
"/%5cadmin",
|
|
"/%2561dmin",
|
|
"/%00",
|
|
"/%ff",
|
|
"/%q0",
|
|
"/a\\b",
|
|
"/admin;session=x",
|
|
"/admin%3buser=x",
|
|
] {
|
|
assert!(routing_path(path).is_err(), "{path}");
|
|
}
|
|
}
|
|
}
|