ms2k/remora
SHA256
Watch
0
Code Releases Activity

Close outbound credential and metadata bypasses

Browse source
This commit is contained in:
ms2k 2026-07-17 03:41:43 +09:00
commit c4402985af
1 changed files with 194 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

17
crates/remora-outbound/src/policy.rs
View file

@ -7,9 +7,6 @@ use ipnet::IpNet;
use crate::{CanonicalUrl, OutboundError, Resolver};
const METADATA_V4: &str = "169.254.169.254";
const METADATA_V6: &str = "fd00:ec2::254";
#[derive(Clone, Debug)]
pub struct OutboundPolicy {
allowed_scheme_ports: HashSet<(String, u16)>,
@ -75,7 +72,7 @@ impl OutboundPolicy {
IpAddr::V6(address) => address.to_ipv4_mapped().map_or(address.into(), IpAddr::V4),
address => address,
};
if effective.to_string() == METADATA_V4 || effective.to_string() == METADATA_V6 {
if is_metadata_capable_space(effective) {
return false;
}
if self
@ -158,6 +155,18 @@ fn is_global_unicast(address: IpAddr) -> bool {
}
}
fn is_metadata_capable_space(address: IpAddr) -> bool {
match address {
IpAddr::V4(address) => {
let [first, second, third, _] = address.octets();
(first == 100 && (64..=127).contains(&second))
|| (first == 169 && second == 254)
|| (first == 192 && second == 0 && third == 0)
}
IpAddr::V6(address) => address.segments()[0] & 0xfe00 == 0xfc00,
}
}
fn is_global_ipv4(address: Ipv4Addr) -> bool {
if address.is_unspecified()
|| address.is_loopback()