ms2k/remora
SHA256
Watch
0
Code Releases Activity

Close outbound credential and metadata bypasses

Browse source
This commit is contained in:
ms2k 2026-07-17 03:41:43 +09:00
commit c4402985af
1 changed files with 194 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

28
crates/remora-outbound/tests/policy.rs
View file

@ -7,7 +7,7 @@ use std::{
use ipnet::IpNet;
use remora_outbound::{
CanonicalUrl, OutboundError, OutboundPolicy, OutboundPolicyBuilder, Resolver,
CanonicalUrl, OutboundError, OutboundPolicy, OutboundPolicyBuilder, Resolver, SystemResolver,
};
#[derive(Clone, Default)]
@ -163,7 +163,18 @@ async fn allowlists_never_override_metadata_denial() {
authorize_literal(&policy, "10.1.2.3")
.await
.expect("allowlisted private address");
for address in ["169.254.169.254", "fd00:ec2::254", "::ffff:169.254.169.254"] {
for address in [
"169.254.169.254",
"169.254.170.2",
"169.254.0.23",
"::ffff:169.254.170.2",
"100.100.100.200",
"::ffff:100.100.100.200",
"192.0.0.192",
"fd00:ec2::254",
"fd20:ce::254",
"fd00:db8:deca:deed::fe",
] {
assert_eq!(
authorize_literal(&policy, address).await,
Err(OutboundError::AddressDenied)
@ -171,6 +182,19 @@ async fn allowlists_never_override_metadata_denial() {
}
}
#[tokio::test]
async fn system_resolver_returns_complete_deduplicated_localhost_answers() {
let answers = SystemResolver
.resolve("localhost", 80)
.await
.expect("localhost resolution");
assert!(!answers.is_empty());
assert!(answers.iter().all(IpAddr::is_loopback));
for (index, address) in answers.iter().enumerate() {
assert!(!answers[..index].contains(address));
}
}
#[tokio::test]
async fn scheme_port_policy_is_exact() {
let resolver = ScriptedResolver::with("example.test", vec![vec![ip("93.184.216.34")]]);