Closed alexzeitgeist closed 7 years ago
go-camo does indeed simply do what you tell it to. There are a couple of ways to handle this:
1) Run go-camo on an isolated instance.
2) Run a local resolver for go-camo that returns NXDOMAIN responses for addresses in blacklisted ranges. (e.g. unbound's private-address
functionality). This is also useful to help prevent dns rebinding attacks in general.
3) Utilize firewall rules to isolate a go-camo server from the rest of your internal network.
Maybe adding simple rfc1918 (and fd00::/8 and fe80::/10) rejection by default (option flag), would be reasonable though. People could turn it off and do other things if they need a more exotic config.
I'll take a look at it -- especially since go-camo currently does try to filter out raw rfc1918 addresses if used directly in the host field of a url -- iit just doesn't try resolving real hostnames then checking currently.
I'll take a look at it -- especially since go-camo currently does try to filter out raw rfc1918 addresses if used directly in the host field of a url -- iit just doesn't try resolving real hostnames then checking currently.
Exactly. I would have followed either of the ways you mentioned to remedy this (thanks for the unbound hint btw!), but since go-camo already attempts to filter out "invalid" IP addresses, I thought it should also take care of invalid hostnames.
@alexzeitgeist Released a version with the change (v1.0.11), along with a minor bug (over eager match) in the rfc1918 regex the fix ended up uncovering. Also released a subsequent version with better address rejection logic in general (v1.0.12). 👍
I had this log entry today:
2017/01/15 05:46:49 [error] 8403#8403: *73363 access forbidden by rule, client: 127.0.0.1, server: _, request: "GET /cnwk.1d/i/bto/20090806/iRex_DR800_mock.png HTTP/1.1", host: "i.i.com.com"
http://i.i.com.com/cnwk.1d/i/bto/20090806/iRex_DR800_mock.png used to point to an image; nowadays though, the host resolves to 127.0.0.1. Yet go-camo dutifully attempts to request the URL. This could potentially leak private information if there's a private server listening on 127.0.0.1.
I suggest to resolve a domain first before making the proxy request and deny it if the domain resolves to an rfc1918 address.