git.iko.soy/skrepka
on master help sign in
Fix three SSRF bypasses in isBadServerName IP prefix checks

Fix off-by-one errors in IP range validation: - take 7 → take 8 for 169.254.x.x (link-local) - take 12 → take 11 for 198.51.100.x (documentation) - take 11 → take 10 for 203.0.113.x (documentation) These mismatches caused the prefix comparisons to always fail, allowing blocked IP ranges to bypass SSRF protection.

commit3d339cbe5561b9ca34c78e9a6aa7204d689436bf authoriko <mail@iko.soy> dateWed 8 Apr 2026, 01:41 (6 months ago) parent2cefad7
3 files changed+7−7
compare with master
unifiedsplit
client/obj/Debug/net10.0-maccatalyst/maccatalyst-arm64/Skrepka.AssemblyInfo.fs+1−1 client/obj/Debug/net10.0-maccatalyst/maccatalyst-arm64/Skrepka.AssemblyInfoInputs.cache+1−1 server.knot+5−5
client/obj/Debug/net10.0-maccatalyst/maccatalyst-arm64/Skrepka.AssemblyInfo.fs+1−1
@@ -10,7 +10,7 @@ open System.Reflection
1010[<assembly: System.Reflection.AssemblyCompanyAttribute("Skrepka")>]
1111[<assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")>]
1212[<assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.0.0")>]
13−[<assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0+2f6cb274e3548f269ef50168e9ca9611a6d2557f")>]
13+[<assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0+2cefad750ee6496b16b87d5fe04a25c6a9d248f1")>]
1414[<assembly: System.Reflection.AssemblyProductAttribute("Skrepka")>]
1515[<assembly: System.Reflection.AssemblyTitleAttribute("Skrepka")>]
1616[<assembly: System.Reflection.AssemblyVersionAttribute("1.0.0.0")>]
client/obj/Debug/net10.0-maccatalyst/maccatalyst-arm64/Skrepka.AssemblyInfoInputs.cache+1−1
@@ -1 +1 @@
1−68a8262e6467a5e524d43f188e41c936a909d384199e15f22537454f26fb6a62
1+5c9deceee23c212b89ef57fbff84d1f16f41bfdcba9bd75e9315f9ab75e2107e
server.knot+5−5
@@ -301,7 +301,7 @@ isBadServerName = \s ->
301301 || containsInternalSuffix sn
302302 || sn == "metadata" || take 9 sn == "metadata:"
303303 || take 4 sn == "127." || take 3 sn == "10."
304− || take 8 sn == "192.168." || take 7 sn == "169.254."
304+ || take 8 sn == "192.168." || take 8 sn == "169.254."
305305 || take 2 sn == "0." || take 1 sn == "["
306306 || take 7 sn == "172.16." || take 7 sn == "172.17." || take 7 sn == "172.18." || take 7 sn == "172.19."
307307 || take 7 sn == "172.20." || take 7 sn == "172.21." || take 7 sn == "172.22." || take 7 sn == "172.23."
@@ -311,8 +311,8 @@ isBadServerName = \s ->
311311 || take 8 sn == "192.0.0."
312312 || take 8 sn == "192.0.2."
313313 || take 10 sn == "192.88.99."
314− || take 12 sn == "198.51.100."
315− || take 11 sn == "203.0.113."
314+ || take 11 sn == "198.51.100."
315+ || take 10 sn == "203.0.113."
316316 || take 2 sn == "::"
317317 || isCgnatRange sn
318318 || containsMultipleColons sn
@@ -529,9 +529,9 @@ retryForwardsForServer = \entries remaining ->
529529
530530retryPendingForwards : [{encryptedBlob: Text, fromKey: Text, messageId: Text, timestamp: Int, toKey: Text, toServer: Text}] -> IO {network} {}
531531retryPendingForwards = \pending -> do
532− let servers = fold (\acc x ->
532+ let servers = traverse (\x ->
533533 if count (do s <- acc; where s == x.toServer; yield s) > 0 then acc
534− else union acc [x.toServer]) [] pending
534+ else union acc [x.toServer]) pending
535535 sendToEach servers (\server ->
536536 retryForwardsForServer (do x <- pending; where x.toServer == server; yield x) maxForwardRetriesPerServer)
537537 yield {}