8815b21 · skrepka · git.iko.soy

git.iko.soy/skrepka

on master help sign in

Fix SSRF via port-only hostnames, ackedIds batch eviction, and remove dead code

8815b21iko7 months ago

server.knot+15−14

compare with master

unifiedsplit

@@ -190,11 +190,6 @@ isCgnatRange = \s ->

190 then True {}

191 else False {}

192

193−containsDoubleColon = \s ->

194− if s == "" then False {}

195− else if take 1 s == ":" && take 1 (drop 1 s) == ":" then True {}

196− else containsDoubleColon (drop 1 s)

197−

198containsColon = \s ->

193containsColon = \s ->

199 if s == "" then False {}

194 if s == "" then False {}

200 else if take 1 s == ":" then True {}

195 else if take 1 s == ":" then True {}

@@ -275,6 +270,7 @@ isBadServerName = \s ->

275 let sn = toLower (stripTrailingDot s)

270 let sn = toLower (stripTrailingDot s)

276 sn == ""

271 sn == ""

277 || take 1 sn == "."

272 || take 1 sn == "."

273+ || take 1 sn == ":"

278 || containsBadUrlChar sn

274 || containsBadUrlChar sn

279 || sn == "localhost" || take 10 sn == "localhost:"

275 || sn == "localhost" || take 10 sn == "localhost:"

280 || sn == "localhost.localdomain" || take 22 sn == "localhost.localdomain:"

276 || sn == "localhost.localdomain" || take 22 sn == "localhost.localdomain:"

@@ -337,6 +333,16 @@ verifyMaintenanceAuth = \authorization ->

337

333

338clampTtl = \ttl -> if ttl < 1 then 1 else if ttl > maxPresenceTtl then maxPresenceTtl else ttl

334clampTtl = \ttl -> if ttl < 1 then 1 else if ttl > maxPresenceTtl then maxPresenceTtl else ttl

339

335

336+evictOldestAckedIds = \items n ->

337+ if n <= 0 then items

338+ else

339+ let oldest = fold (\acc a -> if acc.ackedAt == -1 || a.ackedAt < acc.ackedAt then a else acc) {messageId: "", toKey: "", ackedAt: -1, originServer: ""} items

340+ in if oldest.ackedAt == -1 then items

341+ else evictOldestAckedIds (fold (\acc a ->

342+ if not acc.removed && a == oldest

343+ then {removed: True {}, items: acc.items}

344+ else {removed: acc.removed, items: union acc.items [a]}) {removed: False {}, items: []} items).items (n - 1)

345+

340safeCompareLoop = \s1 s2 result ->

346safeCompareLoop = \s1 s2 result ->

341 if s2 == ""

347 if s2 == ""

342 then result + (if s1 == "" then 0 else 1)

348 then result + (if s1 == "" then 0 else 1)

@@ -746,15 +752,10 @@ serve = \req -> case req of

746 yield {messageId: m.messageId, toKey: m.toKey, ackedAt: t, originServer: m.originServer}

752 yield {messageId: m.messageId, toKey: m.toKey, ackedAt: t, originServer: m.originServer}

747 ackedIds <- *ackedIds

753 ackedIds <- *ackedIds

748 let combinedAckedIds = union ackedIds ackedFederated

754 let combinedAckedIds = union ackedIds ackedFederated

749− let oldestAckedAt = if count combinedAckedIds > maxAckedIds

755+ let excessCount = count combinedAckedIds - maxAckedIds

750− then fold (\acc a -> if acc == -1 || a.ackedAt < acc then a.ackedAt else acc) -1 combinedAckedIds

751− else -1

752− set *ackedIds = if oldestAckedAt >= 0

756+ set *ackedIds = if excessCount <= 0

753− then (fold (\acc a ->

757+ then combinedAckedIds

754− if not acc.removed && a.ackedAt == oldestAckedAt

758+ else evictOldestAckedIds combinedAckedIds excessCount

755− then {removed: True {}, items: acc.items}

756− else {removed: acc.removed, items: union acc.items [a]}) {removed: False {}, items: []} combinedAckedIds).items

757− else combinedAckedIds

758 let ok = case session of

759 let ok = case session of

759 Nothing {} -> False {}

760 Nothing {} -> False {}

760 _ -> True {}

761 _ -> True {}