x509util: harden SSRF guard against DNS rebinding and HTTP redirects

rejectPrivateHost only checked literal IP addresses in the URL.
Two bypasses remained:

1. A hostname resolving to a private/loopback IP (e.g. evil.com → 127.0.0.1)
   was not caught because net.ParseIP returns nil for hostnames.

2. An HTTP redirect from a public host to a private IP was followed by
   the default http.Client without re-checking the target.

Fix: introduce safeTransport (custom DialContext that resolves and
validates all IPs before connecting) and rejectPrivateRedirect
(CheckRedirect hook that blocks redirects to private literal IPs).
All three URL-fetching helpers (ReadPossiblePEMURL, ReadFileOrURL,
GetIssuer) now use safeClient which combines both guards.

Add tests for redirect-to-loopback and localhost-hostname scenarios.

Author: 1seal

x509util/files.go

@@ -15,6 +15,7 @@
 package x509util
 
 import (
+	"context"
 	"encoding/pem"
 	"fmt"
 	"io"
@@ -27,20 +28,75 @@ import (
 	"github.com/google/certificate-transparency-go/x509"
 )
 
-// rejectPrivateHost returns an error if the URL host is a loopback,
-// link-local, or private IP address.
+// isPrivateIP reports whether ip is loopback, link-local, or private.
+func isPrivateIP(ip net.IP) bool {
+	return ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate()
+}
+
+// rejectPrivateHost returns an error if the URL host is a literal private IP.
+// For hostname-based URLs the resolved addresses are checked at dial time by
+// safeTransport; this function catches the obvious literal-IP case early.
 func rejectPrivateHost(u *url.URL) error {
 	host := u.Hostname()
 	ip := net.ParseIP(host)
 	if ip == nil {
 		return nil
 	}
-	if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() {
+	if isPrivateIP(ip) {
 		return fmt.Errorf("refusing to fetch URL with private/loopback host: %q", u.String())
 	}
 	return nil
 }
 
+// safeTransport returns an *http.Transport whose DialContext resolves the
+// hostname and rejects connections to private/loopback addresses.  This
+// defends against DNS-rebinding and hostname-to-private-IP attacks.
+func safeTransport() *http.Transport {
+	return &http.Transport{
+		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			host, port, err := net.SplitHostPort(addr)
+			if err != nil {
+				return nil, err
+			}
+			ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+			if err != nil {
+				return nil, err
+			}
+			for _, ia := range ips {
+				if isPrivateIP(ia.IP) {
+					return nil, fmt.Errorf("refusing to connect: %q resolves to private/loopback address %s", host, ia.IP)
+				}
+			}
+			var d net.Dialer
+			return d.DialContext(ctx, network, net.JoinHostPort(host, port))
+		},
+	}
+}
+
+// rejectPrivateRedirect is an http.Client CheckRedirect function that blocks
+// redirects targeting private/loopback hosts (literal IP or resolved).
+func rejectPrivateRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return fmt.Errorf("stopped after 10 redirects")
+	}
+	return rejectPrivateHost(req.URL)
+}
+
+// safeClient returns an *http.Client that blocks requests and redirects
+// targeting private/loopback addresses.  If base is non-nil its Timeout and
+// Jar are preserved.
+func safeClient(base *http.Client) *http.Client {
+	c := &http.Client{
+		Transport:     safeTransport(),
+		CheckRedirect: rejectPrivateRedirect,
+	}
+	if base != nil {
+		c.Timeout = base.Timeout
+		c.Jar = base.Jar
+	}
+	return c
+}
+
 // ReadPossiblePEMFile loads data from a file which may be in DER format
 // or may be in PEM format (with the given blockname).
 func ReadPossiblePEMFile(filename, blockname string) ([][]byte, error) {
@@ -68,7 +124,7 @@ func ReadPossiblePEMURL(target, blockname string) ([][]byte, error) {
 		return nil, err
 	}
 
-	rsp, err := http.Get(target)
+	rsp, err := safeClient(nil).Get(target)
 	if err != nil {
 		return nil, fmt.Errorf("failed to http.Get(%q): %v", target, err)
 	}
@@ -112,7 +168,7 @@ func ReadFileOrURL(target string, client *http.Client) ([]byte, error) {
 		return nil, err
 	}
 
-	rsp, err := client.Get(u.String())
+	rsp, err := safeClient(client).Get(u.String())
 	if err != nil {
 		return nil, fmt.Errorf("failed to http.Get(%q): %v", target, err)
 	}
@@ -140,7 +196,7 @@ func GetIssuer(cert *x509.Certificate, client *http.Client) (*x509.Certificate,
 		return nil, err
 	}
 
-	rsp, err := client.Get(issuerURL)
+	rsp, err := safeClient(client).Get(issuerURL)
 	if err != nil || rsp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("failed to get issuer from %q: %v", issuerURL, err)
 	}

x509util/files_test.go

@@ -15,6 +15,8 @@
 package x509util
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"testing"
 )
@@ -48,3 +50,28 @@ func TestRejectPrivateHost(t *testing.T) {
 		})
 	}
 }
+
+func TestRedirectToLoopback(t *testing.T) {
+	// Server that redirects to a loopback address.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, "http://127.0.0.1/secret", http.StatusFound)
+	}))
+	defer srv.Close()
+
+	_, err := ReadFileOrURL(srv.URL+"/start", srv.Client())
+	if err == nil {
+		t.Fatal("expected error for redirect to loopback, got nil")
+	}
+}
+
+func TestSafeClientBlocksLocalhostHostname(t *testing.T) {
+	// safeTransport resolves hostnames before connecting.  "localhost"
+	// resolves to 127.0.0.1 / ::1 on every platform, so a request to it
+	// must be rejected even though rejectPrivateHost (literal-IP check)
+	// would pass a hostname through.
+	c := safeClient(nil)
+	_, err := c.Get("http://localhost:1/should-not-connect")
+	if err == nil {
+		t.Fatal("expected error for localhost hostname, got nil")
+	}
+}