mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-06 14:47:01 +02:00
012cd5a42a
USGv6[0] requires implementing §4.1.1 of the NISTv6-r1 profile[1] for IPv6-Only capabilities. This section requires that whenever Vault displays IPv6 addresses (including CLI output, Web UI, logs, etc.) that _all_ IPv6 addresses must conform to RFC-5952 §4 text representation recommendations[2]. These recommendations do not prevent us from accepting RFC-4241[3] IPv6 addresses, however, whenever these same addresses are displayed they must conform to the strict RFC-5952 §4 guidelines. This PR implements handling of IPv6 address conformance in our `vault server` routine. We handle conformance normalization for all server, http_proxy, listener, seal, storage and telemetry configuration where an input could contain an IPv6 address, whether configured via an HCL file or via corresponding environment variables. The approach I've taken is to handle conformance normalization at parse time to ensure that all log output and subsequent usage inside of Vaults various subsystems always reference a conformant address, that way we don't need concern ourselves with conformance later. This approach ought to be backwards compatible to prior loose address configuration requirements, with the understanding that going forward all IPv6 representation will be strict regardless of what has been configured. In many cases I've updated our various parser functions to call the new `configutil.NormalizeAddr()` to apply conformance normalization. Others required no changes because they rely on standard library URL string output, which always displays IPv6 URLs in a conformant way. Not included in this changes is any other vault exec mode other than server. Client, operator commands, agent mode, proxy mode, etc. will be included in subsequent changes if necessary. [0]: https://www.nist.gov/publications/usgv6-profile [1]: https://www.nist.gov/publications/nist-ipv6-profile [2]: https://www.rfc-editor.org/rfc/rfc5952.html#section-4 [3]: https://www.rfc-editor.org/rfc/rfc4291 Signed-off-by: Ryan Cragun <me@ryan.ec>
92 lines
2.2 KiB
Go
92 lines
2.2 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package configutil
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
// NormalizeAddr takes an address as a string and returns a normalized copy.
|
|
// If the addr is a URL, IP Address, or host:port address that includes an IPv6
|
|
// address, the normalized copy will be conformant with RFC-5942 §4
|
|
// See: https://rfc-editor.org/rfc/rfc5952.html
|
|
func NormalizeAddr(address string) string {
|
|
if address == "" {
|
|
return ""
|
|
}
|
|
|
|
var ip net.IP
|
|
var port string
|
|
bracketedIPv6 := false
|
|
|
|
// Try parsing it as a URL
|
|
pu, err := url.Parse(address)
|
|
if err == nil {
|
|
// We've been given something that appears to be a URL. See if the hostname
|
|
// is an IP address
|
|
ip = net.ParseIP(pu.Hostname())
|
|
} else {
|
|
// We haven't been given a URL. Try and parse it as an IP address
|
|
ip = net.ParseIP(address)
|
|
if ip == nil {
|
|
// We haven't been given a URL or IP address, try parsing an IP:Port
|
|
// combination.
|
|
idx := strings.LastIndex(address, ":")
|
|
if idx > 0 {
|
|
// We've perhaps received an IP:Port address
|
|
addr := address[:idx]
|
|
port = address[idx+1:]
|
|
if strings.HasPrefix(addr, "[") && strings.HasSuffix(addr, "]") {
|
|
addr = strings.TrimPrefix(strings.TrimSuffix(addr, "]"), "[")
|
|
bracketedIPv6 = true
|
|
}
|
|
ip = net.ParseIP(addr)
|
|
}
|
|
}
|
|
}
|
|
|
|
// If our IP is nil whatever was passed in does not contain an IP address.
|
|
if ip == nil {
|
|
return address
|
|
}
|
|
|
|
if v4 := ip.To4(); v4 != nil {
|
|
return address
|
|
}
|
|
|
|
if v6 := ip.To16(); v6 != nil {
|
|
// net.IP String() will return IPv6 RFC-5952 conformant addresses.
|
|
|
|
if pu != nil {
|
|
// Return the URL in conformant fashion
|
|
if port := pu.Port(); port != "" {
|
|
pu.Host = fmt.Sprintf("[%s]:%s", v6.String(), port)
|
|
} else {
|
|
pu.Host = fmt.Sprintf("[%s]", v6.String())
|
|
}
|
|
return pu.String()
|
|
}
|
|
|
|
// Handle IP:Port addresses
|
|
if port != "" {
|
|
// Return the address:port or [address]:port
|
|
if bracketedIPv6 {
|
|
return fmt.Sprintf("[%s]:%s", v6.String(), port)
|
|
} else {
|
|
return fmt.Sprintf("%s:%s", v6.String(), port)
|
|
}
|
|
}
|
|
|
|
// Handle just an IP address
|
|
return v6.String()
|
|
}
|
|
|
|
// It shouldn't be possible to get to this point. If we somehow we manage
|
|
// to, return the string unchanged.
|
|
return address
|
|
}
|