From 92975f0c11f0566cc3c36659f5e3bb9faf5cb176 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 12 Jul 2023 14:15:38 +0200 Subject: [PATCH] client: define a "dummy" hostname to use for local connections For local communications (npipe://, unix://), the hostname is not used, but we need valid and meaningful hostname. The current code used the client's `addr` as hostname in some cases, which could contain the path for the unix-socket (`/var/run/docker.sock`), which gets rejected by go1.20.6 and go1.19.11 because of a security fix for [CVE-2023-29406 ][1], which was implemented in https://go.dev/issue/60374. Prior versions go Go would clean the host header, and strip slashes in the process, but go1.20.6 and go1.19.11 no longer do, and reject the host header. This patch introduces a `DummyHost` const, and uses this dummy host for cases where we don't need an actual hostname. Before this patch (using go1.20.6): make GO_VERSION=1.20.6 TEST_FILTER=TestAttach test-integration === RUN TestAttachWithTTY attach_test.go:46: assertion failed: error is not nil: http: invalid Host header --- FAIL: TestAttachWithTTY (0.11s) === RUN TestAttachWithoutTTy attach_test.go:46: assertion failed: error is not nil: http: invalid Host header --- FAIL: TestAttachWithoutTTy (0.02s) FAIL With this patch applied: make GO_VERSION=1.20.6 TEST_FILTER=TestAttach test-integration INFO: Testing against a local daemon === RUN TestAttachWithTTY --- PASS: TestAttachWithTTY (0.12s) === RUN TestAttachWithoutTTy --- PASS: TestAttachWithoutTTy (0.02s) PASS [1]: https://github.com/advisories/GHSA-f8f7-69v5-w4vx Signed-off-by: Sebastiaan van Stijn --- client/client.go | 30 ++++++++++++++++++++++++++++++ client/hijack.go | 6 +++++- client/request.go | 13 ++++--------- client/request_test.go | 4 ++-- 4 files changed, 41 insertions(+), 12 deletions(-) diff --git a/client/client.go b/client/client.go index 0f4343df28eb5..fa98e76135dfd 100644 --- a/client/client.go +++ b/client/client.go @@ -56,6 +56,36 @@ import ( "github.com/pkg/errors" ) +// DummyHost is a hostname used for local communication. +// +// It acts as a valid formatted hostname for local connections (such as "unix://" +// or "npipe://") which do not require a hostname. It should never be resolved, +// but uses the special-purpose ".localhost" TLD (as defined in [RFC 2606, Section 2] +// and [RFC 6761, Section 6.3]). +// +// [RFC 7230, Section 5.4] defines that an empty header must be used for such +// cases: +// +// If the authority component is missing or undefined for the target URI, +// then a client MUST send a Host header field with an empty field-value. +// +// However, [Go stdlib] enforces the semantics of HTTP(S) over TCP, does not +// allow an empty header to be used, and requires req.URL.Scheme to be either +// "http" or "https". +// +// For further details, refer to: +// +// - https://github.com/docker/engine-api/issues/189 +// - https://github.com/golang/go/issues/13624 +// - https://github.com/golang/go/issues/61076 +// - https://github.com/moby/moby/issues/45935 +// +// [RFC 2606, Section 2]: https://www.rfc-editor.org/rfc/rfc2606.html#section-2 +// [RFC 6761, Section 6.3]: https://www.rfc-editor.org/rfc/rfc6761#section-6.3 +// [RFC 7230, Section 5.4]: https://datatracker.ietf.org/doc/html/rfc7230#section-5.4 +// [Go stdlib]: https://github.com/golang/go/blob/6244b1946bc2101b01955468f1be502dbadd6807/src/net/http/transport.go#L558-L569 +const DummyHost = "api.moby.localhost" + // ErrRedirect is the error returned by checkRedirect when the request is non-GET. var ErrRedirect = errors.New("unexpected redirect in response") diff --git a/client/hijack.go b/client/hijack.go index 6bdacab10adbe..4dcaaca4c58f5 100644 --- a/client/hijack.go +++ b/client/hijack.go @@ -64,7 +64,11 @@ func fallbackDial(proto, addr string, tlsConfig *tls.Config) (net.Conn, error) { } func (cli *Client) setupHijackConn(ctx context.Context, req *http.Request, proto string) (net.Conn, string, error) { - req.Host = cli.addr + req.URL.Host = cli.addr + if cli.proto == "unix" || cli.proto == "npipe" { + // Override host header for non-tcp connections. + req.Host = DummyHost + } req.Header.Set("Connection", "Upgrade") req.Header.Set("Upgrade", proto) diff --git a/client/request.go b/client/request.go index edae0611e5786..5d4d46a33d64a 100644 --- a/client/request.go +++ b/client/request.go @@ -102,19 +102,14 @@ func (cli *Client) buildRequest(method, path string, body io.Reader, headers htt return nil, err } req = cli.addHeaders(req, headers) + req.URL.Scheme = cli.scheme + req.URL.Host = cli.addr if cli.proto == "unix" || cli.proto == "npipe" { - // For local communications, it doesn't matter what the host is. We just - // need a valid and meaningful host name. For details, see: - // - // - https://github.com/docker/engine-api/issues/189 - // - https://github.com/golang/go/issues/13624 - req.Host = "docker" + // Override host header for non-tcp connections. + req.Host = DummyHost } - req.URL.Host = cli.addr - req.URL.Scheme = cli.scheme - if body != nil && req.Header.Get("Content-Type") == "" { req.Header.Set("Content-Type", "text/plain") } diff --git a/client/request_test.go b/client/request_test.go index 4226771a9dc24..6bc47fef393ee 100644 --- a/client/request_test.go +++ b/client/request_test.go @@ -29,12 +29,12 @@ func TestSetHostHeader(t *testing.T) { }{ { host: "unix:///var/run/docker.sock", - expectedHost: "docker", + expectedHost: DummyHost, expectedURLHost: "/var/run/docker.sock", }, { host: "npipe:////./pipe/docker_engine", - expectedHost: "docker", + expectedHost: DummyHost, expectedURLHost: "//./pipe/docker_engine", }, {