nextcloud /
server
@@ -28,123 +28,123 @@ |
||
| 28 | 28 | use Psr\Http\Message\RequestInterface; |
| 29 | 29 | |
| 30 | 30 | class DnsPinMiddleware { |
| 31 | - /** @var NegativeDnsCache */ |
|
| 32 | - private $negativeDnsCache; |
|
| 33 | - /** @var LocalAddressChecker */ |
|
| 34 | - private $localAddressChecker; |
|
| 35 | - |
|
| 36 | - public function __construct( |
|
| 37 | - NegativeDnsCache $negativeDnsCache, |
|
| 38 | - LocalAddressChecker $localAddressChecker |
|
| 39 | - ) { |
|
| 40 | - $this->negativeDnsCache = $negativeDnsCache; |
|
| 41 | - $this->localAddressChecker = $localAddressChecker; |
|
| 42 | - } |
|
| 43 | - |
|
| 44 | - /** |
|
| 45 | - * Fetch soa record for a target |
|
| 46 | - * |
|
| 47 | - * @param string $target |
|
| 48 | - * @return array|null |
|
| 49 | - */ |
|
| 50 | - private function soaRecord(string $target): ?array { |
|
| 51 | - $labels = explode('.', $target); |
|
| 52 | - |
|
| 53 | - $top = count($labels) >= 2 ? array_pop($labels) : ''; |
|
| 54 | - $second = array_pop($labels); |
|
| 55 | - |
|
| 56 | - $hostname = $second . '.' . $top; |
|
| 57 | - $responses = dns_get_record($hostname, DNS_SOA); |
|
| 58 | - |
|
| 59 | - if ($responses === false || count($responses) === 0) { |
|
| 60 | - return null; |
|
| 61 | - } |
|
| 62 | - |
|
| 63 | - return reset($responses); |
|
| 64 | - } |
|
| 65 | - |
|
| 66 | - private function dnsResolve(string $target, int $recursionCount) : array { |
|
| 67 | - if ($recursionCount >= 10) { |
|
| 68 | - return []; |
|
| 69 | - } |
|
| 70 | - |
|
| 71 | - $recursionCount++; |
|
| 72 | - $targetIps = []; |
|
| 73 | - |
|
| 74 | - $soaDnsEntry = $this->soaRecord($target); |
|
| 75 | - $dnsNegativeTtl = $soaDnsEntry['minimum-ttl'] ?? null; |
|
| 76 | - |
|
| 77 | - $dnsTypes = [DNS_A, DNS_AAAA, DNS_CNAME]; |
|
| 78 | - foreach ($dnsTypes as $dnsType) { |
|
| 79 | - if ($this->negativeDnsCache->isNegativeCached($target, $dnsType)) { |
|
| 80 | - continue; |
|
| 81 | - } |
|
| 82 | - |
|
| 83 | - $dnsResponses = dns_get_record($target, $dnsType); |
|
| 84 | - $canHaveCnameRecord = true; |
|
| 85 | - if (count($dnsResponses) > 0) { |
|
| 86 | - foreach ($dnsResponses as $dnsResponse) { |
|
| 87 | - if (isset($dnsResponse['ip'])) { |
|
| 88 | - $targetIps[] = $dnsResponse['ip']; |
|
| 89 | - $canHaveCnameRecord = false; |
|
| 90 | - } elseif (isset($dnsResponse['ipv6'])) { |
|
| 91 | - $targetIps[] = $dnsResponse['ipv6']; |
|
| 92 | - $canHaveCnameRecord = false; |
|
| 93 | - } elseif (isset($dnsResponse['target']) && $canHaveCnameRecord) { |
|
| 94 | - $targetIps = array_merge($targetIps, $this->dnsResolve($dnsResponse['target'], $recursionCount)); |
|
| 95 | - $canHaveCnameRecord = true; |
|
| 96 | - } |
|
| 97 | - } |
|
| 98 | - } elseif ($dnsNegativeTtl !== null) { |
|
| 99 | - $this->negativeDnsCache->setNegativeCacheForDnsType($target, $dnsType, $dnsNegativeTtl); |
|
| 100 | - } |
|
| 101 | - } |
|
| 102 | - |
|
| 103 | - return $targetIps; |
|
| 104 | - } |
|
| 105 | - |
|
| 106 | - public function addDnsPinning() { |
|
| 107 | - return function (callable $handler) { |
|
| 108 | - return function ( |
|
| 109 | - RequestInterface $request, |
|
| 110 | - array $options |
|
| 111 | - ) use ($handler) { |
|
| 112 | - if ($options['nextcloud']['allow_local_address'] === true) { |
|
| 113 | - return $handler($request, $options); |
|
| 114 | - } |
|
| 115 | - |
|
| 116 | - $hostName = (string)$request->getUri()->getHost(); |
|
| 117 | - $port = $request->getUri()->getPort(); |
|
| 118 | - |
|
| 119 | - $ports = [ |
|
| 120 | - '80', |
|
| 121 | - '443', |
|
| 122 | - ]; |
|
| 123 | - |
|
| 124 | - if ($port !== null) { |
|
| 125 | - $ports[] = (string)$port; |
|
| 126 | - } |
|
| 127 | - |
|
| 128 | - $targetIps = $this->dnsResolve($hostName, 0); |
|
| 129 | - |
|
| 130 | - $curlResolves = []; |
|
| 131 | - |
|
| 132 | - foreach ($ports as $port) { |
|
| 133 | - $curlResolves["$hostName:$port"] = []; |
|
| 134 | - |
|
| 135 | - foreach ($targetIps as $ip) { |
|
| 136 | - $this->localAddressChecker->ThrowIfLocalIp($ip); |
|
| 137 | - $curlResolves["$hostName:$port"][] = $ip; |
|
| 138 | - } |
|
| 139 | - } |
|
| 140 | - |
|
| 141 | - // Coalesce the per-host:port ips back into a comma separated list |
|
| 142 | - foreach ($curlResolves as $hostport => $ips) { |
|
| 143 | - $options['curl'][CURLOPT_RESOLVE][] = "$hostport:" . implode(',', $ips); |
|
| 144 | - } |
|
| 145 | - |
|
| 146 | - return $handler($request, $options); |
|
| 147 | - }; |
|
| 148 | - }; |
|
| 149 | - } |
|
| 31 | + /** @var NegativeDnsCache */ |
|
| 32 | + private $negativeDnsCache; |
|
| 33 | + /** @var LocalAddressChecker */ |
|
| 34 | + private $localAddressChecker; |
|
| 35 | + |
|
| 36 | + public function __construct( |
|
| 37 | + NegativeDnsCache $negativeDnsCache, |
|
| 38 | + LocalAddressChecker $localAddressChecker |
|
| 39 | + ) { |
|
| 40 | + $this->negativeDnsCache = $negativeDnsCache; |
|
| 41 | + $this->localAddressChecker = $localAddressChecker; |
|
| 42 | + } |
|
| 43 | + |
|
| 44 | + /** |
|
| 45 | + * Fetch soa record for a target |
|
| 46 | + * |
|
| 47 | + * @param string $target |
|
| 48 | + * @return array|null |
|
| 49 | + */ |
|
| 50 | + private function soaRecord(string $target): ?array { |
|
| 51 | + $labels = explode('.', $target); |
|
| 52 | + |
|
| 53 | + $top = count($labels) >= 2 ? array_pop($labels) : ''; |
|
| 54 | + $second = array_pop($labels); |
|
| 55 | + |
|
| 56 | + $hostname = $second . '.' . $top; |
|
| 57 | + $responses = dns_get_record($hostname, DNS_SOA); |
|
| 58 | + |
|
| 59 | + if ($responses === false || count($responses) === 0) { |
|
| 60 | + return null; |
|
| 61 | + } |
|
| 62 | + |
|
| 63 | + return reset($responses); |
|
| 64 | + } |
|
| 65 | + |
|
| 66 | + private function dnsResolve(string $target, int $recursionCount) : array { |
|
| 67 | + if ($recursionCount >= 10) { |
|
| 68 | + return []; |
|
| 69 | + } |
|
| 70 | + |
|
| 71 | + $recursionCount++; |
|
| 72 | + $targetIps = []; |
|
| 73 | + |
|
| 74 | + $soaDnsEntry = $this->soaRecord($target); |
|
| 75 | + $dnsNegativeTtl = $soaDnsEntry['minimum-ttl'] ?? null; |
|
| 76 | + |
|
| 77 | + $dnsTypes = [DNS_A, DNS_AAAA, DNS_CNAME]; |
|
| 78 | + foreach ($dnsTypes as $dnsType) { |
|
| 79 | + if ($this->negativeDnsCache->isNegativeCached($target, $dnsType)) { |
|
| 80 | + continue; |
|
| 81 | + } |
|
| 82 | + |
|
| 83 | + $dnsResponses = dns_get_record($target, $dnsType); |
|
| 84 | + $canHaveCnameRecord = true; |
|
| 85 | + if (count($dnsResponses) > 0) { |
|
| 86 | + foreach ($dnsResponses as $dnsResponse) { |
|
| 87 | + if (isset($dnsResponse['ip'])) { |
|
| 88 | + $targetIps[] = $dnsResponse['ip']; |
|
| 89 | + $canHaveCnameRecord = false; |
|
| 90 | + } elseif (isset($dnsResponse['ipv6'])) { |
|
| 91 | + $targetIps[] = $dnsResponse['ipv6']; |
|
| 92 | + $canHaveCnameRecord = false; |
|
| 93 | + } elseif (isset($dnsResponse['target']) && $canHaveCnameRecord) { |
|
| 94 | + $targetIps = array_merge($targetIps, $this->dnsResolve($dnsResponse['target'], $recursionCount)); |
|
| 95 | + $canHaveCnameRecord = true; |
|
| 96 | + } |
|
| 97 | + } |
|
| 98 | + } elseif ($dnsNegativeTtl !== null) { |
|
| 99 | + $this->negativeDnsCache->setNegativeCacheForDnsType($target, $dnsType, $dnsNegativeTtl); |
|
| 100 | + } |
|
| 101 | + } |
|
| 102 | + |
|
| 103 | + return $targetIps; |
|
| 104 | + } |
|
| 105 | + |
|
| 106 | + public function addDnsPinning() { |
|
| 107 | + return function (callable $handler) { |
|
| 108 | + return function ( |
|
| 109 | + RequestInterface $request, |
|
| 110 | + array $options |
|
| 111 | + ) use ($handler) { |
|
| 112 | + if ($options['nextcloud']['allow_local_address'] === true) { |
|
| 113 | + return $handler($request, $options); |
|
| 114 | + } |
|
| 115 | + |
|
| 116 | + $hostName = (string)$request->getUri()->getHost(); |
|
| 117 | + $port = $request->getUri()->getPort(); |
|
| 118 | + |
|
| 119 | + $ports = [ |
|
| 120 | + '80', |
|
| 121 | + '443', |
|
| 122 | + ]; |
|
| 123 | + |
|
| 124 | + if ($port !== null) { |
|
| 125 | + $ports[] = (string)$port; |
|
| 126 | + } |
|
| 127 | + |
|
| 128 | + $targetIps = $this->dnsResolve($hostName, 0); |
|
| 129 | + |
|
| 130 | + $curlResolves = []; |
|
| 131 | + |
|
| 132 | + foreach ($ports as $port) { |
|
| 133 | + $curlResolves["$hostName:$port"] = []; |
|
| 134 | + |
|
| 135 | + foreach ($targetIps as $ip) { |
|
| 136 | + $this->localAddressChecker->ThrowIfLocalIp($ip); |
|
| 137 | + $curlResolves["$hostName:$port"][] = $ip; |
|
| 138 | + } |
|
| 139 | + } |
|
| 140 | + |
|
| 141 | + // Coalesce the per-host:port ips back into a comma separated list |
|
| 142 | + foreach ($curlResolves as $hostport => $ips) { |
|
| 143 | + $options['curl'][CURLOPT_RESOLVE][] = "$hostport:" . implode(',', $ips); |
|
| 144 | + } |
|
| 145 | + |
|
| 146 | + return $handler($request, $options); |
|
| 147 | + }; |
|
| 148 | + }; |
|
| 149 | + } |
|
| 150 | 150 | } |
