milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reduce connect timeout for tunnel for known instance metadata hosts

Browse source
This commit is contained in:
Sander Declerck 2025-12-04 15:20:47 +01:00
parent e7cf3488b7
commit 47ea989bbd
No known key found for this signature in database
1 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

34
packages/safe-chain/src/registryProxy/tunnelRequestHandler.js
View file

@ -1,6 +1,9 @@
import * as net from "net"; import * as net from "net";
import { ui } from "../environment/userInteraction.js"; import { ui } from "../environment/userInteraction.js";
/** @type {string[]} */
let timedoutEndpoints = [];
/** /**
* @param {import("http").IncomingMessage} req * @param {import("http").IncomingMessage} req
* @param {import("http").ServerResponse} clientSocket * @param {import("http").ServerResponse} clientSocket
@ -38,6 +41,14 @@ export function tunnelRequest(req, clientSocket, head) {
function tunnelRequestToDestination(req, clientSocket, head) { function tunnelRequestToDestination(req, clientSocket, head) {
const { port, hostname } = new URL(`http://${req.url}`); const { port, hostname } = new URL(`http://${req.url}`);
if (timedoutEndpoints.includes(hostname)) {
clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
ui.writeError(
`Safe-chain: Closing connection because previously timedout connect to ${hostname}`
);
return;
}
const serverSocket = net.connect( const serverSocket = net.connect(
Number.parseInt(port) || 443, Number.parseInt(port) || 443,
hostname, hostname,
@ -49,6 +60,16 @@ function tunnelRequestToDestination(req, clientSocket, head) {
} }
); );
const connectTimeout = getConnectTimeout(hostname);
serverSocket.setTimeout(connectTimeout);
serverSocket.on("timeout", () => {
timedoutEndpoints.push(hostname);
ui.writeError(
`Safe-chain: connect to ${hostname}:${port} timed out after ${connectTimeout}ms`
);
clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
});
clientSocket.on("error", () => { clientSocket.on("error", () => {
// This can happen if the client TCP socket sends RST instead of FIN. // This can happen if the client TCP socket sends RST instead of FIN.
// Not subscribing to 'error' event will cause node to throw and crash. // Not subscribing to 'error' event will cause node to throw and crash.
@ -145,3 +166,16 @@ function tunnelRequestViaProxy(req, clientSocket, head, proxyUrl) {
} }
}); });
} }
const imdsEndpoints = [
"metadata.google.internal",
"metadata.goog",
"169.254.169.254",
"192.0.2.1",
];
function getConnectTimeout(/** @type {string} */ host) {
if (imdsEndpoints.includes(host)) {
return 3000;
}
return 30000;
}