Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

issues/260: Add protection against DNS rebinding attacks. #276

Merged
merged 14 commits into from
Jun 18, 2023
Merged

Conversation

komuw
Copy link
Owner

@komuw komuw commented Jun 18, 2023

  • DNS rebinding[2] is a method of manipulating resolution of domain names that is commonly used as a form of computer attack.
    The stdlib http.ServeMux does optionally protect against this class of attack[3][4][5]
  • In our implementation, we fail the requests with a http 400 and appropriate error message if the incoming host is not equal to(or a subdomain) of the registered domain.
  • We also update the middleware New function so that it panics if the given domain is invalid.
  1. Fixes: check if mux is protected against dns rebinding similar to stdblib ServeMux #260
  2. https://en.wikipedia.org/wiki/DNS_rebinding
  3. https://github.com/golang/go/blob/go1.20.5/src/net/http/request.go#L232-L236
  4. https://github.com/golang/go/blob/go1.20.5/src/net/http/server.go#L2467
  5. https://github.com/golang/go/blob/go1.20.5/src/net/http/server.go#L2450-L2453

@komuw komuw changed the title issues/260 issues/260: Add protection against DNS rebinding attacks. Jun 18, 2023
@codecov-commenter
Copy link

codecov-commenter commented Jun 18, 2023

Codecov Report

Patch coverage: 80.72% and project coverage change: +0.26 🎉

Comparison is base (9aeb2b4) 77.72% compared to head (5ec698a) 77.98%.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #276      +/-   ##
==========================================
+ Coverage   77.72%   77.98%   +0.26%     
==========================================
  Files          36       36              
  Lines        3372     3412      +40     
==========================================
+ Hits         2621     2661      +40     
  Misses        623      623              
  Partials      128      128              
Impacted Files Coverage Δ
server/cert.go 32.15% <0.00%> (ø)
server/pprof.go 87.71% <0.00%> (ø)
server/server.go 75.10% <0.00%> (ø)
middleware/redirect.go 90.32% <95.58%> (+6.68%) ⬆️
middleware/middleware.go 100.00% <100.00%> (ø)

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

@komuw komuw marked this pull request as ready for review June 18, 2023 13:35
@komuw komuw merged commit 92fef92 into main Jun 18, 2023
@komuw komuw deleted the issues/260 branch June 18, 2023 13:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

check if mux is protected against dns rebinding similar to stdblib ServeMux
2 participants