/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2026 3A Systems, LLC.
|
*/
|
package org.opends.dsml.protocol;
|
|
import java.io.ByteArrayInputStream;
|
import java.io.IOException;
|
import java.net.InetAddress;
|
import java.net.URI;
|
|
import org.forgerock.opendj.ldap.ByteString;
|
import org.forgerock.testng.ForgeRockTestCase;
|
import org.testng.annotations.AfterMethod;
|
import org.testng.annotations.DataProvider;
|
import org.testng.annotations.Test;
|
|
import static org.testng.Assert.assertEquals;
|
import static org.testng.Assert.assertFalse;
|
import static org.testng.Assert.assertTrue;
|
|
/**
|
* Tests the anyURI dereferencing hardening added for GHSA-68r5-9hpg-7qw9:
|
* secure-by-default (no fetch), scheme allowlist, internal-address filter,
|
* redirect refusal and content size cap. None of these tests performs network
|
* or DNS I/O: hosts are IP literals and streams are in-memory.
|
*/
|
@SuppressWarnings("javadoc")
|
@Test(groups = { "precommit", "dsml" })
|
public class ByteStringUtilityTestCase extends ForgeRockTestCase
|
{
|
@AfterMethod
|
public void restoreDefaults()
|
{
|
ByteStringUtility.setDereferenceUri(false);
|
ByteStringUtility.setAllowedUriSchemes("http,https");
|
ByteStringUtility.setMaxUriContentLength(10L * 1024 * 1024);
|
ByteStringUtility.setNat64Prefixes("");
|
}
|
|
@Test
|
public void testUriIsStoredVerbatimByDefault() throws Exception
|
{
|
ByteString value = ByteStringUtility.convertValue(new URI("http://203.0.113.10/secret"));
|
assertEquals(value, ByteString.valueOfUtf8("http://203.0.113.10/secret"));
|
}
|
|
@DataProvider
|
public Object[][] disallowedSchemeUris()
|
{
|
return new Object[][] {
|
{ "file:///etc/passwd" },
|
{ "ftp://203.0.113.10/file" },
|
{ "gopher://203.0.113.10/1" },
|
{ "jar:http://203.0.113.10/a.jar!/b" },
|
{ "urn:isbn:0451450523" }, // opaque URI, no scheme match
|
{ "/relative/path" }, // no scheme at all
|
};
|
}
|
|
@Test(dataProvider = "disallowedSchemeUris", expectedExceptions = IOException.class,
|
expectedExceptionsMessageRegExp = ".*disallowed scheme.*")
|
public void testDisallowedSchemesAreRejected(String uri) throws Exception
|
{
|
ByteStringUtility.setDereferenceUri(true);
|
ByteStringUtility.convertUri(new URI(uri));
|
}
|
|
@Test(expectedExceptions = IOException.class,
|
expectedExceptionsMessageRegExp = ".*disallowed scheme.*")
|
public void testSchemeAllowlistIsConfigurable() throws Exception
|
{
|
ByteStringUtility.setDereferenceUri(true);
|
ByteStringUtility.setAllowedUriSchemes(" HTTPS , ");
|
// http is no longer on the allowlist, so it is rejected before any I/O.
|
ByteStringUtility.convertUri(new URI("http://203.0.113.10/"));
|
}
|
|
@DataProvider
|
public Object[][] internalUris()
|
{
|
return new Object[][] {
|
{ "http://127.0.0.1/" },
|
{ "http://0.0.0.0/" },
|
{ "http://10.1.2.3/" },
|
{ "http://172.16.5.5/" },
|
{ "http://192.168.1.1/" },
|
{ "http://169.254.169.254/latest/meta-data/" },
|
{ "http://100.100.100.200/latest/meta-data/" },
|
{ "http://198.18.0.1/" },
|
{ "http://240.0.0.1/" },
|
{ "http://[::1]/" },
|
{ "http://[fe80::1]/" },
|
{ "http://[fc00::1]/" },
|
{ "http://[fd12:3456::1]/" },
|
// IPv6 transition addresses embedding an internal IPv4 (GHSA-97x5-8pm7-xfp7).
|
{ "http://[64:ff9b::c0a8:0101]/" }, // NAT64 well-known -> 192.168.1.1
|
{ "http://[64:ff9b::0a00:0001]/" }, // NAT64 well-known -> 10.0.0.1
|
{ "http://[64:ff9b:1::7f00:1]/" }, // NAT64 local-use (RFC 8215) -> 127.0.0.1
|
{ "http://[64:ff9b:1:0:c0:a801:100:0]/" }, // NAT64 local-use, /64 layout -> 192.168.1.1
|
{ "http://[2002:0a00:0001::]/" }, // 6to4 -> 10.0.0.1
|
{ "http://[2001:0000::3f57:fefe]/" }, // Teredo -> 192.168.1.1 (obfuscated)
|
};
|
}
|
|
@Test(dataProvider = "internalUris", expectedExceptions = IOException.class,
|
expectedExceptionsMessageRegExp = ".*(internal|no host).*")
|
public void testInternalAddressesAreRejected(String uri) throws Exception
|
{
|
ByteStringUtility.assertHostAllowed(new URI(uri));
|
}
|
|
@Test(expectedExceptions = IOException.class,
|
expectedExceptionsMessageRegExp = ".*no host.*")
|
public void testUriWithoutHostIsRejected() throws Exception
|
{
|
ByteStringUtility.assertHostAllowed(new URI("http:///path"));
|
}
|
|
@DataProvider
|
public Object[][] addressClassification()
|
{
|
return new Object[][] {
|
// address, expected isInternalAddress
|
{ "8.8.8.8", false },
|
{ "1.1.1.1", false },
|
{ "203.0.113.10", false },
|
{ "2001:4860:4860::8888", false },
|
{ "127.0.0.1", true },
|
{ "0.1.2.3", true },
|
{ "169.254.169.254", true },
|
{ "239.255.255.255", true }, // multicast
|
{ "255.255.255.255", true }, // broadcast
|
// 100.64.0.0/10 boundaries
|
{ "100.63.255.255", false },
|
{ "100.64.0.0", true },
|
{ "100.100.100.200", true },
|
{ "100.127.255.255", true },
|
{ "100.128.0.0", false },
|
// 192.0.0.0/24 boundaries
|
{ "192.0.0.1", true },
|
{ "192.0.1.1", false },
|
// 192.88.99.0/24 (deprecated 6to4 relay anycast, RFC 7526) boundaries
|
{ "192.88.98.255", false },
|
{ "192.88.99.1", true },
|
{ "192.88.100.0", false },
|
// 198.18.0.0/15 boundaries
|
{ "198.17.255.255", false },
|
{ "198.18.0.0", true },
|
{ "198.19.255.255", true },
|
{ "198.20.0.0", false },
|
// 240.0.0.0/4 boundary
|
{ "239.0.0.1", true }, // multicast anyway
|
{ "240.0.0.0", true },
|
// IPv6 unique-local fc00::/7 boundaries
|
{ "fbff::1", false },
|
{ "fc00::1", true },
|
{ "fdff::1", true },
|
{ "fe00::1", false },
|
// IPv6 transition addresses embedding an internal IPv4 (GHSA-97x5-8pm7-xfp7).
|
{ "64:ff9b::c0a8:0101", true }, // NAT64 well-known -> 192.168.1.1
|
{ "64:ff9b::0a00:0001", true }, // NAT64 well-known -> 10.0.0.1
|
{ "64:ff9b::7f00:0001", true }, // NAT64 well-known -> 127.0.0.1
|
{ "64:ff9b::0808:0808", false }, // NAT64 well-known -> 8.8.8.8 (public)
|
// The NAT64 local-use prefix 64:ff9b:1::/48 (RFC 8215) is blocked outright,
|
// whichever RFC 6052 sub-prefix layout the operator picked inside it.
|
{ "64:ff9b:1::7f00:1", true }, // /96 layout -> 127.0.0.1
|
{ "64:ff9b:1::a00:1", true }, // /96 layout -> 10.0.0.1
|
{ "64:ff9b:1:abcd::c0a8:101", true }, // /96 layout in a subnet of the /48 -> 192.168.1.1
|
{ "64:ff9b:1:0:c0:a801:100:0", true }, // /64 layout -> 192.168.1.1
|
{ "64:ff9b:1:0:a:102:300:0", true }, // /64 layout -> 10.1.2.3
|
{ "64:ff9b:1:7f00:0:100::", true }, // /48 layout -> 127.0.0.1
|
{ "64:ff9b:1::808:808", true }, // 8.8.8.8: public, but not reachable through this prefix
|
{ "64:ff9b:1:ffff:ffff:ffff:ffff:ffff", true }, // no layout matches, still in the /48
|
// 64:ff9b:1::/48 boundaries.
|
{ "64:ff9b:0:1::7f00:1", false }, // 64:ff9b:0:1, not the local-use prefix
|
{ "64:ff9b:2::7f00:1", false }, // outside 64:ff9b::/96 and 64:ff9b:1::/48
|
{ "64:ff9c:1::7f00:1", false }, // 64:ff9c:1, not the local-use prefix
|
{ "2002:0a00:0001::", true }, // 6to4 -> 10.0.0.1
|
{ "2002:c0a8:0101::", true }, // 6to4 -> 192.168.1.1
|
{ "2002:c058:6301::", true }, // 6to4 -> 192.88.99.1 (blocked IPv4 via transition)
|
{ "2002:0808:0808::", false }, // 6to4 -> 8.8.8.8 (public)
|
{ "2001:0000::3f57:fefe", true }, // Teredo -> 192.168.1.1 (obfuscated)
|
{ "2001:0000::f7f7:f7f7", false },// Teredo -> 8.8.8.8 (public, obfuscated)
|
// A regular global-unicast address under 2001::/16 must not be misread as Teredo/6to4.
|
{ "2001:4860:4860::8844", false },
|
};
|
}
|
|
@Test(dataProvider = "addressClassification")
|
public void testIsInternalAddress(String literal, boolean expectedInternal) throws Exception
|
{
|
// IP literals do not trigger DNS resolution.
|
InetAddress address = InetAddress.getByName(literal);
|
assertEquals(ByteStringUtility.isInternalAddress(address), expectedInternal,
|
"isInternalAddress(" + literal + ")");
|
}
|
|
@Test
|
public void testNat64NetworkSpecificPrefixIsNotBlockedByDefault() throws Exception
|
{
|
// An NSP is ordinary operator address space: without configuration it
|
// cannot be told apart from a global address, so it must stay allowed.
|
assertFalse(isInternal("2001:db8:122:344::c0a8:101"));
|
}
|
|
@Test
|
public void testConfiguredNat64PrefixFiltersEmbeddedIPv4() throws Exception
|
{
|
ByteStringUtility.setNat64Prefixes("2001:db8:122:344::/96");
|
assertTrue(isInternal("2001:db8:122:344::c0a8:101")); // -> 192.168.1.1
|
assertTrue(isInternal("2001:db8:122:344::7f00:1")); // -> 127.0.0.1
|
assertFalse(isInternal("2001:db8:122:344::808:808")); // -> 8.8.8.8 (public)
|
assertFalse(isInternal("2001:db8:122:345::c0a8:101")); // outside the prefix
|
}
|
|
@Test
|
public void testConfiguredNat64PrefixWith64BitLength() throws Exception
|
{
|
// RFC 6052 /64 format: the IPv4 address sits in bytes 9..12, after the "u" byte.
|
ByteStringUtility.setNat64Prefixes("2001:db8:122:344::/64");
|
assertTrue(isInternal("2001:db8:122:344:a:0:100:0")); // -> 10.0.0.1
|
assertFalse(isInternal("2001:db8:122:344:8:808:800:0"));// -> 8.8.8.8 (public)
|
}
|
|
@Test
|
public void testMultipleNat64PrefixesAreSupported() throws Exception
|
{
|
ByteStringUtility.setNat64Prefixes(" 2001:db8:122:344::/96 , 2001:db8:9::/96 ");
|
assertTrue(isInternal("2001:db8:122:344::a00:1")); // -> 10.0.0.1
|
assertTrue(isInternal("2001:db8:9::a9fe:a9fe")); // -> 169.254.169.254
|
assertFalse(isInternal("2001:db8:9::101:101")); // -> 1.1.1.1 (public)
|
}
|
|
@DataProvider
|
public Object[][] invalidNat64Prefixes()
|
{
|
return new Object[][] {
|
{ "2001:db8::" }, // no /length
|
{ "2001:db8::/95" }, // not an RFC 6052 prefix length
|
{ "2001:db8::/abc" }, // length is not a number
|
{ "not-an-address/96" }, // not an IP literal (must not trigger DNS)
|
{ "192.0.2.0/96" }, // IPv4, not IPv6
|
};
|
}
|
|
@Test(dataProvider = "invalidNat64Prefixes",
|
expectedExceptions = IllegalArgumentException.class)
|
public void testInvalidNat64PrefixesAreRejected(String prefixes)
|
{
|
ByteStringUtility.setNat64Prefixes(prefixes);
|
}
|
|
private boolean isInternal(String literal) throws Exception
|
{
|
return ByteStringUtility.isInternalAddress(InetAddress.getByName(literal));
|
}
|
|
@DataProvider
|
public Object[][] redirectCodes()
|
{
|
return new Object[][] { { 300 }, { 301 }, { 302 }, { 303 }, { 307 }, { 308 } };
|
}
|
|
@Test(dataProvider = "redirectCodes", expectedExceptions = IOException.class,
|
expectedExceptionsMessageRegExp = ".*redirect.*")
|
public void testRedirectsAreRefused(int responseCode) throws Exception
|
{
|
ByteStringUtility.assertNotRedirect(responseCode, new URI("http://203.0.113.10/"));
|
}
|
|
@Test
|
public void testNonRedirectCodesAreAccepted() throws Exception
|
{
|
ByteStringUtility.assertNotRedirect(200, new URI("http://203.0.113.10/"));
|
ByteStringUtility.assertNotRedirect(404, new URI("http://203.0.113.10/"));
|
}
|
|
@Test
|
public void testContentWithinCapIsReadFully() throws Exception
|
{
|
byte[] content = new byte[8192];
|
for (int i = 0; i < content.length; i++)
|
{
|
content[i] = (byte) i;
|
}
|
ByteStringUtility.setMaxUriContentLength(content.length);
|
ByteString value = ByteStringUtility.readCapped(
|
new ByteArrayInputStream(content), new URI("http://203.0.113.10/"));
|
assertEquals(value, ByteString.wrap(content));
|
}
|
|
@Test(expectedExceptions = IOException.class,
|
expectedExceptionsMessageRegExp = ".*maximum allowed size.*")
|
public void testContentOverCapIsRejected() throws Exception
|
{
|
ByteStringUtility.setMaxUriContentLength(1024);
|
ByteStringUtility.readCapped(
|
new ByteArrayInputStream(new byte[1025]), new URI("http://203.0.113.10/"));
|
}
|
|
@Test(expectedExceptions = IllegalArgumentException.class)
|
public void testZeroMaxSizeIsRejected()
|
{
|
ByteStringUtility.setMaxUriContentLength(0);
|
}
|
|
@Test(expectedExceptions = IllegalArgumentException.class)
|
public void testNegativeMaxSizeIsRejected()
|
{
|
ByteStringUtility.setMaxUriContentLength(-1);
|
}
|
|
@DataProvider
|
public Object[][] convertibleValues()
|
{
|
return new Object[][] {
|
{ "a string value", ByteString.valueOfUtf8("a string value") },
|
{ new byte[] { 1, 2, 3 }, ByteString.wrap(new byte[] { 1, 2, 3 }) },
|
{ URI.create("http://203.0.113.10/secret"),
|
ByteString.valueOfUtf8("http://203.0.113.10/secret") },
|
};
|
}
|
|
@Test(dataProvider = "convertibleValues")
|
public void testRequiredValueIsConverted(Object value, ByteString expected) throws Exception
|
{
|
assertEquals(ByteStringUtility.convertRequiredValue(value), expected);
|
}
|
|
/**
|
* The XML binding turns an anyURI whose lexical form java.net.URI rejects
|
* into a null value. Storing that would silently drop the value from the
|
* request, so it is reported to the client instead.
|
*/
|
@Test(expectedExceptions = IOException.class,
|
expectedExceptionsMessageRegExp = ".*value is missing.*")
|
public void testMissingRequiredValueIsRejected() throws Exception
|
{
|
ByteStringUtility.convertRequiredValue(null);
|
}
|
|
@Test(expectedExceptions = IOException.class,
|
expectedExceptionsMessageRegExp = ".*value is missing.*")
|
public void testUnconvertibleRequiredValueIsRejected() throws Exception
|
{
|
ByteStringUtility.convertRequiredValue(Integer.valueOf(42));
|
}
|
|
@Test
|
public void testSchemeCheckPrecedesHostCheck() throws Exception
|
{
|
ByteStringUtility.setDereferenceUri(true);
|
// A disallowed scheme must be rejected even for an internal host,
|
// and the internal host must be rejected for an allowed scheme.
|
try
|
{
|
ByteStringUtility.convertUri(new URI("file://127.0.0.1/etc/passwd"));
|
assertFalse(true, "expected IOException for disallowed scheme");
|
}
|
catch (IOException e)
|
{
|
assertTrue(e.getMessage().contains("disallowed scheme"), e.getMessage());
|
}
|
try
|
{
|
ByteStringUtility.convertUri(new URI("http://127.0.0.1/"));
|
assertFalse(true, "expected IOException for internal address");
|
}
|
catch (IOException e)
|
{
|
assertTrue(e.getMessage().contains("internal"), e.getMessage());
|
}
|
}
|
}
|
