webhook: additional check for payload url

Adds new global configurations to give more flexibility in controlling
payload URL for the webhooks. New domain-scope configs:
- webhook.delivery.blocklist
- webhook.delivery.allow.redirects
- webhook.delivery.allow.http
- webhook.delivery.block.local.addresses (Hidden)

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

Author: shwstppr

plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/WebhookApiServiceImpl.java

@@ -61,7 +61,6 @@
 import com.cloud.user.AccountManager;
 import com.cloud.utils.Pair;
 import com.cloud.utils.Ternary;
-import com.cloud.utils.UriUtils;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
@@ -221,10 +220,17 @@ protected void validateWebhookOwnerPayloadUrl(Account owner, String payloadUrl,
             return;
         }
         String error = String.format("Payload URL: %s is already in use by another webhook", payloadUrl);
-        logger.error(String.format("%s: %s for Account [%s]", error, webhookVO, owner));
+        logger.error("{}: {} for Account [{}]", error, webhookVO, owner);
         throw new InvalidParameterValueException(error);
     }
 
+    protected URI validatePayloadUrlByDeliverySecurityPolicy(String payloadUrl, long domainId) {
+        return WebhookUrlValidator.validateWebhookDestinationUrl(payloadUrl,
+                WebhookService.WebhookDeliveryAllowHttp.valueIn(domainId),
+                WebhookService.WebhookDeliveryBlocklist.valueIn(domainId),
+                WebhookService.WebhookDeliveryBlockLocalAddresses.value());
+    }
+
     @Override
     public ListResponse<WebhookResponse> listWebhooks(ListWebhooksCmd cmd) {
         final CallContext ctx = CallContext.current();
@@ -338,7 +344,7 @@ public WebhookResponse createWebhook(CreateWebhookCmd cmd) throws CloudRuntimeEx
                 throw new InvalidParameterValueException("Invalid state specified");
             }
         }
-        UriUtils.validateUrl(payloadUrl);
+        validatePayloadUrlByDeliverySecurityPolicy(payloadUrl, owner.getDomainId());
         validateWebhookOwnerPayloadUrl(owner, payloadUrl, null);
         URI uri = URI.create(payloadUrl);
         if (sslVerification && !HttpConstants.HTTPS.equalsIgnoreCase(uri.getScheme())) {
@@ -421,7 +427,7 @@ public WebhookResponse updateWebhook(UpdateWebhookCmd cmd) throws CloudRuntimeEx
         }
         URI uri = URI.create(webhook.getPayloadUrl());
         if (StringUtils.isNotEmpty(payloadUrl)) {
-            UriUtils.validateUrl(payloadUrl);
+            validatePayloadUrlByDeliverySecurityPolicy(payloadUrl, owner.getDomainId());
             validateWebhookOwnerPayloadUrl(owner, payloadUrl, webhook);
             uri = URI.create(payloadUrl);
             webhook.setPayloadUrl(payloadUrl);
@@ -540,8 +546,13 @@ public WebhookDeliveryResponse executeWebhookDelivery(ExecuteWebhookDeliveryCmd
             }
             webhook = webhookDao.findById(existingDelivery.getWebhookId());
         }
+        URI uri = null;
         if (StringUtils.isNotBlank(payloadUrl)) {
-            UriUtils.validateUrl(payloadUrl);
+            long domainId = owner.getDomainId();
+            if (webhook != null) {
+                domainId = webhook.getDomainId();
+            }
+            uri = validatePayloadUrlByDeliverySecurityPolicy(payloadUrl, domainId);
         }
         if (webhookId != null) {
             webhook = webhookDao.findById(webhookId);
@@ -562,7 +573,7 @@ public WebhookDeliveryResponse executeWebhookDelivery(ExecuteWebhookDeliveryCmd
             webhook = new WebhookVO(owner.getDomainId(), owner.getId(), payloadUrl, secretKey,
                     Boolean.TRUE.equals(sslVerification));
         }
-        WebhookDelivery webhookDelivery = webhookService.executeWebhookDelivery(existingDelivery, webhook, payload);
+        WebhookDelivery webhookDelivery = webhookService.executeWebhookDelivery(existingDelivery, webhook, payload, uri);
         if (webhookDelivery.getId() != WebhookDelivery.ID_DUMMY) {
             return createWebhookDeliveryResponse(webhookDeliveryJoinDao.findById(webhookDelivery.getId()));
         }

plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/WebhookDeliveryThread.java

@@ -19,7 +19,6 @@
 
 import java.io.IOException;
 import java.net.URI;
-import java.net.URISyntaxException;
 import java.nio.charset.StandardCharsets;
 import java.security.InvalidKeyException;
 import java.security.KeyManagementException;
@@ -40,11 +39,11 @@
 import org.apache.cloudstack.storage.command.CommandResult;
 import org.apache.commons.codec.DecoderException;
 import org.apache.commons.codec.binary.Base64;
-import org.apache.commons.httpclient.HttpStatus;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.http.Header;
 import org.apache.http.HttpEntity;
 import org.apache.http.HttpHeaders;
+import org.apache.http.HttpStatus;
 import org.apache.http.client.config.RequestConfig;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpPost;
@@ -63,13 +62,16 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
+import com.cloud.exception.InvalidParameterValueException;
+
 public class WebhookDeliveryThread implements Runnable {
     protected static Logger LOGGER = LogManager.getLogger(WebhookDeliveryThread.class);
 
     private static final String HEADER_X_CS_EVENT_ID = "X-CS-Event-ID";
     private static final String HEADER_X_CS_EVENT = "X-CS-Event";
     private static final String HEADER_X_CS_SIGNATURE = "X-CS-Signature";
     private static final String PREFIX_HEADER_USER_AGENT = "CS-Hookshot/";
+    private static final int MAX_REDIRECT_HOPS = 5;
     private final Webhook webhook;
     private final Event event;
     private CloseableHttpClient httpClient;
@@ -79,6 +81,11 @@ public class WebhookDeliveryThread implements Runnable {
     private Date startTime;
     private int deliveryTries = 3;
     private int deliveryTimeout = 10;
+    private String destinationBlocklist;
+    private boolean blockLocalAddresses = true;
+    private boolean allowRedirects;
+    private boolean allowHttp;
+    private URI payloadUri;
 
     AsyncCompletionCallback<WebhookDeliveryResult> callback;
 
@@ -97,19 +104,19 @@ protected boolean isValidJson(String json) {
 
     protected void setHttpClient() throws NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
         if (webhook.isSslVerification()) {
-            httpClient = HttpClients.createDefault();
+            httpClient = HttpClients.custom().disableRedirectHandling().build();
             return;
         }
         httpClient = HttpClients
                 .custom()
+                .disableRedirectHandling()
                 .setSSLContext(new SSLContextBuilder().loadTrustMaterial(null,
                         TrustAllStrategy.INSTANCE).build())
                 .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE)
                 .build();
     }
 
-    protected HttpPost getBasicHttpPostRequest() throws URISyntaxException {
-        final URI uri = new URI(webhook.getPayloadUrl());
+    protected HttpPost getBasicHttpPostRequest(final URI uri) {
         HttpPost request = new HttpPost();
         RequestConfig.Builder requestConfig = RequestConfig.custom();
         requestConfig.setConnectTimeout(deliveryTimeout * 1000);
@@ -143,13 +150,19 @@ protected void updateRequestHeaders(HttpPost request) throws DecoderException, N
         this.headers = StringUtils.join(headers, "\n");
     }
 
-    public WebhookDeliveryThread(Webhook webhook, Event event,
+    public WebhookDeliveryThread(Webhook webhook, Event event, URI uri,
                                  AsyncCompletionCallback<WebhookDeliveryResult> callback) {
         this.webhook = webhook;
         this.event = event;
+        this.payloadUri = uri;
         this.callback = callback;
     }
 
+    public WebhookDeliveryThread(Webhook webhook, Event event,
+                                 AsyncCompletionCallback<WebhookDeliveryResult> callback) {
+        this(webhook, event, null, callback);
+    }
+
     public void setDeliveryTries(int deliveryTries) {
         this.deliveryTries = deliveryTries;
     }
@@ -158,13 +171,29 @@ public void setDeliveryTimeout(int deliveryTimeout) {
         this.deliveryTimeout = deliveryTimeout;
     }
 
+    public void setDestinationBlocklist(String destinationBlocklist) {
+        this.destinationBlocklist = destinationBlocklist;
+    }
+
+    public void setBlockLocalAddresses(boolean blockLocalAddresses) {
+        this.blockLocalAddresses = blockLocalAddresses;
+    }
+
+    public void setAllowRedirects(boolean allowRedirects) {
+        this.allowRedirects = allowRedirects;
+    }
+
+    public void setAllowHttp(boolean allowHttp) {
+        this.allowHttp = allowHttp;
+    }
+
     @Override
     public void run() {
-        LOGGER.debug("Delivering event: {} for {}", event.getEventType(), webhook);
         if (event == null) {
             LOGGER.warn("Invalid event received for delivering to {}", webhook);
             return;
         }
+        LOGGER.debug("Delivering event: {} for {}", event.getEventType(), webhook);
         payload = event.getDescription();
         LOGGER.trace("Payload: {}", payload);
         int attempt = 0;
@@ -176,6 +205,10 @@ public void run() {
             callback.complete(new WebhookDeliveryResult(headers, payload, success, response, new Date()));
             return;
         }
+        if (payloadUri == null) {
+            payloadUri = WebhookUrlValidator.validateWebhookDestinationUrl(webhook.getPayloadUrl(), allowHttp,
+                    destinationBlocklist, blockLocalAddresses);
+        }
         while (attempt < deliveryTries) {
             attempt++;
             if (delivery(attempt)) {
@@ -188,7 +221,7 @@ public void run() {
 
     protected void updateResponseFromRequest(HttpEntity entity) {
         try {
-            this.response =  EntityUtils.toString(entity, StandardCharsets.UTF_8);
+            this.response = EntityUtils.toString(entity, StandardCharsets.UTF_8);
         } catch (IOException e) {
             LOGGER.error("Failed to parse response for event: {} for {}",
                     event.getEventType(), webhook);
@@ -199,30 +232,66 @@ protected void updateResponseFromRequest(HttpEntity entity) {
     protected boolean delivery(int attempt) {
         startTime = new Date();
         try {
-            HttpPost request = getBasicHttpPostRequest();
-            StringEntity input = new StringEntity(payload,
-                    isValidJson(payload) ? ContentType.APPLICATION_JSON : ContentType.TEXT_PLAIN);
-            request.setEntity(input);
-            updateRequestHeaders(request);
-            LOGGER.trace("Delivering event: {} for {} with timeout: {}, " +
-                            "attempt #{}", event.getEventType(), webhook,
-                    deliveryTimeout, attempt);
-            final CloseableHttpResponse response = httpClient.execute(request);
-            updateResponseFromRequest(response.getEntity());
-            if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
-                LOGGER.trace("Successfully delivered event: {} for {}",
-                        event.getEventType(), webhook);
-                return true;
+            int redirectsFollowed = 0;
+            URI currentUri = payloadUri;
+            while (true) {
+                HttpPost request = getBasicHttpPostRequest(currentUri);
+                StringEntity input = new StringEntity(payload,
+                        isValidJson(payload) ? ContentType.APPLICATION_JSON : ContentType.TEXT_PLAIN);
+                request.setEntity(input);
+                updateRequestHeaders(request);
+                LOGGER.trace("Delivering event: {} for {} with timeout: {}, attempt #{}, uri={}",
+                        event.getEventType(), webhook, deliveryTimeout, attempt, currentUri);
+                try (CloseableHttpResponse response = httpClient.execute(request)) {
+                    updateResponseFromRequest(response.getEntity());
+                    int statusCode = response.getStatusLine().getStatusCode();
+                    if (statusCode == HttpStatus.SC_OK) {
+                        LOGGER.trace("Successfully delivered event: {} for {}",
+                                event.getEventType(), webhook);
+                        return true;
+                    }
+                    if (!isRedirectStatus(statusCode)) {
+                        return false;
+                    }
+                    if (!allowRedirects) {
+                        this.response = String.format(
+                                "Delivery failed due to redirect status code %s while redirects are disabled",
+                                statusCode);
+                        return false;
+                    }
+                    Header locationHeader = response.getFirstHeader(HttpHeaders.LOCATION);
+                    if (locationHeader == null || StringUtils.isBlank(locationHeader.getValue())) {
+                        this.response = "Delivery failed due to redirect response without location header";
+                        return false;
+                    }
+                    redirectsFollowed++;
+                    if (redirectsFollowed > MAX_REDIRECT_HOPS) {
+                        this.response = String.format(
+                                "Delivery failed due to too many redirect hops (>%s)",
+                                MAX_REDIRECT_HOPS);
+                        return false;
+                    }
+                    currentUri = WebhookUrlValidator.validateWebhookDestinationURI(
+                            currentUri.resolve(locationHeader.getValue()),
+                            allowHttp,destinationBlocklist, blockLocalAddresses);
+                }
             }
-        } catch (URISyntaxException | IOException | DecoderException | NoSuchAlgorithmException |
-                 InvalidKeyException e) {
+        } catch (IOException | DecoderException | NoSuchAlgorithmException | InvalidKeyException e) {
             LOGGER.warn("Failed to deliver {}, in attempt #{} due to: {}",
                     webhook, attempt, e.getMessage());
             response = String.format("Failed due to : %s", e.getMessage());
+        } catch (InvalidParameterValueException e) {
+            LOGGER.warn("Failed to deliver {}, in attempt #{} due to security policy: {}",
+                    webhook, attempt, e.getMessage());
+            response = String.format("Failed due to : %s", e.getMessage());
         }
         return false;
     }
 
+    protected boolean isRedirectStatus(final int statusCode) {
+        return statusCode >= 300 && statusCode < 400;
+    }
+
     public static String generateHMACSignature(String data,  String key)
             throws InvalidKeyException, NoSuchAlgorithmException, DecoderException {
         Mac mac = Mac.getInstance("HMACSHA256");

plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/WebhookService.java

@@ -17,6 +17,8 @@
 
 package org.apache.cloudstack.mom.webhook;
 
+import java.net.URI;
+
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
 import org.apache.cloudstack.framework.events.Event;
@@ -42,6 +44,38 @@ public interface WebhookService extends PluggableService, Configurable {
             "Size of the thread pool for webhook deliveries",
             false, ConfigKey.Scope.Global);
 
+    ConfigKey<String> WebhookDeliveryBlocklist = new ConfigKey<>("Advanced", String.class,
+            "webhook.delivery.blocklist",
+            "0.0.0.0/8,10.0.0.0/8,100.64.0.0/10,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,"
+                    + "192.0.0.0/24,192.0.2.0/24,192.88.99.0/24,192.168.0.0/16,198.18.0.0/15,"
+                    + "198.51.100.0/24,203.0.113.0/24,224.0.0.0/4,240.0.0.0/4,"
+                    + "::1/128,::/128,::ffff:0:0/96,64:ff9b::/96,64:ff9b:1::/48,100::/64,"
+                    + "2001::/32,2001:db8::/32,2002::/16,fc00::/7,fe80::/10,ff00::/8",
+            "Comma-separated list of IPv4/IPv6 CIDR ranges where webhook deliveries are prohibited "
+                    + "from accessing. Validation is performed against the resolved destination IP "
+                    + "addresses.",
+            true, ConfigKey.Scope.Domain);
+
+    ConfigKey<Boolean> WebhookDeliveryBlockLocalAddresses = new ConfigKey<>("Hidden", Boolean.class,
+            "webhook.delivery.block.local.addresses", "true",
+            "Whether webhook deliveries are prohibited from accessing IP addresses assigned to "
+                    + "the local management server. Validation is performed against resolved "
+                    + "destination IP addresses.",
+            true, ConfigKey.Scope.Global);
+
+    ConfigKey<Boolean> WebhookDeliveryAllowRedirects = new ConfigKey<>("Advanced", Boolean.class,
+            "webhook.delivery.allow.redirects", "false",
+            "Whether webhook deliveries are allowed to follow HTTP redirects. If enabled, "
+                    + "each redirect target is validated against the destination blocklist and "
+                    + "local management server address restrictions, when enabled.",
+            true, ConfigKey.Scope.Domain);
+
+    ConfigKey<Boolean> WebhookDeliveryAllowHttp = new ConfigKey<>("Advanced", Boolean.class,
+            "webhook.delivery.allow.http", "false",
+            "Whether unencrypted HTTP URLs are allowed as webhook destinations. When false, "
+                    + "only HTTPS URLs are permitted.",
+            true, ConfigKey.Scope.Domain);
+
     ConfigKey<Integer> WebhookDeliveriesLimit = new ConfigKey<>("Advanced", Integer.class,
             "webhook.deliveries.limit", "10",
             "Limit for the number of deliveries to keep in DB per webhook",
@@ -57,7 +91,9 @@ public interface WebhookService extends PluggableService, Configurable {
             "Interval (in seconds) for cleaning up webhook deliveries",
             false, ConfigKey.Scope.Global);
 
+
+
     void handleEvent(Event event) throws EventBusException;
-    WebhookDelivery executeWebhookDelivery(WebhookDelivery delivery, Webhook webhook, String payload)
+    WebhookDelivery executeWebhookDelivery(WebhookDelivery delivery, Webhook webhook, String payload, URI uri)
             throws CloudRuntimeException;
 }