mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
44a8e10bfc
AWS recently launched a new version of the EC2 Instance Metadata Service, which is used to provide credentials to the awslogs driver when running on Amazon EC2. This new version of the IMDS adds defense-in-depth mechanisms against open firewalls, reverse proxies, and SSRF vulnerabilities and is generally an improvement over the previous version. An updated version of the AWS SDK is able to handle the both the previous version and the new version of the IMDS and functions when either is enabled. More information about IMDSv2 is available at the following links: * https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/ * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html Closes https://github.com/moby/moby/issues/40422 Signed-off-by: Samuel Karp <skarp@amazon.com>
49 lines
1.4 KiB
Go
49 lines
1.4 KiB
Go
package protocol
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/aws/aws-sdk-go/aws/awserr"
|
|
"github.com/aws/aws-sdk-go/aws/request"
|
|
)
|
|
|
|
// RequireHTTPMinProtocol request handler is used to enforce that
|
|
// the target endpoint supports the given major and minor HTTP protocol version.
|
|
type RequireHTTPMinProtocol struct {
|
|
Major, Minor int
|
|
}
|
|
|
|
// Handler will mark the request.Request with an error if the
|
|
// target endpoint did not connect with the required HTTP protocol
|
|
// major and minor version.
|
|
func (p RequireHTTPMinProtocol) Handler(r *request.Request) {
|
|
if r.Error != nil || r.HTTPResponse == nil {
|
|
return
|
|
}
|
|
|
|
if !strings.HasPrefix(r.HTTPResponse.Proto, "HTTP") {
|
|
r.Error = newMinHTTPProtoError(p.Major, p.Minor, r)
|
|
}
|
|
|
|
if r.HTTPResponse.ProtoMajor < p.Major || r.HTTPResponse.ProtoMinor < p.Minor {
|
|
r.Error = newMinHTTPProtoError(p.Major, p.Minor, r)
|
|
}
|
|
}
|
|
|
|
// ErrCodeMinimumHTTPProtocolError error code is returned when the target endpoint
|
|
// did not match the required HTTP major and minor protocol version.
|
|
const ErrCodeMinimumHTTPProtocolError = "MinimumHTTPProtocolError"
|
|
|
|
func newMinHTTPProtoError(major, minor int, r *request.Request) error {
|
|
return awserr.NewRequestFailure(
|
|
awserr.New("MinimumHTTPProtocolError",
|
|
fmt.Sprintf(
|
|
"operation requires minimum HTTP protocol of HTTP/%d.%d, but was %s",
|
|
major, minor, r.HTTPResponse.Proto,
|
|
),
|
|
nil,
|
|
),
|
|
r.HTTPResponse.StatusCode, r.RequestID,
|
|
)
|
|
}
|