mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
44a8e10bfc
AWS recently launched a new version of the EC2 Instance Metadata Service, which is used to provide credentials to the awslogs driver when running on Amazon EC2. This new version of the IMDS adds defense-in-depth mechanisms against open firewalls, reverse proxies, and SSRF vulnerabilities and is generally an improvement over the previous version. An updated version of the AWS SDK is able to handle the both the previous version and the new version of the IMDS and functions when either is enabled. More information about IMDSv2 is available at the following links: * https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/ * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html Closes https://github.com/moby/moby/issues/40422 Signed-off-by: Samuel Karp <skarp@amazon.com>
54 lines
1.3 KiB
Go
54 lines
1.3 KiB
Go
package protocol
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/aws/aws-sdk-go/aws"
|
|
"github.com/aws/aws-sdk-go/aws/request"
|
|
)
|
|
|
|
// HostPrefixHandlerName is the handler name for the host prefix request
|
|
// handler.
|
|
const HostPrefixHandlerName = "awssdk.endpoint.HostPrefixHandler"
|
|
|
|
// NewHostPrefixHandler constructs a build handler
|
|
func NewHostPrefixHandler(prefix string, labelsFn func() map[string]string) request.NamedHandler {
|
|
builder := HostPrefixBuilder{
|
|
Prefix: prefix,
|
|
LabelsFn: labelsFn,
|
|
}
|
|
|
|
return request.NamedHandler{
|
|
Name: HostPrefixHandlerName,
|
|
Fn: builder.Build,
|
|
}
|
|
}
|
|
|
|
// HostPrefixBuilder provides the request handler to expand and prepend
|
|
// the host prefix into the operation's request endpoint host.
|
|
type HostPrefixBuilder struct {
|
|
Prefix string
|
|
LabelsFn func() map[string]string
|
|
}
|
|
|
|
// Build updates the passed in Request with the HostPrefix template expanded.
|
|
func (h HostPrefixBuilder) Build(r *request.Request) {
|
|
if aws.BoolValue(r.Config.DisableEndpointHostPrefix) {
|
|
return
|
|
}
|
|
|
|
var labels map[string]string
|
|
if h.LabelsFn != nil {
|
|
labels = h.LabelsFn()
|
|
}
|
|
|
|
prefix := h.Prefix
|
|
for name, value := range labels {
|
|
prefix = strings.Replace(prefix, "{"+name+"}", value, -1)
|
|
}
|
|
|
|
r.HTTPRequest.URL.Host = prefix + r.HTTPRequest.URL.Host
|
|
if len(r.HTTPRequest.Host) > 0 {
|
|
r.HTTPRequest.Host = prefix + r.HTTPRequest.Host
|
|
}
|
|
}
|