feat(runtime/permissions): support IP CIDR ranges in net allowlist

runtime/Cargo.toml

@@ -61,6 +61,7 @@ http = "0.2.4"
 hyper = { version = "0.14.10", features = ["server", "stream", "http1", "http2", "runtime"] }
 # TODO(lucacasonato): unlock when https://github.com/tkaitchuck/aHash/issues/95 is resolved
 indexmap = "=1.6.2"
+ipnet = "2.3.1"
 lazy_static = "1.4.0"
 libc = "0.2.98"
 log = "0.4.14"

runtime/permissions.rs

@@ -12,12 +12,14 @@ use deno_core::serde::Serialize;
 use deno_core::url;
 use deno_core::ModuleSpecifier;
 use deno_core::OpState;
+use ipnet::IpNet;
 use log::debug;
 use std::collections::HashSet;
 use std::fmt;
 use std::hash::Hash;
 #[cfg(not(test))]
 use std::io;
+use std::net::IpAddr;
 use std::path::{Path, PathBuf};
 #[cfg(test)]
 use std::sync::atomic::AtomicBool;
@@ -174,12 +176,50 @@ pub struct WriteDescriptor(pub PathBuf);
 #[derive(Clone, Eq, PartialEq, Hash, Debug, Default, Deserialize)]
 pub struct NetDescriptor(pub String, pub Option<u16>);
 
+fn split_cidr_port(addr: &str) -> Option<usize> {
+  // port specified after mask in CIDR
+  if addr.rfind(':') > addr.rfind('/') {
+    addr.rfind(':')
+  } else {
+    None
+  }
+}
+
+fn is_cidr(mut addr: &str) -> bool {
+  if addr.contains('[') || addr.contains(']') || !addr.contains('/') {
+    return false;
+  }
+
+  let port_index = split_cidr_port(addr);
+  if let Some(i) = port_index {
+    addr = &addr[..i];
+  }
+
+  let res: Result<IpNet, _> = addr.parse();
+  if res.is_err() {
+    return false;
+  }
+  let res = res.unwrap();
+
+  res.prefix_len() < res.max_prefix_len()
+}
+
 impl NetDescriptor {
   fn new<T: AsRef<str>>(host: &&(T, Option<u16>)) -> Self {
     NetDescriptor(host.0.as_ref().to_string(), host.1)
   }
 
   pub fn from_string(host: String) -> Self {
+    if is_cidr(&host) {
+      return match split_cidr_port(&host) {
+        Some(i) => NetDescriptor(
+          host[..i].into(),
+          Some(host[(i + 1)..].parse().unwrap()),
+        ),
+        None => NetDescriptor(host, None),
+      };
+    }
+
     let url = url::Url::parse(&format!("http://{}", host)).unwrap();
     let hostname = url.host_str().unwrap().to_string();
 
@@ -461,6 +501,31 @@ impl UnaryPermission<NetDescriptor> {
             None,
           )))
             || self.granted_list.contains(&NetDescriptor::new(host))
+            || {
+              let mut found_matching_cidr = false;
+              let ip: Result<IpAddr, _> = host.0.as_ref().parse();
+              if ip.is_err() {
+                return PermissionState::Prompt;
+              }
+              let ip = ip.unwrap();
+
+              for x in self.granted_list.iter() {
+                let net: &str = x.0.as_ref();
+                let net: Result<IpNet, _> = net.parse();
+                if net.is_err() {
+                  continue;
+                }
+                let net = net.unwrap();
+
+                found_matching_cidr =
+                  net.contains(&ip) && (x.1 == None || host.1 == x.1);
+
+                if found_matching_cidr {
+                  break;
+                }
+              }
+              found_matching_cidr
+            }
         }
       }
     {
@@ -1210,7 +1275,11 @@ mod tests {
         "github.com:3000",
         "127.0.0.1",
         "172.16.0.2:8000",
-        "www.github.com:443"
+        "www.github.com:443",
+        "10.7.0.0/24:8000",
+        "10.8.0.0/26",
+        "2001:db8::/32",
+        "2001:fb8::/32:8000"
       ]),
       ..Default::default()
     });
@@ -1233,6 +1302,16 @@ mod tests {
       ("172.16.0.2", 0, false),
       ("172.16.0.2", 6000, false),
       ("172.16.0.1", 8000, false),
+      ("10.7.0.1", 8000, true),
+      ("10.7.0.78", 8000, true),
+      ("10.7.0.1", 6000, false),
+      ("10.8.0.1", 8000, true),
+      ("10.8.0.78", 8000, false),
+      ("2001:db8::1", 8000, true),
+      ("2001:db8:ffff::", 8000, true),
+      ("2001:db9::", 8000, false),
+      ("2001:fb8:ffff::", 8000, true),
+      ("2001:fb8:ffff::", 6000, false),
       // Just some random hosts that should err
       ("somedomain", 0, false),
       ("192.168.0.1", 0, false),
@@ -1320,7 +1399,9 @@ mod tests {
         "github.com:3000",
         "127.0.0.1",
         "172.16.0.2:8000",
-        "www.github.com:443"
+        "www.github.com:443",
+        "10.7.0.0/24:8000",
+        "10.8.0.0/26"
       ]),
       ..Default::default()
     });
@@ -1360,6 +1441,10 @@ mod tests {
       ("https://172.16.0.2:6000", false),
       ("tcp://172.16.0.1:8000", false),
       ("https://172.16.0.1:8000", false),
+      ("tcp://10.7.0.78:8000", true),
+      ("tcp://10.7.0.78:6000", false),
+      ("tcp://10.8.0.1:1234", true),
+      ("tcp://10.8.0.78:1234", false),
       // Testing issue #6531 (Network permissions check doesn't account for well-known default ports) so we dont regress
       ("https://www.github.com:443/robots.txt", true),
     ];