Vault Agent Cache Auto-Auth SSRF Protection

api/client.go

@@ -433,7 +433,7 @@ func NewClient(c *Config) (*Client, error) {
 	}
 
 	// Add the VaultRequest SSRF protection header
-	client.headers["Vault-Request"] = []string{"true"}
+	client.headers[consts.VaultRequestHeader] = []string{"true"}
 
 	if token := os.Getenv(EnvVaultToken); token != "" {
 		client.token = token

command/agent/cache/handler.go

@@ -10,7 +10,6 @@ import (
 	"io"
 	"io/ioutil"
 	"net/http"
-	"reflect"
 	"time"
 
 	"github.com/hashicorp/errwrap"
@@ -27,14 +26,13 @@ func Handler(ctx context.Context, logger hclog.Logger, proxier Proxier, inmemSin
 
 		// Check for the required request header
 		if requireRequestHeader {
-			val, ok := r.Header["Vault-Request"]
-			if !ok || !reflect.DeepEqual(val, []string{"true"}) {
+			if val, ok := r.Header[consts.VaultRequestHeader]; !ok || len(val) != 1 || val[0] != "true" {
 				logical.RespondError(w, http.StatusPreconditionFailed, errors.New("missing 'Vault-Request' header"))
 				return
 			}
 
 			// Remove the required request header
-			delete(r.Header, "Vault-Request")
+			delete(r.Header, consts.VaultRequestHeader)
 		}
 
 		// Get token from the header

command/agent_test.go

@@ -4,7 +4,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
+	"net/http"
 	"os"
+	"reflect"
 	"sync"
 	"testing"
 	"time"
@@ -15,6 +17,7 @@ import (
 	credAppRole "github.com/hashicorp/vault/builtin/credential/approle"
 	"github.com/hashicorp/vault/command/agent"
 	vaulthttp "github.com/hashicorp/vault/http"
+	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
@@ -377,7 +380,7 @@ auto_auth {
 
 func TestAgent_RequireRequestHeader(t *testing.T) {
 
-	// request is a helper function that issues HTTP requests.
+	// request issues HTTP requests.
 	request := func(client *api.Client, req *api.Request, expectedStatusCode int) map[string]interface{} {
 		resp, err := client.RawRequest(req)
 		if err != nil {
@@ -403,8 +406,7 @@ func TestAgent_RequireRequestHeader(t *testing.T) {
 		return body
 	}
 
-	// makeTempFile is a helper function that creates a temp file and
-	// populates it.
+	// makeTempFile creates a temp file and populates it.
 	makeTempFile := func(name, contents string) string {
 		f, err := ioutil.TempFile("", name)
 		if err != nil {
@@ -416,7 +418,7 @@ func TestAgent_RequireRequestHeader(t *testing.T) {
 		return path
 	}
 
-	// newApiClient is a helper function that creates an *api.Client.
+	// newApiClient creates an *api.Client.
 	newApiClient := func(addr string, includeVaultRequestHeader bool) *api.Client {
 		conf := api.DefaultConfig()
 		conf.Address = addr
@@ -425,11 +427,16 @@ func TestAgent_RequireRequestHeader(t *testing.T) {
 			t.Fatalf("err: %s", err)
 		}
 
+		h := cli.Headers()
+		val, ok := h[consts.VaultRequestHeader]
+		if !ok || !reflect.DeepEqual(val, []string{"true"}) {
+			t.Fatal("invalid Vault-Request header")
+		}
 		if !includeVaultRequestHeader {
-			h := cli.Headers()
-			delete(h, "Vault-Request")
+			delete(h, consts.VaultRequestHeader)
 			cli.SetHeaders(h)
 		}
+
 		return cli
 	}
 
@@ -588,12 +595,27 @@ listener "tcp" {
 	if err == nil {
 		t.Fatalf("expected error")
 	}
-	if resp.StatusCode != 412 {
-		t.Fatalf("expected status code %d, not %d", 412, resp.StatusCode)
+	if resp.StatusCode != http.StatusPreconditionFailed {
+		t.Fatalf("expected status code %d, not %d", http.StatusPreconditionFailed, resp.StatusCode)
+	}
+
+	// Test against a listener configuration that sets 'require_request_header'
+	// to 'true', with an invalid header present in the request.
+	agentClient = newApiClient("http://127.0.0.1:8103", false)
+	h := agentClient.Headers()
+	h[consts.VaultRequestHeader] = []string{"bogus"}
+	agentClient.SetHeaders(h)
+	req = agentClient.NewRequest("GET", "/v1/sys/health")
+	resp, err = agentClient.RawRequest(req)
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if resp.StatusCode != http.StatusPreconditionFailed {
+		t.Fatalf("expected status code %d, not %d", http.StatusPreconditionFailed, resp.StatusCode)
 	}
 
 	// Test against a listener configuration that sets 'require_request_header'
-	// to 'true', with the header present in the request.
+	// to 'true', with the proper header present in the request.
 	agentClient = newApiClient("http://127.0.0.1:8103", true)
 	req = agentClient.NewRequest("GET", "/v1/sys/health")
 	request(agentClient, req, 200)

sdk/helper/consts/agent.go

@@ -3,3 +3,7 @@ package consts
 // AgentPathCacheClear is the path that the agent will use as its cache-clear
 // endpoint.
 const AgentPathCacheClear = "/agent/v1/cache-clear"
+
+// VaultRequestHeader is the name of the header entry used by the Agent for
+// SSRF protection.
+const VaultRequestHeader = "Vault-Request"