Class PublicNetworkConnector

Namespace

NuvTools.Security.Network

Assembly

NuvTools.Security.dll

Makes a SocketsHttpHandler connect only to addresses a NetworkAddressPolicy allows, judged at the moment of connecting.

public static class PublicNetworkConnector

Inheritance

object

PublicNetworkConnector

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Why at the socket and not before the request. Checking a URL, resolving it and then letting HttpClient resolve it again leaves a gap an attacker controls: their DNS answers a public address to the check and a private one to the connection. Here the address that is checked is the address the socket connects to — there is no second lookup.

Every connection goes through the callback, redirects included, so a public URL answering 302 Location: http://169.254.169.254/ is refused at the second hop. The proxy is switched off, because through a proxy the callback would only ever see the proxy's address.

Works with anything built on SocketsHttpHandler: an HttpClient, an IHttpClientFactory primary handler, or a reverse proxy's forwarder handler.

Methods

Apply(SocketsHttpHandler, NetworkAddressPolicy?)

Applies the policy to an existing handler, replacing its connect callback and its proxy.

public static void Apply(SocketsHttpHandler handler, NetworkAddressPolicy? policy = null)

Parameters

handler SocketsHttpHandler

The handler to restrict.

policy NetworkAddressPolicy

The policy; PublicOnly when omitted.

CreateConnectCallback(NetworkAddressPolicy)

The connect callback itself, for a handler configured elsewhere.

public static Func<SocketsHttpConnectionContext, CancellationToken, ValueTask<Stream>> CreateConnectCallback(NetworkAddressPolicy policy)

Parameters

policy NetworkAddressPolicy

Returns

Func<SocketsHttpConnectionContext, CancellationToken, ValueTask<Stream>>

CreateHandler(NetworkAddressPolicy?)

Creates a handler that connects only where policy allows.

public static SocketsHttpHandler CreateHandler(NetworkAddressPolicy? policy = null)

Parameters

policy NetworkAddressPolicy

The policy; PublicOnly when omitted.

Returns

SocketsHttpHandler