Merge pull request #20 from JavaScriptSolidServer/issue-19-relay-ssrf-hardening

Security: relay-harvest SSRF hardening + bomb cap + junk cleanup

Author: melvincarvalho

package.json

@@ -11,7 +11,8 @@
     "start": "node index.js",
     "index": "node -e \"import('./src/indexer.js').then(m => m.runIndexer())\"",
     "serve": "node -e \"import('./src/server.js').then(m => m.startServer())\"",
-    "probe": "node probe.js"
+    "probe": "node probe.js",
+    "clean:relays": "node scripts/clean-relays.js"
   },
   "dependencies": {
     "@noble/curves": "^2.2.0",

scripts/clean-relays.js

@@ -0,0 +1,30 @@
+// One-off: purge relay-directory docs whose URL fails the SSRF/format screen
+// (loopback, private/reserved IPs, .onion, IP-literals, malformed hosts).
+// Uses the exact same `safeRelayUrl` the harvest + prober now enforce.
+//
+//   node scripts/clean-relays.js --dry   # report only
+//   node scripts/clean-relays.js         # delete
+import { connect, close } from '../src/db.js';
+import { safeRelayUrl } from '../src/hoses/relays.js';
+import 'dotenv/config';
+
+const RELAY_DIRECTORY = process.env.MONGO_RELAY_DIRECTORY_COLLECTION || 'relays';
+const DRY = process.argv.includes('--dry');
+
+const db = await connect();
+const col = db.collection(RELAY_DIRECTORY);
+const before = await col.estimatedDocumentCount();
+
+const bad = [];
+for await (const d of col.find({}, { projection: { relay: 1 } })) {
+  if (!d.relay || !safeRelayUrl(d.relay)) bad.push(d._id);
+}
+console.log(`[clean] ${before} relays, ${bad.length} unsafe/malformed (${DRY ? 'dry run' : 'deleting'})`);
+
+if (bad.length && !DRY) {
+  for (let i = 0; i < bad.length; i += 1000) {
+    await col.deleteMany({ _id: { $in: bad.slice(i, i + 1000) } });
+  }
+  console.log(`[clean] deleted ${bad.length}; ${await col.estimatedDocumentCount()} remain`);
+}
+await close();

src/hoses/relays.js

@@ -1,32 +1,72 @@
 // Shared relay-directory helpers, used by any hose that discovers relay URLs
-// (follows harvests them from legacy kind-3 content; relay-lists from kind-3…
-// sorry, kind-10002 `r` tags). Discovery only seeds the URL — it never touches
-// the health metrics the relay-health prober owns.
+// (follows harvests them from legacy kind-3 content; relay-lists from kind-10002
+// `r` tags) and by the relay-health prober.
+//
+// SECURITY: relay URLs come from arbitrary, attacker-controllable Nostr events.
+// `safeRelayUrl` is the single chokepoint that canonicalizes a URL and rejects
+// anything we must never dial — loopback, private/reserved ranges, link-local,
+// IP-literals, .onion, and malformed hosts — so the prober can't be turned into
+// an SSRF amplifier against our own host or internal network.
 const RELAY_DIRECTORY = process.env.MONGO_RELAY_DIRECTORY_COLLECTION || 'relays';
 
-// Trailing slash on bare origins (so `wss://r.com` and `wss://r.com/` dedupe);
-// keep an explicit path as-is. Non-ws(s) or unparseable URLs return null.
-export function canonicalizeRelayUrl(url) {
-  try {
-    const u = new URL(url);
-    if (u.protocol !== 'wss:' && u.protocol !== 'ws:') return null;
-    if (u.pathname === '' || u.pathname === '/') return `${u.protocol}//${u.host}/`;
-    return url;
-  } catch { return null; }
+// Max relay URLs harvested from a single event — a real NIP-65 list is tiny;
+// a 9,000-tag event is a bomb. Truncate rather than ingest the lot.
+export const MAX_HARVEST_PER_EVENT = Number(process.env.RELAY_HARVEST_CAP) || 100;
+
+const DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/i;
+
+// Is this hostname a private / loopback / reserved / otherwise un-probeable
+// target we must refuse? Operates on the literal host (no DNS resolution).
+function isBlockedHost(host) {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, ''); // strip IPv6 brackets
+  if (!h) return true;
+  if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local')) return true;
+  if (h.endsWith('.onion')) return true;            // can't reach without Tor
+  if (h === '::1' || h.startsWith('fe80:') || h.startsWith('fc') || h.startsWith('fd')) return true; // IPv6 loopback/link-local/ULA
+  // IPv4 literal?
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (m) {
+    const [a, b] = [Number(m[1]), Number(m[2])];
+    if (a === 10 || a === 127 || a === 0 || a >= 224) return true;          // private/loopback/this-host/multicast+reserved
+    if (a === 169 && b === 254) return true;                                 // link-local incl. cloud metadata
+    if (a === 192 && b === 168) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;                       // CGNAT
+    return true; // any other bare IPv4 literal: relays should use DNS names
+  }
+  if (/^[0-9a-f:]+$/i.test(h) && h.includes(':')) return true;               // any other IPv6 literal
+  return !DNS_NAME.test(h);                                                   // require a real DNS hostname
 }
 
+/**
+ * Canonicalize + security-screen a relay URL. Returns the normalized wss/ws URL
+ * (trailing slash on bare origins), or null if it must not be stored/dialed.
+ */
+export function safeRelayUrl(url) {
+  let u;
+  try { u = new URL(String(url)); } catch { return null; }
+  if (u.protocol !== 'wss:' && u.protocol !== 'ws:') return null;
+  if (isBlockedHost(u.hostname)) return null;
+  if (u.pathname === '' || u.pathname === '/') return `${u.protocol}//${u.host}/`;
+  return u.toString();
+}
+
+// Back-compat alias (older callers/tests): same screening as safeRelayUrl.
+export const canonicalizeRelayUrl = safeRelayUrl;
+
 export async function ensureRelayDirectoryIndex(db) {
   await db.collection(RELAY_DIRECTORY).createIndex({ relay: 1 })
     .catch((e) => { if (e?.code !== 85 && e?.code !== 86) throw e; });
 }
 
 /**
  * Best-effort discovery: seed newly-seen relay URLs into the directory without
- * touching any existing fields ($setOnInsert). Canonicalizes + dedupes first.
- * Never throws — discovery must never fail an ingest. Returns the count seeded.
+ * touching any existing fields ($setOnInsert). Screens + dedupes first, and
+ * caps how many it accepts from one event (bomb protection). Never throws.
+ * Returns the count seeded.
  */
 export async function harvestRelays(db, urls) {
-  const uniq = [...new Set((urls || []).map(canonicalizeRelayUrl).filter(Boolean))];
+  const uniq = [...new Set((urls || []).map(safeRelayUrl).filter(Boolean))].slice(0, MAX_HARVEST_PER_EVENT);
   if (!uniq.length) return 0;
   await db.collection(RELAY_DIRECTORY).bulkWrite(
     uniq.map((relay) => ({ updateOne: { filter: { relay }, update: { $setOnInsert: { relay } }, upsert: true } })),

src/prober.js

@@ -7,7 +7,7 @@
 // The relay universe is the `relays` collection itself, continuously seeded by
 // the follows/relay-lists hoses' URL harvesting.
 import { connect } from './db.js';
-import { ensureRelayDirectoryIndex } from './hoses/relays.js';
+import { ensureRelayDirectoryIndex, safeRelayUrl } from './hoses/relays.js';
 import 'dotenv/config';
 
 const RELAY_DIRECTORY = process.env.MONGO_RELAY_DIRECTORY_COLLECTION || 'relays';
@@ -126,14 +126,18 @@ async function mapPool(items, concurrency, fn) {
 /** One full sweep over every relay in the directory. Returns { total, online }. */
 export async function sweepOnce(db, cfg) {
   const docs = await db.collection(RELAY_DIRECTORY).find({}, { projection: { relay: 1, _id: 0 } }).toArray();
-  const relays = [...new Set(docs.map((d) => d.relay).filter(Boolean))];
+  const all = [...new Set(docs.map((d) => d.relay).filter(Boolean))];
+  // Defense-in-depth: never dial loopback/private/reserved targets, even if
+  // junk slipped into the directory before harvest hardening (SSRF guard).
+  const relays = all.filter((r) => safeRelayUrl(r));
+  const skipped = all.length - relays.length;
   let online = 0;
   await mapPool(relays, cfg.concurrency, async (relay) => {
     try { if ((await probeRelay(db, relay, cfg)).online) online++; }
     catch (e) { console.error(`[beacon] probe error ${relay}: ${e.message}`); }
   });
-  console.log(`[beacon] relay sweep: ${online}/${relays.length} online`);
-  return { total: relays.length, online };
+  console.log(`[beacon] relay sweep: ${online}/${relays.length} online${skipped ? ` (skipped ${skipped} unsafe)` : ''}`);
+  return { total: relays.length, online, skipped };
 }
 
 export async function runProber() {

test/relay-safety.test.js

@@ -0,0 +1,47 @@
+// safeRelayUrl is the SSRF/format chokepoint for harvested relay URLs.
+// Regression net for the relay-bomb incident (kind-10002 r-tag bombs full of
+// loopback/private/.onion targets the prober would otherwise have dialed).
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { safeRelayUrl, MAX_HARVEST_PER_EVENT } from '../src/hoses/relays.js';
+
+test('accepts normal relays; canonicalizes bare origins', () => {
+  assert.equal(safeRelayUrl('wss://relay.damus.io'), 'wss://relay.damus.io/');
+  assert.equal(safeRelayUrl('wss://relay.damus.io/'), 'wss://relay.damus.io/');
+  assert.equal(safeRelayUrl('wss://nos.lol/inbox'), 'wss://nos.lol/inbox');
+  assert.equal(safeRelayUrl('ws://relay.example.com'), 'ws://relay.example.com/');
+});
+
+test('rejects loopback / localhost (would hit our own host)', () => {
+  for (const u of ['wss://localhost', 'wss://localhost:3001', 'ws://127.0.0.1:4848/',
+    'wss://app.localhost', 'wss://relay.local', 'wss://[::1]/', 'wss://0.0.0.0/']) {
+    assert.equal(safeRelayUrl(u), null, u);
+  }
+});
+
+test('rejects private / reserved / link-local ranges', () => {
+  for (const u of ['ws://10.0.0.1:9173/', 'wss://192.168.1.5/', 'wss://172.16.0.1/',
+    'wss://172.31.255.255/', 'wss://169.254.169.254/', 'wss://100.64.0.1/', 'wss://fe80::1/', 'wss://fc00::1/']) {
+    assert.equal(safeRelayUrl(u), null, u);
+  }
+});
+
+test('rejects all bare IP-literals (relays must use DNS names)', () => {
+  assert.equal(safeRelayUrl('wss://8.8.8.8/'), null);     // public IP, still rejected
+  assert.equal(safeRelayUrl('wss://1.2.3.4:7000/'), null);
+});
+
+test('rejects .onion (unreachable without Tor)', () => {
+  assert.equal(safeRelayUrl('wss://abcdefghij234567.onion/'), null);
+});
+
+test('rejects malformed / double-scheme / non-ws', () => {
+  for (const u of ['garbage', '', 'https://relay.example.com', 'wss://http://nostr-01.example.com',
+    'wss://', 'wss://nodot', 'http://relay.example.com']) {
+    assert.equal(safeRelayUrl(u), null, JSON.stringify(u));
+  }
+});
+
+test('harvest cap is sane (bomb protection)', () => {
+  assert.ok(MAX_HARVEST_PER_EVENT >= 1 && MAX_HARVEST_PER_EVENT <= 1000);
+});