Userspace install source_url fetch: DNS-rebinding/TOCTOU SSRF hardening (pin validated IP)

[jaylfc]

Background security review (MEDIUM). is_safe_public_url (tinyagentos/userspace/url_guard.py) resolves + validates a hostname's IPs, but install_app then re-resolves the hostname when httpx connects, leaving a DNS-rebinding / TOCTOU window where the connected IP can differ from the validated one (and bounce to an internal address).

Fix

Resolve once in is_safe_public_url, return the validated IP(s), and pin the httpx connection to that IP (a custom transport / pinned resolver) while preserving the original Host header and SNI for TLS.

Scheduling

This lives in install_app's source_url fetch, which the P2 distribution phase rebuilds into a proper download broker (signed-bundle fetch + sha256 + signature + min_os verification). The DNS-pinned fetch belongs there, so it is folded into P2 rather than fixed in isolation, and to avoid colliding with the in-flight P3b branch that edits the same install_app function.

Note: is_safe_public_url already blocks the obvious case (private / loopback / reserved IPs at check time); this closes the rebinding residual. Not yet on master (master is gated), so not shipping.

Part of #89 (P2 download broker).

[simonlpaige]

Looking at this from a practical standpoint, the approach of folding this into P2 makes sense to avoid merge conflicts with P3b, but there's a simpler intermediate hardening you could apply right now without touching install_app at all.

In url_guard.py, after resolving and validating the IPs, you could cache the resolved IP-to-hostname mapping with a TTL equal to the DNS TTL from the original query (or a conservative default like 30s). Then add a lightweight middleware in the httpx client factory that intercepts connections and rejects any that don't match the cached mapping. This would live entirely outside install_app and wouldn't conflict with P3b's edits.

For the pinned resolver approach you mentioned, httpx supports custom transports - specifically httpx.AsyncHTTPTransport with a custom resolve callback. The key detail: you need to set verify_mode and pass the original hostname as the SNI hint via ssl.SSLContext.server_hostname, otherwise TLS verification will fail on the IP address. The tls_extensions callback in Python 3.12+ can also handle this more cleanly.

If you want a reference implementation, aiohttp's TCPConnector with resolve=async_dns_resolver and custom ssl_context has been used in production for this exact pattern.

[jaylfc]

Thanks, this is really helpful. The cached IP-to-hostname mapping with a TTL-bound check in the httpx client factory is a clean intermediate step, it keeps the hardening out of install_app so it won't collide with P3b, which is exactly the constraint I was worried about. Good catch on the SNI hint too; pinning to the validated IP without setting server_hostname would have broken TLS verification and I'd have chased that for a while. I'll prototype the client-factory middleware approach first and fall back to the custom transport if the connection-intercept point isn't clean enough. Appreciate the references.