CVE-2019-13209

@@ -11,7 +11,6 @@ import (
 )
 
 type Router struct {
-	clusterLookup ClusterLookup
 	serverFactory *factory
 }
 
@@ -25,7 +24,12 @@ func New(localConfig *rest.Config, lookup ClusterLookup, dialer dialer.Factory,
 func (r *Router) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	c, handler, err := r.serverFactory.get(req)
 	if err != nil {
-		response(rw, httperror.ServerError, err.Error())
+		e, ok := err.(*httperror.APIError)
+		if ok {
+			response(rw, e.Code, e.Message)
+		} else {
+			response(rw, httperror.ServerError, err.Error())
+		}
 		return
 	}
 

@@ -0,0 +1,89 @@
+package websocket
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/rancher/norman/httperror"
+)
+
+func NewWebsocketHandler(handler http.Handler) http.Handler {
+	return &websocketHandler{
+		handler,
+	}
+}
+
+type websocketHandler struct {
+	next http.Handler
+}
+
+func (h websocketHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	if isWebsocket(req) {
+		if !checkSameOrigin(req) {
+			response(rw, httperror.PermissionDenied, "origin not allowed")
+			return
+		}
+	}
+	h.next.ServeHTTP(rw, req)
+}
+
+// Inspired by https://github.com/gorilla/websocket/blob/80c2d40e9b91f2ef7a9c1a403aeec64d1b89a9a6/server.go#L87
+// checkSameOrigin returns true if the origin is not set or is equal to the request host.
+func checkSameOrigin(r *http.Request) bool {
+	origin := r.Header["Origin"]
+	if len(origin) == 0 {
+		return true
+	}
+	u, err := url.Parse(origin[0])
+	if err != nil {
+		return false
+	}
+
+	if u.Port() == "" {
+		return u.Host == r.Host
+	}
+	return u.Host == r.Host && u.Port() == portOnly(r.Host)
+}
+
+// isWebsocket returns true if the request is a websocket
+func isWebsocket(r *http.Request) bool {
+	if !headerListContainsValue(r.Header, "Connection", "upgrade") {
+		return false
+	}
+	return true
+}
+
+// headerListContainsValue returns true if the token header with the given name contains token.
+func headerListContainsValue(header http.Header, name string, value string) bool {
+	for _, v := range header[name] {
+		for _, s := range strings.Split(v, ",") {
+			if strings.EqualFold(value, strings.TrimSpace(s)) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func response(rw http.ResponseWriter, code httperror.ErrorCode, message string) {
+	rw.WriteHeader(code.Status)
+	rw.Header().Set("content-type", "application/json")
+	json.NewEncoder(rw).Encode(httperror.NewAPIError(code, message))
+}
+
+// portOnly returns the port part of localhost:port, without the leading colon
+func portOnly(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return ""
+	}
+	if i := strings.Index(hostport, "]:"); i != -1 {
+		return hostport[i+len("]:"):]
+	}
+	if strings.Contains(hostport, "]") {
+		return ""
+	}
+	return hostport[colon+len(":"):]
+}

@@ -21,6 +21,7 @@ import (
 	"github.com/rancher/rancher/pkg/pipeline/hooks"
 	"github.com/rancher/rancher/pkg/rkenodeconfigserver"
 	"github.com/rancher/rancher/pkg/telemetry"
+	"github.com/rancher/rancher/pkg/websocket"
 	"github.com/rancher/rancher/server/capabilities"
 	"github.com/rancher/rancher/server/responsewriter"
 	"github.com/rancher/rancher/server/ui"
@@ -58,8 +59,9 @@ func Start(ctx context.Context, httpPort, httpsPort int, localClusterEnabled boo
 	if err != nil {
 		return err
 	}
+	websocketHandler := websocket.NewWebsocketHandler(authedHandler)
 
-	auditHandler := audit.NewAuditLogFilter(ctx, auditLogWriter, authedHandler)
+	auditHandler := audit.NewAuditLogFilter(ctx, auditLogWriter, websocketHandler)
 
 	webhookHandler := hooks.New(scaledContext)
 

@@ -1,3 +1,8 @@
+import pytest
+import rancher
+from .conftest import BASE_URL
+
+
 def test_certificates(admin_mc):
     client = admin_mc.client
 
@@ -10,3 +15,18 @@ def test_certificates(admin_mc):
             currentCount += 1
 
     assert currentCount == 1
+
+
+def test_websocket(admin_mc):
+    client = rancher.Client(url=BASE_URL, token=admin_mc.client.token,
+                            verify=False)
+    # make a request that looks like a websocket
+    client._session.headers["Connection"] = "upgrade"
+    client._session.headers["Upgrade"] = "websocket"
+    client._session.headers["Origin"] = "badStuff"
+    # do something with client now that we have a "websocket"
+
+    with pytest.raises(rancher.ApiError) as e:
+        client.list_cluster()
+
+    assert e.value.error.Code.Status == 403