Re: bin/58581: ftp(1) should allow specifying header fields in http requests

[Sunil Nimmagadda <sunil%nimmagadda.net@localhost>]

The following reply was made to PR bin/58581; it has been noted by GNATS.

From: Sunil Nimmagadda <sunil%nimmagadda.net@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: bin/58581: ftp(1) should allow specifying header fields in http
 requests
Date: Wed, 25 Sep 2024 09:43:37 +0530

 gnats-admin%netbsd.org@localhost writes:
 
 > The following reply was made to PR bin/58581; it has been noted by GNATS.
 >
 > From: Sunil Nimmagadda <sunil%nimmagadda.net@localhost>
 > To: gnats-bugs%netbsd.org@localhost
 > Cc: 
 > Subject: Re: bin/58581: ftp(1) should allow specifying header fields in http
 >  requests
 > Date: Sun, 11 Aug 2024 21:15:22 +0530
 >
 >  campbell+netbsd%mumble.net@localhost writes:
 >  
 >  >>Number:         58581
 >  >>Category:       bin
 >  >>Synopsis:       ftp(1) should allow specifying header fields in http requests
 >  >>Confidential:   no
 >  >>Severity:       serious
 >  >>Priority:       medium
 >  >>Responsible:    bin-bug-people
 >  >>State:          open
 >  >>Class:          change-request
 >  >>Submitter-Id:   net
 >  >>Arrival-Date:   Sun Aug 11 14:05:00 +0000 2024
 >  >>Originator:     Taylor R Campbell
 >  >>Release:        current, 10, 9, ...
 >  >>Organization:
 >  > The X-NetBSD: Fetchation
 >  >>Environment:
 >  >>Description:
 >  > It would be nice if you could add a custom header field to an http request.
 >  >
 >  > For example, the Instance Metadata Service version 2 in Oracle Compute
 >  > Infrastructure requires adding a header field `Authorization: Bearer
 >  > Oracle' in order to prevent SSRF attacks which might expose secret
 >  > keys.
 >  >
 >  > Similarly, the IMDSv2 in Amazon EC2 requires an X-aws-ec2-metadata-token header field, populated with a token retrieved by another request made with an X-aws-ec2-metadata-token-ttl-seconds field.
 >  >
 >  > Although you can do this with fancier http clients like curl(1), we
 >  > might want to use these in rc scripts at first boot like
 >  > /etc/rc.d/ec2_init, and it would be good if that worked only with
 >  > what's available in the base system.
 >  >>How-To-Repeat:
 >  > try to use a service that requires a custom header field
 >  >>Fix:
 >  > Add a `-H <headerfield>' option to ftp(1) like curl(1) has.
 
 Updated diff with two changes...
  - Support specifiying multiple -H <hdr> option.
  - Document new -H option in manpage.
 
 diff --git a/usr.bin/ftp/fetch.c b/usr.bin/ftp/fetch.c
 index a2ccd8c3897a..f714bb6b6f2b 100644
 --- a/usr.bin/ftp/fetch.c
 +++ b/usr.bin/ftp/fetch.c
 @@ -865,6 +865,7 @@ print_get(FETCH *fin, int hasleading, int isproxy, const struct urlinfo *oui,
      const struct urlinfo *ui)
  {
  	const char *leading = hasleading ? ", " : "  (";
 +	struct entry *np;
  
  	if (isproxy) {
  		if (verbose) {
 @@ -882,6 +883,9 @@ print_get(FETCH *fin, int hasleading, int isproxy, const struct urlinfo *oui,
  	print_host(fin, ui);
  	fetch_printf(fin, "Accept: */*\r\n");
  	fetch_printf(fin, "Connection: close\r\n");
 +	SLIST_FOREACH(np, &custom_headers, entries)
 +	    fetch_printf(fin, "%s\r\n", np->header);
 +
  	if (restart_point) {
  		fputs(leading, ttyout);
  		fetch_printf(fin, "Range: bytes=" LLF "-\r\n",
 diff --git a/usr.bin/ftp/ftp.1 b/usr.bin/ftp/ftp.1
 index 9d2319884706..c0663f800266 100644
 --- a/usr.bin/ftp/ftp.1
 +++ b/usr.bin/ftp/ftp.1
 @@ -67,6 +67,7 @@
  .Nm
  .Op Fl 46AadefginpRtVv\&?
  .Op Fl b Ar bufsize
 +.Op Fl H Ar hdr
  .Op Fl N Ar netrc
  .Op Fl o Ar output
  .Op Fl P Ar port
 @@ -223,6 +224,10 @@ or
  proxies.
  .It Fl g
  Disables file name globbing.
 +.It Fl H Ar hdr
 +Include
 +.Ar hdr
 +string as a custom HTTP header for an HTTP request.
  .It Fl i
  Turns off interactive prompting during
  multiple file transfers.
 diff --git a/usr.bin/ftp/ftp_var.h b/usr.bin/ftp/ftp_var.h
 index 1c7448dc0a75..2c12ae82d9ed 100644
 --- a/usr.bin/ftp/ftp_var.h
 +++ b/usr.bin/ftp/ftp_var.h
 @@ -101,6 +101,7 @@
  #endif
  
  #include <sys/param.h>
 +#include <sys/queue.h>
  
  #include <netinet/in.h>
  #include <arpa/inet.h>
 @@ -165,6 +166,14 @@ enum {
  	FEAT_max
  };
  
 +/*
 + * Custom HTTP headers
 + */
 +struct entry {
 +	SLIST_ENTRY(entry)	entries;
 +	const char		*header;
 +};
 +SLIST_HEAD(http_headers, entry);
  
  /*
   * Global defines
 @@ -320,8 +329,9 @@ GLOBAL	FILE	*cin;
  GLOBAL	FILE	*cout;
  GLOBAL	int	 data;
  
 -extern	struct cmd	cmdtab[];
 -extern	struct option	optiontab[];
 +extern	struct cmd		cmdtab[];
 +extern	struct option		optiontab[];
 +extern	struct http_headers	custom_headers;
  
  extern	size_t ftp_buflen;
  
 diff --git a/usr.bin/ftp/main.c b/usr.bin/ftp/main.c
 index 82e0b6656fd7..54fc1ca3cf64 100644
 --- a/usr.bin/ftp/main.c
 +++ b/usr.bin/ftp/main.c
 @@ -134,6 +134,8 @@ static int	usage(void);
  static int	usage_help(void);
  static void	setupoption(const char *, const char *, const char *);
  
 +struct http_headers custom_headers;
 +
  int
  main(int volatile argc, char **volatile argv)
  {
 @@ -267,7 +269,8 @@ main(int volatile argc, char **volatile argv)
  		}
  	}
  
 -	while ((ch = getopt(argc, argv, ":46Aab:defginN:o:pP:q:r:Rs:tT:u:vVx:")) != -1) {
 +	SLIST_INIT(&custom_headers);
 +	while ((ch = getopt(argc, argv, ":46Aab:defgH:inN:o:pP:q:r:Rs:tT:u:vVx:")) != -1) {
  		switch (ch) {
  		case '4':
  			family = AF_INET;
 @@ -315,6 +318,13 @@ main(int volatile argc, char **volatile argv)
  			doglob = 0;
  			break;
  
 +		case 'H':
 +			struct entry *p;
 +			p = ftp_malloc(sizeof *p);
 +			p->header = ftp_strdup(optarg);
 +			SLIST_INSERT_HEAD(&custom_headers, p, entries);
 +			break;
 +
  		case 'i':
  			interactive = 0;
  			break;