transport: validate Bearer realm URL to prevent SSRF (#2243)

fromChallenge() stored the realm value from a WWW-Authenticate header
verbatim without validation. A malicious or MITM'd registry could supply
a realm pointing at a private/link-local address (e.g. 169.254.169.254)
or use a non-HTTP scheme, causing the client to make token-fetch requests
to internal services when pulling images.

Add validateRealmURL() which enforces:
- Scheme allowlist: only https is accepted for secure registries; http
  is additionally accepted when the registry is marked insecure.
- IP literal blocklist: loopback, link-local unicast/multicast, and
  private-range addresses are rejected. This blocks direct SSRF to cloud
  instance metadata services and RFC 1918 networks. DNS-based SSRF is
  out of scope and should be handled at the network layer.

Author: evilgensec

pkg/v1/remote/transport/bearer.go

@@ -82,6 +82,13 @@ func fromChallenge(reg name.Registry, auth authn.Authenticator, t http.RoundTrip
 	if !ok {
 		return nil, fmt.Errorf("malformed www-authenticate, missing realm: %v", pr.Parameters)
 	}
+	// Validate the realm URL before storing it. A malicious or compromised
+	// registry can supply a realm pointing at an internal service or cloud
+	// metadata endpoint (e.g. 169.254.169.254), causing SSRF when the client
+	// subsequently fetches a token.
+	if err := validateRealmURL(realm, pr.Insecure); err != nil {
+		return nil, fmt.Errorf("invalid realm in www-authenticate: %w", err)
+	}
 	service := pr.Parameters["service"]
 	scheme := "https"
 	if pr.Insecure {
@@ -98,6 +105,38 @@ func fromChallenge(reg name.Registry, auth authn.Authenticator, t http.RoundTrip
 	}, nil
 }
 
+// validateRealmURL returns an error if the realm URL uses a disallowed scheme
+// or resolves to a private / link-local IP address. This prevents a crafted
+// WWW-Authenticate header from redirecting token fetches to internal services.
+func validateRealmURL(realm string, insecure bool) error {
+	u, err := url.Parse(realm)
+	if err != nil {
+		return fmt.Errorf("parsing realm %q: %w", realm, err)
+	}
+	switch u.Scheme {
+	case "https":
+		// always allowed
+	case "http":
+		if !insecure {
+			return fmt.Errorf("realm scheme %q not allowed for a secure registry; use https", u.Scheme)
+		}
+	default:
+		return fmt.Errorf("realm scheme %q not allowed; must be https (or http for insecure registries)", u.Scheme)
+	}
+	// Reject IP literals that resolve to private or link-local ranges.
+	// This blocks direct references to RFC 1918 addresses, loopback, and
+	// link-local ranges including the cloud instance metadata service
+	// (169.254.169.254 / fd00:ec2::254).  DNS-based SSRF is out of scope
+	// here; callers should apply network-level controls if needed.
+	host := u.Hostname()
+	if ip := net.ParseIP(host); ip != nil {
+		if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() {
+			return fmt.Errorf("realm host %q is a private or link-local address", host)
+		}
+	}
+	return nil
+}
+
 type bearerTransport struct {
 	mx sync.RWMutex
 	// Wrapped by bearerTransport.