Merged PR 13618357: guest/network: Restrict hostname to valid characters

[cherry-picked from 055ee5eb4a802cb407575fb6cc1e9b07069d3319]

guest/network: Restrict hostname to valid characters

Because we write this hostname to /etc/hosts, without proper validation the host
can trick us into writing arbitrary data to /etc/hosts, which can, for example,
redirect things like ip6-localhost (but likely not localhost itself) to an
attacker-controlled IP address.

We implement a check here that the host-provided DNS name in the OCI spec is
valid.

ACI actually restricts this to 5-63 characters of a-zA-Z0-9 and '-', where the
first and last characters can not be '-'.  This aligns with the Kubernetes
restriction.  c.f. IsValidDnsLabel in Compute-ACI.  However, there is no
consistent official agreement on what a valid hostname can contain.  RFC 952
says that "Domain name" can be up to 24 characters of A-Z0-9 '.' and '-', RFC
1123 expands this to 255 characters, but RFC 1035 claims that domain names can
in fact contain anything if quoted (as long as the length is within 255
characters), and this is confirmed again in RFC 2181.  In practice we see names
with underscopes, most commonly \_dmarc.example.com.  curl allows 0-9a-zA-Z and
-.\_|~ and any other codepoints from \u0001-\u001f and above \u007f:
https://github.com/curl/curl/blob/master/lib/urlapi.c#L527-L545

With the above in mind, this commit allows up to 255 characters of a-zA-Z0-9 and
'_', '-' and '.'.  This change is applied to all LCOW use cases.

This fix can be tested with the below code to bypass any host-side checks:

	+++ b/internal/hcsoci/hcsdoc_lcow.go
	@@ -52,6 +52,10 @@ func createLCOWSpec(ctx context.Context, coi *createOptionsInternal) (*specs.Spe
			spec.Linux.Seccomp = nil
		}

	+	if spec.Annotations[annotations.KubernetesContainerType] == "sandbox" {
	+		spec.Hostname = "invalid-hostname\n1.1.1.1 ip6-localhost ip6-loopback localhost"
	+	}
	+
		return spec, nil
	}

Output:

	time="2025-10-01T15:13:41Z" level=fatal msg="run pod sandbox: rpc error: code = Unknown desc = failed to create containerd task: failed to create shim task: failed to create container f2209bb2960d5162fc9937d3362e1e2cf1724c56d1296ba2551ce510cb2bcd43: guest RPC failure: hostname \"invalid-hostname\\n1.1.1.1 ip6-localhost ip6-loopback localhost\" invalid: must match ^[a-zA-Z0-9_\\-\\.]{0,999}$: unknown"

Related work items: #34370598
Closes: https://msazure.visualstudio.com/One/_workitems/edit/34370598
Signed-off-by: Tingmao Wang <tingmaowang@microsoft.com>

Author: micromaomao

internal/guest/network/network.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"time"
 
@@ -32,6 +33,18 @@ var (
 // maxDNSSearches is limited to 6 in `man 5 resolv.conf`
 const maxDNSSearches = 6
 
+var validHostnameRegex = regexp.MustCompile(`^[a-zA-Z0-9_\-\.]{0,255}$`)
+
+// Check that the hostname is safe. This function is less strict than
+// technically allowed, but ensures that when the hostname is inserted to
+// /etc/hosts, it cannot lead to injection attacks.
+func ValidateHostname(hostname string) error {
+	if !validHostnameRegex.MatchString(hostname) {
+		return errors.Errorf("hostname %q invalid: must match %s", hostname, validHostnameRegex.String())
+	}
+	return nil
+}
+
 // GenerateEtcHostsContent generates a /etc/hosts file based on `hostname`.
 func GenerateEtcHostsContent(ctx context.Context, hostname string) string {
 	_, span := oc.StartSpan(ctx, "network::GenerateEtcHostsContent")

internal/guest/network/network_test.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -122,6 +123,40 @@ func Test_MergeValues(t *testing.T) {
 	}
 }
 
+func Test_ValidateHostname(t *testing.T) {
+	validNames := []string{
+		"localhost",
+		"my-hostname",
+		"my.hostname",
+		"my-host-name123",
+		"_underscores.are.allowed.too",
+		"", // Allow not specifying a hostname
+	}
+
+	invalidNames := []string{
+		"localhost\n13.104.0.1 ip6-localhost ip6-loopback localhost",
+		"localhost\n2603:1000::1 ip6-localhost ip6-loopback",
+		"hello@microsoft.com",
+		"has space",
+		"has,comma",
+		"\x00",
+		"a\nb",
+		strings.Repeat("a", 1000),
+	}
+
+	for _, n := range validNames {
+		if err := ValidateHostname(n); err != nil {
+			t.Fatalf("expected %q to be valid, got: %v", n, err)
+		}
+	}
+
+	for _, n := range invalidNames {
+		if err := ValidateHostname(n); err == nil {
+			t.Fatalf("expected %q to be invalid, but got nil error", n)
+		}
+	}
+}
+
 func Test_GenerateEtcHostsContent(t *testing.T) {
 	type testcase struct {
 		name string

internal/guest/runtime/hcsv2/sandbox_container.go

@@ -54,6 +54,9 @@ func setupSandboxContainerSpec(ctx context.Context, id string, spec *oci.Spec) (
 
 	// Write the hostname
 	hostname := spec.Hostname
+	if err = network.ValidateHostname(hostname); err != nil {
+		return err
+	}
 	if hostname == "" {
 		var err error
 		hostname, err = os.Hostname()

internal/guest/runtime/hcsv2/standalone_container.go

@@ -61,6 +61,9 @@ func setupStandaloneContainerSpec(ctx context.Context, id string, spec *oci.Spec
 	}()
 
 	hostname := spec.Hostname
+	if err = network.ValidateHostname(hostname); err != nil {
+		return err
+	}
 	if hostname == "" {
 		var err error
 		hostname, err = os.Hostname()