mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-30 19:41:30 +02:00
52373f87f4
Four points from the review of #7246, all confirmed against the code. **regionFromUpstream panicked on Bedrock's regionless endpoint.** The template is "bedrock-runtime.<region>.amazonaws.com", so the two fixed halves are "bedrock-runtime." and ".amazonaws.com". The regionless host "bedrock-runtime.amazonaws.com" carries both at once, with the halves overlapping rather than sandwiching a region — it satisfied HasPrefix and HasSuffix, then sliced host[16:15]: panic: runtime error: slice bounds out of range [16:15] That is reachable from any operator who types that host into upstream_url on a Bedrock record. The length check makes the overlap read as "no region here", which is what it is. **A DNS-rebinding window sat between the guard and the dial.** checkPublicHost resolved the host and the transport resolved it again to dial, and the name's owner picks both answers. Public to the first lookup, 127.0.0.1 to the second, and the request reached loopback carrying the operator's provider credential. The dialer now re-checks at the socket through net.Dialer.Control, which runs post-resolution and pre-connect for each address tried, so it sees what the second lookup actually returned. The transport is cloned from http.DefaultTransport to keep its proxy and TLS behaviour, and shared package-wide so the connection pool survives. **Caller-input failures answered 500.** An unknown provider, an unusable upstream, a region that cannot be read and a missing key are all reachable from a well-formed request with a bad field value, and the OpenAPI document already declares 400 for this endpoint. They now carry ErrInvalidRequest and the handler branches on the sentinel rather than on message text. The non-public-address refusal is included: that is the caller's own URL. **The catalog id was trimmed for the emptiness test and then discarded.** A padded " openai_api " cleared the check and reached catalog.Lookup with its spaces, so the operator was told their provider was unknown.