fix(git)!: use internal proxy for all git operations (#39426)

Introduces gitproxy module which spawns a small forward proxy as scanner
for git calls
Replaces hostmatcher with matchlist which supports port rules
Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS
settings in migration in favor of full names we have in security
configs.
Removes `external` preset in favor of lax/strict modes, strict mode
requiring explicit ports if they aren't standard http/s ones.

Breaking changes:
- `external` preset no longer works as deny rule. To enforce that, use
`strict` mode and allow ranges to connect to
- Wildcards are no longer accepted in IP addresses
- `*` is no longer allowed as entry in lists
- domain rules now use curl like syntax `*.example.com` matching
subdomains but not `example.com`, `example.com` matching itself and all
subdomains. `example.*` is not a valid rule
- In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer
restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive
list. A startup warning flags this
- Invalid list entries are logged at startup, invalid
`BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it

Docs: https://gitea.com/gitea/docs/pulls/557
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

routers/web/auth/oauth.go

@@ -19,11 +19,10 @@ import (
 	user_model "gitea.dev/models/user"
 	auth_module "gitea.dev/modules/auth"
 	"gitea.dev/modules/container"
-	"gitea.dev/modules/hostmatcher"
+	"gitea.dev/modules/egress"
 	"gitea.dev/modules/httplib"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/optional"
-	"gitea.dev/modules/proxy"
 	"gitea.dev/modules/session"
 	"gitea.dev/modules/setting"
 	"gitea.dev/services/audit"
@@ -300,21 +299,10 @@ func showLinkingLogin(ctx *context.Context, authSourceID int64, gothUser goth.Us
 	ctx.Redirect(setting.AppSubURL + "/user/link_account")
 }
 
-// oauth2AvatarAllowList parses the host allow-list applied to avatar fetches from the global
-// [security] ALLOWED_HOST_LIST, defaulting an empty setting to the built-in "external" set. An empty
-// host-match list would otherwise disable the allow-list check entirely and permit any host, including
-// loopback/private addresses (SSRF).
-func oauth2AvatarAllowList() *hostmatcher.HostMatchList {
-	return hostmatcher.ParseHostMatchList("security.ALLOWED_HOST_LIST", setting.Security.AllowedHostList)
-}
-
-// oauth2AvatarHTTPClient builds the SSRF-protected client for avatar fetches. It is constructed per call
-// so a changed allowlist takes effect (avatar fetches are infrequent, so this is not a hot path).
 func oauth2AvatarHTTPClient() *http.Client {
-	allowList := oauth2AvatarAllowList()
 	return &http.Client{
 		Timeout:   30 * time.Second,
-		Transport: hostmatcher.NewHTTPTransport("oauth2-avatar", allowList, nil, proxy.Proxy(), setting.Proxy.ProxyURLFixed, nil),
+		Transport: egress.NewSecurityPolicy("oauth2-avatar").NewHTTPTransport(),
 	}
 }
 

routers/web/auth/oauth_test.go

@@ -12,9 +12,7 @@ import (
 	"gitea.dev/models/auth"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/hostmatcher"
-	"gitea.dev/modules/setting"
-	"gitea.dev/modules/test"
+	"gitea.dev/modules/egress/policy"
 	"gitea.dev/services/oauth2_provider"
 
 	"github.com/golang-jwt/jwt/v5"
@@ -98,24 +96,12 @@ func TestOAuth2AvatarClientBlocksLoopback(t *testing.T) {
 	assert.False(t, hit.Load(), "avatar client must refuse to dial a loopback address")
 }
 
-func TestOAuth2AvatarAllowListRestricts(t *testing.T) {
-	defer test.MockVariableValue(&setting.Security.AllowedHostList, "avatars.example.com")()
-	allowList := oauth2AvatarAllowList()
-	assert.True(t, allowList.MatchHostName("avatars.example.com"), "the configured host must be allowed")
-	assert.False(t, allowList.MatchHostName("8.8.8.8"), "an unrelated external host must be rejected")
-
-	// the default `external` allow-list still permits external hosts
-	setting.Security.AllowedHostList = hostmatcher.MatchBuiltinExternal
-	assert.True(t, oauth2AvatarAllowList().MatchHostName("8.8.8.8"), "default allow-list permits external hosts")
-}
-
 func TestOAuth2AvatarClientBlocksCloudMetadata(t *testing.T) {
-	// external-only allow-list must reject link-local cloud metadata (169.254.169.254) at dial time
 	resp, err := oauth2AvatarHTTPClient().Get("http://169.254.169.254/latest/meta-data/")
 	if resp != nil {
 		_ = resp.Body.Close()
 	}
 	require.Error(t, err)
-	assert.ErrorContains(t, err, "can only call allowed HTTP servers",
+	assert.ErrorIs(t, err, policy.ErrDenied,
 		"avatar client must refuse a link-local cloud-metadata address")
 }