net/http: use consistent IDNA processing for dial target and Host header

http2/transport_internal_test.go

@@ -18,6 +18,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"golang.org/x/net/idna"
 )
 
 type panicReader struct{}
@@ -192,6 +194,29 @@ func TestAuthorityAddr(t *testing.T) {
 	}
 }
 
+// TestAuthorityAddrIDNAMapping verifies that authorityAddr, which computes the
+// connection pool key and the address to dial, applies UTS #46 processing
+// (with mapping) to the host. This must match the IDNA profile used for the
+// :authority header so the dialed address and the header cannot disagree.
+// See https://go.dev/issue/80417.
+func TestAuthorityAddrIDNAMapping(t *testing.T) {
+	// uniHost maps to a different name under UTS #46 processing (idna.Lookup)
+	// than under Punycode-only processing (idna.ToASCII, previously used here).
+	// Verify the two disagree so this test actually exercises the mapping.
+	const uniHost = "\u24d6\u24de\u24df\u24d1\u24d4\u24e1.example" // "ⓖⓞⓟⓗⓔⓡ.example"
+	mapped, err := idna.Lookup.ToASCII(uniHost)
+	if err != nil {
+		t.Fatalf("idna.Lookup.ToASCII(%q) = %v", uniHost, err)
+	}
+	if puny, err := idna.ToASCII(uniHost); err == nil && puny == mapped {
+		t.Fatalf("test host %q does not distinguish IDNA profiles", uniHost)
+	}
+	want := mapped + ":443"
+	if got := authorityAddr("https", uniHost); got != want {
+		t.Errorf("authorityAddr(%q, %q) = %q; want %q", "https", uniHost, got, want)
+	}
+}
+
 // Issue 25009: use Request.GetBody if present, even if it seems like
 // we might not need it. Apparently something else can still read from
 // the original request body. Data race? In any case, rewinding

internal/httpcommon/request.go

@@ -8,6 +8,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net"
 	"net/http/httptrace"
 	"net/textproto"
 	"net/url"
@@ -17,6 +18,7 @@ import (
 
 	"golang.org/x/net/http/httpguts"
 	"golang.org/x/net/http2/hpack"
+	"golang.org/x/net/idna"
 )
 
 var (
@@ -77,7 +79,13 @@ func EncodeHeaders(ctx context.Context, param EncodeHeadersParam, headerf func(n
 	if host == "" {
 		host = req.URL.Host
 	}
-	host, err := httpguts.PunycodeHostPort(host)
+	// Convert the host to its IDNA ASCII form using the same UTS #46
+	// processing (with mapping) used to pick the address the request is
+	// dialed to. Using a different IDNA profile here would let the
+	// :authority header disagree with the address actually dialed, which
+	// can be used to bypass SSRF filters that inspect URL.Hostname.
+	// See https://go.dev/issue/80417.
+	host, err := idnaASCIIHostPort(host)
 	if err != nil {
 		return res, err
 	}
@@ -501,3 +509,38 @@ func NewServerRequest(rp ServerRequestParam) ServerRequestResult {
 		Trailer:       trailer,
 	}
 }
+
+// idnaASCIIHostPort applies UTS #46 IDNA processing (with mapping) to the host
+// portion of a "host" or "host:port" string, leaving the port unchanged. It is
+// used to compute the Host / :authority header so that it is consistent with
+// the address the request is dialed to. See https://go.dev/issue/80417.
+func idnaASCIIHostPort(v string) (string, error) {
+	if isASCII(v) {
+		return v, nil
+	}
+	host, port, err := net.SplitHostPort(v)
+	if err != nil {
+		// Assume v is a host without a port. Any error will be reported
+		// by idna.Lookup.ToASCII or by later Host header validation.
+		host = v
+		port = ""
+	}
+	host, err = idna.Lookup.ToASCII(host)
+	if err != nil {
+		return "", err
+	}
+	if port == "" {
+		return host, nil
+	}
+	return net.JoinHostPort(host, port), nil
+}
+
+// isASCII reports whether s is composed entirely of ASCII bytes.
+func isASCII(s string) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] >= 0x80 {
+			return false
+		}
+	}
+	return true
+}

internal/httpcommon/request_test.go

@@ -11,6 +11,8 @@ import (
 	"slices"
 	"strings"
 	"testing"
+
+	"golang.org/x/net/idna"
 )
 
 func TestEncodeHeaders(t *testing.T) {
@@ -523,6 +525,44 @@ func TestEncodeHeaders(t *testing.T) {
 	}
 }
 
+// TestEncodeHeadersIDNAMapping verifies that the :authority pseudo-header is
+// computed with the same UTS #46 processing (with mapping) used to pick the
+// address the request is dialed to, so the header cannot disagree with the
+// dialed address. See https://go.dev/issue/80417.
+func TestEncodeHeadersIDNAMapping(t *testing.T) {
+	// uniHost maps to a different name under UTS #46 processing (idna.Lookup,
+	// used to pick the dial address) than under Punycode-only processing
+	// (idna.ToASCII, which used to be used for the header). Verify the two
+	// disagree so this test actually exercises the mapping.
+	const uniHost = "ⓖⓞⓟⓑⓔⓡ.example" // "ⓖⓞⓟⓗⓔⓡ.example"
+	mapped, err := idna.Lookup.ToASCII(uniHost)
+	if err != nil {
+		t.Fatalf("idna.Lookup.ToASCII(%q) = %v", uniHost, err)
+	}
+	if puny, err := idna.ToASCII(uniHost); err == nil && puny == mapped {
+		t.Fatalf("test host %q does not distinguish IDNA profiles", uniHost)
+	}
+
+	req := newReq(func() *http.Request {
+		r := must(http.NewRequest("GET", "https://example.tld/", nil))
+		r.Host = uniHost
+		return r
+	})
+
+	var authority string
+	_, err = EncodeHeaders(context.Background(), EncodeHeadersParam{Request: req}, func(name, value string) {
+		if name == ":authority" {
+			authority = value
+		}
+	})
+	if err != nil {
+		t.Fatalf("EncodeHeaders = %v", err)
+	}
+	if authority != mapped {
+		t.Errorf(":authority = %q, want %q", authority, mapped)
+	}
+}
+
 func TestEncodeHeaderErrors(t *testing.T) {
 	for _, test := range []struct {
 		name string