A2A 推送接收方加固：SSRF、认证、重放与故障注入

收到 CreateTaskPushNotificationConfig(url)
  ├─ 语法层：必须是 HTTPS 地址，拒绝 userinfo、非标准端口（按策略）
  ├─ 解析 DNS → 得到 IP 列表
  │    └─ 任一 IP 命中回环/私有/链路本地段 → 拒绝整个配置
  ├─ 存储配置（存 URL，不存当时的 IP）
  └─ 投递时，对每次请求、每次重定向后：
       ├─ 重新解析 DNS → 重新校验全部 IP
       ├─ 用已校验的 IP 建立连接（不要重新解析）
       └─ 校验失败 → 记日志、终止本次投递，不跟随该重定向

投递 → 2xx：完成
     → 非 2xx 或超时（10–30 秒）→ 指数退避重试
          → 达到配置的连续失败上限 → 停止投递并记录

#!/usr/bin/env bash
set -euo pipefail

: "${A2A_BASE_URL:?Set A2A_BASE_URL}"
: "${A2A_VALID_TOKEN:?Set A2A_VALID_TOKEN}"
: "${CALLBACK_BASE:?Set CALLBACK_BASE, e.g. https://callback.example.com/}"
: "${TEST_TASK_ID:?Set TEST_TASK_ID to a task created by this caller}"

create_config() { # task_id body_json → prints HTTP code (HTTP binding of CreateTaskPushNotificationConfig)
  curl --silent --output /dev/null --write-out '%{http_code}' \
    -H "Authorization: Bearer $A2A_VALID_TOKEN" -H 'Content-Type: application/json' \
    -d "$2" "$A2A_BASE_URL/tasks/$1/pushNotificationConfigs"
}

expect() { # label expected_pattern actual
  if [[ "$3" == $2 ]]; then printf 'OK   %s -> %s\n' "$1" "$3"
  else printf 'FAIL %s -> %s (expected %s)\n' "$1" "$3" "$2" >&2; exit 1; fi
}

# 1. Direct private address must never be accepted. Use a real test task ID; whether
#    the server answers 400 (validation) or 404 (task scope) first is up to the
#    implementation — the assertion is that it is NOT a 2xx and no config is created.
expect "private url rejected" 4?? "$(create_config "$TEST_TASK_ID" \
  '{"url":"http://192.168.1.10/hook"}')"

# 2. Redirect into a private network must be rejected at delivery time:
#    point the config at an endpoint you control that answers 302 -> http://127.0.0.1/x
#    then trigger a task event and assert no request reached 127.0.0.1.

# 3. Replay: capture one delivered notification (headers + body), then:
replay_code="$(curl --silent --output /dev/null --write-out '%{http_code}' \
  -H 'Content-Type: application/json' -H "Authorization: Bearer $VALID_CALLBACK_CREDENTIALS" \
  --data-binary "$CAPTURED_BODY" "$CALLBACK_BASE/hook")"
expect "replayed notification accepted (idempotent)" 2?? "$replay_code"

# 4. Forged notification without credentials must be rejected before business logic.
expect "forged notification rejected" 401 "$(curl --silent --output /dev/null \
  --write-out '%{http_code}' -H 'Content-Type: application/json' \
  -d "$CAPTURED_BODY" "$CALLBACK_BASE/hook")"