Merge commit from fork

* Inject DenyList from config to `StartCommands()`

* Implementation draft

* Move address checker to separate package

* Migrate usages of actions.AddressChecker to denylist.AddressChecker

* Rename denylist package files

* Pass []denylist.AddressChecker to StartCommand

* Add DenyList to defaults.yaml and add custom config parser

* net: add HostnameToIPList function

* denylist: Add IsHostBlocked()

* actions: use denylist.IsHostBlocked()

* command: Inject ip lookup function + extend add target validationt test

* command: Unexport ChangeTarget.IsValid()

* command: Add denyList check on ChangeTarget validation

* command: Export ActionsV2DenyList and IPLookupFunction params

* Lint fix

* Check denylist during action execution

* Fix integration tests

* Apply suggestions

* Add `mapstructure.StringToSliceHookFunc()` to decode `HTTPConfigDecodeHook`

internal/api/grpc/server/connect_middleware/execution_interceptor.go

@@ -13,6 +13,7 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
@@ -26,12 +27,12 @@ var headersToForward = map[string]bool{
 	strings.ToLower(http_utils.Origin):        true,
 }
 
-func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) connect.UnaryInterceptorFunc {
+func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) connect.UnaryInterceptorFunc {
 	return func(handler connect.UnaryFunc) connect.UnaryFunc {
 		return func(ctx context.Context, req connect.AnyRequest) (_ connect.AnyResponse, err error) {
 
 			requestTargets := execution.QueryExecutionTargetsForRequest(ctx, req.Spec().Procedure)
-			handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey)
+			handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey, deniedIPList)
 			if err != nil {
 				return nil, err
 			}
@@ -42,12 +43,12 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution
 			}
 
 			responseTargets := execution.QueryExecutionTargetsForResponse(ctx, req.Spec().Procedure)
-			return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey)
+			return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey, deniedIPList)
 		}
 	}
 }
 
-func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ connect.AnyRequest, err error) {
+func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ connect.AnyRequest, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
@@ -67,14 +68,14 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
 		Headers:    SetRequestHeaders(req.Header()),
 	}
 
-	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
+	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
 	if err != nil {
 		return nil, err
 	}
 	return req, nil
 }
 
-func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ connect.AnyResponse, err error) {
+func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ connect.AnyResponse, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
@@ -95,7 +96,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
 		Headers:    SetRequestHeaders(req.Header()),
 	}
 
-	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
+	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
 	if err != nil {
 		return nil, err
 	}

internal/api/grpc/server/connect_middleware/execution_interceptor_test.go

@@ -21,6 +21,7 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 )
@@ -74,6 +75,10 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
 }
 
 func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
+	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
+	require.NoError(t, err)
+	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+
 	type target struct {
 		reqBody             execution.ContextInfo
 		sleep               time.Duration
@@ -89,9 +94,10 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 		fullMethod             string
 		req                    connect.AnyRequest
 		getActiveSigningWebKey execution.GetActiveSigningWebKey
+		deniedIPs              []denylist.AddressChecker
 	}
 	type res struct {
-		want    interface{}
+		want    any
 		wantErr bool
 	}
 	tests := []struct {
@@ -286,6 +292,37 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				want: newMockContentRequest("content1"),
 			},
 		},
+		{
+			"when target endpoint is in deny list should return error",
+			args{
+				ctx:        context.Background(),
+				fullMethod: "/service/method",
+				executionTargets: []target_domain.Target{
+					{
+						ExecutionID:      "request./zitadel.session.v2.SessionService/SetSession",
+						TargetID:         "target",
+						TargetType:       target_domain.TargetTypeCall,
+						Timeout:          time.Minute,
+						InterruptOnError: true,
+						Endpoint:         "127.0.0.1",
+					},
+				},
+				targets: []target{
+					{
+						reqBody:             newMockContextInfoRequest("/service/method", "content"),
+						respBody:            newMockContentResponse("content1"),
+						sleep:               0,
+						statusCode:          http.StatusOK,
+						requestVerification: validateJSONPayload,
+					},
+				},
+				req:       newMockContentRequest("content"),
+				deniedIPs: deniedIPs,
+			},
+			res{
+				wantErr: true,
+			},
+		},
 		{
 			"target async, timeout",
 			args{
@@ -631,6 +668,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				tt.args.req,
 				nil,
 				tt.args.getActiveSigningWebKey,
+				tt.args.deniedIPs,
 			)
 
 			if tt.res.wantErr {
@@ -736,6 +774,9 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
 }
 
 func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
+	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
+	require.NoError(t, err)
+	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
 	type target struct {
 		reqBody    execution.ContextInfo
 		sleep      time.Duration
@@ -750,6 +791,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 		fullMethod       string
 		req              connect.AnyRequest
 		resp             connect.AnyResponse
+		deniedIPs        []denylist.AddressChecker
 	}
 	type res struct {
 		want    interface{}
@@ -844,6 +886,37 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				want: newMockContentResponse("response1"),
 			},
 		},
+		{
+			"when target endpoint is in deny list should return error",
+			args{
+				ctx:        context.Background(),
+				fullMethod: "/service/method",
+				executionTargets: []target_domain.Target{
+					{
+						ExecutionID:      "response./zitadel.session.v2.SessionService/SetSession",
+						TargetID:         "target",
+						TargetType:       target_domain.TargetTypeCall,
+						Timeout:          time.Minute,
+						InterruptOnError: true,
+						Endpoint:         "127.0.0.1",
+					},
+				},
+				targets: []target{
+					{
+						reqBody:    newMockContextInfoResponse("/service/method", "request", "response"),
+						respBody:   newMockContentResponse("response1"),
+						sleep:      0,
+						statusCode: http.StatusOK,
+					},
+				},
+				req:       newMockContentRequest("request"),
+				resp:      newMockContentResponse("response"),
+				deniedIPs: deniedIPs,
+			},
+			res{
+				wantErr: true,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -869,6 +942,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				tt.args.resp,
 				nil,
 				mockGetActiveSigningWebKey(),
+				tt.args.deniedIPs,
 			)
 
 			if tt.res.wantErr {

internal/api/grpc/server/middleware/execution_interceptor.go

@@ -13,16 +13,17 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/server/connect_middleware"
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 )
 
-func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) grpc.UnaryServerInterceptor {
+func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) grpc.UnaryServerInterceptor {
 	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
 		requestTargets := execution.QueryExecutionTargetsForRequest(ctx, info.FullMethod)
 		// call targets otherwise return req
-		handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey)
+		handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey, deniedIPList)
 		if err != nil {
 			return nil, err
 		}
@@ -33,11 +34,11 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution
 		}
 
 		responseTargets := execution.QueryExecutionTargetsForResponse(ctx, info.FullMethod)
-		return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey)
+		return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey, deniedIPList)
 	}
 }
 
-func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ interface{}, err error) {
+func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req any, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ interface{}, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
@@ -58,10 +59,10 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
 		Headers:    connect_middleware.SetRequestHeaders(md),
 	}
 
-	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
+	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
 }
 
-func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ interface{}, err error) {
+func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ interface{}, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
@@ -83,7 +84,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
 		Headers:    connect_middleware.SetRequestHeaders(md),
 	}
 
-	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
+	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
 }
 
 var _ execution.ContextInfo = &ContextInfoRequest{}

internal/api/grpc/server/middleware/execution_interceptor_test.go

@@ -20,6 +20,7 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 )
@@ -63,6 +64,10 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
 }
 
 func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
+	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
+	require.NoError(t, err)
+	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+
 	type target struct {
 		reqBody             execution.ContextInfo
 		sleep               time.Duration
@@ -78,6 +83,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 		fullMethod             string
 		req                    interface{}
 		getActiveSigningWebKey execution.GetActiveSigningWebKey
+		deniedIPs              []denylist.AddressChecker
 	}
 	type res struct {
 		want    interface{}
@@ -275,6 +281,36 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				want: newMockContentRequest("content1"),
 			},
 		},
+		{
+			"when target endpoint is in denylist should return error",
+			args{
+				ctx:        context.Background(),
+				fullMethod: "/service/method",
+				executionTargets: []target_domain.Target{
+					{
+						ExecutionID:      "request./zitadel.session.v2.SessionService/SetSession",
+						TargetID:         "target",
+						TargetType:       target_domain.TargetTypeCall,
+						Timeout:          time.Minute,
+						InterruptOnError: true,
+					},
+				},
+				targets: []target{
+					{
+						reqBody:             newMockContextInfoRequest("/service/method", "content"),
+						respBody:            newMockContentRequest("content1"),
+						sleep:               0,
+						statusCode:          http.StatusOK,
+						requestVerification: validateJSONPayload,
+					},
+				},
+				req:       newMockContentRequest("content"),
+				deniedIPs: deniedIPs,
+			},
+			res{
+				wantErr: true,
+			},
+		},
 		{
 			"target async, timeout",
 			args{
@@ -620,6 +656,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				tt.args.req,
 				nil,
 				tt.args.getActiveSigningWebKey,
+				tt.args.deniedIPs,
 			)
 
 			if tt.res.wantErr {
@@ -725,6 +762,10 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
 }
 
 func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
+	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
+	require.NoError(t, err)
+	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+
 	type target struct {
 		reqBody    execution.ContextInfo
 		sleep      time.Duration
@@ -739,6 +780,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 		fullMethod       string
 		req              interface{}
 		resp             interface{}
+		deniedIPs        []denylist.AddressChecker
 	}
 	type res struct {
 		want    interface{}
@@ -833,6 +875,36 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				want: newMockContentRequest("response1"),
 			},
 		},
+		{
+			"when target endpoint is in deny list should return error",
+			args{
+				ctx:        context.Background(),
+				fullMethod: "/service/method",
+				executionTargets: []target_domain.Target{
+					{
+						ExecutionID:      "response./zitadel.session.v2.SessionService/SetSession",
+						TargetID:         "target",
+						TargetType:       target_domain.TargetTypeCall,
+						Timeout:          time.Minute,
+						InterruptOnError: true,
+					},
+				},
+				targets: []target{
+					{
+						reqBody:    newMockContextInfoResponse("/service/method", "request", "response"),
+						respBody:   newMockContentRequest("response1"),
+						sleep:      0,
+						statusCode: http.StatusOK,
+					},
+				},
+				req:       newMockContentRequest("request"),
+				resp:      newMockContentRequest("response"),
+				deniedIPs: deniedIPs,
+			},
+			res{
+				wantErr: true,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -858,6 +930,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				tt.args.resp,
 				nil,
 				mockGetActiveSigningWebKey(),
+				tt.args.deniedIPs,
 			)
 
 			if tt.res.wantErr {

internal/api/grpc/server/server.go

@@ -16,6 +16,7 @@ import (
 	grpc_api "github.com/zitadel/zitadel/internal/api/grpc"
 	"github.com/zitadel/zitadel/internal/api/grpc/server/middleware"
 	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/logstore"
 	"github.com/zitadel/zitadel/internal/logstore/record"
@@ -64,6 +65,7 @@ func CreateServer(
 	accessSvc *logstore.Service[*record.AccessLog],
 	targetEncAlg crypto.EncryptionAlgorithm,
 	translator *i18n.Translator,
+	deniedIPList []denylist.AddressChecker,
 ) *grpc.Server {
 	metricTypes := []metrics.MetricType{metrics.MetricTypeTotalCount, metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode}
 	serverOptions := []grpc.ServerOption{
@@ -80,7 +82,7 @@ func CreateServer(
 				middleware.AuthorizationInterceptor(verifier, systemAuthz, authConfig),
 				middleware.TranslationHandler(),
 				middleware.QuotaExhaustedInterceptor(accessSvc, system_pb.SystemService_ServiceDesc.ServiceName),
-				middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey),
+				middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey, deniedIPList),
 				middleware.ValidationHandler(),
 				middleware.ServiceHandler(),
 				middleware.ActivityInterceptor(),