-
Notifications
You must be signed in to change notification settings - Fork 38
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add a new option that configure the list of trusted address to parse the proxy headers from.
The parsing is handled by `uvicorn` which currently only support `x-forwarded-{for,proto}` headers.
Closes #8626, closes #8427
Co-authored-by: Marcos Medrano <[email protected]>- Loading branch information
1 parent
28a78bd
commit 0c0d9e3
Showing
9 changed files
with
51 additions
and
81 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| Add server option ``--proxy-trusted-addresses`` to enable parsing of proxy headers from trusted addresses. By default, the server will trust the proxy headers from localhost. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,19 +43,6 @@ | |
| DEFAULT_EMAIL_SENDER = "[email protected]" | ||
|
|
||
|
|
||
| def _parse_forward_proto_enforce_https_check_param( | ||
| raw_param: str | None, | ||
| ) -> tuple[str, str] | None: | ||
| if raw_param is None: | ||
| return None | ||
| try: | ||
| key, value = raw_param.split(":") | ||
| except ValueError: | ||
| raise click.BadParameter("Invalid format, should be `<header-name>:<header-value>`") | ||
| # HTTP header key is case-insensitive unlike the header value | ||
| return (key.lower(), value) | ||
|
|
||
|
|
||
| def _parse_organization_initial_tos_url(raw_param: str | None) -> dict[TosLocale, TosUrl] | None: | ||
| if raw_param is None: | ||
| return None | ||
|
|
@@ -292,20 +279,15 @@ def handle_parse_result( | |
| help="Sender address used in sent emails", | ||
| ) | ||
| @click.option( | ||
| "--forward-proto-enforce-https", | ||
| type=str, | ||
| show_default=True, | ||
| default=None, | ||
| callback=lambda ctx, param, value: _parse_forward_proto_enforce_https_check_param(value), | ||
| envvar="PARSEC_FORWARD_PROTO_ENFORCE_HTTPS", | ||
| "--proxy-trusted-addresses", | ||
| default=["localhost", "127.0.0.1", "::1"], | ||
| envvar="PARSEC_PROXY_TRUSTED_ADDRESSES", | ||
| callback=lambda ctx, param, value: [item.strip() for item in str(value).split(",")], | ||
| show_envvar=True, | ||
| help=( | ||
| "Enforce HTTPS by redirecting incoming request that do not comply with the provided header." | ||
| " This is useful when running Parsec behind a forward proxy handing the SSL layer." | ||
| " You should *only* use this setting if you control your proxy or have some other" | ||
| " guarantee that it sets/strips this header appropriately." | ||
| " Typical value for this setting should be `X-Forwarded-Proto:https`." | ||
| ), | ||
| help="""\b | ||
| Comma-separated list of IP Addresses, IP Networks or literals to trust with proxy headers. | ||
| Set this value to allow the server to use the forwarded headers from those clients. | ||
| """, | ||
| ) | ||
| @click.option( | ||
| "--ssl-keyfile", | ||
|
|
@@ -373,7 +355,7 @@ def run_cmd( | |
| email_use_ssl: bool, | ||
| email_use_tls: bool, | ||
| email_sender: str | None, | ||
| forward_proto_enforce_https: tuple[str, str] | None, | ||
| proxy_trusted_addresses: list[str], | ||
| ssl_keyfile: Path | None, | ||
| ssl_certfile: Path | None, | ||
| log_level: LogLevel, | ||
|
|
@@ -418,7 +400,7 @@ def run_cmd( | |
| sse_keepalive=sse_keepalive, | ||
| blockstore_config=blockstore, | ||
| email_config=email_config, | ||
| forward_proto_enforce_https=forward_proto_enforce_https, | ||
| proxy_trusted_addresses=proxy_trusted_addresses, | ||
| server_addr=server_addr, | ||
| debug=debug, | ||
| organization_bootstrap_webhook_url=organization_bootstrap_webhook, | ||
|
|
@@ -505,6 +487,7 @@ async def _run_backend( | |
| port=port, | ||
| ssl_certfile=ssl_certfile, | ||
| ssl_keyfile=ssl_keyfile, | ||
| proxy_trusted_addresses=app_config.proxy_trusted_addresses, | ||
| ) | ||
| return | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -240,7 +240,7 @@ async def testbed_backend_factory( | |
| debug=True, | ||
| db_config=db_config, | ||
| sse_keepalive=30, | ||
| forward_proto_enforce_https=None, | ||
| proxy_trusted_addresses=[], | ||
| server_addr=server_addr, | ||
| email_config=MockedEmailConfig("[email protected]", tmpdir), | ||
| blockstore_config=blockstore_config, | ||
|
|
@@ -343,7 +343,9 @@ async def _watch_and_stop_after_process(pid: int, cancel_scope: anyio.CancelScop | |
|
|
||
| app.state.testbed = testbed | ||
| app.state.backend = testbed.backend | ||
| await serve_parsec_asgi_app(host=host, port=port, app=app) | ||
| await serve_parsec_asgi_app( | ||
| host=host, port=port, app=app, proxy_trusted_addresses=[] | ||
| ) | ||
|
|
||
| click.echo("bye ;-)") | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,12 @@ | |
| from parsec.backend import Backend, backend_factory | ||
| from parsec.cli.testbed import TestbedBackend, TestbedTemplate | ||
| from parsec.components.memory.organization import MemoryOrganization, OrganizationID | ||
| from parsec.config import BackendConfig, BaseBlockStoreConfig, BaseDatabaseConfig, MockedEmailConfig | ||
| from parsec.config import ( | ||
| BackendConfig, | ||
| BaseBlockStoreConfig, | ||
| BaseDatabaseConfig, | ||
| MockedEmailConfig, | ||
| ) | ||
| from tests.common.postgresql import reset_postgresql_testbed | ||
|
|
||
| SERVER_DOMAIN = "parsec.invalid" | ||
|
|
@@ -33,7 +38,7 @@ def backend_config( | |
| debug=True, | ||
| db_config=db_config, | ||
| sse_keepalive=30, | ||
| forward_proto_enforce_https=None, | ||
| proxy_trusted_addresses=[], | ||
| server_addr=ParsecAddr(hostname=SERVER_DOMAIN, port=None, use_ssl=True), | ||
| email_config=MockedEmailConfig("[email protected]", tmpdir), | ||
| blockstore_config=blockstore_config, | ||
|
|
||