-
Notifications
You must be signed in to change notification settings - Fork 40
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add a new option that configure the list of trusted address to parse the proxy headers from.
The parsing is handled by `uvicorn` which currently only support `x-forwarded-{for,proto}` headers.
Closes #8626, closes #8427- Loading branch information
1 parent
d634e8c
commit ab99e7b
Showing
9 changed files
with
57 additions
and
79 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| Add server option ``--proxy-trusted-addresses`` to enabled parsing of proxy headers from trusted addresses. | ||
|
|
||
| .. important:: | ||
| Breaking change: Previous the server used the default value provided by ``uvicorn`` which always enabled the proxy header for localhost proxy. | ||
| If you want to have the same behavior as before, you need to set the ``--proxy-trusted-addresses`` to ``localhost,127.0.0.1,::1``. | ||
|
|
||
| .. tip:: | ||
| The env variable ``PARSEC_PROXY_TRUSTED_ADDRESSES`` instead of the option. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,18 +43,6 @@ | |
| DEFAULT_EMAIL_SENDER = "[email protected]" | ||
|
|
||
|
|
||
| def _parse_forward_proto_enforce_https_check_param( | ||
| raw_param: str | None, | ||
| ) -> tuple[str, str] | None: | ||
| if raw_param is None: | ||
| return None | ||
| try: | ||
| key, value = raw_param.split(":") | ||
| except ValueError: | ||
| raise click.BadParameter("Invalid format, should be `<header-name>:<header-value>`") | ||
| # HTTP header key is case-insensitive unlike the header value | ||
| return (key.lower(), value) | ||
|
|
||
|
|
||
| def _parse_organization_initial_tos_url(raw_param: str | None) -> dict[TosLocale, TosUrl] | None: | ||
| if raw_param is None: | ||
|
|
@@ -292,20 +280,15 @@ def handle_parse_result( | |
| help="Sender address used in sent emails", | ||
| ) | ||
| @click.option( | ||
| "--forward-proto-enforce-https", | ||
| type=str, | ||
| show_default=True, | ||
| default=None, | ||
| callback=lambda ctx, param, value: _parse_forward_proto_enforce_https_check_param(value), | ||
| envvar="PARSEC_FORWARD_PROTO_ENFORCE_HTTPS", | ||
| "--proxy-trusted-addresses", | ||
| default=[], | ||
| envvar="PARSEC_PROXY_TRUSTED_ADDRESSES", | ||
| callback=lambda ctx, param, value: str(value).split(","), | ||
| show_envvar=True, | ||
| help=( | ||
| "Enforce HTTPS by redirecting incoming request that do not comply with the provided header." | ||
| " This is useful when running Parsec behind a forward proxy handing the SSL layer." | ||
| " You should *only* use this setting if you control your proxy or have some other" | ||
| " guarantee that it sets/strips this header appropriately." | ||
| " Typical value for this setting should be `X-Forwarded-Proto:https`." | ||
| ), | ||
| help="""\b | ||
| Comma-separated list of IP Addresses, IP Networks or literals to trust with proxy headers. | ||
| Settings this value will allow the server to use the forwarded headers from those clients. | ||
| """, | ||
| ) | ||
| @click.option( | ||
| "--ssl-keyfile", | ||
|
|
@@ -373,7 +356,7 @@ def run_cmd( | |
| email_use_ssl: bool, | ||
| email_use_tls: bool, | ||
| email_sender: str | None, | ||
| forward_proto_enforce_https: tuple[str, str] | None, | ||
| proxy_trusted_addresses: list[str], | ||
| ssl_keyfile: Path | None, | ||
| ssl_certfile: Path | None, | ||
| log_level: LogLevel, | ||
|
|
@@ -418,7 +401,7 @@ def run_cmd( | |
| sse_keepalive=sse_keepalive, | ||
| blockstore_config=blockstore, | ||
| email_config=email_config, | ||
| forward_proto_enforce_https=forward_proto_enforce_https, | ||
| proxy_trusted_addresses=proxy_trusted_addresses, | ||
| server_addr=server_addr, | ||
| debug=debug, | ||
| organization_bootstrap_webhook_url=organization_bootstrap_webhook, | ||
|
|
@@ -505,6 +488,7 @@ async def _run_backend( | |
| port=port, | ||
| ssl_certfile=ssl_certfile, | ||
| ssl_keyfile=ssl_keyfile, | ||
| proxy_trusted_addresses=app_config.proxy_trusted_addresses, | ||
| ) | ||
| return | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -240,7 +240,7 @@ async def testbed_backend_factory( | |
| debug=True, | ||
| db_config=db_config, | ||
| sse_keepalive=30, | ||
| forward_proto_enforce_https=None, | ||
| proxy_trusted_addresses=[], | ||
| server_addr=server_addr, | ||
| email_config=MockedEmailConfig("[email protected]", tmpdir), | ||
| blockstore_config=blockstore_config, | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,13 @@ | |
| from parsec.backend import Backend, backend_factory | ||
| from parsec.cli.testbed import TestbedBackend, TestbedTemplate | ||
| from parsec.components.memory.organization import MemoryOrganization, OrganizationID | ||
| from parsec.config import BackendConfig, BaseBlockStoreConfig, BaseDatabaseConfig, MockedEmailConfig | ||
| from parsec.config import ( | ||
| BackendConfig, | ||
| BaseBlockStoreConfig, | ||
| BaseDatabaseConfig, | ||
| MockedEmailConfig, | ||
| ProxyHeaderMode, | ||
| ) | ||
| from tests.common.postgresql import reset_postgresql_testbed | ||
|
|
||
| SERVER_DOMAIN = "parsec.invalid" | ||
|
|
@@ -33,7 +39,8 @@ def backend_config( | |
| debug=True, | ||
| db_config=db_config, | ||
| sse_keepalive=30, | ||
| forward_proto_enforce_https=None, | ||
| proxy_header_mode=ProxyHeaderMode.Disabled, | ||
| proxy_trusted_addresses=[], | ||
| server_addr=ParsecAddr(hostname=SERVER_DOMAIN, port=None, use_ssl=True), | ||
| email_config=MockedEmailConfig("[email protected]", tmpdir), | ||
| blockstore_config=blockstore_config, | ||
|
|
||