mirror of
https://github.com/distribution/distribution.git
synced 2025-09-11 03:39:41 +00:00
Honor X-Forwarded-Port and Forwarded headers
Prefer non-standard headers like X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port over the standard Forwarded header to maintain backwards compatibility. If a port is not specified neither in Host nor in forwarded headers but it is specified just with X-Forwarded-Port, use its value in base urls for redirects. Forwarded header is defined in rfc7239. X-Forwarded-Port is a non-standard header. Here's a description copied from "HTTP Headers and Elastic Load Balancing" of AWS ELB docs: > The X-Forwarded-Port request header helps you identify the port that > an HTTP or HTTPS load balancer uses to connect to the client. Signed-off-by: Michal Minář <miminar@redhat.com>
This commit is contained in:
Michal Minář
@@ -165,50 +165,222 @@ func TestBuilderFromRequest(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
forwardedProtoHeader := make(http.Header, 1)
|
||||
forwardedProtoHeader.Set("X-Forwarded-Proto", "https")
|
||||
|
||||
forwardedHostHeader1 := make(http.Header, 1)
|
||||
forwardedHostHeader1.Set("X-Forwarded-Host", "first.example.com")
|
||||
|
||||
forwardedHostHeader2 := make(http.Header, 1)
|
||||
forwardedHostHeader2.Set("X-Forwarded-Host", "first.example.com, proxy1.example.com")
|
||||
|
||||
testRequests := []struct {
|
||||
name string
|
||||
request *http.Request
|
||||
base string
|
||||
configHost url.URL
|
||||
}{
|
||||
{
|
||||
name: "no forwarded header",
|
||||
request: &http.Request{URL: u, Host: u.Host},
|
||||
base: "http://example.com",
|
||||
},
|
||||
|
||||
{
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: forwardedProtoHeader},
|
||||
base: "http://example.com",
|
||||
name: "https protocol forwarded with a non-standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Proto": []string{"https"},
|
||||
}},
|
||||
base: "http://example.com",
|
||||
},
|
||||
{
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: forwardedProtoHeader},
|
||||
base: "https://example.com",
|
||||
name: "forwarded protocol is the same",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Proto": []string{"https"},
|
||||
}},
|
||||
base: "https://example.com",
|
||||
},
|
||||
{
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: forwardedHostHeader1},
|
||||
base: "http://first.example.com",
|
||||
name: "forwarded host with a non-standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Host": []string{"first.example.com"},
|
||||
}},
|
||||
base: "http://first.example.com",
|
||||
},
|
||||
{
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: forwardedHostHeader2},
|
||||
base: "http://first.example.com",
|
||||
name: "forwarded multiple hosts a with non-standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Host": []string{"first.example.com, proxy1.example.com"},
|
||||
}},
|
||||
base: "http://first.example.com",
|
||||
},
|
||||
{
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: forwardedHostHeader2},
|
||||
base: "https://third.example.com:5000",
|
||||
name: "host configured in config file takes priority",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Host": []string{"first.example.com, proxy1.example.com"},
|
||||
}},
|
||||
base: "https://third.example.com:5000",
|
||||
configHost: url.URL{
|
||||
Scheme: "https",
|
||||
Host: "third.example.com:5000",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "forwarded host and port with just one non-standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Host": []string{"first.example.com:443"},
|
||||
}},
|
||||
base: "http://first.example.com:443",
|
||||
},
|
||||
{
|
||||
name: "forwarded port with a non-standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Port": []string{"5000"},
|
||||
}},
|
||||
base: "http://example.com:5000",
|
||||
},
|
||||
{
|
||||
name: "forwarded multiple ports with a non-standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Port": []string{"443 , 5001"},
|
||||
}},
|
||||
base: "http://example.com:443",
|
||||
},
|
||||
{
|
||||
name: "several non-standard headers",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Proto": []string{"https"},
|
||||
"X-Forwarded-Host": []string{" first.example.com "},
|
||||
"X-Forwarded-Port": []string{" 12345 \t"},
|
||||
}},
|
||||
base: "http://first.example.com:12345",
|
||||
},
|
||||
{
|
||||
name: "forwarded host with port supplied takes priority",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Host": []string{"first.example.com:5000"},
|
||||
"X-Forwarded-Port": []string{"80"},
|
||||
}},
|
||||
base: "http://first.example.com:5000",
|
||||
},
|
||||
{
|
||||
name: "malformed forwarded port",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Host": []string{"first.example.com"},
|
||||
"X-Forwarded-Port": []string{"abcd"},
|
||||
}},
|
||||
base: "http://first.example.com",
|
||||
},
|
||||
{
|
||||
name: "forwarded protocol and addr using standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`proto=https;for="192.168.22.30:80"`},
|
||||
}},
|
||||
base: "https://192.168.22.30:80",
|
||||
},
|
||||
{
|
||||
name: "forwarded addr takes priority over host",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`host=reg.example.com;for="192.168.22.30:5000"`},
|
||||
}},
|
||||
base: "http://192.168.22.30:5000",
|
||||
},
|
||||
{
|
||||
name: "forwarded host and protocol using standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`host=reg.example.com;proto=https`},
|
||||
}},
|
||||
base: "https://reg.example.com",
|
||||
},
|
||||
{
|
||||
name: "process just the first standard forwarded header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`host="reg.example.com:88";proto=http`, `host=reg.example.com;proto=https`},
|
||||
}},
|
||||
base: "http://reg.example.com:88",
|
||||
},
|
||||
{
|
||||
name: "process just the first list element of standard header",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="reg.example.com:443";proto=https, for="reg.example.com:80";proto=http`},
|
||||
}},
|
||||
base: "https://reg.example.com:443",
|
||||
},
|
||||
{
|
||||
name: "IPv6 address override port",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="2607:f0d0:1002:51::4"`},
|
||||
"X-Forwarded-Port": []string{"5001"},
|
||||
}},
|
||||
base: "http://[2607:f0d0:1002:51::4]:5001",
|
||||
},
|
||||
{
|
||||
name: "IPv6 address with port",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="[2607:f0d0:1002:51::4]:4000"`},
|
||||
"X-Forwarded-Port": []string{"5001"},
|
||||
}},
|
||||
base: "http://[2607:f0d0:1002:51::4]:4000",
|
||||
},
|
||||
{
|
||||
name: "IPv6 long address override port",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="2607:f0d0:1002:0051:0000:0000:0000:0004"`},
|
||||
"X-Forwarded-Port": []string{"5001"},
|
||||
}},
|
||||
base: "http://[2607:f0d0:1002:0051:0000:0000:0000:0004]:5001",
|
||||
},
|
||||
{
|
||||
name: "IPv6 long address enclosed in brackets - be benevolent",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="[2607:f0d0:1002:0051:0000:0000:0000:0004]"`},
|
||||
"X-Forwarded-Port": []string{"5001"},
|
||||
}},
|
||||
base: "http://[2607:f0d0:1002:0051:0000:0000:0000:0004]:5001",
|
||||
},
|
||||
{
|
||||
name: "IPv6 long address with port",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="[2607:f0d0:1002:0051:0000:0000:0000:0004]:4321"`},
|
||||
"X-Forwarded-Port": []string{"5001"},
|
||||
}},
|
||||
base: "http://[2607:f0d0:1002:0051:0000:0000:0000:0004]:4321",
|
||||
},
|
||||
{
|
||||
name: "IPv6 address with zone ID",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="fe80::bd0f:a8bc:6480:238b%11"`},
|
||||
"X-Forwarded-Port": []string{"5001"},
|
||||
}},
|
||||
base: "http://[fe80::bd0f:a8bc:6480:238b%2511]:5001",
|
||||
},
|
||||
{
|
||||
name: "IPv6 address with zone ID and port",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="[fe80::bd0f:a8bc:6480:238b%eth0]:12345"`},
|
||||
"X-Forwarded-Port": []string{"5001"},
|
||||
}},
|
||||
base: "http://[fe80::bd0f:a8bc:6480:238b%25eth0]:12345",
|
||||
},
|
||||
{
|
||||
name: "IPv6 address without port",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"Forwarded": []string{`for="::FFFF:129.144.52.38"`},
|
||||
}},
|
||||
base: "http://[::FFFF:129.144.52.38]",
|
||||
},
|
||||
{
|
||||
name: "non-standard and standard forward headers",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Proto": []string{`https`},
|
||||
"X-Forwarded-Host": []string{`first.example.com`},
|
||||
"X-Forwarded-Port": []string{``},
|
||||
"Forwarded": []string{`host=first.example.com; proto=https`},
|
||||
}},
|
||||
base: "https://first.example.com",
|
||||
},
|
||||
{
|
||||
name: "non-standard headers take precedence over standard one",
|
||||
request: &http.Request{URL: u, Host: u.Host, Header: http.Header{
|
||||
"X-Forwarded-Proto": []string{`http`},
|
||||
"Forwarded": []string{`host=second.example.com; proto=https`},
|
||||
"X-Forwarded-Host": []string{`first.example.com`},
|
||||
"X-Forwarded-Port": []string{`4000`},
|
||||
}},
|
||||
base: "http://first.example.com:4000",
|
||||
},
|
||||
}
|
||||
|
||||
doTest := func(relative bool) {
|
||||
for _, tr := range testRequests {
|
||||
var builder *URLBuilder
|
||||
@@ -221,7 +393,7 @@ func TestBuilderFromRequest(t *testing.T) {
|
||||
for _, testCase := range makeURLBuilderTestCases(builder) {
|
||||
buildURL, err := testCase.build()
|
||||
if err != nil {
|
||||
t.Fatalf("%s: error building url: %v", testCase.description, err)
|
||||
t.Fatalf("[relative=%t, request=%q, case=%q]: error building url: %v", relative, tr.name, testCase.description, err)
|
||||
}
|
||||
|
||||
var expectedURL string
|
||||
@@ -244,11 +416,12 @@ func TestBuilderFromRequest(t *testing.T) {
|
||||
}
|
||||
|
||||
if buildURL != expectedURL {
|
||||
t.Fatalf("%s: %q != %q", testCase.description, buildURL, expectedURL)
|
||||
t.Errorf("[relative=%t, request=%q, case=%q]: %q != %q", relative, tr.name, testCase.description, buildURL, expectedURL)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
doTest(true)
|
||||
doTest(false)
|
||||
}
|
||||
@@ -332,3 +505,119 @@ func TestBuilderFromRequestWithPrefix(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsIPv6Address(t *testing.T) {
|
||||
for _, tc := range []struct {
|
||||
name string
|
||||
address string
|
||||
isIPv6 bool
|
||||
}{
|
||||
{
|
||||
name: "IPv6 short address",
|
||||
address: `2607:f0d0:1002:51::4`,
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "IPv6 short address enclosed in brackets",
|
||||
address: "[2607:f0d0:1002:51::4]",
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "IPv6 address",
|
||||
address: `2607:f0d0:1002:0051:0000:0000:0000:0004`,
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "IPv6 address with numeric zone ID",
|
||||
address: `fe80::bd0f:a8bc:6480:238b%11`,
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "IPv6 address with device name as zone ID",
|
||||
address: `fe80::bd0f:a8bc:6480:238b%eth0`,
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "IPv6 address with device name as zone ID enclosed in brackets",
|
||||
address: `[fe80::bd0f:a8bc:6480:238b%eth0]`,
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "IPv4-mapped address",
|
||||
address: "::FFFF:129.144.52.38",
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "localhost",
|
||||
address: "::1",
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "localhost",
|
||||
address: "::1",
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "long localhost address",
|
||||
address: "0:0:0:0:0:0:0:1",
|
||||
isIPv6: true,
|
||||
},
|
||||
{
|
||||
name: "IPv6 long address with port",
|
||||
address: "[2607:f0d0:1002:0051:0000:0000:0000:0004]:4321",
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "too many groups",
|
||||
address: "2607:f0d0:1002:0051:0000:0000:0000:0004:4321",
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "square brackets don't make an IPv6 address",
|
||||
address: "[2607:f0d0]",
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "require two consecutive colons in localhost",
|
||||
address: ":1",
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "more then 4 hexadecimal digits",
|
||||
address: "2607:f0d0b:1002:0051:0000:0000:0000:0004",
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "too short address",
|
||||
address: `2607:f0d0:1002:0000:0000:0000:0004`,
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "IPv4 address",
|
||||
address: `192.168.100.1`,
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "unclosed bracket",
|
||||
address: `[2607:f0d0:1002:0051:0000:0000:0000:0004`,
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "trailing bracket",
|
||||
address: `2607:f0d0:1002:0051:0000:0000:0000:0004]`,
|
||||
isIPv6: false,
|
||||
},
|
||||
{
|
||||
name: "domain name",
|
||||
address: `localhost`,
|
||||
isIPv6: false,
|
||||
},
|
||||
} {
|
||||
isIPv6 := isIPv6Address(tc.address)
|
||||
if isIPv6 && !tc.isIPv6 {
|
||||
t.Errorf("[%s] address %q falsely detected as IPv6 address", tc.name, tc.address)
|
||||
} else if !isIPv6 && tc.isIPv6 {
|
||||
t.Errorf("[%s] address %q not recognized as IPv6", tc.name, tc.address)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user