2020-01-24 02:20:58 +03:00
|
|
|
-- Global project configuration.
|
|
|
|
|
--
|
|
|
|
|
-- This file can be overridden with cabal.project.local (see e.g. cabal.project.dev)
|
|
|
|
|
--
|
|
|
|
|
-- If you need to switch between several local configurations you can also
|
|
|
|
|
-- create a symlink to this file with a different name, e.g.:
|
|
|
|
|
-- $ ln -s cabal.project cabal.project.myconfig
|
|
|
|
|
-- $ ln -s cabal.project.freeze cabal.project.myconfig.freeze
|
|
|
|
|
-- ...and then create a new set of overrides in:
|
|
|
|
|
-- cabal.project.myconfig.local
|
|
|
|
|
-- ...and then invoke cabal with
|
|
|
|
|
-- $ cabal new-build --project-file=cabal.project.myconfig
|
|
|
|
|
--
|
2020-02-13 20:38:23 +03:00
|
|
|
-- See: https://www.haskell.org/cabal/users-guide/nix-local-build.html#configuring-builds-with-cabal-project
|
2021-08-11 07:18:40 +03:00
|
|
|
|
2021-11-15 16:21:37 +03:00
|
|
|
with-compiler: ghc-8.10.7
|
|
|
|
|
|
2021-11-24 11:19:19 +03:00
|
|
|
-- package-level parallelism:
|
|
|
|
|
jobs: $ncpus
|
|
|
|
|
|
2021-08-11 07:18:40 +03:00
|
|
|
packages: server
|
2020-01-18 01:07:15 +03:00
|
|
|
|
server: http ip blocklist (closes #2449)
## Description
This PR is in reference to #2449 (support IP blacklisting for multitenant)
*RFC Update: Add support for IPv6 blocking*
### Solution and Design
Using [http-client-restricted](https://hackage.haskell.org/package/http-client-restricted) package, we're creating the HTTP manager with restricting capabilities. The IPs can be supplied from the CLI arguments as `--ipv4BlocklistCidrs cidr1, cidr2...` or `--disableDefaultIPv4Blocklist` for a default IP list. The new manager will block all requests to the provided CIDRs.
We are extracting the error message string to show the end-user that given IP is blocked from being set as a webhook. There are 2 ways to extract the error message "connection to IP address is blocked". Given below are the responses from event trigger to a blocked IP for these implementations:
- 6d74fde316f61e246c861befcca5059d33972fa7 - We return the error message string as a HTTPErr(HOther) from `Hasura/Eventing/HTTP.hs`.
```
{
"data": {
"message": "blocked connection to private IP address "
},
"version": "2",
"type": "client_error"
}
```
- 88e17456345cbb449a5ecd4877c84c9f319dbc25 - We case match on HTTPExceptionContent for InternaException in `Hasura/HTTP.hs` and extract the error message string from it. (this is implemented as it handles all the cases where pro engine makes webhook requests)
```
{
"data": {
"message": {
"type": "http_exception",
"message": "blocked connection to private IP address ",
"request": {
"secure": false,
"path": "/webhook",
"responseTimeout": "ResponseTimeoutMicro 60000000",
"queryString": "",
"method": "POST",
"requestHeaders": {
"Content-Type": "application/json",
"X-B3-ParentSpanId": "5ae6573edb2a6b36",
"X-B3-TraceId": "29ea7bd6de6ebb8f",
"X-B3-SpanId": "303137d9f1d4f341",
"User-Agent": "hasura-graphql-engine/cerebushttp-ip-blacklist-a793a0e41-dirty"
},
"host": "139.59.90.109",
"port": 8000
}
}
},
"version": "2",
"type": "client_error"
}
```
### Steps to test and verify
The restricted IPs can be used as webhooks in event triggers, and hasura will return an error message in reponse.
### Limitations, known bugs & workarounds
- The `http-client-restricted` has a needlessly complex interface, and puts effort into implementing proxy support which we don't want, so we've inlined a stripped down version.
- Performance constraint: As the blocking is checked for each request, if a long list of blocked CIDRs is supplied, iterating through all of them is not what we would prefer. Using trie is suggested to overcome this. (Added to RFC)
- Calls to Lux endpoints are inconsistent: We use either the http manager from the ProServeCtx which is unrestricted, or the http manager from the ServeCtx which is restricted (the latter through the instances for MonadMetadataApiAuthorization and UserAuthentication). (The failure scenario here would be: cloud sets PRO_ENDPOINT to something that resolves to an internal address, and then restricted requests to those endpoints fail, causing auth to fail on user requests. This is about HTTP requests to lux auth endpoints.)
## Changelog
- ✅ `CHANGELOG.md` is updated with user-facing content relevant to this PR.
## Affected components
- ✅ Server
- ✅ Tests
PR-URL: https://github.com/hasura/graphql-engine-mono/pull/3186
Co-authored-by: Robert <132113+robx@users.noreply.github.com>
GitOrigin-RevId: 5bd2de2d028bc416b02c99e996c7bebce56fb1e7
2022-02-25 16:29:55 +03:00
|
|
|
-- https://github.com/andrewthad/haskell-ip/issues/79
|
|
|
|
|
allow-newer: ip:attoparsec
|
|
|
|
|
|
2020-01-18 01:07:15 +03:00
|
|
|
package *
|
2021-10-20 19:14:00 +03:00
|
|
|
-- NOTE: this gets applied to both local (hasura) packages and dependencies,
|
|
|
|
|
-- but optimizations for local hasura packages are overridden/controlled
|
|
|
|
|
-- via the 'optimize-hasura' flag.
|
2020-01-18 01:07:15 +03:00
|
|
|
optimization: 2
|
2020-04-03 11:24:51 +03:00
|
|
|
-- For tooling, e.g. 'weeder', and IDE-like stuff:
|
|
|
|
|
ghc-options: -fwrite-ide-info
|
2020-01-18 01:07:15 +03:00
|
|
|
|
|
|
|
|
haddock-html: true
|
|
|
|
|
haddock-hoogle: true
|
|
|
|
|
haddock-hyperlink-source: true
|
|
|
|
|
haddock-quickjump: true
|
|
|
|
|
|
|
|
|
|
package graphql-engine
|
|
|
|
|
ghc-options: -j
|
|
|
|
|
haddock-options: "--show-all"
|
|
|
|
|
|
2021-09-16 14:03:01 +03:00
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
2021-09-16 23:16:08 +03:00
|
|
|
location: https://github.com/hasura/kriti-lang.git
|
2022-02-24 16:07:32 +03:00
|
|
|
tag: v0.3.1
|
2021-09-16 14:03:01 +03:00
|
|
|
|
2020-01-18 01:07:15 +03:00
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
|
|
|
|
location: https://github.com/hasura/pg-client-hs.git
|
2021-09-29 19:20:06 +03:00
|
|
|
tag: f28738e18b7038627fb59b93dbc67929fe427c57
|
2020-01-18 01:07:15 +03:00
|
|
|
|
|
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
|
|
|
|
location: https://github.com/hasura/graphql-parser-hs.git
|
2021-10-22 14:53:16 +03:00
|
|
|
tag: 36212bcc3815434a1bc25dc96f091a783b880ca4
|
2020-01-18 01:07:15 +03:00
|
|
|
|
|
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
|
|
|
|
location: https://github.com/hasura/ci-info-hs.git
|
2021-03-03 10:01:44 +03:00
|
|
|
tag: be578a01979fc95137cc2c84827f9fafb99df60f
|
2020-09-01 07:56:11 +03:00
|
|
|
|
|
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
|
|
|
|
location: https://github.com/hasura/pool.git
|
2021-02-15 16:32:19 +03:00
|
|
|
tag: bc4c3f739a8fb8ec4444336a34662895831c9acf
|
2021-02-23 20:37:27 +03:00
|
|
|
|
|
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
2022-02-14 13:42:11 +03:00
|
|
|
location: https://github.com/fpco/odbc.git
|
|
|
|
|
tag: 3d80ffdd4a2879f0debecabb56d834d2d898212b
|
2021-02-23 20:37:27 +03:00
|
|
|
|
|
|
|
|
package odbc
|
|
|
|
|
ghc-options: -Wwarn
|
|
|
|
|
-- Our CI compiles with -Werror, which is also applied to those packages
|
|
|
|
|
-- while it's fine for packages we maintain, we can't actually enforce
|
|
|
|
|
-- that third-party packages are warning-free, hence this -Wno-error.
|
|
|
|
|
-- When the changes in odbc are released, we can instead depend on
|
|
|
|
|
-- the hackage version, and remove it from this list of packages.
|
2021-08-06 00:07:17 +03:00
|
|
|
|
|
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
|
|
|
|
location: https://github.com/hasura/ekg-core.git
|
2021-12-27 20:00:41 +03:00
|
|
|
tag: ac51c3834e242833e9735394295cbcaa583233f8
|
2021-08-06 00:07:17 +03:00
|
|
|
|
|
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
|
|
|
|
location: https://github.com/hasura/ekg-json.git
|
2021-12-27 20:00:41 +03:00
|
|
|
tag: 84990712c165d7e3e76b2b289640ef8b5033f12f
|
2021-08-11 07:18:40 +03:00
|
|
|
|
2021-11-19 20:05:01 +03:00
|
|
|
-- This is v1.2.3.2 with https://github.com/haskell/text/pull/348
|
2021-09-08 07:12:45 +03:00
|
|
|
-- cherry-picked. When 1.3 is released we can move from this fork.
|
|
|
|
|
source-repository-package
|
|
|
|
|
type: git
|
|
|
|
|
location: https://github.com/hasura/text.git
|
2021-11-19 20:05:01 +03:00
|
|
|
tag: 874c3164fadf39a83382359d2b6ce941a3e134da
|
2021-09-08 07:12:45 +03:00
|
|
|
|
