ilyakooo0/urbit
1
0
Fork 0
mirror of https://github.com/ilyakooo0/urbit.git synced 2024-12-15 01:52:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

eyre: respect protocol from Forwarded header

Browse Source 
If the Forwarded header specifies the original connection is secure,
update the flag to reflect that, regardless of whether the connection
directly to the urbit was made securely.
This commit is contained in:
fang 2020-10-29 14:24:24 +01:00
parent 82dcad4c59
commit 42229657ca
No known key found for this signature in database
GPG Key ID: EB035760C1BBA972
1 changed files with 36 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
pkg/arvo/sys/vane/eyre.hoon
View File

@ -590,8 +590,12 @@
=* headers header-list.request
:: for requests from localhost, respect the "forwarded" header
::
=? address =([%ipv4 .127.0.0.1] address)
(fall (forwarded-for headers) address)
=/ [secure=? =^address]
=* same [secure address]
?. =([%ipv4 .127.0.0.1] address) same
?~ forwards=(forwarded-params headers) same
:- (fall (forwarded-secure u.forwards) secure)
(fall (forwarded-for u.forwards) address)
::
=/ host (get-header:http 'host' headers)
=/ [=action suburl=@t]
@ -2013,29 +2017,39 @@
(cat 3 '.' u.ext.request-line)
--
::
++ forwarded-for
++ forwarded-params
|= =header-list:http
^- (unit address)
=/ forwarded=(unit @t)
^- (unit (list (map @t @t)))
%+ biff
(get-header:http 'forwarded' header-list)
?~ forwarded ~
|^ =/ forwards=(unit (list (map @t @t)))
(unpack-header:http u.forwarded)
?. ?=([~ ^] forwards) ~
=* forward i.u.forwards
?~ for=(~(get by forward) 'for') ~
::NOTE per rfc7239, non-ip values are also valid. they're not useful
:: for the general case, so we ignore them here. if needed,
:: request handlers are free to inspect the headers themselves.
::
(rush u.for ip-address)
unpack-header:http
::
++ forwarded-for
|= forwards=(list (map @t @t))
^- (unit address)
?. ?=(^ forwards) ~
=* forward i.forwards
?~ for=(~(get by forward) 'for') ~
::NOTE per rfc7239, non-ip values are also valid. they're not useful
:: for the general case, so we ignore them here. if needed,
:: request handlers are free to inspect the headers themselves.
::
++ ip-address
;~ sfix
;~(pose (stag %ipv4 ip4) (stag %ipv6 (ifix [lac rac] ip6)))
;~(pose ;~(pfix col dim:ag) (easy ~))
==
--
%+ rush u.for
;~ sfix
;~(pose (stag %ipv4 ip4) (stag %ipv6 (ifix [lac rac] ip6)))
;~(pose ;~(pfix col dim:ag) (easy ~))
==
::
++ forwarded-secure
|= forwards=(list (map @t @t))
^- (unit ?)
?. ?=(^ forwards) ~
=* forward i.forwards
?~ proto=(~(get by forward) 'proto') ~
?+ u.proto ~
%http `|
%https `&
==
::
++ parse-request-line
|= url=@t