53 lines
1.5 KiB
Python
53 lines
1.5 KiB
Python
"""The reverse-proxy boundary must reject client-supplied forwarding metadata."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
from typing import Any
|
|
|
|
from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
|
|
|
|
|
|
def _resolved_client(*, peer: str, trusted: tuple[str, ...]) -> tuple[str, int]:
|
|
seen: dict[str, tuple[str, int]] = {}
|
|
|
|
async def app(scope: dict[str, Any], receive: Any, send: Any) -> None:
|
|
seen["client"] = scope["client"]
|
|
|
|
async def receive() -> dict[str, str]:
|
|
return {"type": "http.disconnect"}
|
|
|
|
async def send(message: dict[str, Any]) -> None:
|
|
return None
|
|
|
|
middleware = ProxyHeadersMiddleware(app, trusted_hosts=list(trusted))
|
|
scope: dict[str, Any] = {
|
|
"type": "http",
|
|
"scheme": "http",
|
|
"client": (peer, 50000),
|
|
"headers": [(b"x-forwarded-for", b"203.0.113.25")],
|
|
}
|
|
asyncio.run(middleware(scope, receive, send))
|
|
return seen["client"]
|
|
|
|
|
|
def test_untrusted_peer_cannot_spoof_the_rate_limit_client_identity() -> None:
|
|
assert _resolved_client(peer="192.168.10.55", trusted=("172.30.50.2",)) == (
|
|
"192.168.10.55",
|
|
50000,
|
|
)
|
|
|
|
|
|
def test_docker_gateway_cannot_spoof_client_identity() -> None:
|
|
assert _resolved_client(peer="172.30.50.1", trusted=("172.30.50.2",)) == (
|
|
"172.30.50.1",
|
|
50000,
|
|
)
|
|
|
|
|
|
def test_trusted_proxy_can_forward_the_real_client_identity() -> None:
|
|
assert _resolved_client(peer="172.30.50.2", trusted=("172.30.50.2",)) == (
|
|
"203.0.113.25",
|
|
0,
|
|
)
|