public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Backend: fix IPv6 address parsing erroneous (#28585)

Browse Source 
* Backend: Fix parsing of client IP address

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>
This commit is contained in:
taciomcosta
2020-11-25 07:55:22 +01:00
committed by GitHub
co-authored by Arve Knudsen
parent 3d33de1751
commit 10ff4eecef
15 changed files with 228 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/middleware/auth_proxy/auth_proxy.go
+5 -3
View File
@@ -132,7 +132,10 @@ func (auth *AuthProxy) IsAllowedIP() (bool, *Error) {
proxyObjs = append(proxyObjs, result)
}
sourceIP, _, _ := net.SplitHostPort(ip)
sourceIP, _, err := net.SplitHostPort(ip)
if err != nil {
return false, newError("could not parse address", err)
}
sourceObj := net.ParseIP(sourceIP)
for _, proxyObj := range proxyObjs {
@@ -141,11 +144,10 @@ func (auth *AuthProxy) IsAllowedIP() (bool, *Error) {
}
}
err := fmt.Errorf(
err = fmt.Errorf(
"request for user (%s) from %s is not from the authentication proxy", auth.header,
sourceIP,
)
return false, newError("Proxy authentication required", err)
}
pkg/middleware/middleware.go
+8 -1
View File
@@ -14,6 +14,7 @@ import (
"github.com/grafana/grafana/pkg/bus"
"github.com/grafana/grafana/pkg/components/apikeygen"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/network"
"github.com/grafana/grafana/pkg/infra/remotecache"
"github.com/grafana/grafana/pkg/login"
"github.com/grafana/grafana/pkg/models"
@@ -255,7 +256,13 @@ func rotateEndOfRequestFunc(ctx *models.ReqContext, authTokenService models.User
return
}
rotated, err := authTokenService.TryRotateToken(ctx.Req.Context(), token, ctx.RemoteAddr(), ctx.Req.UserAgent())
addr := ctx.RemoteAddr()
ip, err := network.GetIPFromAddress(addr)
if err != nil {
ctx.Logger.Debug("Failed to get client IP address", "addr", addr, "err", err)
ip = nil
}
rotated, err := authTokenService.TryRotateToken(ctx.Req.Context(), token, ip, ctx.Req.UserAgent())
if err != nil {
ctx.Logger.Error("Failed to rotate token", "error", err)
return
pkg/middleware/middleware_test.go
+7 -3
View File
@@ -4,6 +4,7 @@ import (
"context"
"errors"
"fmt"
"net"
"net/http"
"net/http/httptest"
"path/filepath"
@@ -249,7 +250,8 @@ func TestMiddlewareContext(t *testing.T) {
}, nil
}
sc.userAuthTokenService.TryRotateTokenProvider = func(ctx context.Context, userToken *models.UserToken, clientIP, userAgent string) (bool, error) {
sc.userAuthTokenService.TryRotateTokenProvider = func(ctx context.Context, userToken *models.UserToken,
clientIP net.IP, userAgent string) (bool, error) {
userToken.UnhashedToken = "rotated"
return true, nil
}
@@ -593,7 +595,8 @@ func TestDontRotateTokensOnCancelledRequests(t *testing.T) {
tryRotateCallCount := 0
uts := &auth.FakeUserAuthTokenService{
TryRotateTokenProvider: func(ctx context.Context, token *models.UserToken, clientIP, userAgent string) (bool, error) {
TryRotateTokenProvider: func(ctx context.Context, token *models.UserToken, clientIP net.IP,
userAgent string) (bool, error) {
tryRotateCallCount++
return false, nil
},
@@ -613,7 +616,8 @@ func TestTokenRotationAtEndOfRequest(t *testing.T) {
require.NoError(t, err)
uts := &auth.FakeUserAuthTokenService{
TryRotateTokenProvider: func(ctx context.Context, token *models.UserToken, clientIP, userAgent string) (bool, error) {
TryRotateTokenProvider: func(ctx context.Context, token *models.UserToken, clientIP net.IP,
userAgent string) (bool, error) {
newToken, err := util.RandomHex(16)
require.NoError(t, err)
token.AuthToken = newToken