mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-01 14:51:17 +00:00
TheFox0x7
1b1274486c
Introduces gitproxy module which spawns a small forward proxy as scanner for git calls Replaces hostmatcher with matchlist which supports port rules Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS settings in migration in favor of full names we have in security configs. Removes `external` preset in favor of lax/strict modes, strict mode requiring explicit ports if they aren't standard http/s ones. Breaking changes: - `external` preset no longer works as deny rule. To enforce that, use `strict` mode and allow ranges to connect to - Wildcards are no longer accepted in IP addresses - `*` is no longer allowed as entry in lists - domain rules now use curl like syntax `*.example.com` matching subdomains but not `example.com`, `example.com` matching itself and all subdomains. `example.*` is not a valid rule - In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive list. A startup warning flags this - Invalid list entries are logged at startup, invalid `BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it Docs: https://gitea.com/gitea/docs/pulls/557 Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
62 lines
1.6 KiB
Go
62 lines
1.6 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package proxy
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
"sync"
|
|
|
|
"gitea.dev/modules/glob"
|
|
"gitea.dev/modules/log"
|
|
"gitea.dev/modules/setting"
|
|
)
|
|
|
|
var (
|
|
globalProxyHosts = sync.OnceValue(func() []glob.Glob { return compileHosts(setting.Proxy.ProxyHosts) })
|
|
webhookProxyHosts = sync.OnceValue(func() []glob.Glob { return compileHosts(setting.Webhook.ProxyHosts) })
|
|
)
|
|
|
|
func compileHosts(hosts []string) (globs []glob.Glob) {
|
|
for _, h := range hosts {
|
|
if g, err := glob.Compile(h); err == nil {
|
|
globs = append(globs, g)
|
|
} else {
|
|
log.Error("glob.Compile %s failed: %v", h, err)
|
|
}
|
|
}
|
|
return globs
|
|
}
|
|
|
|
// hostsProxy sends requests for hosts matching globs through proxyURL, others follow the environment
|
|
func hostsProxy(globs []glob.Glob, proxyURL *url.URL) func(req *http.Request) (*url.URL, error) {
|
|
return func(req *http.Request) (*url.URL, error) {
|
|
for _, g := range globs {
|
|
if g.Match(req.URL.Host) {
|
|
return proxyURL, nil
|
|
}
|
|
}
|
|
return http.ProxyFromEnvironment(req)
|
|
}
|
|
}
|
|
|
|
// Proxy returns the system proxy
|
|
func Proxy() func(req *http.Request) (*url.URL, error) {
|
|
if !setting.Proxy.Enabled {
|
|
return nil
|
|
}
|
|
if setting.Proxy.ProxyURL == "" {
|
|
return http.ProxyFromEnvironment
|
|
}
|
|
return hostsProxy(globalProxyHosts(), setting.Proxy.ProxyURLFixed)
|
|
}
|
|
|
|
// WebHookProxy returns the webhook proxy, falling back to the system proxy if no webhook proxy is set
|
|
func WebHookProxy() func(req *http.Request) (*url.URL, error) {
|
|
if setting.Webhook.ProxyURL == "" {
|
|
return Proxy()
|
|
}
|
|
return hostsProxy(webhookProxyHosts(), setting.Webhook.ProxyURLFixed)
|
|
}
|