Mercurial > kallithea
changeset 7367:c57d926edd39
auth: strip RFC4007 zone identifiers from IPv6 addresses before doing access control
If using IPv6, the request IP address might contain a '%' that the ipaddr
module that is used for IP filtering can't handle.
https://tools.ietf.org/html/rfc4007#section-11 specifies how IPv6 addresses can
have zone identifiers like trailing '%13' or '%eth0'. The zone identifier is
used to help distinguish *if* the same address should be available on multiple
interfaces. It *could* potentially have security implications in the odd case
where the same address is different on different interfaces. The IP whitelist
functionality does however not support zone filters, so there is no way users
can expect the zone to be relevant for IP filtering. We can thus safely strip
the zone index and only check for match on the other parts of the address.
| author | Mads Kiilerich <mads@kiilerich.com> |
|---|---|
| date | Sat, 01 Sep 2018 01:12:13 +0200 |
| parents | a79c137b1ddc |
| children | e44954828c9a |
| files | kallithea/lib/auth.py |
| diffstat | 1 files changed, 1 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/kallithea/lib/auth.py Thu Aug 30 20:58:25 2018 +0200 +++ b/kallithea/lib/auth.py Sat Sep 01 01:12:13 2018 +0200 @@ -1008,6 +1008,7 @@ :param allowed_ips: list of allowed ips together with mask """ from kallithea.lib import ipaddr + source_ip = source_ip.split('%', 1)[0] log.debug('checking if ip:%s is subnet of %s', source_ip, allowed_ips) if isinstance(allowed_ips, (tuple, list, set)): for ip in allowed_ips: