New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[] notation for IPv6 with X-Forwarded-For #230

Closed
NicolasLM opened this Issue Jan 16, 2019 · 3 comments

Comments

Projects
None yet
2 participants
@NicolasLM
Copy link

NicolasLM commented Jan 16, 2019

After upgrading to Waitress 1.2.0 and letting it handle X-Forwarded-For headers, the WSGI environment REMOTE_ADDR is populated with IPv6 using the [] notation, for instance '[2a02::1]'.

While the WSGI specification doesn't say anything about REMOTE_ADDR, it is a bit surprising since this notation cannot be used with ipaddress:

>>> import ipaddress
>>> ipaddress.ip_address('2a02::1')
IPv6Address('2a02::1')
>>> ipaddress.ip_address('[2a02::1]')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.4/ipaddress.py", line 54, in ip_address
    address)
ValueError: '[2a02::1]' does not appear to be an IPv4 or IPv6 address
@bertjwregeer

This comment has been minimized.

Copy link
Member

bertjwregeer commented Jan 17, 2019

TL;DR: The [] needs to be stripped from the IPv6 address, with the caveat that at that point you can't easily do env['REMOTE_ADDR'] + ':' + env['REMOTE_PORT'] and get a "nice" representation

Background:

The REMOTE_ADDR is actually from the CGI spec which the WSGI specification kind of inherits from.

The CGI spec: https://tools.ietf.org/html/rfc3875#section-4.1.8 mentions https://tools.ietf.org/html/rfc3513#section-2.2 which is the standard for IPv6. However https://tools.ietf.org/html/rfc4291#section-2.2 obsoletes RFC3513. Then there is errata for RFC4291 that is https://tools.ietf.org/html/rfc5952#page-11 which shows how to best do text presentation of IPv6.

When we get the X-Forwarded-For header, it may include the remote port, in this format:

X-Forwarded-For: [2001:db8::1]:30943

We peel off the 30943 and set that as the REMOTE_PORT and the rest is REMOTE_ADDR. This way if you take env['REMOTE_ADDR'] + ':' + env['REMOTE_PORT'] you get back [2001:db8::1]:30943, if we strip [] from the IPv6 address, you'd end up with 2001:db8::1:30943 which while a valid way to represent an IPv6 address + port (RFC5952) is not very readable and requires extra parsing to put together the real remote pair.

I would argue that ipaddress should be updated to support bracketed IPv6 as well, but it also doesn't support scoped IPv6 addresses either, so there's some other needs too.

@bertjwregeer

This comment has been minimized.

Copy link
Member

bertjwregeer commented Jan 26, 2019

@NicolasLM I fixed and released version 1.2.1

@NicolasLM

This comment has been minimized.

Copy link
Author

NicolasLM commented Jan 26, 2019

Thank you for your work on this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment