Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

X-Forwarded-For Proxy Fix - does not work with IPv6 Addresses #2262

Closed
hjensas opened this issue Oct 18, 2021 · 4 comments · Fixed by #2263
Closed

X-Forwarded-For Proxy Fix - does not work with IPv6 Addresses #2262

hjensas opened this issue Oct 18, 2021 · 4 comments · Fixed by #2263
Labels
Milestone

Comments

@hjensas
Copy link
Contributor

hjensas commented Oct 18, 2021

X-Forwarded-For Proxy Fix does a host.split(":", 1)[1]. This does not work with IPv6 addresses using : separator.
For example splitting [fd00', 'fd00:fd00:0000::2]:13050/ would result in: ['[fd00', 'fd00:fd00:0000::2]:13050/'] and host is incorrectly set to [fd00' i.e only the first hextet of the IPv6 address.

[1] https://github.com/pallets/werkzeug/blob/main/src/werkzeug/middleware/proxy_fix.py#L176

Environment:

  • Python version: Python 3.6.8
  • Werkzeug version: python3-werkzeug-2.0.1-2.el8.noarch
hjensas added a commit to hjensas/werkzeug that referenced this issue Oct 18, 2021
Check for brackets([]) in host, and partition the host
based on closing bracket if the case where host is a
IPv6 Address.

Fixes: pallets#2262
hjensas added a commit to hjensas/werkzeug that referenced this issue Oct 18, 2021
Check for brackets([]) in host, and partition the host
based on closing bracket if the case where host is a
IPv6 Address.

Fixes: pallets#2262
hjensas added a commit to hjensas/werkzeug that referenced this issue Oct 18, 2021
Check for brackets([]) in host, and partition the host
based on closing bracket if the case where host is a
IPv6 Address.

Fixes: pallets#2262
@davidism
Copy link
Member

davidism commented Oct 18, 2021

I see you're already working on a fix. Instead of adding special handling for IPv6, you can change the whole x_host block to this. A similar change will work for x_port.

environ["HTTP_HOST"] = environ["SERVER_NAME"] = x_host

if ":" in x_host and not x_host.endswith("]"):
    environ["SERVER_NAME"], environ["SERVER_PORT"] = x_host.rsplit(":", 1)

hjensas added a commit to hjensas/werkzeug that referenced this issue Oct 18, 2021
Check for brackets([]) in host, and partition/split the
host based on closing bracket if the case where host is
a IPv6 Address.

Fixes: pallets#2262
@hjensas
Copy link
Contributor Author

hjensas commented Oct 18, 2021

@davidism We need to handle 2001:db8::a]:8080 as well, so not x_host.endswith("]") can be problematic?

But, indeed using rsplit() helps making the code a bit easier to read.
WDYT about the latest update at: hjensas@04fb182

hjensas added a commit to hjensas/werkzeug that referenced this issue Oct 18, 2021
Use rsplit to split host/port, this will work for both
IPv4, IPV6 and hostnames. Only split if no brackets and
colon, or in case closing bracket followed by colon in
the string.

Fixes: pallets#2262
@davidism
Copy link
Member

If the host has : but does end with ], then it's an IPv6 without a port, so the code shouldn't try to split the port.

@hjensas
Copy link
Contributor Author

hjensas commented Oct 18, 2021

facpalm you are right. It makes sense now.

hjensas added a commit to hjensas/werkzeug that referenced this issue Oct 18, 2021
Use rsplit() to split host/port, this will work for both
IPv4, IPV6 and hostnames. Only rsplit() if ':' in string
and the string does not end with closing bracket.

Fixes: pallets#2262
hjensas added a commit to hjensas/werkzeug that referenced this issue Oct 18, 2021
Use rsplit() to split host/port, this will work for both
IPv4, IPV6 and hostnames. Only rsplit() if ':' in string
and the string does not end with closing bracket.

Fixes: pallets#2262
hjensas added a commit to hjensas/werkzeug that referenced this issue Oct 18, 2021
Use rsplit() to split host/port, this will work for both
IPv4, IPV6 and hostnames. Only rsplit() if ':' in string
and the string does not end with closing bracket.

Fixes: pallets#2262
@davidism davidism added this to the 2.0.3 milestone Nov 16, 2021
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Dec 1, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants