lgladsden/jellyfin-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Impliments KnownNetworks and KnownProxies

Browse Source
This commit is contained in:
BaronGreenback 2021-01-08 00:05:15 +00:00
parent 7acee4070e
commit 35a30c9d09
6 changed files with 283 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Jellyfin.Networking/Configuration/NetworkConfiguration.cs
View File

@ -224,7 +224,7 @@ namespace Jellyfin.Networking.Configuration
public string[] LocalNetworkAddresses { get; set; } = Array.Empty<string>();
/// <summary>
/// Gets or sets the known proxies.
/// Gets or sets the known proxies. If the proxy is a network, it's added to the KnownNetworks.
/// </summary>
public string[] KnownProxies { get; set; } = Array.Empty<string>();
}

31
Jellyfin.Networking/Manager/NetworkManager.cs
View File

@ -139,6 +139,16 @@ namespace Jellyfin.Networking.Manager
/// </summary>
public bool IsIP4Enabled { get; set; }
/// <summary>
/// Gets or sets a value indicating whether the system has IP4 is enabled.
/// </summary>
public bool SystemIP4Enabled { get; set; }
/// <summary>
/// Gets or sets a value indicating whether the system has IP6 is enabled.
/// </summary>
public bool SystemIP6Enabled { get; set; }
/// <inheritdoc/>
public Collection<IPObject> RemoteAddressFilter { get; private set; }
@ -185,6 +195,15 @@ namespace Jellyfin.Networking.Manager
return _macAddresses;
}
/// <summary>
/// REMOVE after debugging.
/// </summary>
/// <param name="msg">Message.</param>
public void Log(string msg)
{
_logger.LogInformation(msg);
}
/// <inheritdoc/>
public bool IsGatewayInterface(IPObject? addressObj)
{
@ -1047,7 +1066,10 @@ namespace Jellyfin.Networking.Manager
// populate interface address list
foreach (UnicastIPAddressInformation info in ipProperties.UnicastAddresses)
{
if (IsIP4Enabled && info.Address.AddressFamily == AddressFamily.InterNetwork)
if (info.Address.AddressFamily == AddressFamily.InterNetwork)
{
SystemIP4Enabled = true;
if (IsIP4Enabled)
{
IPNetAddress nw = new IPNetAddress(info.Address, IPObject.MaskToCidr(info.IPv4Mask))
{
@ -1068,7 +1090,11 @@ namespace Jellyfin.Networking.Manager
_interfaceNames[adapter.Description.ToLower(CultureInfo.InvariantCulture)] = tag;
_interfaceNames["eth" + tag.ToString(CultureInfo.InvariantCulture)] = tag;
}
else if (IsIP6Enabled && info.Address.AddressFamily == AddressFamily.InterNetworkV6)
}
else if (info.Address.AddressFamily == AddressFamily.InterNetworkV6)
{
SystemIP6Enabled = true;
if (IsIP6Enabled)
{
IPNetAddress nw = new IPNetAddress(info.Address, (byte)info.PrefixLength)
{
@ -1091,6 +1117,7 @@ namespace Jellyfin.Networking.Manager
}
}
}
}
#pragma warning disable CA1031 // Do not catch general exception types
catch (Exception ex)
{

112
Jellyfin.Server/Extensions/ApiServiceCollectionExtensions.cs
View File

@ -1,9 +1,12 @@
using System;
using System.Collections.Generic;
using System.Globalization;
using System.IO;
using System.Linq;
using System.Net;
using System.Net.Sockets;
using System.Reflection;
using System.Text;
using Emby.Server.Implementations;
using Jellyfin.Api.Auth;
using Jellyfin.Api.Auth.DefaultAuthorizationPolicy;
@ -20,6 +23,7 @@ using Jellyfin.Api.Constants;
using Jellyfin.Api.Controllers;
using Jellyfin.Api.ModelBinders;
using Jellyfin.Data.Enums;
using Jellyfin.Networking.Configuration;
using Jellyfin.Server.Configuration;
using Jellyfin.Server.Filters;
using Jellyfin.Server.Formatters;
@ -169,36 +173,124 @@ namespace Jellyfin.Server.Extensions
.AddScheme<AuthenticationSchemeOptions, CustomAuthenticationHandler>(AuthenticationSchemes.CustomAuthentication, null);
}
/// <summary>
/// Sets up the proxy configuration based on the addresses in <paramref name="userList"/>.
/// </summary>
/// <param name="networkManager">The <see cref="INetworkManager"/> instance.</param>
/// <param name="config">The <see cref="NetworkConfiguration"/> containing the config settings.</param>
/// <param name="userList">The string array to parse.</param>
/// <param name="options">The <see cref="ForwardedHeadersOptions"/> instance.</param>
public static void ParseList(INetworkManager networkManager, NetworkConfiguration config, string[] userList, ForwardedHeadersOptions options)
{
for (var i = 0; i < userList.Length; i++)
{
if (IPNetAddress.TryParse(userList[i], out var addr))
{
if ((!config.EnableIPV4 && addr.AddressFamily == AddressFamily.InterNetwork)
|| (!config.EnableIPV6 && addr.AddressFamily == AddressFamily.InterNetworkV6))
{
continue;
}
if (networkManager.SystemIP6Enabled && addr.AddressFamily == AddressFamily.InterNetwork)
{
// If the server is using dual-mode sockets, IPv4 addresses are supplied in an IPv6 format.
// https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-5.0 .
addr.Address = addr.Address.MapToIPv6();
}
if (addr.PrefixLength == 32)
{
options.KnownProxies.Add(addr.Address);
}
else
{
options.KnownNetworks.Add(new IPNetwork(addr.Address, addr.PrefixLength));
}
}
else if (IPHost.TryParse(userList[i], out var host))
{
foreach (var address in host.GetAddresses())
{
if ((!config.EnableIPV4 && host.AddressFamily == AddressFamily.InterNetwork)
|| (!config.EnableIPV6 && host.AddressFamily == AddressFamily.InterNetworkV6))
{
continue;
}
var hostAddr = address;
if (networkManager.SystemIP6Enabled && address.AddressFamily == AddressFamily.InterNetwork)
{
// If the server is using dual-mode sockets, IPv4 addresses are supplied in an IPv6 format.
// https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-5.0 .
hostAddr = address.MapToIPv6();
}
options.KnownProxies.Add(hostAddr);
}
}
}
}
private static string EnumToString<T>(IEnumerable<T> x)
{
var sb = new StringBuilder();
foreach (var item in x)
{
if (item is IPAddress ipItem)
{
sb.Append(ipItem.ToString());
}
else if (item is IPNetwork ipNetwork)
{
sb.Append(ipNetwork.Prefix.ToString());
sb.Append('/');
sb.Append(ipNetwork.PrefixLength.ToString(CultureInfo.InvariantCulture));
sb.Append(',');
}
}
return sb.ToString();
}
/// <summary>
/// Extension method for adding the jellyfin API to the service collection.
/// </summary>
/// <param name="serviceCollection">The service collection.</param>
/// <param name="pluginAssemblies">An IEnumerable containing all plugin assemblies with API controllers.</param>
/// <param name="knownProxies">A list of all known proxies to trust for X-Forwarded-For.</param>
/// <param name="config">The <see cref="NetworkConfiguration"/>.</param>
/// <param name="networkManager">The <see cref="INetworkManager"/> instance.</param>
/// <returns>The MVC builder.</returns>
public static IMvcBuilder AddJellyfinApi(this IServiceCollection serviceCollection, IEnumerable<Assembly> pluginAssemblies, IReadOnlyList<string> knownProxies)
public static IMvcBuilder AddJellyfinApi(this IServiceCollection serviceCollection, IEnumerable<Assembly> pluginAssemblies, NetworkConfiguration config, INetworkManager networkManager)
{
IMvcBuilder mvcBuilder = serviceCollection
.AddCors()
.AddTransient<ICorsPolicyProvider, CorsPolicyProvider>()
.Configure<ForwardedHeadersOptions>(options =>
{
// https://github.com/dotnet/aspnetcore/blob/master/src/Middleware/HttpOverrides/src/ForwardedHeadersMiddleware.cs
// Enable debug logging on Microsoft.AspNetCore.HttpOverrides.ForwardedHeadersMiddleware to help investigate issues.
options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
if (knownProxies.Count == 0)
if (config.KnownProxies.Length == 0)
{
options.KnownNetworks.Clear();
options.KnownProxies.Clear();
options.KnownNetworks.Clear();
}
else
{
for (var i = 0; i < knownProxies.Count; i++)
ParseList(networkManager, config, config.KnownProxies, options);
networkManager.Log("KnownProxies: " + EnumToString<IPAddress>(options.KnownProxies));
networkManager.Log("KnownNetworks: " + EnumToString<IPNetwork>(options.KnownNetworks));
}
// Only set forward limit if we have some known proxies or some known networks.
if (options.KnownProxies.Count != 0 || options.KnownNetworks.Count != 0)
{
if (IPHost.TryParse(knownProxies[i], out var host))
{
options.KnownProxies.Add(host.Address);
}
}
options.ForwardLimit = null;
}
networkManager.Log("Forward Limit : " + options.ForwardLimit?.ToString(CultureInfo.CurrentCulture) ?? "None");
})
.AddMvc(opts =>
{

8
Jellyfin.Server/Startup.cs
View File

@ -26,18 +26,22 @@ namespace Jellyfin.Server
{
private readonly IServerConfigurationManager _serverConfigurationManager;
private readonly IServerApplicationHost _serverApplicationHost;
private readonly INetworkManager _networkManager;
/// <summary>
/// Initializes a new instance of the <see cref="Startup" /> class.
/// </summary>
/// <param name="serverConfigurationManager">The server configuration manager.</param>
/// <param name="serverApplicationHost">The server application host.</param>
/// <param name="networkManager">The network manager.</param>
public Startup(
IServerConfigurationManager serverConfigurationManager,
IServerApplicationHost serverApplicationHost)
IServerApplicationHost serverApplicationHost,
INetworkManager networkManager)
{
_serverConfigurationManager = serverConfigurationManager;
_serverApplicationHost = serverApplicationHost;
_networkManager = networkManager;
}
/// <summary>
@ -52,7 +56,7 @@ namespace Jellyfin.Server
{
options.HttpsPort = _serverApplicationHost.HttpsPort;
});
services.AddJellyfinApi(_serverApplicationHost.GetApiPluginAssemblies(), _serverConfigurationManager.GetNetworkConfiguration().KnownProxies);
services.AddJellyfinApi(_serverApplicationHost.GetApiPluginAssemblies(), _serverConfigurationManager.GetNetworkConfiguration(), _networkManager);
services.AddJellyfinApiSwagger();

16
MediaBrowser.Common/Net/INetworkManager.cs
View File

@ -44,6 +44,16 @@ namespace MediaBrowser.Common.Net
/// </summary>
bool IsIP4Enabled { get; set; }
/// <summary>
/// Gets or sets a value indicating whether the system has IP4 is enabled.
/// </summary>
public bool SystemIP4Enabled { get; set; }
/// <summary>
/// Gets or sets a value indicating whether the system has IP6 is enabled.
/// </summary>
public bool SystemIP6Enabled { get; set; }
/// <summary>
/// Calculates the list of interfaces to use for Kestrel.
/// </summary>
@ -229,5 +239,11 @@ namespace MediaBrowser.Common.Net
/// <param name="filter">Optional filter for the list.</param>
/// <returns>Returns a filtered list of LAN addresses.</returns>
Collection<IPObject> GetFilteredLANSubnets(Collection<IPObject>? filter = null);
/// <summary>
/// REMOVE after debugging.
/// </summary>
/// <param name="msg">Message.</param>
void Log(string msg);
}
}

95
tests/Jellyfin.Api.Tests/ParseNetworkTests.cs Normal file
View File

@ -0,0 +1,95 @@
using System;
using System.Collections.Generic;
using System.Globalization;
using System.Linq;
using System.Net;
using System.Text;
using System.Threading.Tasks;
using Jellyfin.Networking.Configuration;
using Jellyfin.Networking.Manager;
using Jellyfin.Server.Extensions;
using MediaBrowser.Common.Configuration;
using MediaBrowser.Common.Net;
using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.Logging.Abstractions;
using Moq;
using Xunit;
namespace Jellyfin.Api.Tests
{
public class ParseNetworkTests
{
private static IConfigurationManager GetMockConfig(NetworkConfiguration conf)
{
var configManager = new Mock<IConfigurationManager>
{
CallBase = true
};
configManager.Setup(x => x.GetConfiguration(It.IsAny<string>())).Returns(conf);
return (IConfigurationManager)configManager.Object;
}
private static NetworkManager CreateNetworkManager()
{
var conf = new NetworkConfiguration()
{
EnableIPV6 = true,
EnableIPV4 = true,
};
return new NetworkManager(GetMockConfig(conf), new NullLogger<NetworkManager>());
}
/// <summary>
/// Order of the result has always got to be hosts, then networks.
/// </summary>
/// <param name="ip4">IP4 enabled.</param>
/// <param name="ip6">IP6 enabled.</param>
/// <param name="hostList">List to parse.</param>
/// <param name="match">What it should match.</param>
[Theory]
[InlineData(true, true, "192.168.0.0/16,www.yahoo.co.uk", "::ffff:212.82.100.150,::ffff:192.168.0.0/16")]
[InlineData(true, false, "192.168.0.0/16,www.yahoo.co.uk", "212.82.100.150,192.168.0.0/16")]
[InlineData(true, true, "192.168.t,127.0.0.1,1234.1232.12.1234", "::ffff:127.0.0.1")]
[InlineData(true, false, "192.168.x,127.0.0.1,1234.1232.12.1234", "127.0.0.1")]
[InlineData(true, true, "::1", "::1/128")]
public void TestNetworks(bool ip4, bool ip6, string hostList, string match)
{
using var nm = CreateNetworkManager();
nm.SystemIP6Enabled = ip6;
var settings = new NetworkConfiguration();
settings.EnableIPV4 = ip4;
settings.EnableIPV6 = ip6;
var result = match + ',';
ForwardedHeadersOptions options = new ForwardedHeadersOptions();
// Need this here as ::1 and 127.0.0.1 are in them by default.
options.KnownProxies.Clear();
options.KnownNetworks.Clear();
ApiServiceCollectionExtensions.ParseList(nm, settings, hostList.Split(","), options);
var sb = new StringBuilder();
foreach (var item in options.KnownProxies)
{
sb.Append(item.ToString());
sb.Append(',');
}
foreach (var item in options.KnownNetworks)
{
sb.Append(item.Prefix.ToString());
sb.Append('/');
sb.Append(item.PrefixLength.ToString(CultureInfo.InvariantCulture));
sb.Append(',');
}
if (!string.Equals(sb.ToString(), result, StringComparison.OrdinalIgnoreCase))
{
throw new Exception("Not matched: " + sb.ToString() + " does not match " + result);
}
}
}
}