public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-01 20:59:45 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(git)!: use internal proxy for all git operations (#39426)

Browse Source 
Introduces gitproxy module which spawns a small forward proxy as scanner
for git calls
Replaces hostmatcher with matchlist which supports port rules
Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS
settings in migration in favor of full names we have in security
configs.
Removes `external` preset in favor of lax/strict modes, strict mode
requiring explicit ports if they aren't standard http/s ones.

Breaking changes:
- `external` preset no longer works as deny rule. To enforce that, use
`strict` mode and allow ranges to connect to
- Wildcards are no longer accepted in IP addresses
- `*` is no longer allowed as entry in lists
- domain rules now use curl like syntax `*.example.com` matching
subdomains but not `example.com`, `example.com` matching itself and all
subdomains. `example.*` is not a valid rule
- In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer
restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive
list. A startup warning flags this
- Invalid list entries are logged at startup, invalid
`BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it

Docs: https://gitea.com/gitea/docs/pulls/557
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
TheFox0x7
2026-09-29 14:43:36 +02:00
committed by GitHub
parent ebcb0150d1
commit 1b1274486c
57 changed files with 2356 additions and 1106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/setting/migrations.go
+35 -9
View File
@@ -3,17 +3,20 @@
package setting
import "strings"
// Migrations settings
var Migrations = struct {
MaxAttempts int
RetryBackoff int
AllowedDomains string
BlockedDomains string
AllowLocalNetworks bool
SkipTLSVerify bool
MaxAttempts int
RetryBackoff int
EgressMode string
AllowedHostList string
BlockedHostList string
SkipTLSVerify bool
}{
MaxAttempts: 3,
RetryBackoff: 3,
EgressMode: "lax",
}
func loadMigrationsFrom(rootCfg ConfigProvider) {
@@ -21,8 +24,31 @@ func loadMigrationsFrom(rootCfg ConfigProvider) {
Migrations.MaxAttempts = sec.Key("MAX_ATTEMPTS").MustInt(Migrations.MaxAttempts)
Migrations.RetryBackoff = sec.Key("RETRY_BACKOFF").MustInt(Migrations.RetryBackoff)
Migrations.AllowedDomains = sec.Key("ALLOWED_DOMAINS").MustString("")
Migrations.BlockedDomains = sec.Key("BLOCKED_DOMAINS").MustString("")
Migrations.AllowLocalNetworks = sec.Key("ALLOW_LOCALNETWORKS").MustBool(false)
egressModeSet := sec.HasKey("EGRESS_MODE")
Migrations.EgressMode = normalizePolicyMode(sec.Key("EGRESS_MODE").String())
deprecatedSetting(rootCfg, "migrations", "ALLOWED_DOMAINS", "migrations", "ALLOWED_HOST_LIST", "v28.0.0")
deprecatedSetting(rootCfg, "migrations", "BLOCKED_DOMAINS", "migrations", "BLOCKED_HOST_LIST", "v28.0.0")
deprecatedSetting(rootCfg, "migrations", "ALLOW_LOCALNETWORKS", "migrations", "ALLOWED_HOST_LIST", "v28.0.0")
Migrations.AllowedHostList = ConfigSectionKeyString(sec, "ALLOWED_HOST_LIST")
if Migrations.AllowedHostList == "" {
var hosts []string
for host := range strings.SplitSeq(ConfigSectionKeyString(sec, "ALLOWED_DOMAINS"), ",") {
if host = strings.TrimSpace(host); host != "" {
hosts = append(hosts, host+":*")
}
}
if len(hosts) > 0 && !egressModeSet {
Migrations.EgressMode = "strict" // ALLOWED_DOMAINS allowed only its hosts, on any port
}
if ConfigSectionKeyBool(sec, "ALLOW_LOCALNETWORKS") {
hosts = append(hosts, "private:*", "loopback:*")
}
Migrations.AllowedHostList = strings.Join(hosts, ",")
}
Migrations.BlockedHostList = ConfigSectionKeyString(sec, "BLOCKED_HOST_LIST", ConfigSectionKeyString(sec, "BLOCKED_DOMAINS"))
checkHostList("[migrations] ALLOWED_HOST_LIST", Migrations.AllowedHostList, false)
checkHostList("[migrations] BLOCKED_HOST_LIST", Migrations.BlockedHostList, true)
Migrations.SkipTLSVerify = sec.Key("SKIP_TLS_VERIFY").MustBool(false)
}
modules/setting/migrations_test.go
+33
View File
@@ -0,0 +1,33 @@
// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package setting
import (
"testing"
"gitea.dev/modules/test"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestLoadMigrationsFrom(t *testing.T) {
defer test.MockVariableValue(&Migrations)()
for ini, want := range map[string][3]string{
`ALLOWED_DOMAINS = github.com
BLOCKED_DOMAINS = gitlab.com
ALLOW_LOCALNETWORKS = true`: {"github.com:*,private:*,loopback:*", "gitlab.com", "strict"},
`ALLOW_LOCALNETWORKS = true`: {"private:*,loopback:*", "", "lax"},
`ALLOWED_HOST_LIST = 10.0.0.0/8
ALLOWED_DOMAINS = github.com
ALLOW_LOCALNETWORKS = true
BLOCKED_HOST_LIST = evil.com
BLOCKED_DOMAINS = gitlab.com`: {"10.0.0.0/8", "evil.com", "lax"},
} {
cfg, err := NewConfigProviderFromData("[migrations]\n" + ini)
require.NoError(t, err)
loadMigrationsFrom(cfg)
assert.Equal(t, want, [3]string{Migrations.AllowedHostList, Migrations.BlockedHostList, Migrations.EgressMode}, ini)
}
}
modules/setting/security.go
+34 -1
View File
@@ -9,6 +9,7 @@ import (
"strings"
"gitea.dev/modules/auth/password/hash"
"gitea.dev/modules/egress/policy"
"gitea.dev/modules/generate"
"gitea.dev/modules/log"
)
@@ -20,11 +21,37 @@ var Security = struct {
XContentTypeOptions string
ContentSecurityPolicyGeneral string // it only supports empty (default policy) or "unset", maybe it can support more in the future
EgressMode string
AllowedHostList string
}{
XFrameOptions: "SAMEORIGIN",
XContentTypeOptions: "nosniff",
AllowedHostList: "external",
EgressMode: "lax",
}
// normalizePolicyMode validates a lax/strict egress policy EGRESS_MODE value, empty defaults to lax
func normalizePolicyMode(mode string) string {
mode = strings.ToLower(strings.TrimSpace(mode))
switch mode {
case "":
return "lax"
case "lax", "strict":
return mode
default:
log.Fatal("Invalid egress policy EGRESS_MODE %q, use lax or strict", mode)
return ""
}
}
// checkHostList reports the entries an egress host list drops, a dropped block entry would allow a blocked host so it stops startup
func checkHostList(key, hostList string, isBlockList bool) {
rejected := policy.NewAllowList(hostList, policy.Lax).Rejected()
for _, reason := range rejected {
LogStartupProblem(1, log.ERROR, "%s ignores an invalid entry: %s", key, reason)
}
if isBlockList && len(rejected) > 0 {
log.Fatal("%s has invalid entries, fix them so no blocked host is allowed", key)
}
}
var (
@@ -160,6 +187,12 @@ func loadSecurityFrom(rootCfg ConfigProvider) {
if err := sec.MapTo(&Security); err != nil {
log.Fatal("Failed to map security settings: %v", err)
}
egressModeSet := sec.HasKey("EGRESS_MODE")
Security.EgressMode = normalizePolicyMode(sec.Key("EGRESS_MODE").String())
checkHostList("[security] ALLOWED_HOST_LIST", Security.AllowedHostList, false)
if Security.AllowedHostList != "" && !egressModeSet {
LogStartupProblem(1, log.WARN, "[security] ALLOWED_HOST_LIST only restricts private hosts in the default lax mode, set EGRESS_MODE = strict to allow only the listed hosts, or lax to keep this")
}
twoFactorAuth := sec.Key("TWO_FACTOR_AUTH").String()
switch twoFactorAuth {
modules/setting/security_test.go
+4 -1
View File
@@ -12,11 +12,13 @@ import (
func TestLoadSecurityFrom(t *testing.T) {
assert.Equal(t, "SAMEORIGIN", Security.XFrameOptions)
assert.Equal(t, "nosniff", Security.XContentTypeOptions)
assert.Equal(t, "external", Security.AllowedHostList)
assert.Equal(t, "lax", Security.EgressMode)
assert.Equal(t, "", Security.AllowedHostList)
cfg, err := NewConfigProviderFromData(`[security]
X_FRAME_OPTIONS = DENY
X_CONTENT_TYPE_OPTIONS = unset
EGRESS_MODE = Strict
ALLOWED_HOST_LIST = foo
CONTENT_SECURITY_POLICY_GENERAL = "script-src *; foo"
`)
@@ -24,6 +26,7 @@ CONTENT_SECURITY_POLICY_GENERAL = "script-src *; foo"
loadSecurityFrom(cfg)
assert.Equal(t, "DENY", Security.XFrameOptions)
assert.Equal(t, "unset", Security.XContentTypeOptions)
assert.Equal(t, "strict", Security.EgressMode)
assert.Equal(t, "foo", Security.AllowedHostList)
assert.Equal(t, `"script-src *`, Security.ContentSecurityPolicyGeneral) // holy shit ini package bug
}
modules/setting/webhook.go
+3
View File
@@ -37,6 +37,9 @@ func loadWebhookFrom(rootCfg ConfigProvider) {
deprecatedSetting(rootCfg, "webhook", "ALLOWED_HOST_LIST", "security", "ALLOWED_HOST_LIST", "v28.0.0")
Webhook.AllowedHostList = sec.Key("ALLOWED_HOST_LIST").MustString(Security.AllowedHostList)
if Webhook.AllowedHostList != Security.AllowedHostList {
checkHostList("[webhook] ALLOWED_HOST_LIST", Webhook.AllowedHostList, false)
}
Webhook.Types = []string{"gitea", "gogs", "slack", "discord", "dingtalk", "telegram", "msteams", "feishu", "matrix", "wechatwork", "packagist"}
Webhook.PagingNum = sec.Key("PAGING_NUM").MustInt(10)