public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-01 20:59:45 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(git)!: use internal proxy for all git operations (#39426)

Browse Source 
Introduces gitproxy module which spawns a small forward proxy as scanner
for git calls
Replaces hostmatcher with matchlist which supports port rules
Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS
settings in migration in favor of full names we have in security
configs.
Removes `external` preset in favor of lax/strict modes, strict mode
requiring explicit ports if they aren't standard http/s ones.

Breaking changes:
- `external` preset no longer works as deny rule. To enforce that, use
`strict` mode and allow ranges to connect to
- Wildcards are no longer accepted in IP addresses
- `*` is no longer allowed as entry in lists
- domain rules now use curl like syntax `*.example.com` matching
subdomains but not `example.com`, `example.com` matching itself and all
subdomains. `example.*` is not a valid rule
- In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer
restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive
list. A startup warning flags this
- Invalid list entries are logged at startup, invalid
`BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it

Docs: https://gitea.com/gitea/docs/pulls/557
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
TheFox0x7
2026-09-29 14:43:36 +02:00
committed by GitHub
parent ebcb0150d1
commit 1b1274486c
57 changed files with 2356 additions and 1106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/setting/security.go
+34 -1
View File
@@ -9,6 +9,7 @@ import (
"strings"
"gitea.dev/modules/auth/password/hash"
"gitea.dev/modules/egress/policy"
"gitea.dev/modules/generate"
"gitea.dev/modules/log"
)
@@ -20,11 +21,37 @@ var Security = struct {
XContentTypeOptions string
ContentSecurityPolicyGeneral string // it only supports empty (default policy) or "unset", maybe it can support more in the future
EgressMode string
AllowedHostList string
}{
XFrameOptions: "SAMEORIGIN",
XContentTypeOptions: "nosniff",
AllowedHostList: "external",
EgressMode: "lax",
}
// normalizePolicyMode validates a lax/strict egress policy EGRESS_MODE value, empty defaults to lax
func normalizePolicyMode(mode string) string {
mode = strings.ToLower(strings.TrimSpace(mode))
switch mode {
case "":
return "lax"
case "lax", "strict":
return mode
default:
log.Fatal("Invalid egress policy EGRESS_MODE %q, use lax or strict", mode)
return ""
}
}
// checkHostList reports the entries an egress host list drops, a dropped block entry would allow a blocked host so it stops startup
func checkHostList(key, hostList string, isBlockList bool) {
rejected := policy.NewAllowList(hostList, policy.Lax).Rejected()
for _, reason := range rejected {
LogStartupProblem(1, log.ERROR, "%s ignores an invalid entry: %s", key, reason)
}
if isBlockList && len(rejected) > 0 {
log.Fatal("%s has invalid entries, fix them so no blocked host is allowed", key)
}
}
var (
@@ -160,6 +187,12 @@ func loadSecurityFrom(rootCfg ConfigProvider) {
if err := sec.MapTo(&Security); err != nil {
log.Fatal("Failed to map security settings: %v", err)
}
egressModeSet := sec.HasKey("EGRESS_MODE")
Security.EgressMode = normalizePolicyMode(sec.Key("EGRESS_MODE").String())
checkHostList("[security] ALLOWED_HOST_LIST", Security.AllowedHostList, false)
if Security.AllowedHostList != "" && !egressModeSet {
LogStartupProblem(1, log.WARN, "[security] ALLOWED_HOST_LIST only restricts private hosts in the default lax mode, set EGRESS_MODE = strict to allow only the listed hosts, or lax to keep this")
}
twoFactorAuth := sec.Key("TWO_FACTOR_AUTH").String()
switch twoFactorAuth {