public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-01 20:59:45 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(git)!: use internal proxy for all git operations (#39426)

Browse Source 
Introduces gitproxy module which spawns a small forward proxy as scanner
for git calls
Replaces hostmatcher with matchlist which supports port rules
Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS
settings in migration in favor of full names we have in security
configs.
Removes `external` preset in favor of lax/strict modes, strict mode
requiring explicit ports if they aren't standard http/s ones.

Breaking changes:
- `external` preset no longer works as deny rule. To enforce that, use
`strict` mode and allow ranges to connect to
- Wildcards are no longer accepted in IP addresses
- `*` is no longer allowed as entry in lists
- domain rules now use curl like syntax `*.example.com` matching
subdomains but not `example.com`, `example.com` matching itself and all
subdomains. `example.*` is not a valid rule
- In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer
restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive
list. A startup warning flags this
- Invalid list entries are logged at startup, invalid
`BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it

Docs: https://gitea.com/gitea/docs/pulls/557
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
TheFox0x7
2026-09-29 14:43:36 +02:00
committed by GitHub
parent ebcb0150d1
commit 1b1274486c
57 changed files with 2356 additions and 1106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/actions_schedule_test.go
-9
View File
@@ -18,16 +18,12 @@ import (
"gitea.dev/models/unittest"
user_model "gitea.dev/models/user"
"gitea.dev/modules/migration"
"gitea.dev/modules/setting"
api "gitea.dev/modules/structs"
"gitea.dev/modules/test"
migrations_service "gitea.dev/services/migrations"
mirror_service "gitea.dev/services/mirror"
repo_service "gitea.dev/services/repository"
files_service "gitea.dev/services/repository/files"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestScheduleUpdate(t *testing.T) {
@@ -148,11 +144,6 @@ jobs:
func testScheduleUpdateMirrorSync(t *testing.T) {
doTestScheduleUpdate(t, func(t *testing.T, u *url.URL, testContext APITestContext, user *user_model.User, repo *repo_model.Repository) (commitID, expectedSpec string) {
// the mirror sync re-validates the remote URL, which rejects the local test server unless local
// networks are allowed; migrations.Init rebuilds the host allow-list from the setting
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
require.NoError(t, migrations_service.Init())
// create mirror repo
opts := migration.MigrateOptions{
RepoName: "actions-schedule-mirror",
tests/integration/api_repo_edit_test.go
+6 -13
View File
@@ -16,10 +16,7 @@ import (
"gitea.dev/models/unittest"
user_model "gitea.dev/models/user"
"gitea.dev/modules/git"
"gitea.dev/modules/setting"
api "gitea.dev/modules/structs"
"gitea.dev/modules/test"
"gitea.dev/services/migrations"
mirror_service "gitea.dev/services/mirror"
"gitea.dev/tests"
@@ -462,11 +459,7 @@ func TestAPIRepoEdit(t *testing.T) {
mirror := unittest.AssertExistsAndLoadBean(t, &repo_model.Mirror{RepoID: 5})
newPassword := "updated-password"
require.NoError(t, mirror_service.UpdateAddress(ctx, mirror, "https://existing-user:existing-password@example.com/user2/repo1.git"))
defer migrations.Init()
defer test.MockVariableValue(&setting.Migrations.AllowedDomains, "*")()
_ = migrations.Init()
require.NoError(t, mirror_service.UpdateAddress(ctx, mirror, "https://existing-user:existing-password@127.0.0.1/user2/repo1.git"))
req = NewRequestWithJSON(t, "PATCH", fmt.Sprintf("/api/v1/repos/%s/%s", mirrorRepo.OwnerName, mirrorRepo.Name), &api.EditRepoOption{
MirrorPassword: &newPassword,
@@ -474,10 +467,10 @@ func TestAPIRepoEdit(t *testing.T) {
MakeRequest(t, req, http.StatusOK)
updatedMirror := unittest.AssertExistsAndLoadBean(t, &repo_model.Mirror{RepoID: mirrorRepo.ID})
assert.Equal(t, "https://example.com/user2/repo1.git", updatedMirror.RemoteAddress)
assert.Equal(t, "https://127.0.0.1/user2/repo1.git", updatedMirror.RemoteAddress)
updatedRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: mirrorRepo.ID})
assert.Equal(t, "https://example.com/user2/repo1.git", updatedRepo.OriginalURL)
assert.Equal(t, "https://127.0.0.1/user2/repo1.git", updatedRepo.OriginalURL)
remoteURL, err := git.ParseRemoteAddressURL(ctx, updatedRepo, updatedMirror.GetRemoteName())
require.NoError(t, err)
@@ -490,7 +483,7 @@ func TestAPIRepoEdit(t *testing.T) {
// Test updating mirror token without guessing a username
token := "mirror-token-value"
require.NoError(t, mirror_service.UpdateAddress(ctx, mirror, "https://example.com/user2/repo1.git"))
require.NoError(t, mirror_service.UpdateAddress(ctx, mirror, "https://127.0.0.1/user2/repo1.git"))
req = NewRequestWithJSON(t, "PATCH", fmt.Sprintf("/api/v1/repos/%s/%s", mirrorRepo.OwnerName, mirrorRepo.Name), &api.EditRepoOption{
MirrorToken: &token,
@@ -498,10 +491,10 @@ func TestAPIRepoEdit(t *testing.T) {
MakeRequest(t, req, http.StatusOK)
updatedMirror = unittest.AssertExistsAndLoadBean(t, &repo_model.Mirror{RepoID: mirrorRepo.ID})
assert.Equal(t, "https://example.com/user2/repo1.git", updatedMirror.RemoteAddress)
assert.Equal(t, "https://127.0.0.1/user2/repo1.git", updatedMirror.RemoteAddress)
updatedRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: mirrorRepo.ID})
assert.Equal(t, "https://example.com/user2/repo1.git", updatedRepo.OriginalURL)
assert.Equal(t, "https://127.0.0.1/user2/repo1.git", updatedRepo.OriginalURL)
remoteURL, err = git.ParseRemoteAddressURL(ctx, updatedRepo, updatedMirror.GetRemoteName())
require.NoError(t, err)
tests/integration/api_repo_lfs_migrate_test.go
-3
View File
@@ -15,7 +15,6 @@ import (
"gitea.dev/modules/setting"
api "gitea.dev/modules/structs"
"gitea.dev/modules/test"
"gitea.dev/services/migrations"
"gitea.dev/tests"
"github.com/stretchr/testify/assert"
@@ -24,8 +23,6 @@ import (
func TestAPIRepoLFSMigrateLocal(t *testing.T) {
defer tests.PrepareTestEnv(t)()
defer test.MockVariableValue(&setting.ImportLocalPaths, true)()
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
assert.NoError(t, migrations.Init())
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
session := loginUser(t, user.Name)
tests/integration/api_repo_test.go
+2 -9
View File
@@ -18,12 +18,10 @@ import (
"gitea.dev/modules/setting"
api "gitea.dev/modules/structs"
"gitea.dev/modules/test"
"gitea.dev/services/migrations"
repo_service "gitea.dev/services/repository"
"gitea.dev/tests"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestAPIUserReposNotLogin(t *testing.T) {
@@ -357,9 +355,6 @@ func TestAPIRepoMigrate(t *testing.T) {
cloneAddr := fmt.Sprintf("%s%s/%s.git", u.String(), repo1.OwnerName, repo1.Name)
t.Run("Permitted", func(t *testing.T) {
// migrations.Init builds the host allowlist from AllowLocalNetworks, so set it first
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
require.NoError(t, migrations.Init())
for _, testCase := range []struct {
ctxUserID, ownerID int64
repoName string
@@ -383,15 +378,13 @@ func TestAPIRepoMigrate(t *testing.T) {
})
t.Run("DisallowedHost", func(t *testing.T) {
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, false)()
require.NoError(t, migrations.Init())
token := getTokenForLoggedInUser(t, loginUser(t, "user2"), auth_model.AccessTokenScopeWriteRepository)
defer test.MockVariableValue(&setting.Migrations.AllowedHostList, "")()
for _, cloneURL := range []string{"https://localhost:3000/user/test_repo.git", "https://10.0.0.1/user/test_repo.git"} {
req := NewRequestWithJSON(t, "POST", "/api/v1/repos/migrate", &api.MigrateRepoOptions{
CloneAddr: cloneURL,
RepoOwnerID: 3,
RepoName: "private-ip",
}).AddTokenAuth(token)
}).AddBasicAuth("user2")
resp := MakeRequest(t, req, http.StatusUnprocessableEntity)
assert.Equal(t, "You can not import from disallowed hosts.", DecodeJSON(t, resp, map[string]string{})["message"])
}
tests/integration/dump_restore_test.go
-2
View File
@@ -31,8 +31,6 @@ func TestDumpRestore(t *testing.T) {
onGiteaRun(t, func(t *testing.T, u *url.URL) {
// Gitea SDK (go-sdk) need to parse the AppVer from server response, so we must set it to a valid version string.
defer test.MockVariableValue(&setting.AppVer, "1.16.0")()
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
assert.NoError(t, migrations.Init())
reponame := "repo1"
tests/integration/migrate_test.go
-4
View File
@@ -61,9 +61,7 @@ func TestMigrateLocalPath(t *testing.T) {
func TestMigrateGiteaForm(t *testing.T) {
onGiteaRun(t, func(t *testing.T, u *url.URL) {
// Gitea SDK (go-sdk) need to parse the AppVer from server response, so we must set it to a valid version string.
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
defer test.MockVariableValue(&setting.AppVer, "1.16.0")()
assert.NoError(t, migrations.Init())
ownerName := "user2"
repoName := "repo1"
@@ -222,8 +220,6 @@ done
func Test_MigrateFromGiteaToGitea(t *testing.T) {
defer tests.PrepareTestEnv(t)()
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
assert.NoError(t, migrations.Init())
mockServer := setupGiteaMockServer(t)
tests/integration/mirror_pull_test.go
+13 -34
View File
@@ -7,6 +7,7 @@ import (
"net/http"
"net/http/httptest"
"slices"
"strings"
"sync/atomic"
"testing"
@@ -20,7 +21,6 @@ import (
"gitea.dev/modules/migration"
"gitea.dev/modules/setting"
"gitea.dev/modules/test"
migrations "gitea.dev/services/migrations"
mirror_service "gitea.dev/services/mirror"
release_service "gitea.dev/services/release"
repo_service "gitea.dev/services/repository"
@@ -139,40 +139,19 @@ func TestMirrorPullSSRFRevalidation(t *testing.T) {
defer tests.PrepareTestEnv(t)()
ctx := t.Context()
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
repoPath := gitrepo.RepoLocalPath(repo)
// an "internal" server that records whether it was reached
var reached atomic.Bool
internal := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
reached.Store(true)
w.WriteHeader(http.StatusNotFound)
var requests atomic.Int32
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
requests.Add(1)
http.Redirect(w, r, "http://"+strings.Replace(r.Host, "127.0.0.1", "0.0.0.0", 1)+r.URL.RequestURI(), http.StatusFound)
}))
defer internal.Close()
defer server.Close()
mirrorRepo, err := repo_service.CreateRepositoryDirectly(ctx, user, user, repo_service.CreateRepoOptions{
Name: "ssrf_mirror",
IsMirror: true,
Status: repo_model.RepositoryBeingMigrated,
}, false)
require.NoError(t, err)
_, err = repo_service.MigrateRepositoryGitData(ctx, user, mirrorRepo, migration.MigrateOptions{
RepoName: "ssrf_mirror",
Mirror: true,
CloneAddr: repoPath,
}, nil)
require.NoError(t, err)
mirror := unittest.AssertExistsAndLoadBean(t, &repo_model.Mirror{RepoID: 5})
require.NoError(t, mirror_service.UpdateAddress(ctx, mirror, server.URL+"/repo.git"))
assert.False(t, mirror_service.SyncPullMirror(ctx, mirror.RepoID))
assert.EqualValues(t, 1, requests.Load(), "the git proxy must deny the redirect to a reserved address")
mirror, err := repo_model.GetMirrorByRepoID(ctx, mirrorRepo.ID)
require.NoError(t, err)
// repoint the mirror at the loopback server, which is disallowed once local networks are off
require.NoError(t, mirror_service.UpdateAddress(ctx, mirror, internal.URL+"/repo.git"))
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, false)()
require.NoError(t, migrations.Init())
t.Cleanup(func() { _ = migrations.Init() })
assert.False(t, mirror_service.SyncPullMirror(ctx, mirrorRepo.ID))
assert.False(t, reached.Load(), "the disallowed internal remote must not be reached")
defer test.MockVariableValue(&setting.Migrations.AllowedHostList, "")()
assert.False(t, mirror_service.SyncPullMirror(ctx, mirror.RepoID))
assert.EqualValues(t, 1, requests.Load(), "the disallowed internal remote must not be reached")
}
tests/integration/mirror_push_test.go
+1 -12
View File
@@ -18,7 +18,6 @@ import (
"gitea.dev/modules/git"
"gitea.dev/modules/setting"
"gitea.dev/modules/test"
"gitea.dev/services/migrations"
mirror_service "gitea.dev/services/mirror"
repo_service "gitea.dev/services/repository"
wiki_service "gitea.dev/services/wiki"
@@ -36,9 +35,6 @@ func TestMirrorPushWikiDefaultBranchMismatch(t *testing.T) {
}
func testMirrorPush(t *testing.T, u *url.URL) {
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
assert.NoError(t, migrations.Init())
_ = db.TruncateBeans(t.Context(), &repo_model.PushMirror{})
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
srcRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
@@ -76,9 +72,7 @@ func testMirrorPush(t *testing.T, u *url.URL) {
assert.Equal(t, srcCommit.ID, mirrorCommit.ID)
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, false)() // the remote is re-checked every sync, not just when added
assert.NoError(t, migrations.Init())
t.Cleanup(func() { _ = migrations.Init() })
defer test.MockVariableValue(&setting.Migrations.AllowedHostList, "")()
assert.False(t, mirror_service.SyncPushMirror(t.Context(), mirrors[0].ID))
// Cleanup
@@ -89,9 +83,6 @@ func testMirrorPush(t *testing.T, u *url.URL) {
}
func testMirrorPushWikiDefaultBranchMismatch(t *testing.T, u *url.URL) {
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
assert.NoError(t, migrations.Init())
_ = db.TruncateBeans(t.Context(), &repo_model.PushMirror{})
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
srcRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
@@ -160,8 +151,6 @@ func doUpdatePushMirror(t *testing.T, session *TestSession, owner, repo string,
func TestRepoSettingPushMirrorUpdate(t *testing.T) {
defer tests.PrepareTestEnv(t)()
defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
assert.NoError(t, migrations.Init())
session := loginUser(t, "user2")
repo2 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})