Files
@ c57d926edd39
Branch filter:
Location: kallithea/MANIFEST.in - annotation
c57d926edd39
1.1 KiB
text/plain
auth: strip RFC4007 zone identifiers from IPv6 addresses before doing access control
If using IPv6, the request IP address might contain a '%' that the ipaddr
module that is used for IP filtering can't handle.
https://tools.ietf.org/html/rfc4007#section-11 specifies how IPv6 addresses can
have zone identifiers like trailing '%13' or '%eth0'. The zone identifier is
used to help distinguish *if* the same address should be available on multiple
interfaces. It *could* potentially have security implications in the odd case
where the same address is different on different interfaces. The IP whitelist
functionality does however not support zone filters, so there is no way users
can expect the zone to be relevant for IP filtering. We can thus safely strip
the zone index and only check for match on the other parts of the address.
If using IPv6, the request IP address might contain a '%' that the ipaddr
module that is used for IP filtering can't handle.
https://tools.ietf.org/html/rfc4007#section-11 specifies how IPv6 addresses can
have zone identifiers like trailing '%13' or '%eth0'. The zone identifier is
used to help distinguish *if* the same address should be available on multiple
interfaces. It *could* potentially have security implications in the odd case
where the same address is different on different interfaces. The IP whitelist
functionality does however not support zone filters, so there is no way users
can expect the zone to be relevant for IP filtering. We can thus safely strip
the zone index and only check for match on the other parts of the address.
8cea7986ed79 ff08d3cf9aef ff08d3cf9aef ff08d3cf9aef 8cea7986ed79 ff08d3cf9aef ff08d3cf9aef ff08d3cf9aef ff08d3cf9aef 8cea7986ed79 ff08d3cf9aef 8cea7986ed79 8cea7986ed79 8cea7986ed79 dba4e770d4b6 2d7a94f3eaae 0e6035a85980 7894a440e134 ff08d3cf9aef 8cea7986ed79 ff08d3cf9aef ff08d3cf9aef 1969f7dfb6b0 7e5f8c12a3fc ff08d3cf9aef ff08d3cf9aef 8cea7986ed79 8cea7986ed79 ff08d3cf9aef 8cea7986ed79 | include .coveragerc
include Apache-License-2.0.txt
include CONTRIBUTORS
include COPYING
include Jenkinsfile
include LICENSE-MERGELY.html
include LICENSE.md
include MIT-Permissive-License.txt
include README.rst
include dev_requirements.txt
include development.ini
include pytest.ini
include requirements.txt
include tox.ini
include package.json
recursive-include docs *
recursive-include init.d *
recursive-include kallithea/alembic *
include kallithea/bin/ldap_sync.conf
include kallithea/lib/paster_commands/template.ini.mako
recursive-include kallithea/i18n *
recursive-include kallithea/public *
recursive-include node_modules/bootstrap *
recursive-include kallithea/templates *
recursive-include kallithea/tests/fixtures *
recursive-include kallithea/tests/scripts *
include kallithea/tests/models/test_dump_html_mails.ref.html
include kallithea/tests/performance/test_vcs.py
include kallithea/tests/vcs/aconfig
recursive-include scripts *
|