toaster: add * to ALLOWED_HOSTS setting

PATCH In review brian avery 3 participants 4 messages Nov 2, 2016

Share & tools

brian avery

author

2016-11-02 00:02 UTC #0 lore raw

cover toaster: add * to ALLOWED_HOSTS setting

As of Django 1.8.16, django is rejecting any HTTP_HOST header that is
not on the ALLOWED_HOST list. We often need to reference the toaster server via a fqdn, if we start it via webport=0.0.0.0:8000 for instance, and are hitting the server from a laptop. This change does reduce the protection from a DNS rebinding attack, however, if you are running the toaster server outside a protected network, you need to be using the production instance.

In particular, this prevents the toaster container tests from running as well as the containers from working as is in the Windows Docker Toolbox case.

-brian

The following changes since commit c3d2df883a9d6d5036277114339673656d89a728:

oeqa/selftest/kernel.py: Add new file destined for kernel related tests (2016-11-01 10:05:46 +0000)

are available in the git repository at:

git://git.yoctoproject.org/poky-contrib bavery/toaster/fixALLOWED_HOSTexclusion
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=bavery/toaster/fixALLOWED_HOSTexclusion

brian avery (1):
toaster: settings.py , add * to ALLOWED_HOSTS

 lib/toaster/toastermain/settings.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--
1.9.1

brian avery

author

2016-11-02 00:02 UTC #1 lore raw

PATCH 1/1 toaster: settings.py , add * to ALLOWED_HOSTS

As of Django 1.8.16, django is rejecting any HTTP_HOST header that is not on the ALLOWED_HOST list. We often need to reference the toaster server via a fqdn, if we start it via webport=0.0.0.0:8000 for instance, and are hitting the server from a laptop. This change does reduce the protection from a DNS rebinding attack, however, if you are running the toaster server outside a protected network, you need to be using the production instance.

Fixes [YOCTO #10578 ].

Signed-off-by brian avery <[email protected]>

---
 lib/toaster/toastermain/settings.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

lib/toaster/toastermain/settings.py +3 -1

index 3dfa2b2..718e809 100644
@@ -62,7 +62,9 @@ if 'sqlite' in DATABASES['default']['ENGINE']:
 
 # Hosts/domain names that are valid for this site; required if DEBUG is False
 # See https://docs.djangoproject.com/en/1.5/ref/settings/#allowed-hosts
-ALLOWED_HOSTS = []
+# update as of django 1.8.16 release, the '*' is needed to allow us to connect while running
+# on hosts with unknown fqdn. https://docs.djangoproject.com/en/dev/ref/settings/
+ALLOWED_HOSTS = ['localhost','127.0.0.1','::1','*']
 
 # Local time zone for this installation. Choices can be found here:
 # http://en.wikipedia.org/wiki/List_of_tz_zones_by_name

Signature · 1 line

1.9.1

Michael Wood

2016-11-02 12:46 UTC #2 lore raw

Re: [PATCH 1/1] toaster: settings.py , add * to ALLOWED_HOSTS

Quoted 20 lines · brian avery

As of Django 1.8.16, django is rejecting any HTTP_HOST header that is not on the ALLOWED_HOST list. We often need to reference the toaster server via a fqdn, if we start it via webport=0.0.0.0:8000 for instance, and are hitting the server from a laptop. This change does reduce the protection from a DNS rebinding attack, however, if you are running the toaster server outside a protected network, you need to be using the production instance.
Fixes [YOCTO #10578 ].
Signed-off-by brian avery <[email protected]>
---
  lib/toaster/toastermain/settings.py | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
lib/toaster/toastermain/settings.py +0 -0
index 3dfa2b2..718e809 100644

lib/toaster/toastermain/settings.py if 'sqlite' in DATABASES['default']['ENGINE']: · line 67

Quoted 7 lines

lib/toaster/toastermain/settings.py +3 -1

@@ -62,7 +62,9 @@ if 'sqlite' in DATABASES['default']['ENGINE']:
 
  # Hosts/domain names that are valid for this site; required if DEBUG is False
  # See https://docs.djangoproject.com/en/1.5/ref/settings/#allowed-hosts
-ALLOWED_HOSTS = []
+# update as of django 1.8.16 release, the '*' is needed to allow us to connect while running
+# on hosts with unknown fqdn. https://docs.djangoproject.com/en/dev/ref/settings/
+ALLOWED_HOSTS = ['localhost','127.0.0.1','::1','*']

This is an odd way to express the ALLOWED_HOSTS, you've specified 3 allowed ones and then said, "aannnd everything!" this could easily be missed by anyone using the default configuration. I think it would be better either to restore the old behaviour by doing:

if DEBUG is True:

    ALLOWED_HOSTS = [ '*' ]

or by being smarter and inspecting the value of the environment variable ADDR_PORT and appending a best value for ALLOWED_HOSTS.

I've opened a bug to provide an example production environment settings file which will help with this sort of problem. https://bugzilla.yoctoproject.org/show_bug.cgi?id=10581

Quoted 3 lines

lib/toaster/toastermain/settings.py +0 -0

  # Local time zone for this installation. Choices can be found here:
  # http://en.wikipedia.org/wiki/List_of_tz_zones_by_name

Brian Avery

2016-11-02 14:52 UTC #3 lore raw

Re: [PATCH 1/1] toaster: settings.py , add * to ALLOWED_HOSTS

Hi,

Quoted 39 lines · Michael Wood

Quoted 26 lines · brian avery
As of Django 1.8.16, django is rejecting any HTTP_HOST header that is not on the ALLOWED_HOST list. We often need to reference the toaster server via a fqdn, if we start it via webport=0.0.0.0:8000 for instance, and are hitting the server from a laptop. This change does reduce the protection from a DNS rebinding attack, however, if you are running the toaster server outside a protected network, you need to be using the production instance.
Fixes [YOCTO #10578 ].
Signed-off-by brian avery <[email protected]>
---
  lib/toaster/toastermain/settings.py | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
lib/toaster/toastermain/settings.py +0 -0
index 3dfa2b2..718e809 100644
@@ -62,7 +62,9 @@ if 'sqlite' in DATABASES['default']['ENGINE']:
    # Hosts/domain names that are valid for this site; required if DEBUG
is False
# See https://docs.djangoproject.com/en/1.5/ref/settings/#allowed-hosts
lib/toaster/toastermain/settings.py +1 -1
-ALLOWED_HOSTS = []
+# update as of django 1.8.16 release, the '*' is needed to allow us to
Quoted 5 lines
connect while running
+# on hosts with unknown fqdn. https://docs.djangoproject.com
/en/dev/ref/settings/
+ALLOWED_HOSTS = ['localhost','127.0.0.1','::1','*']
This is an odd way to express the ALLOWED_HOSTS, you've specified 3 allowed ones and then said, "aannnd everything!" this could easily be missed by anyone using the default configuration. I think it would be better either to restore the old behaviour by doing:

Quoted 3 lines

if DEBUG is True:
    ALLOWED_HOSTS = [ '*' ]

I don't mind the if DEBUG part.
The value ['localhost','127.0.0.1','::1'] is what we are currently
getting by setting

Quoted 2 lines

ALLOWED_HOSTS = [ ]

so I wanted to
1) make it clear what the old default was
2) provide a place to replace '*' with 'cow.intel.com' and have the system still work. If I do

Quoted 3 lines

ALLOWED_HOSTS = [ 'cow.intel.com'], then std usage aka
http://localhost:8000 would break

if I do
ALLOWED_HOSTS = ['localhost','127.0.0.1','::1','cow.intel.com'] then it will work as I would expect.

Quoted 6 lines

or by being smarter and inspecting the value of the environment variable ADDR_PORT and appending a best value for ALLOWED_HOSTS.
I've opened a bug to provide an example production environment settings file which will help with this sort of problem.
https://bugzilla.yoctoproject.org/show_bug.cgi?id=10581

Well, we already have a production setup and generally this is handled at the nginx layer so that the django server doesn't even see it.

-b

Quoted 13 lines

# Local time zone for this installation. Choices can be found here:
Quoted 2 lines
# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name
--
_______________________________________________
toaster mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/toaster