106 lines
3.1 KiB
Bash
Executable File
106 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
bold=$'\033[1m'
|
|
reset=$'\033[0m'
|
|
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
mkdir -p "$tmp/state" "$tmp/root"
|
|
|
|
printf '%sQuestion%s\n' "$bold" "$reset"
|
|
printf 'Does the proposed copyparty reverse-proxy config parse and make a proxied HTTPS-origin login-shaped request pass the CORS gate?\n\n'
|
|
|
|
printf '%sNix-generated config fragment%s\n' "$bold" "$reset"
|
|
config_script=$(nix eval --raw '.#nixosConfigurations.pikachu.config.containers.copyparty.config.systemd.services.copyparty.serviceConfig.ExecStartPre')
|
|
awk '/\[global\]/{show=1} /\[accounts\]/{show=0} show {print}' "$config_script" | grep -E 'rproxy|xff-hdr|xff-src' || true
|
|
|
|
pkg=$(nix eval --raw '.#nixosConfigurations.pikachu.config.containers.copyparty.config.modules.services.copyparty.package.outPath')
|
|
|
|
make_conf() {
|
|
local file=$1 port=$2 rproxy=$3
|
|
cat > "$file" <<EOF
|
|
[global]
|
|
i: 127.0.0.1
|
|
p: $port
|
|
usernames
|
|
http-only
|
|
no-crt
|
|
no-thumb
|
|
no-snap
|
|
no-rescan
|
|
ses-db: $tmp/state/sessions-$port.db
|
|
chpw-db: $tmp/state/chpw-$port.json
|
|
shr-db: $tmp/state/shares-$port.db
|
|
$rproxy
|
|
|
|
[accounts]
|
|
alexion: prototype-password
|
|
|
|
[/]
|
|
$tmp/root
|
|
accs:
|
|
A: alexion
|
|
EOF
|
|
}
|
|
|
|
start_server() {
|
|
local conf=$1 log=$2
|
|
"$pkg/bin/copyparty" -c "$conf" >"$log" 2>&1 &
|
|
local pid=$!
|
|
for _ in {1..50}; do
|
|
if grep -q 'listening' "$log"; then
|
|
printf '%s' "$pid"
|
|
return 0
|
|
fi
|
|
sleep 0.1
|
|
done
|
|
cat "$log"
|
|
kill "$pid" 2>/dev/null || true
|
|
return 1
|
|
}
|
|
|
|
request() {
|
|
local label=$1 port=$2 host=$3 proto=${4:-}
|
|
local headers="$tmp/$label.headers"
|
|
local body="$tmp/$label.body"
|
|
local args=(
|
|
-sS
|
|
-D "$headers"
|
|
-o "$body"
|
|
-X POST
|
|
-H "Host: $host"
|
|
-H 'Origin: https://files.alexion.dev'
|
|
-H 'X-Forwarded-For: 10.23.20.20'
|
|
)
|
|
if [[ -n "$proto" ]]; then
|
|
args+=(-H "X-Forwarded-Proto: $proto")
|
|
fi
|
|
curl "${args[@]}" "http://127.0.0.1:$port/?pw=alexion:prototype-password" >/dev/null || true
|
|
printf '%-24s %s %s\n' "$label" "$(head -1 "$headers" | tr -d '\r')" "$(head -1 "$body")"
|
|
}
|
|
|
|
rproxy_config=' rproxy: 1
|
|
xff-hdr: x-forwarded-for
|
|
xff-src: 127.0.0.1/32'
|
|
make_conf "$tmp/rproxy.conf" 39234 "$rproxy_config"
|
|
pid=$(start_server "$tmp/rproxy.conf" "$tmp/rproxy.log")
|
|
|
|
printf '\n%sCORS gate probes%s\n' "$bold" "$reset"
|
|
request with-forwarded-https 39234 files.alexion.dev https
|
|
request missing-forwarded-proto 39234 files.alexion.dev
|
|
request wrong-forwarded-host 39234 '10.23.20.126:3923' https
|
|
|
|
kill "$pid" 2>/dev/null || true
|
|
wait "$pid" 2>/dev/null || true
|
|
|
|
printf '\n%sRelevant server log%s\n' "$bold" "$reset"
|
|
grep -E 'cors-reject|POST|http405|got proxied request|untrusted source|listening' "$tmp/rproxy.log" || true
|
|
|
|
printf '\n%sNginx proxy headers%s\n' "$bold" "$reset"
|
|
toplevel=$(nix build --print-out-paths '.#nixosConfigurations.pikachu.config.containers.reverse-proxy.config.system.build.toplevel' --no-link)
|
|
nginx_conf=$(readlink -f "$toplevel/etc/nginx/nginx.conf")
|
|
include_path=$(awk '/server_name files\.alexion\.dev;/{in_server=1} in_server && /include .*recommended-proxy_set_header/{print $2; exit}' "$nginx_conf" | tr -d ';')
|
|
cat "$include_path"
|