Skip to content

Commit eea5e04

Browse files
theCalcaholictheCalcaholic
committed
ncp-web: Set domain explicitly to whatever was visited when activating NCP
1 parent d513873 commit eea5e04

8 files changed

Lines changed: 356 additions & 452 deletions

File tree

‎.github/workflows/SelfTest.php‎

Lines changed: 265 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
/**
6+
* SPDX-FileCopyrightText: 2020 Nextcloud GmbH and Nextcloud contributors
7+
* SPDX-License-Identifier: AGPL-3.0-or-later
8+
*/
9+
10+
namespace OCA\NotifyPush;
11+
12+
use OCA\NotifyPush\Queue\IQueue;
13+
use OCA\NotifyPush\Queue\RedisQueue;
14+
use OCP\App\IAppManager;
15+
use OCP\Http\Client\IClient;
16+
use OCP\Http\Client\IClientService;
17+
use OCP\IAppConfig;
18+
use OCP\IConfig;
19+
use OCP\IDBConnection;
20+
use OCP\Security\ISecureRandom;
21+
use Symfony\Component\Console\Output\OutputInterface;
22+
use Symfony\Component\HttpFoundation\IpUtils;
23+
use Psr\Log\LoggerInterface;
24+
25+
class SelfTest {
26+
public const ERROR_OTHER = 1;
27+
public const ERROR_TRUSTED_PROXY = 2;
28+
29+
private IClient $client;
30+
private int $cookie;
31+
private string $token;
32+
33+
public function __construct(
34+
IClientService $clientService,
35+
private IConfig $config,
36+
private IAppConfig $appConfig,
37+
private IQueue $queue,
38+
private IDBConnection $connection,
39+
private IAppManager $appManager,
40+
private ISecureRandom $random,
41+
private LoggerInterface $logger,
42+
) {
43+
$this->client = $clientService->newClient();
44+
$this->cookie = rand(1, (int)pow(2, 30));
45+
$this->token = $this->random->generate(32);
46+
}
47+
48+
private function getHttpOpts(): array {
49+
return ['nextcloud' => ['allow_local_address' => true], 'verify' => false, 'headers' => ['token' => $this->token]];
50+
}
51+
52+
public function test(string $server, OutputInterface $output, bool $ignoreProxyError = false): int {
53+
if ($this->queue instanceof RedisQueue) {
54+
$output->writeln('<info>✓ redis is configured</info>');
55+
} else {
56+
$output->writeln('<error>🗴 redis is not configured</error>');
57+
return self::ERROR_OTHER;
58+
}
59+
60+
if (strpos($server, 'http://') === 0) {
61+
$output->writeln('<comment>🗴 using unencrypted http for push server is strongly discouraged</comment>');
62+
} elseif (strpos($server, 'https://') !== 0) {
63+
$output->writeln('<error>🗴 malformed server url</error>');
64+
return self::ERROR_OTHER;
65+
}
66+
if (strpos($server, 'localhost') !== false) {
67+
$output->writeln('<comment>🗴 push server URL is set to localhost, the push server will not be reachable from other machines</comment>');
68+
}
69+
70+
$this->queue->getConnection()->set('test-token', $this->token);
71+
$this->queue->push('notify_test_cookie', $this->cookie);
72+
$this->appConfig->setValueInt('notify_push', 'cookie', $this->cookie);
73+
74+
try {
75+
$retrievedCookie = (int)$this->client->get($server . '/test/cookie', $this->getHttpOpts())->getBody();
76+
} catch (\Exception $e) {
77+
$msg = $e->getMessage();
78+
$output->writeln("<error>🗴 can't connect to push server: $msg</error>");
79+
return self::ERROR_OTHER;
80+
}
81+
82+
if ($this->cookie === $retrievedCookie) {
83+
$output->writeln('<info>✓ push server is receiving redis messages</info>');
84+
} else {
85+
$expected = $this->cookie;
86+
$output->writeln("<error>🗴 push server is not receiving redis messages (received $expected, got $retrievedCookie)</error>");
87+
return self::ERROR_OTHER;
88+
}
89+
90+
// test if the push server can load storage mappings from the db
91+
[$storageId, $count] = $this->getStorageIdForTest();
92+
// If no admin user was created during the installation, there are no oc_filecache and oc_mounts entries yet, so this check has to be skipped.
93+
if ($storageId !== null) {
94+
try {
95+
$this->logger->warning($server . '/test/mapping/' . $storageId . " :: " . print_r($this->getHttpOpts(), true));
96+
$resp = $this->client->get($server . '/test/mapping/' . $storageId, $this->getHttpOpts());
97+
$this->logger->warning($resp->getStatusCode() . ": " . $resp->getBody() . ", expected: " . $count);
98+
$retrievedCount = (int)$resp->getBody();
99+
} catch (\Exception $e) {
100+
$msg = $e->getMessage();
101+
$output->writeln("<error>🗴 can't connect to push server: $msg</error>");
102+
return self::ERROR_OTHER;
103+
}
104+
105+
if ((int)$count === $retrievedCount) {
106+
$output->writeln('<info>✓ push server can load mount info from database</info>');
107+
} else {
108+
$output->writeln("<error>🗴 push server can't load mount info from database</error>");
109+
return self::ERROR_OTHER;
110+
}
111+
}
112+
113+
// test if the push server can reach nextcloud by having it request the cookie
114+
try {
115+
$response = $this->client->get($server . '/test/reverse_cookie', $this->getHttpOpts())->getBody();
116+
$retrievedCookie = (int)$response;
117+
118+
if ($this->cookie === $retrievedCookie) {
119+
$output->writeln('<info>✓ push server can connect to the Nextcloud server</info>');
120+
} else {
121+
$output->writeln("<error>🗴 push server can't connect to the Nextcloud server</error>");
122+
if (!is_numeric($response)) {
123+
$output->writeln("<error> $response</error>");
124+
}
125+
return self::ERROR_OTHER;
126+
}
127+
} catch (\Exception $e) {
128+
$msg = $e->getMessage();
129+
$output->writeln("<error>🗴 can't connect to push server: $msg</error>");
130+
return self::ERROR_OTHER;
131+
}
132+
133+
// test that the push server is a trusted proxy
134+
try {
135+
$resolvedRemote = $this->client->get($server . '/test/remote/1.2.3.4', $this->getHttpOpts())->getBody();
136+
} catch (\Exception $e) {
137+
$msg = $e->getMessage();
138+
$output->writeln("<error>🗴 can't connect to push server: $msg</error>");
139+
return self::ERROR_OTHER;
140+
}
141+
142+
if ($ignoreProxyError || $resolvedRemote === '1.2.3.4') {
143+
$output->writeln('<info>✓ push server is a trusted proxy</info>');
144+
} else {
145+
$trustedProxies = $this->config->getSystemValue('trusted_proxies', []);
146+
$headers = $this->config->getSystemValue('forwarded_for_headers', ['HTTP_X_FORWARDED_FOR']);
147+
$receivedHeader = $this->queue->getConnection()->get('notify_push_forwarded_header');
148+
$remote = $this->queue->getConnection()->get('notify_push_remote');
149+
150+
if (array_search('HTTP_X_FORWARDED_FOR', $headers) === false) {
151+
$output->writeln('<error>🗴 Nextcloud is configured to not use the `x-http-forwarded-for` header.</error>');
152+
$output->writeln("<error> Please add 'HTTP_X_FORWARDED_FOR' the the 'forwarded_for_headers' in your config.php.</error>");
153+
return self::ERROR_TRUSTED_PROXY;
154+
}
155+
156+
$output->writeln('<error>🗴 push server is not a trusted proxy by Nextcloud or another proxy in the chain.</error>');
157+
$output->writeln(" Nextcloud resolved the following client address for the test request: \"$resolvedRemote\" instead of the expected \"1.2.3.4\" test value.");
158+
$output->writeln(' The following trusted proxies are currently configured: ' . implode(', ', array_map(function (string $proxy) {
159+
return '"' . $proxy . '"';
160+
}, $trustedProxies)));
161+
$invalidConfig = array_filter($trustedProxies, function (string $proxy) {
162+
return !$this->isValidProxyConfig($proxy);
163+
});
164+
if ($invalidConfig) {
165+
$output->writeln('<error> of which the following seem to be invalid: ' . implode(', ', array_map(function (string $proxy) {
166+
return '"' . $proxy . '"';
167+
}, $invalidConfig)) . '</error>');
168+
}
169+
$output->writeln(" The following x-forwarded-for header was received by Nextcloud: \"$receivedHeader\"");
170+
$output->writeln(" from the following remote: $remote");
171+
$output->writeln('');
172+
173+
if ($receivedHeader) {
174+
$forwardedParts = array_map('trim', explode(',', $receivedHeader));
175+
$forwardedClient = $forwardedParts[0];
176+
$proxies = [$remote, ...array_reverse(array_slice($forwardedParts, 1))];
177+
$untrusted = $this->getFirstUntrustedIp($proxies, $trustedProxies);
178+
if ($untrusted) {
179+
$output->writeln(" <error>$untrusted is not trusted as a reverse proxy by Nextcloud</error>");
180+
$output->writeln(' See https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/reverse_proxy_configuration.html#defining-trusted-proxies for how to add trusted proxies.');
181+
} else {
182+
$output->writeln('<info>✓ All proxies in the chain appear to be trusted by Nextcloud</info>');
183+
if ($forwardedClient != '1.2.3.4') {
184+
$output->writeln("<comment> One of the proxies is the chain (probably $forwardedClient) seems to have stripped the x-forwarded-for header</comment>");
185+
$output->writeln(" Please configure the reverse proxy at $forwardedClient to not strip the x-forwarded-for header");
186+
}
187+
}
188+
} else {
189+
$output->writeln("<comment> No x-forwarded-for header was received by Nextcloud, $remote seems to be stripping the header from the request</comment>");
190+
$output->writeln(" Please configure the reverse proxy at $remote to not strip the x-forwarded-for header");
191+
}
192+
$output->writeln('');
193+
194+
$output->writeln(" If you're having issues getting the trusted proxy setup working, you can try bypassing any existing reverse proxy");
195+
$output->writeln(' in your setup by setting the `NEXTCLOUD_URL` environment variable to point directly to the internal Nextcloud webserver url');
196+
$output->writeln(' (You will still need the ip address of the push server added as trusted proxy)');
197+
return self::ERROR_TRUSTED_PROXY;
198+
}
199+
200+
// test that the binary is up to date
201+
try {
202+
$this->queue->getConnection()->del('notify_push_version');
203+
$response = $this->client->post($server . '/test/version', $this->getHttpOpts());
204+
if ($response === 'error') {
205+
$output->writeln('<error>🗴 failed to get binary version, check the push server output for more information</error>');
206+
return self::ERROR_OTHER;
207+
}
208+
usleep(10 * 1000);
209+
$binaryVersion = $this->queue->getConnection()->get('notify_push_version');
210+
if (!$binaryVersion) {
211+
throw new \Exception('push server didn\'t set expected redis key');
212+
}
213+
} catch (\Exception $e) {
214+
$msg = $e->getMessage();
215+
$output->writeln("<error>🗴 failed to get binary version: $msg</error>");
216+
return self::ERROR_OTHER;
217+
}
218+
$appVersion = $this->appManager->getAppVersion('notify_push');
219+
$appVersionNoMinor = substr($appVersion, 0, strrpos($appVersion, '.'));
220+
$binaryVersionNoMinor = substr($binaryVersion, 0, strrpos($binaryVersion, '.'));
221+
222+
if ($appVersionNoMinor === $binaryVersionNoMinor) {
223+
$output->writeln('<info>✓ push server is running the same version as the app</info>');
224+
} else {
225+
$output->writeln("<error>🗴 push server (version $binaryVersion) is not the same version as the app (version $appVersion).</error>");
226+
return self::ERROR_OTHER;
227+
}
228+
229+
return 0;
230+
}
231+
232+
private function getFirstUntrustedIp(array $ips, array $trusted): ?string {
233+
foreach ($ips as $ip) {
234+
if (str_starts_with($ip, '[') && str_ends_with($ip, ']')) {
235+
$ip = substr($ip, 1, -1);
236+
}
237+
if (!IpUtils::checkIp($ip, $trusted)) {
238+
return $ip;
239+
}
240+
}
241+
return null;
242+
}
243+
244+
private function getStorageIdForTest() {
245+
$query = $this->connection->getQueryBuilder();
246+
$query->select('storage_id', $query->func()->count())
247+
->from('mounts', 'm')
248+
->innerJoin('m', 'filecache', 'f', $query->expr()->eq('root_id', 'fileid'))
249+
->where($query->expr()->eq('path_hash', $query->createNamedParameter(md5(''))))
250+
->groupBy('storage_id')
251+
->setMaxResults(1);
252+
253+
return $query->executeQuery()->fetch(\PDO::FETCH_NUM);
254+
}
255+
256+
private function isValidProxyConfig(string $proxyConfig): bool {
257+
$cidrre = '/^([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\/([0-9]{1,2})$/';
258+
259+
if (filter_var($proxyConfig, FILTER_VALIDATE_IP) !== false) {
260+
return true;
261+
} else {
262+
return (bool)preg_match($cidrre, $proxyConfig);
263+
}
264+
}
265+
}

‎.github/workflows/build-lxd.yml‎

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,7 @@ jobs:
267267
set -x
268268
export GECKODRIVER_PATH="$GECKODRIVER_PATH"
269269
export FF_BINARY_PATH="$(which firefox)"
270+
sudo "$LXC" exec ncp -- /usr/local/bin/ncc config:system:set overwrite.cli.url --value "https://nextcloudpi.local"
270271
sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
271272
../.venv/bin/python activation_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
272273
echo "Activation test failed!"
@@ -319,7 +320,6 @@ jobs:
319320
320321
sudo "$LXC" exec ncp -- bash -c "DBG=x ncp-update ${UPDATE_ARGS[*]}"
321322
sudo "$LXC" exec ncp -- /usr/local/bin/ncc status
322-
sudo "$LXC" exec ncp -- /usr/local/bin/ncc notify_push:self-test
323323
324324
if [[ "$current_nc_version" =~ "$latest_nc_version".* ]]
325325
then
@@ -367,7 +367,36 @@ jobs:
367367
sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
368368
export GECKODRIVER_PATH="$GECKODRIVER_PATH"
369369
export FF_BINARY_PATH="$(which firefox)"
370-
../.venv/bin/python nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
370+
sudo "$LXC" exec ncp -- /usr/local/bin/ncc notify_push:self-test
371+
sudo "$LXC" file push --uid 33 --gid 33 ../.github/workflows/SelfTest.php ncp/var/www/nextcloud/apps/notify_push/lib/SelfTest.php
372+
nc_test_cmd=(../.venv/bin/python nextcloud_tests.py --no-gui)
373+
nc_test_args=("nextcloudpi.local" 443 4443)
374+
notify_push_test=(sudo "$LXC" exec ncp -- /usr/local/bin/ncc notify_push:self-test)
375+
376+
USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --skip-update-test --non-interactive || {
377+
echo "System test failed!"
378+
sudo "$LXC" exec ncp -- /usr/local/bin/ncc notify_push:self-test || :;
379+
echo "ncp.log: "
380+
sudo "$LXC" exec ncp -- bash -c "tail -n20 /var/log/ncp.log" || true
381+
echo "================"
382+
echo "nextcloud log: "
383+
datadir="$(sudo "$LXC" exec ncp -- ncc config:system:get datadirectory)"
384+
sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
385+
exit 1
386+
}
387+
#"${nc_test_cmd[@]}" --return-after=1 "${nc_test_args[@]}" \
388+
#&& "${notify_push_test[@]}" \
389+
##&& "${nc_test_cmd[@]}" --return-after=2 "${nc_test_args[@]}" \
390+
#&& "${notify_push_test[@]}" \
391+
#&& "${nc_test_cmd[@]}" --return-after=3 "${nc_test_args[@]}" \
392+
#&& "${notify_push_test[@]}" \
393+
#&& "${nc_test_cmd[@]}" --return-after=4 "${nc_test_args[@]}" \
394+
#&& "${notify_push_test[@]}" \
395+
#&& "${nc_test_cmd[@]}" --return-after=5 "${nc_test_args[@]}" \
396+
#&& "${notify_push_test[@]}" \
397+
#&& "${nc_test_cmd[@]}" --return-after=6 "${nc_test_args[@]}" \
398+
#&& "${notify_push_test[@]}" \
399+
"${nc_test_cmd[@]}" "${nc_test_args[@]}" || {
371400
echo "Nextcloud test failed!"
372401
echo "Geckodriver logs:"
373402
tail -n 20 geckodriver.log >&2 || true
@@ -380,10 +409,6 @@ jobs:
380409
sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
381410
exit 1
382411
}
383-
USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --non-interactive || {
384-
echo "System test failed!"
385-
exit 1
386-
}
387412
sudo "$LXC" stop ncp
388413
389414
test-dist-upgrade:

0 commit comments

Comments
 (0)