benya/rmm-openwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use router-local host for LuCI proxy

Browse Source
This commit is contained in:
benya
2026-06-04 19:37:27 +03:00
parent 6583aecfde
commit 7048ba615a
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/internal/httpapi/server.go
View File

@@ -1117,7 +1117,10 @@ func (a *App) proxyLuCI(w http.ResponseWriter, r *http.Request, deviceID, sessio
proxy.Director = func(req *http.Request) { proxy.Director = func(req *http.Request) {
originalDirector(req) originalDirector(req)
req.URL.Path = upstreamPath req.URL.Path = upstreamPath
req.Host = upstream.Host // uhttpd's RFC1918/DNS-rebinding protection rejects LuCI CGI requests
// whose Host points at the Docker tunnel service instead of the router.
req.Host = "127.0.0.1"
req.Header.Set("Host", "127.0.0.1")
req.Header.Del("Accept-Encoding") req.Header.Del("Accept-Encoding")
removeCookie(req, operatorSessionCookie) removeCookie(req, operatorSessionCookie)
removeCookie(req, luciRouteCookie) removeCookie(req, luciRouteCookie)

4
server/internal/httpapi/server_test.go
View File

@@ -408,6 +408,10 @@ func TestAgentOperatorSmokeFlow(t *testing.T) {
func TestLuCIProxyRequiresActiveSessionAndRewritesPaths(t *testing.T) { func TestLuCIProxyRequiresActiveSessionAndRewritesPaths(t *testing.T) {
var upstreamPath string var upstreamPath string
upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.Host != "127.0.0.1" {
http.Error(w, "rejected host", http.StatusForbidden)
return
}
if strings.Contains(r.Header.Get("Cookie"), "rmm_operator_session=") { if strings.Contains(r.Header.Get("Cookie"), "rmm_operator_session=") {
t.Fatal("operator session cookie leaked to LuCI upstream") t.Fatal("operator session cookie leaked to LuCI upstream")
} }