Commit4fd4fe3

committed

fix(coderd): prevent agent reverse proxy from usingHTTP[S]_PROXY envs

1 parentdc8cf3e commit4fd4fe3Copy full SHA for 4fd4fe3

File tree

+32

-0

lines changed

+32

-0

lines changed

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,9 @@ func init() {`
`37`	`37`	`if!valid {`
`38`	`38`	`panic("dev error: default transport is the wrong type")`
`39`	`39`	`}`
	`40`	`+// We do not want to respect the proxy settings from the environment, since`
	`41`	`+// all network traffic happens over wireguard.`
	`42`	`+tailnetTransport.Proxy=nil`
`40`	`43`	`}`
`41`	`44`
`42`	`45`	`var_ workspaceapps.AgentProvider= (*ServerTailnet)(nil)`

Lines changed: 29 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -68,6 +68,35 @@ func TestServerTailnet_AgentConn_NoSTUN(t *testing.T) {`
`68`	`68`	`assert.True(t,conn.AwaitReachable(ctx))`
`69`	`69`	`}`
`70`	`70`
	`71`	`+//nolint:paralleltest // t.Setenv`
	`72`	`+funcTestServerTailnet_ReverseProxy_ProxyEnv(t*testing.T) {`
	`73`	`+t.Setenv("HTTP_PROXY","http://169.254.169.254:12345")`
	`74`	`+`
	`75`	`+ctx,cancel:=context.WithTimeout(context.Background(),testutil.WaitLong)`
	`76`	`+defercancel()`
	`77`	`+`
	`78`	`+agents,serverTailnet:=setupServerTailnetAgent(t,1)`
	`79`	`+a:=agents[0]`
	`80`	`+`
	`81`	`+u,err:=url.Parse(fmt.Sprintf("http://127.0.0.1:%d",workspacesdk.AgentHTTPAPIServerPort))`
	`82`	`+require.NoError(t,err)`
	`83`	`+`
	`84`	`+rp:=serverTailnet.ReverseProxy(u,u,a.id)`
	`85`	`+`
	`86`	`+rw:=httptest.NewRecorder()`
	`87`	`+req:=httptest.NewRequest(`
	`88`	`+http.MethodGet,`
	`89`	`+u.String(),`
	`90`	`+nil,`
	`91`	`+).WithContext(ctx)`
	`92`	`+`
	`93`	`+rp.ServeHTTP(rw,req)`
	`94`	`+res:=rw.Result()`
	`95`	`+deferres.Body.Close()`
	`96`	`+`
	`97`	`+assert.Equal(t,http.StatusOK,res.StatusCode)`
	`98`	`+}`
	`99`	`+`
`71`	`100`	`funcTestServerTailnet_ReverseProxy(t*testing.T) {`
`72`	`101`	`t.Parallel()`
`73`	`102`

Comments

(0)