mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-08-10 12:51:11 +03:00
Josh HawkinsandGitHub
4883e20898
/auth grants anonymous admin to any request whose X-Server-Port matches networking.listen.internal, but it read that port off the live config while nginx binds its listeners once at container start and never reloads them, so any path that swaps the running config could move the trusted port without nginx moving with it. Saving networking.listen.internal equal to the external port applied immediately despite the restart-required warning, which handed unauthenticated admin to everything reaching the external port. Snapshot the port at app creation and compare against that instead, and reject a config whose two listeners share a port number, which nginx would refuse to start with anyway.
42 lines
1.4 KiB
Python
42 lines
1.4 KiB
Python
"""Tests for networking config validation."""
|
|
|
|
import unittest
|
|
|
|
from pydantic import ValidationError
|
|
|
|
from frigate.config.network import ListenConfig
|
|
|
|
|
|
class TestListenConfig(unittest.TestCase):
|
|
def test_defaults_are_distinct(self):
|
|
listen = ListenConfig()
|
|
|
|
self.assertEqual(listen.internal_port, 5000)
|
|
self.assertEqual(listen.external_port, 8971)
|
|
|
|
def test_address_and_port_string_is_parsed(self):
|
|
listen = ListenConfig(internal="127.0.0.1:5000", external="0.0.0.0:8971")
|
|
|
|
self.assertEqual(listen.internal_port, 5000)
|
|
self.assertEqual(listen.external_port, 8971)
|
|
|
|
def test_identical_ports_rejected(self):
|
|
with self.assertRaises(ValidationError):
|
|
ListenConfig(internal=8971, external=8971)
|
|
|
|
def test_same_port_on_different_addresses_rejected(self):
|
|
# nginx would accept these as distinct listeners, but /auth decides on
|
|
# the port alone, so the external one would inherit anonymous admin
|
|
with self.assertRaises(ValidationError):
|
|
ListenConfig(internal="127.0.0.1:8971", external="0.0.0.0:8971")
|
|
|
|
def test_distinct_ports_accepted(self):
|
|
listen = ListenConfig(internal=5001, external="0.0.0.0:8971")
|
|
|
|
self.assertEqual(listen.internal_port, 5001)
|
|
self.assertEqual(listen.external_port, 8971)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main(verbosity=2)
|