starred/copyparty
1
0
Fork 0
mirror of https://github.com/9001/copyparty.git synced 2026-10-05 22:04:38 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

support cidr notation for --xff-src, --ipa, --*-ipa

Browse Source 
the old `10.88.` syntax is still supported,
translating to `10.88.0.0/16`

also fix `--tftp-ipa` when optimizations are enabled
This commit is contained in:
ed
2024-03-14 19:07:35 +01:00
parent 78919e65d6
commit b377791be7
13 changed files with 103 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/examples/docker/idp-authelia-traefik/cpp/copyparty.conf
+2 -2
View File
@@ -24,8 +24,8 @@
# if we are confident that we got the docker-network config correct
# (meaning copyparty is only accessible through traefik, and
# traefik makes sure that all requests go through authelia),
# then disable the reverse-proxy source-ip safety check like this:
xff-src: any
# then accept X-Forwarded-For and IdP headers from any private IP:
xff-src: lan
# enable IdP support by expecting username/groupname in
# http-headers provided by the reverse-proxy; header "X-IdP-User"
docs/examples/docker/idp/copyparty.conf
+4 -1
View File
@@ -31,7 +31,10 @@
# preventing malicious users from pretending to be the proxy;
# pay attention to the warning message in the logs and then
# adjust the following config option accordingly:
xff-src: 192.168.
xff-src: 192.168.0.0/16
# or just allow all LAN / private IPs (probably good enough):
xff-src: lan
# an additional, optional security measure is to expect a
# secret header name from the reverse-proxy; you can enable
docs/idp.md
+1 -1
View File
@@ -4,4 +4,4 @@ to configure IdP from scratch, you must place copyparty behind a reverse-proxy w
in the copyparty `[global]` config, specify which headers to read client info from; username is required (`idp-h-usr: X-Authooley-User`), group(s) are optional (`idp-h-grp: X-Authooley-Groups`)
* it is also required to specify the subnet that legit requests will be coming from, for example `--xff-src=10.88.` to allow 10.88.x.x, and it is recommended to configure the reverseproxy to include a secret header as proof that the other headers are also legit (and not smuggled in by a malicious client), telling copyparty the headername to expect with `idp-h-key: shangala-bangala`
* it is also required to specify the subnet that legit requests will be coming from, for example `--xff-src=10.88.0.0/24` to allow 10.88.x.x (or `--xff-src=lan` for all private IPs), and it is recommended to configure the reverseproxy to include a secret header as proof that the other headers are also legit (and not smuggled in by a malicious client), telling copyparty the headername to expect with `idp-h-key: shangala-bangala`