Graylog2 / graylog-plugin-auth-sso

SSO support for Graylog through trusted HTTP headers set by load balancers or authentication proxies
Other
50 stars 13 forks source link

Trusted subnets should be checked only if option is enabled #8

Closed hc4 closed 8 years ago

hc4 commented 8 years ago

Problem description

Currently trusted subnets checked even if checking disabled.

Should be checked only if option enabed:

if (config.requireTrustedProxies()) {
    final boolean inTrustedSubnets = trustedProxies.stream()
        .anyMatch(ipSubnet -> {
            try {
                return ipSubnet.contains(headersToken.getRemoteAddr());
            } catch (UnknownHostException ignored) {
                LOG.debug("Looking up remote address {} failed.", headersToken.getRemoteAddr());
                return false;
            }
        });
    if(!inTrustedSubnets) {     
        LOG.info("Request with trusted header {} received from {} which is not in the trusted subnets: {}",
             usernameHeader,
             headersToken.getRemoteAddr(),
             Joiner.on(", ").join(trustedProxies));
        return null;
    }
}

Environment