qbittorrent / qBittorrent

qBittorrent BitTorrent client
https://www.qbittorrent.org
Other
27.96k stars 3.95k forks source link

AbstractWebApplication::validateHostHeader prevents webUI from being accessible when running in a docker container #7641

Closed FilipBB closed 7 years ago

FilipBB commented 7 years ago

qBittorrent version and Operating System:

qBittorrent v3.4.0beta2

If on linux, libtorrent and Qt version:

libtorrent 1.0.11 Qt 5.8.0

What is the problem:

Tying to access the webUI from within the local lan with qbittorrent-nox running in docker container on another host on the lan causes the following warning message in the logs: "WebUI: Invalid Host header, port mismatch"

The webUI is not displayed, no page is displayed at all.

What is the expected behavior:

The webUI would be displayed

Steps to reproduce:

Run qbittorrent in a docker container and try to access the webui from another host.

Extra info(if any):

Chocobo1 commented 7 years ago

"WebUI: Invalid Host header, port mismatch"

Post the full message, please. How do you forward the traffic from outside docker to qbittorrent?

FilipBB commented 7 years ago

The full message is: (W) 2017-10-24T19:00:40 - WebUI: Invalid Host header, port mismatch Source IP: '192.168.1.118'. Received Host header: '192.168.1.100'

I'm just using the standard docker container set-up: The interface inside the docker container is eth0 and the ip address is 172.17.0.3. The qBittorrent webUI is listening at port 8080 inside the container. Docker is mapping the external port 21011 to the port 8080 inside the container. The host is a raspberry pi at IP 192.168.1.100 and I'm trying to connect from another PC on the lan who's IP is 192.168.1.118. I have some other self hosted services running on the Pi that work fine, and qBittorrent 3.3.13 was not having this problem.

Chocobo1 commented 7 years ago

Docker is mapping the external port 21011 to the port 8080 inside the container.

As a workaround, obviously you can set both ports to the same number and it should work. This was implemented to defend against DNS rebinding attacks, I'm not inclined to loosen the security check yet.

FilipBB commented 7 years ago

Ok, well your workaround solves it for now, thanks.