Skip to main content

Tuleap Community Edition development and releases are no longer public. You have until September 30th to download packages and sources in Tuleap project. You can contact the team if you need further assistance.

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #9280 Set $sys_trusted_proxies should allow a subnet
    Infos
    #9280
    Matthieu Monnier (mmonnier)
    2016-06-29 17:42
    2016-06-23 18:31
    9570
    Details
    Set $sys_trusted_proxies should allow a subnet
    When using tuleap in a controlled network (like docker network) it make sense to make tuleap trust the whole subnet

    File: /etc/tuleap/conf/local.inc
    ...
    $sys_trusted_proxies = '10.0.0.0/8';
    ...
    Other
    All
    Empty
    • [x] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2016-06-29
    Attachments
    Empty
    References
    Referencing request #9280

    Artifact

    rel #9210 8.17
    Referenced by request #9280

    Other

    gerrit #6052
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2016-06-29 17:42
    Integrated into Tuleap 8.16.99.16.
    • Category changed from Tuleap Appliance to Other
    • Status changed from Under review to Closed
    • Reported in version changed from 8.15 to All
    • Close date changed from 2016-06-24 to 2016-06-29
    • Platform cleared values: CentOS 6
    • Is an Enhancement or an internal improvement? set to enhancement
    User avatar
    Manuel Vacelet (vaceletm)2016-06-24 15:43

    An alternative is to have a subnet as a trusted proxy

    • Summary
      -Set $sys_trusted_proxies with a hostname is impossible 
      +Set $sys_trusted_proxies should allow a subnet 
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    • Status changed from Declined to New
    User avatar
    Manuel Vacelet (vaceletm)2016-06-24 14:27

    I had a look at the code and it's the right way to do it as we do the match with REMOTE_ADDR header that is set as an IP address. Checking for hostname IP for each hit would have a very high cost so the workaround needs to be defined elsewhere.

    • Status changed from New to Declined
    • Close date set to 2016-06-24
    User avatar
    Matthieu Monnier (mmonnier)2016-06-23 22:24
    • Summary
      -set $sys_trusted_proxies with a hostname is impossible 
      +Set $sys_trusted_proxies with a hostname is impossible 
    User avatar
    Matthieu Monnier (mmonnier)2016-06-23 22:13
    • Summary
      -$sys_trusted_proxies with a hostname is impossible 
      +set $sys_trusted_proxies with a hostname is impossible