Repository navigation
fix(bench): Check backup URLs before the agent downloads them (backport #654) - #655
Merged
Merged
Conversation
The agent downloads the database and files backups for a restore from the URLs that Press sends. Each request now goes only to a public address, and the connection uses the address that was checked. The download follows up to 3 redirects, and each target goes through the same check. Webhooks and Remote File in Press use the same checks. (cherry picked from commit d6263ad)
The adapter test replaced the request, so it never ran a TLS handshake. The new tests serve HTTPS on 127.0.0.1 with a test CA. A certificate for the hostname is accepted, and the SNI is the hostname. A certificate for another name, or for the pinned IP, is rejected. urllib3 sends server_hostname for SNI and checks the certificate against it, so the adapter no longer sets assert_hostname. (cherry picked from commit 31c5827)
Contributor
Author
|
This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The agent downloads the database and files backups for a restore from the URLs that Press sends. This change checks each URL before the download, with the same checks that webhooks and Remote File use in Press.
Changes
agent/remote_url.pywithopen_remote_url. It accepts only http and https URLs, resolves the host, and connects only when every address is public. The connection uses the address that was checked. The Host header and the TLS certificate check keep the hostname.download_fileusesopen_remote_urlin place ofrequests.get.Before merge
All restore downloads go through the check, including the S3 links that Press presigns. If a Backup Bucket
endpoint_urlresolves to an address that is not public, restores from that bucket fail. Please confirm the endpoints in use.Tests
agent/tests/test_remote_url.py, 9 tests on Python 3.8. Two tests send real requests to a local server, where only the check can resolve the hostname. Over HTTPS with a test CA, a certificate for the hostname is accepted, and a certificate for another name or for the pinned IP is rejected.This is an automatic backport of pull request #654 done by [Mergify](https://mergify.com).