Added a command line option xheaders

webssh/handler.py

@@ -46,19 +46,21 @@ class MixinHandler(object):
     }
 
     def initialize(self):
+        conn = self.request.connection
+        self.context = conn.context
         if self.is_forbidden():
             result = '{} 403 Forbidden\r\n\r\n'.format(self.request.version)
-            self.request.connection.stream.write(to_bytes(result))
-            self.request.connection.close()
+            conn.stream.write(to_bytes(result))
+            conn.close()
             raise ValueError('Accesss denied')
 
     def is_forbidden(self):
         """
         Following requests are forbidden:
         * requests not come from trusted_downstream (if set).
-        * non-https requests from a public network.
+        * plain http requests from a public network.
         """
-        context = self.request.connection.context
+        context = self.context
         ip = context.address[0]
         lst = context.trusted_downstream
 
@@ -71,7 +73,7 @@ class MixinHandler(object):
         if options.fbidhttp and context._orig_protocol == 'http':
             ipaddr = to_ip_address(ip)
             if not ipaddr.is_private:
-                logging.warning('Public non-https request is forbidden.')
+                logging.warning('Public plain http request is forbidden.')
                 return True
 
     def set_default_headers(self):
@@ -85,8 +87,10 @@ class MixinHandler(object):
         return value
 
     def get_client_addr(self):
-        return self.get_real_client_addr() or self.request.connection.context.\
-                address
+        if options.xheaders:
+            return self.get_real_client_addr() or self.context.address
+        else:
+            return self.context.address
 
     def get_real_client_addr(self):
         ip = self.request.remote_ip

webssh/settings.py

@@ -30,8 +30,10 @@ define('policy', default='warning',
        help='Missing host key policy, reject|autoadd|warning')
 define('hostfile', default='', help='User defined host keys file')
 define('syshostfile', default='', help='System wide host keys file')
-define('tdstream', default='', help='trusted downstream, separated by comma')
-define('fbidhttp', type=bool, default=True, help='forbid public http request')
+define('tdstream', default='', help='Trusted downstream, separated by comma')
+define('fbidhttp', type=bool, default=True,
+       help='Forbid public plain http incoming requests')
+define('xheaders', type=bool, default=True, help='Support xheaders')
 define('wpintvl', type=int, default=0, help='Websocket ping interval')
 define('version', type=bool, help='Show version information',
        callback=print_version)
@@ -39,7 +41,6 @@ define('version', type=bool, help='Show version information',
 
 base_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 max_body_size = 1 * 1024 * 1024
-xheaders = True
 
 
 def get_app_settings(options):
@@ -55,7 +56,7 @@ def get_app_settings(options):
 
 def get_server_settings(options):
     settings = dict(
-        xheaders=xheaders,
+        xheaders=options.xheaders,
         max_body_size=max_body_size,
         trusted_downstream=get_trusted_downstream(options)
     )
@@ -121,4 +122,4 @@ def detect_is_open_to_public(options):
     result = on_public_network_interfaces(get_ips_by_name(options.address))
     if not result and options.fbidhttp:
         options.fbidhttp = False
-    logging.info('Forbid public http: {}'.format(options.fbidhttp))
+    logging.info('Forbid public plain http: {}'.format(options.fbidhttp))