Always reset fbidhttp to False if not open to public

webssh/handler.py

@@ -10,6 +10,7 @@ import paramiko
 import tornado.web
 
 from tornado.ioloop import IOLoop
+from tornado.options import options
 from webssh.utils import (
     is_valid_ip_address, is_valid_port, is_valid_hostname,
     to_bytes, to_str, to_int, to_ip_address, UnicodeType
@@ -32,8 +33,6 @@ KEY_MAX_SIZE = 16384
 DEFAULT_PORT = 22
 
 swallow_http_errors = True
-is_open_to_public = None
-forbid_public_http = None
 
 
 class InvalidValueError(Exception):
@@ -69,12 +68,11 @@ class MixinHandler(object):
             )
             return True
 
-        if is_open_to_public and forbid_public_http:
-            if context._orig_protocol == 'http':
-                ipaddr = to_ip_address(ip)
-                if not ipaddr.is_private:
-                    logging.warning('Public non-https request is forbidden.')
-                    return True
+        if options.fbidhttp and context._orig_protocol == 'http':
+            ipaddr = to_ip_address(ip)
+            if not ipaddr.is_private:
+                logging.warning('Public non-https request is forbidden.')
+                return True
 
     def set_default_headers(self):
         for header in self.custom_headers.items():

webssh/settings.py

@@ -4,7 +4,6 @@ import ssl
 import sys
 
 from tornado.options import define
-from webssh import handler
 from webssh.policy import (
     load_host_keys, get_policy_class, check_policy_setting
 )
@@ -119,10 +118,7 @@ def get_trusted_downstream(options):
 
 
 def detect_is_open_to_public(options):
-    handler.forbid_public_http = options.fbidhttp
-
-    if on_public_network_interfaces(get_ips_by_name(options.address)):
-        handler.is_open_to_public = True
-        logging.info('Forbid public http: {}'.format(options.fbidhttp))
-    else:
-        handler.is_open_to_public = False
+    result = on_public_network_interfaces(get_ips_by_name(options.address))
+    if not result and options.fbidhttp:
+        options.fbidhttp = False
+    logging.info('Forbid public http: {}'.format(options.fbidhttp))