Added an option for blocking public non-https requests

tests/test_handler.py

@@ -3,7 +3,6 @@ import paramiko
 
 from tornado.httpclient import HTTPRequest
 from tornado.httputil import HTTPServerRequest
-from tornado.web import HTTPError
 from tests.utils import read_file, make_tests_data_path
 from webssh.handler import MixinHandler, IndexHandler, InvalidValueError
 
@@ -17,6 +16,8 @@ class TestMixinHandler(unittest.TestCase):
 
     def test_is_forbidden(self):
         handler = MixinHandler()
+        handler.is_open_to_public = True
+        handler.forbid_public_http = True
         request = HTTPRequest('http://example.com/')
         handler.request = request
 

tests/test_settings.py

@@ -7,10 +7,11 @@ import paramiko
 import tornado.options as options
 
 from tests.utils import make_tests_data_path
+from webssh import settings
 from webssh.policy import load_host_keys
 from webssh.settings import (
     get_host_keys_settings, get_policy_setting, base_dir, print_version,
-    get_ssl_context, get_trusted_downstream
+    get_ssl_context, get_trusted_downstream, detect_is_open_to_public,
 )
 from webssh.utils import UnicodeType
 from webssh._version import __version__
@@ -137,3 +138,29 @@ class TestSettings(unittest.TestCase):
         options.tdstream = '1.1.1.1, 2.2.2.'
         with self.assertRaises(ValueError):
             get_trusted_downstream(options), tdstream
+
+    def test_detect_is_open_to_public(self):
+        options.fbidhttp = True
+        options.address = 'localhost'
+        detect_is_open_to_public(options)
+        self.assertFalse(settings.is_open_to_public)
+
+        options.address = '127.0.0.1'
+        detect_is_open_to_public(options)
+        self.assertFalse(settings.is_open_to_public)
+
+        options.address = '192.168.1.1'
+        detect_is_open_to_public(options)
+        self.assertFalse(settings.is_open_to_public)
+
+        options.address = ''
+        detect_is_open_to_public(options)
+        self.assertTrue(settings.is_open_to_public)
+
+        options.address = '0.0.0.0'
+        detect_is_open_to_public(options)
+        self.assertTrue(settings.is_open_to_public)
+
+        options.address = '::'
+        detect_is_open_to_public(options)
+        self.assertTrue(settings.is_open_to_public)

tests/test_utils.py

@@ -1,8 +1,9 @@
 import unittest
 
 from webssh.utils import (
-    is_valid_ip_address, is_valid_port, is_valid_hostname,
-    to_str, to_bytes, to_int
+    is_valid_ip_address, is_valid_port, is_valid_hostname, to_str, to_bytes,
+    to_int, on_public_network_interface, on_public_network_interfaces,
+    get_ips_by_name
 )
 
 
@@ -51,3 +52,25 @@ class TestUitls(unittest.TestCase):
         self.assertFalse(is_valid_hostname('https://www.google.com'))
         self.assertFalse(is_valid_hostname('127.0.0.1'))
         self.assertFalse(is_valid_hostname('::1'))
+
+    def test_get_ips_by_name(self):
+        self.assertTrue(get_ips_by_name(''), {'0.0.0.0', '::'})
+        self.assertTrue(get_ips_by_name('localhost'), {'127.0.0.1'})
+        self.assertTrue(get_ips_by_name('192.68.1.1'), {'192.168.1.1'})
+        self.assertTrue(get_ips_by_name('2.2.2.2'), {'2.2.2.2'})
+
+    def test_on_public_network_interface(self):
+        self.assertTrue(on_public_network_interface('0.0.0.0'))
+        self.assertTrue(on_public_network_interface('::'))
+        self.assertTrue(on_public_network_interface('0:0:0:0:0:0:0:0'))
+        self.assertTrue(on_public_network_interface('2.2.2.2'))
+        self.assertTrue(on_public_network_interface('2:2:2:2:2:2:2:2'))
+        self.assertIsNone(on_public_network_interface('127.0.0.1'))
+
+    def test_on_public_network_interfaces(self):
+        self.assertTrue(
+            on_public_network_interfaces(['0.0.0.0', '127.0.0.1'])
+        )
+        self.assertIsNone(
+            on_public_network_interfaces(['192.168.1.1', '127.0.0.1'])
+        )