Fixes #39817 - Respect configured smart proxy names as Sinatra permitted_hosts

Warn when permitted hosts are not enforced by Sinatra

Author: lhellebr

config/settings.yml.example

@@ -18,6 +18,11 @@
 # Valid values: '1.0', '1.1', '1.2', '1.3'.
 #:tls_min_version: '1.2'
 
+# Hostnames accepted in HTTP Host headers. An empty list allows any hostname.
+# This is unrelated to trusted_hosts, which authorizes client machines.
+#:permitted_hosts:
+#  - proxy.example.com
+
 # Hosts which the proxy accepts connections from
 # commenting the following lines would mean every verified SSL connection allowed
 # HTTPS: test the certificate CN

lib/launcher.rb

@@ -219,6 +219,7 @@ def launch
       raise Exception.new("Both http and https are disabled, unable to start.") unless http_enabled? || https_enabled?
 
       ::Proxy::PluginInitializer.new(::Proxy::Plugins.instance).initialize_plugins
+      warn_if_unsupported_host_authorization
 
       http_app = http_app(settings.http_port)
       https_app = https_app(settings.https_port)
@@ -242,6 +243,14 @@ def launch
       exit(1)
     end
 
+    def warn_if_unsupported_host_authorization
+      return unless settings.permitted_hosts&.any?
+      # Sinatra 2 and 3 accept the setting but have no host authorization middleware.
+      return if ::Sinatra::Base.respond_to?(:setup_host_authorization, true)
+
+      logger.warn("permitted_hosts is configured but not enforced by this Sinatra version")
+    end
+
     def install_webrick_callback!(*apps)
       apps.compact!
 

lib/smart_proxy_main.rb

@@ -51,6 +51,14 @@ module Proxy
   # requests whose Host header isn't localhost — breaking all real
   # deployments where Foreman reaches smart-proxy by hostname.
   ::Sinatra::Base.set :environment, :production
+  # Sinatra 2 ignores this setting; without configured hosts, Sinatra 4
+  # accepts all hostnames as it did before.
+  # Sinatra passes this hash to Rack::Protection::HostAuthorization, which runs
+  # before LoggerMiddleware. Use the proxy logger for rejected-host diagnostics.
+  ::Sinatra::Base.set :host_authorization, {
+    permitted_hosts: SETTINGS.permitted_hosts || [],
+    logger: ::Proxy::LogBuffer::Decorator.instance,
+  }
   ::Sinatra::Base.register ::Sinatra::Authorization
 
   require 'root/root'

test/global_settings_test.rb

@@ -1,4 +1,5 @@
 require 'test_helper'
+require 'tempfile'
 
 class GlobalSettingsTest < Test::Unit::TestCase
   def test_default_values
@@ -9,6 +10,28 @@ def test_default_values
     assert_equal "INFO", settings.log_level
   end
 
+  def test_reads_permitted_hosts_from_config
+    settings = read_global_settings(<<~YAML)
+      :permitted_hosts:
+        - proxy.example.com
+        - alias.example.com
+    YAML
+
+    assert_equal ['proxy.example.com', 'alias.example.com'], settings.permitted_hosts
+  end
+
+  def test_reads_empty_permitted_hosts_from_config
+    settings = read_global_settings(":permitted_hosts: []\n")
+
+    assert_equal [], settings.permitted_hosts
+  end
+
+  def test_permitted_hosts_is_nil_when_unset_in_config
+    settings = read_global_settings("{}\n")
+
+    assert_nil settings.permitted_hosts
+  end
+
   def test_normalize_setting
     how_to = { :test => ->(value) { value + 1 } }
     assert_equal 2, ::Proxy::Settings::Global.new({}).normalize_setting(:test, 1, how_to)
@@ -26,4 +49,14 @@ def test_bind_host_is_normalized
     assert_equal ['127.0.0.1'], ::Proxy::Settings::Global.new(:bind_host => '127.0.0.1').bind_host
     assert_equal ['127.0.0.1'], ::Proxy::Settings::Global.new(:bind_host => ['127.0.0.1']).bind_host
   end
+
+  private
+
+  def read_global_settings(yaml)
+    Tempfile.create('smart-proxy-settings') do |file|
+      file.write(yaml)
+      file.flush
+      ::Proxy::Settings.initialize_global_settings(file.path)
+    end
+  end
 end

test/launcher_test.rb

@@ -23,6 +23,34 @@ def test_launched_with_sdnotify
   end
 end
 
+class LauncherHostAuthorizationTest < Test::Unit::TestCase
+  def test_warns_when_permitted_hosts_are_not_enforced
+    settings = Proxy::Settings::Global.new(permitted_hosts: ['proxy.example.com'])
+    launcher = Proxy::Launcher.new(settings)
+    ::Sinatra::Base.expects(:respond_to?).with(:setup_host_authorization, true).returns(false)
+    launcher.logger.expects(:warn).with('permitted_hosts is configured but not enforced by this Sinatra version')
+
+    launcher.warn_if_unsupported_host_authorization
+  end
+
+  def test_no_warning_when_host_authorization_is_supported
+    settings = Proxy::Settings::Global.new(permitted_hosts: ['proxy.example.com'])
+    launcher = Proxy::Launcher.new(settings)
+    ::Sinatra::Base.expects(:respond_to?).with(:setup_host_authorization, true).returns(true)
+    launcher.logger.expects(:warn).never
+
+    launcher.warn_if_unsupported_host_authorization
+  end
+
+  def test_no_warning_when_permitted_hosts_are_empty
+    settings = Proxy::Settings::Global.new(permitted_hosts: [])
+    launcher = Proxy::Launcher.new(settings)
+    launcher.logger.expects(:warn).never
+
+    launcher.warn_if_unsupported_host_authorization
+  end
+end
+
 class LauncherTlsCiphersTest < Test::Unit::TestCase
   def setup
     @launcher = Proxy::Launcher.new

test/root/root_api_test.rb

@@ -33,6 +33,25 @@ def test_features
     assert_equal ['test2'], JSON.parse(last_response.body)
   end
 
+  def test_features_rejects_unpermitted_host
+    omit 'This Sinatra version has no host authorization' unless ::Sinatra::Base.respond_to?(:setup_host_authorization, true)
+
+    ::Proxy::RootApi.stubs(:host_authorization).returns(permitted_hosts: ['proxy.example.com'])
+    get '/features', {}, 'HTTP_HOST' => 'proxy.example.com'
+    assert_equal 200, last_response.status
+
+    get '/features', {}, 'HTTP_HOST' => 'unknown.example.com'
+    assert_equal 403, last_response.status
+    assert_equal 'Host not permitted', last_response.body
+  end
+
+  def test_features_accepts_any_host_when_permitted_hosts_are_empty
+    ::Proxy::RootApi.stubs(:host_authorization).returns(permitted_hosts: [])
+
+    get '/features', {}, 'HTTP_HOST' => 'unknown.example.com'
+    assert_equal 200, last_response.status
+  end
+
   def test_version
     all_modules = [{:name => :foreman_proxy, :version => "0.0.1", :class => TestPlugin0, :state => :running},
                    {:name => :test2, :version => "0.0.1", :class => TestPlugin2, :state => :running},