[Bug 1711573] Update Released
Corey Bryant
corey.bryant at canonical.com
Wed Oct 25 18:13:14 UTC 2017
The verification of the Stable Release Update for python-oslo.middleware
has completed successfully and the package has now been released to
-updates. In the event that you encounter a regression using the package
from -updates please report a new bug using ubuntu-bug and tag the bug
report regression-update so we can easily find any regressions.
--
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1711573
Title:
Invalid parsing of Forwarded header (RFC7239)
Status in Ubuntu Cloud Archive:
Fix Released
Status in Ubuntu Cloud Archive ocata series:
Fix Released
Status in Ubuntu Cloud Archive pike series:
Fix Released
Status in oslo.middleware:
Fix Released
Status in python-oslo.middleware package in Ubuntu:
Fix Released
Status in python-oslo.middleware source package in Zesty:
Fix Committed
Status in python-oslo.middleware source package in Artful:
Fix Released
Bug description:
>>> from oslo_middleware.http_proxy_to_wsgi import HTTPProxyToWSGI
>>> HTTPProxyToWSGI._parse_rfc7239_header("for=192.0.2.60;proto=http, for=192.0.2.60;by=203.0.113.43")
[{'for': '192.0.2.60', 'proto': 'http'}, {' for': '192.0.2.60', 'by': '203.0.113.43'}]
>>>
>>> HTTPProxyToWSGI._parse_rfc7239_header("for=192.0.2.60; proto=http, for=192.0.2.60; by=203.0.113.43")
[{' proto': 'http', 'for': '192.0.2.60'}, {' for': '192.0.2.60', ' by': '203.0.113.43'}]
According to some sources:
https://en.wikipedia.org/wiki/X-Forwarded-For#Alternatives_and_variations
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
using space after semicolon in Forwarded header is valid, but
_parse_rfc7239_header does not parse it properly: note spaces in keys
in the dict above.
This affects e.g. Heat when using a proxy+SSL.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1711573/+subscriptions
More information about the Ubuntu-openstack-bugs
mailing list