Skip to content

[HttpClient] adding NoPrivateNetworkHttpClient decorator #35566

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

hallboav
Copy link
Contributor

@hallboav hallboav commented Feb 3, 2020

Q A
Branch? master
Bug fix? no
New feature? yes
Deprecations? no
Tickets -
License MIT
Doc PR -

The purpose of NoPrivateNetworkHttpClient is for block requests to private networks by default or block one or more subnetwork if specified. NoPrivateNetworkHttpClient accepts two arguments, first one is a HttpClientInterface instance and subnetworks as a second argument.
Second argument $subnets can be null for blocking requests to private networks, or string to specify a single subnet of array for a set of subnets.

<?php

use Symfony\Component\HttpClient\HttpClient;
use Symfony\Component\HttpClient\NoPrivateNetworkHttpClient;

$client = new NoPrivateNetworkHttpClient(HttpClient::create());
// You can request public networks normally using the code above
$client->request('GET', 'https://symfony.com/');

// Requests to private neworks will be blocked because second argument ($subnets) is null
$client->request('GET', 'http://localhost/');

// If we request from 104.26.14.0 to 104.26.15.255 we'll get an exception, since I'm specifying a subnetwork
$client = new NoPrivateNetworkHttpClient(HttpClient::create(), ['104.26.14.0/23']);

// Let's suppose that our DNS server resolves symfony.com to 104.26.14.6, then the following request will be blocked
$client->request('GET', 'https://symfony.com/');

{
use HttpClientTrait;

const PRIVATE_SUBNETS = [
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

public or private?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

public LGTM

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why public?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so that ppl can reuse it?
private works for me also!

Copy link
Contributor Author

@hallboav hallboav Feb 3, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ahhh, I thought you were talking about the name of the constant. Thank you!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

private const PRIVATE_SUBNETS works

@nicolas-grekas nicolas-grekas added this to the next milestone Feb 3, 2020
Copy link
Member

@nicolas-grekas nicolas-grekas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!
Just minor comments remaining.

{
use HttpClientTrait;

const PRIVATE_SUBNETS = [
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

public LGTM

@hallboav hallboav force-pushed the no-private-network-http-client-decorator branch from c5147dd to e48b6d5 Compare February 3, 2020 13:33
@hallboav
Copy link
Contributor Author

hallboav commented Feb 3, 2020

@nicolas-grekas @OskarStark
I made all the changes you requested.

@nicolas-grekas nicolas-grekas force-pushed the no-private-network-http-client-decorator branch from e48b6d5 to 63fec80 Compare February 3, 2020 16:39
@nicolas-grekas
Copy link
Member

Thank you @hallboav.

nicolas-grekas added a commit that referenced this pull request Feb 3, 2020
…or (hallboav)

This PR was merged into the 5.1-dev branch.

Discussion
----------

[HttpClient] adding NoPrivateNetworkHttpClient decorator

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

The purpose of NoPrivateNetworkHttpClient is for block requests to private networks by default or block one or more subnetwork if specified. NoPrivateNetworkHttpClient accepts two arguments, first one is a HttpClientInterface instance and subnetworks as a second argument.
Second argument $subnets can be null for blocking requests to private networks, or string to specify a single subnet of array for a set of subnets.

```php
<?php

use Symfony\Component\HttpClient\HttpClient;
use Symfony\Component\HttpClient\NoPrivateNetworkHttpClient;

$client = new NoPrivateNetworkHttpClient(HttpClient::create());
// You can request public networks normally using the code above
$client->request('GET', 'https://symfony.com/');

// Requests to private neworks will be blocked because second argument ($subnets) is null
$client->request('GET', 'http://localhost/');

// If we request from 104.26.14.0 to 104.26.15.255 we'll get an exception, since I'm specifying a subnetwork
$client = new NoPrivateNetworkHttpClient(HttpClient::create(), ['104.26.14.0/23']);

// Let's suppose that our DNS server resolves symfony.com to 104.26.14.6, then the following request will be blocked
$client->request('GET', 'https://symfony.com/');
```

Commits
-------

63fec80 [HttpClient] adding NoPrivateNetworkHttpClient decorator
@nicolas-grekas nicolas-grekas merged commit 63fec80 into symfony:master Feb 3, 2020
@nicolas-grekas nicolas-grekas modified the milestones: next, 5.1 May 4, 2020
@fabpot fabpot mentioned this pull request May 5, 2020
nicolas-grekas added a commit that referenced this pull request Mar 20, 2023
…r1337)

This PR was squashed before being merged into the 6.3 branch.

Discussion
----------

[HttpFoundation] Add IpUtils::isPrivateIp

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | N/A
| License       | MIT
| Doc PR        | symfony/symfony-docs#18102

This is only my second PR for this project, so I hope I followed all the guidelines correctly.
Recently I had more and more use cases where I had to make exceptions (mostly rate limiting) for private IP ranges.

Symfony currently does not provide an easy way to check if an IP is private or public but implements such logic internally (private constant) for the [NoPrivateNetworkHttpClient](https://github.com/symfony/symfony/blob/6.3/src/Symfony/Component/HttpClient/NoPrivateNetworkHttpClient.php).

This PR intents to make the private subnet list reusable by adding it to [IpUtils](https://github.com/symfony/symfony/blob/6.3/src/Symfony/Component/HttpFoundation/IpUtils.php).

In the original PR of the NoPrivateNetworkHttpClient it was also briefly mentioned that this constant may have value when made public. #35566 (comment)

I think symfony should and always should have exposed this constant.

Commits
-------

6471582 [HttpFoundation] Add IpUtils::isPrivateIp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants