Home-Assistant/core
1
0
Fork 0
mirror of https://github.com/home-assistant/core.git synced 2026-07-10 00:05:13 +01:00
Code Activity

Store recovery HTTP config with the full trusted proxy network

Browse Source 
The recovery config saved only the network address of each trusted proxy
(``ip.network_address``), dropping the prefix length. A configured network
like 10.0.0.0/24 was stored as 10.0.0.0 and read back as 10.0.0.0/32, so
recovery mode narrowed the trusted proxies to a single host and rejected
requests from the real proxy.

Store the full network (``str(ip)``) so the config round-trips losslessly.
The restored value is re-validated through HTTP_SCHEMA, which accepts both
forms, so this is safe on read back.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Stefan Agner
2026-07-09 11:59:12 +02:00
parent 257548bf88
commit 73806810cf
2 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
homeassistant/components/http/__init__.py
+4 -1
View File
@@ -725,8 +725,11 @@ async def start_http_server_and_save_config(
)
if CONF_TRUSTED_PROXIES in conf:
# Store the full network (address and prefix) so the recovery config
# round-trips losslessly; ``network_address`` alone drops the netmask
# and would narrow e.g. 10.0.0.0/24 to a single host.
conf[CONF_TRUSTED_PROXIES] = [
str(cast(IPv4Network | IPv6Network, ip).network_address)
str(cast(IPv4Network | IPv6Network, ip))
for ip in conf[CONF_TRUSTED_PROXIES]
]
tests/components/http/test_init.py
+4 -2
View File
@@ -490,7 +490,7 @@ async def test_storing_config(
config = {
http.CONF_SERVER_PORT: unused_tcp_port_factory(),
"use_x_forwarded_for": True,
"trusted_proxies": ["192.168.1.100"],
"trusted_proxies": ["192.168.1.100", "10.0.0.0/24"],
}
assert await async_setup_component(hass, http.DOMAIN, {http.DOMAIN: config})
@@ -501,7 +501,9 @@ async def test_storing_config(
await hass.async_block_till_done()
restored = await http.async_get_last_config(hass)
restored["trusted_proxies"][0] = ip_network(restored["trusted_proxies"][0])
restored["trusted_proxies"] = [
ip_network(proxy) for proxy in restored["trusted_proxies"]
]
assert restored == http.HTTP_SCHEMA(config)