tPj UddlmZmZddlmZddlmZddlmZm Z m Z dZ ee d<de eeffdZ dd e eefd zdeefd Zd eded zfd Zd e dd ed e eefd zdededd f dZy ))AnyFinal)Request)verbose_proxy_logger)ip_in_networksnormalize_cidr_rangesparse_trusted_proxy_rangestrusted_proxy_rangesTRUSTED_PROXY_RANGES_KEYreturnc> ddlm}|xsiS#t$ricYSwxYw)Nrgeneral_settings)litellm.proxy.proxy_serverr ImportErrorrs k/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/trusted_proxy_utils.py_get_proxy_general_settingsrs)?%2%  s  Nrcb| t}t|jttS)zOperator-configured trusted reverse-proxy CIDRs, normalized to strings. Empty when none are configured, in which case X-Forwarded-For must not be trusted and only the direct peer is authoritative.  setting_name)rrgetr rs rget_trusted_proxy_cidrsrs268 56- requestc\t|dd}t|dd}t|tr|Sy)Nclienthost)getattr isinstancestr)rr client_hosts r_get_direct_client_ipr"(s1GXt4F 6K+s# r)rr feature_namerc| t}t|j||}|st|d|dt |}t ||s(t jd||t|d|dy)a Fail closed unless the direct TCP peer is one of the configured trusted reverse proxies. Header-based auth paths must validate the direct peer, not X-Forwarded-For, because the direct peer is the actor supplying the identity headers. Nrz requires general_settings.z9 before trusting identity headers from an upstream proxy.z?%s rejected identity headers from untrusted direct client IP %rzV only accepts identity headers from configured trusted proxy ranges. Direct client IP z is not trusted.)rr r ValueErrorr"rrwarning)rrr#rtrusted_networksdirect_client_ips rrequire_trusted_proxy_requestr)0s6889I9M9Ml9[jvw n7 ~F@ @  4G< *,< =$$ M   n66F5IJ   >r)N)typingrrfastapirlitellm._loggingrlitellm.proxy.auth.networkrrr r __annotations__dictr rlistrr"r)rrr2s1 #9%8T#s(^/3 38nt+  #Y  7sTz/30 $ $ 38nt+$  $  $  $ r