tPj!:2UdZddlZddlmZddlmZmZddlmZddl m Z m Z ddl m Z ddlmZd ad ae eZeed <ed d Gd dZed d GddZed d GddZeezezZGddZy)z IP address utilities for MCP public/private access control. Internal callers (private IPs) see all MCP servers. External callers (public IPs) only see servers with available_on_public_internet=True. N) dataclass)AnyFinal)Request) TypeAdapterValidationError)verbose_proxy_logger)_get_request_ip_addressF_NUM_TRUSTED_HOPS_ADAPTERT)frozenslotsceZdZdZy)_HopCountUnsetzFmcp_xff_num_trusted_hops is absent: keep the legacy leftmost-XFF path.N__name__ __module__ __qualname____doc__h/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/auth/ip_address_utils.pyrr!sPrrceZdZdZy)_HopCountInvalidzLmcp_xff_num_trusted_hops is present but unusable: fail closed, never legacy.Nrrrrrr&sVrrceZdZUeed<y) _HopCountvalueN)rrrint__annotations__rrrrr+s Jrrc eZdZdZej dej dej dej dej dej dgZedee d zd eejejzfd Z edee d zd eejejzfd Z ed e d zdeejejzd efdZe dde d zdeejejzd zd efdZe ddedee efd zd efdZede ded e d zfdZeded efdZe ddedee efd zd e d zfdZy )IPAddressUtilsz1Static utilities for IP-based MCP access control.z 10.0.0.0/8z 172.16.0.0/12z192.168.0.0/16z 127.0.0.0/8z::1/128zfc00::/7configured_rangesNreturnc|stjSg}|D])} |jtj|d+|r|StjS#t $rt jd|YawxYw)zLParse configured CIDR ranges into network objects, falling back to defaults.Fstrictz4Invalid CIDR in mcp_internal_ip_ranges: %s, skipping)r _DEFAULT_INTERNAL_NETWORKSappend ipaddress ip_network ValueErrorr warningr!networkscidrs rparse_internal_networksz&IPAddressUtils.parse_internal_networks?s !!<< z2IPAddressUtils.is_trusted_proxy..jsG7twG)r( ip_addressstripanyr*)r2r3r:s @ris_trusted_proxyzIPAddressUtils.is_trusted_proxy`sN / #..x~~/?@DG6FGG G  s6? A  A  client_ipinternal_networksc |syd|vr"|jddj}|xstj} t j |jtfd|DS#t $rYywxYw)z Check if a client IP is from an internal/private network. Handles X-Forwarded-For comma chains (takes leftmost = original client). Fails closed: empty/invalid IPs are treated as external. F,rc3&K|]}|v ywr6rr7s rr;z0IPAddressUtils.is_internal_ip..s;w47?;r<)splitr>r r&r(r=r*r?)rArBr-r:s @ris_internal_ipzIPAddressUtils.is_internal_ipns ) !,Q/557I+X~/X/X #..y/@AD;(;;;  s#A77 BBrequestgeneral_settingsch| ddlm}|}|i}|jddsy|jd}|stst j dday|jr|jjnd}tj|}tj||S#t$ri}YwxYw) a Return True if X-Forwarded-* headers on this request should be trusted. Trusts the headers iff both: 1. ``use_x_forwarded_for`` is enabled in proxy settings, AND 2. ``mcp_trusted_proxy_ranges`` is configured AND the direct connection IP (``request.client.host``) falls inside one of those CIDRs. When ``use_x_forwarded_for`` is enabled but ``mcp_trusted_proxy_ranges`` is missing, the headers are NOT trusted: there is no way to distinguish a trusted reverse proxy from a direct attacker, so callers that build URLs (OAuth issuer / redirect_uri / etc.) must fall back to the request's literal base URL instead of risking a poisoned host. NrrIuse_x_forwarded_forFmcp_trusted_proxy_rangesause_x_forwarded_for is enabled but mcp_trusted_proxy_ranges is not configured, so X-Forwarded-* headers will NOT be trusted. MCP OAuth discovery URLs fall back to the proxy's literal request URL, and MCP access-control client-IP resolution fails closed (callers are treated as external). Set mcp_trusted_proxy_ranges in general_settings to your reverse-proxy CIDR(s) to trust X-Forwarded-*.T) litellm.proxy.proxy_serverrI ImportErrorget"_warned_xff_without_trusted_rangesr r+clienthostr r1r@)rHrIproxy_general_settingstrusted_ranges direct_ipr3s ris_request_from_trusted_proxyz,IPAddressUtils.is_request_from_trusted_proxys(  # &$:   #! ##$95A 0 4 45O P5$,,%6:229..7>>..d "0"M"Mn"]..y:JKK7 &#%  &sB## B10B1 xff_headernum_trusted_hopsctd|jdD}|dkst||kry|| } tj||S#t $rYywxYw)a Resolve the originating client IP from an X-Forwarded-For chain by counting ``num_trusted_hops`` entries from the right. Each trusted proxy appends the address it received the connection from, so the right end of the chain is written by infrastructure while the left end is attacker-controllable. Selecting the Nth entry from the right, where N is the number of trusted appending proxies in front of the gateway, yields the real client IP and discards any values a client prepended to spoof an allowed address. Returns None when the chain has fewer than ``num_trusted_hops`` entries or the selected entry is not a valid IP, so callers can fail closed. c3^K|]%}|js|j'ywr6)r>)r8parts rr;zAIPAddressUtils.extract_client_ip_from_xff_hops..s"^QUQ[Q[Q]tzz|^s--rDN)tuplerFlenr(r=r*)rXrYentries candidates rextract_client_ip_from_xff_hopsz.IPAddressUtils.extract_client_ip_from_xff_hopsss&^ 8H8H8M^^ a 3w<2B#B"$4#45     +  sA A A raw_num_trusted_hopsc| tS tj|}|dkr t j d|t St|S#t$r#t j d|t cYSwxYw)NzInvalid mcp_xff_num_trusted_hops value %r; failing closed for MCP client IP resolution. Set it to a positive integer, or remove the setting to restore the legacy X-Forwarded-For pathr]zmcp_xff_num_trusted_hops=%s is below the minimum of 1; failing closed for MCP client IP resolution. Set it to a positive integer, or remove the setting to restore the legacy X-Forwarded-For path)rr validate_pythonrr r+rr)rcnum_hopss r_resolve_num_trusted_hopsz(IPAddressUtils._resolve_num_trusted_hopss  '!# # &7GGH\]H a< ( ('  $% %""# & ( (P%   $% % &sA)A?>A?c| ddlm}|}|i}|jdd}|rdan+d|j vrtst jdda|rd|j vrtj||sN|jr|jjnd}|jd rt jd ||Sy tj|jd xtd x\y xtdxB\}tj!|j d|}|t jd|y |St"d x\nt%||S#t$ri}YbwxYw)aV Extract client IP from a FastAPI request for MCP access control. Security: Only trusts X-Forwarded-For if: 1. use_x_forwarded_for is enabled in settings 2. The direct connection is from a trusted proxy (if mcp_trusted_proxy_ranges configured) When ``mcp_xff_num_trusted_hops`` is set, the client IP is read that many entries from the right of the chain instead of the spoofable leftmost value, defeating append-style X-Forwarded-For forgery. A present-but-invalid value (non-integer or below 1) fails closed rather than silently reverting to the legacy path, so a config typo cannot quietly weaken access control. Args: request: FastAPI request object general_settings: Optional settings dict. If not provided, imports from proxy_server. NrrKrLFzx-forwarded-foraReceived a request with an X-Forwarded-For header but use_x_forwarded_for is not enabled. The real client IP is being ignored and the direct peer's IP (typically your load balancer / reverse proxy) is used for MCP access control. Because that peer almost always falls within general_settings.mcp_internal_ip_ranges, every external caller is treated as internal and 'available_on_public_internet: false' MCP servers are effectively exposed. Set use_x_forwarded_for: true (and mcp_trusted_proxy_ranges to your proxy CIDRs) in general_settings to honor the real client IP. Not failing the request: if there is no load balancer, a crafted X-Forwarded-For header must not be able to take down the service.TrMz)XFF header from untrusted IP %s, ignoringmcp_xff_num_trusted_hopsr)rznX-Forwarded-For chain has fewer than mcp_xff_num_trusted_hops=%s entries or an invalid address; failing closed)rL)rNrIrOrP _warned_xff_present_but_disabledheadersr errorr rWrRrSr+rgrrrbrr )rHrIrTuse_xffrVrYrAs rget_mcp_client_ipz IPAddressUtils.get_mcp_client_ips,  # &$:  #! )--.CUK /4 , '// 13$** 0480 (GOO;!??Zj?k:A..7>>#6#6d #''(BC(001\^gh$$  ::;K;O;OPj;kl'%'(6Y6'5'U'U(9:rs!11A&+"$) #.s#353 $d#QQ$Q $d#WW$W $d#$"$44y@_M_Mr