PR feedback

- Move new ServiceCollectionExtension to Configuration.CloudFoundry
- Use IConfigureOptions<ForwardedHeadersOptions>
- add missing using on ServiceProviders, true in BuildServiceProvider
- more consistent usage of EnvironmentVariableScope
- remove CF_INSTANCE var parsing option

Author: TimHess

src/Common/src/Hosting/Properties/AssemblyInfo.cs

@@ -13,4 +13,3 @@
 [assembly: InternalsVisibleTo("Steeltoe.Management.Endpoint")]
 [assembly: InternalsVisibleTo("Steeltoe.Management.Endpoint.Test")]
 [assembly: InternalsVisibleTo("Steeltoe.Management.Prometheus.Test")]
-[assembly: InternalsVisibleTo("Steeltoe.Security.Authorization.Certificate.Test")]

src/Common/src/Hosting/PublicAPI.Unshipped.txt

@@ -1,3 +0,0 @@
-#nullable enable
-static Steeltoe.Common.Hosting.ServiceCollectionExtensions.ConfigureForwardedHeadersOptionsForCloudFoundry(this Microsoft.Extensions.DependencyInjection.IServiceCollection! services) -> Microsoft.Extensions.DependencyInjection.IServiceCollection!
-Steeltoe.Common.Hosting.ServiceCollectionExtensions

src/Common/src/Hosting/ServiceCollectionExtensions.cs

@@ -2,6 +2,8 @@
 // The .NET Foundation licenses this file to you under the Apache 2.0 License.
 // See the LICENSE file in the project root for more information.
 
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Options;
@@ -41,4 +43,32 @@ public static IServiceCollection AddCloudFoundryOptions(this IServiceCollection
 
         return services;
     }
+
+    /// <summary>
+    /// Configures <see cref="ForwardedHeadersOptions" /> to use forwarded headers as they are provided in Cloud Foundry. Includes
+    /// <see cref="ForwardedHeaders.XForwardedHost" /> and <see cref="ForwardedHeaders.XForwardedProto" />, and allows any network.
+    /// </summary>
+    /// <param name="services">
+    /// The <see cref="IServiceCollection" /> to configure.
+    /// </param>
+    /// <returns>
+    /// The same <see cref="IServiceCollection" /> instance, for chaining.
+    /// </returns>
+    /// <remarks>
+    /// IMPORTANT: <see cref="ForwardedHeadersExtensions.UseForwardedHeaders(IApplicationBuilder)" /> must be called separately to activate these options.
+    /// </remarks>
+    /// <exception cref="ArgumentNullException">
+    /// Thrown if <paramref name="services" /> is <c>null</c>.
+    /// </exception>
+    public static IServiceCollection ConfigureForwardedHeadersOptionsForCloudFoundry(this IServiceCollection services)
+    {
+        ArgumentNullException.ThrowIfNull(services);
+
+        services.AddLogging();
+        services.AddOptions<ForwardedHeadersSettings>().BindConfiguration(ForwardedHeadersSettings.ConfigurationKey);
+        services.AddOptions<ForwardedHeadersOptions>();
+        services.TryAddEnumerable(ServiceDescriptor.Singleton<IConfigureOptions<ForwardedHeadersOptions>, ConfigureForwardedHeadersOptions>());
+
+        return services;
+    }
 }

src/Common/test/Hosting.Test/ServiceCollectionExtensionsTest.cs

@@ -0,0 +1,104 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the Apache 2.0 License.
+// See the LICENSE file in the project root for more information.
+
+using System.Globalization;
+using System.Net;
+using System.Net.Sockets;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.HttpOverrides;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Steeltoe.Common;
+using IPNetwork = Microsoft.AspNetCore.HttpOverrides.IPNetwork;
+
+namespace Steeltoe.Configuration.CloudFoundry;
+
+internal sealed class ConfigureForwardedHeadersOptions(IOptions<ForwardedHeadersSettings> headerSettings, ILogger<ConfigureForwardedHeadersOptions> logger)
+    : IConfigureOptions<ForwardedHeadersOptions>
+{
+    public void Configure(ForwardedHeadersOptions options)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+
+        if (!Platform.IsCloudFoundry)
+        {
+            return;
+        }
+
+        options.ForwardedHeaders |= ForwardedHeaders.XForwardedHost | ForwardedHeaders.XForwardedProto;
+
+        if (!IsDefaultKnownNetworks(options.KnownNetworks) || !IsDefaultKnownProxies(options.KnownProxies))
+        {
+            logger.LogTrace("Known proxies or networks have already been configured.");
+            return;
+        }
+
+        if (headerSettings.Value.TrustAllNetworks)
+        {
+            logger.LogInformation(
+                "'TrustAllNetworks' has been set, forwarded headers will be allowed from any source. This should only be used behind a trusted ingress.");
+
+            options.KnownNetworks.Clear();
+            options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("0.0.0.0"), 0));
+        }
+        else
+        {
+            AddKnownNetworksFromConfiguration(options);
+        }
+    }
+
+    private static bool IsDefaultKnownNetworks(IList<IPNetwork> networks)
+    {
+        if (networks.Count != 1)
+        {
+            return false;
+        }
+
+        IPNetwork network = networks[0];
+
+        return network is { PrefixLength: 8, Prefix.AddressFamily: AddressFamily.InterNetwork } &&
+            network.Prefix.GetAddressBytes().SequenceEqual(IPAddress.Parse("127.0.0.1").GetAddressBytes());
+    }
+
+    private static bool IsDefaultKnownProxies(IList<IPAddress> proxies)
+    {
+        return proxies.Count == 1 && proxies[0].Equals(IPAddress.IPv6Loopback);
+    }
+
+    private void AddKnownNetworksFromConfiguration(ForwardedHeadersOptions options)
+    {
+        foreach (string cidr in headerSettings.Value.KnownNetworks?.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries) ?? [])
+        {
+            if (TryParseCidr(cidr, out IPNetwork network) && !options.KnownNetworks.Any(knownNetwork =>
+                knownNetwork.Prefix.Equals(network.Prefix) && knownNetwork.PrefixLength.Equals(network.PrefixLength)))
+            {
+                logger.LogDebug("Adding known network {Network}/{PrefixLength} from configuration.", network.Prefix, network.PrefixLength);
+                options.KnownNetworks.Add(network);
+            }
+            else
+            {
+                logger.LogWarning("Invalid CIDR format in {KnownNetworksKey}: '{CIDR}'", $"{ForwardedHeadersSettings.ConfigurationKey}:KnownNetworks", cidr);
+            }
+        }
+    }
+
+    private static bool TryParseCidr(string cidr, out IPNetwork network)
+    {
+        network = null!;
+        string[] parts = cidr.Split('/');
+
+        if (parts.Length != 2)
+        {
+            return false;
+        }
+
+        if (IPAddress.TryParse(parts[0], out IPAddress? address) && int.TryParse(parts[1], CultureInfo.InvariantCulture, out int prefixLength))
+        {
+            network = new IPNetwork(address, prefixLength);
+            return true;
+        }
+
+        return false;
+    }
+}

src/Configuration/src/CloudFoundry/CloudFoundryServiceCollectionExtensions.cs

@@ -0,0 +1,20 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the Apache 2.0 License.
+// See the LICENSE file in the project root for more information.
+
+namespace Steeltoe.Configuration.CloudFoundry;
+
+public sealed class ForwardedHeadersSettings
+{
+    internal const string ConfigurationKey = "Steeltoe:ForwardedHeaders";
+
+    /// <summary>
+    /// Gets or sets a value indicating whether to trust all networks (adds 0.0.0.0/0). WARNING: Use only behind a trusted ingress.
+    /// </summary>
+    public bool TrustAllNetworks { get; set; } = true;
+
+    /// <summary>
+    /// Gets or sets known networks to trust, in CIDR notation. Example: "10.0.0.0/8,192.168.0.0/16".
+    /// </summary>
+    public string? KnownNetworks { get; set; }
+}

src/Configuration/src/CloudFoundry/ConfigureForwardedHeadersOptions.cs

@@ -11,3 +11,4 @@
 [assembly: InternalsVisibleTo("Steeltoe.Configuration.ConfigServer.Test")]
 [assembly: InternalsVisibleTo("Steeltoe.Connectors.Test")]
 [assembly: InternalsVisibleTo("Steeltoe.Discovery.HttpClients.Test")]
+[assembly: InternalsVisibleTo("Steeltoe.Security.Authorization.Certificate.Test")]