Django ALLOWED_HOSTS IP 范围

Question

有没有办法在 django 中设置一系列 ALLOWED_HOSTS IP？

类似这样的：

ALLOWED_HOSTS = ['172.17.*.*']

Answer 1

不，这目前是不可能的。根据the docs，支持以下语法：

['www.example.com']  # Fully qualified domain
['.example.com']  # Subdomain wildcard, matches example.com and www.example.com 
['*']  # Matches anything

如果您查看validate_host 方法的实现，您会发现允许单独使用'*'，但不允许使用* 作为通配符作为字符串的一部分（例如'172.17.*.*'）支持。

Answer 2

我在 Django 上发布了一张票，但是我发现这可以通过执行以下操作来实现

from socket import gethostname, gethostbyname 
ALLOWED_HOSTS = [ gethostname(), gethostbyname(gethostname()), ] 

更新。如果您使用的是 docker，下面的代码会更好，因为 gethostbyname 没有得到正确的信息。

from socket import gethostname, gethostbyname, gethostbyname_ex
ALLOWED_HOSTS = [ gethostname(), ] + list(set(gethostbyname_ex(gethostname())[2]))

它被转换为集合的原因是 gethostbyname_ex 可以返回重复项。

django网站上的ticket链接是。

https://code.djangoproject.com/ticket/27485

Answer 3

Mozilla 发布了一个名为 django-allow-cidr 的 Python 包，旨在解决这个问题。

announcement blog post 解释说，它对于没有 Host 标头且仅使用 IP 地址的运行状况检查非常有用。

您必须将您的 IP 地址 '172.17.*.*' 稍微更改为 CIDR range，例如 172.17.0.0/16

Answer 4

这是一个快速而肮脏的解决方案。

ALLOWED_HOSTS += ['172.17.{}.{}'.format(i,j) for i in range(256) for j in range(256)]

Answer 5

我找到了过滤 IP 范围的解决方案：

https://stackoverflow.com/a/36222755/3766751

使用这种方法，我们可以通过任何方式过滤 IP（例如使用正则表达式）。

from django.http import HttpResponseForbidden

class FilterHostMiddleware(object):

    def process_request(self, request):

        allowed_hosts = ['127.0.0.1', 'localhost']  # specify complete host names here
        host = request.META.get('HTTP_HOST')

        if host[len(host)-10:] == 'dyndns.org':  # if the host ends with dyndns.org then add to the allowed hosts
            allowed_hosts.append(host)
        elif host[:7] == '192.168':  # if the host starts with 192.168 then add to the allowed hosts
            allowed_hosts.append(host)

        if host not in allowed_hosts:
            raise HttpResponseForbidden

        return None

感谢@Zorgmorduk

Answer 6

如果我们看看 Django 如何验证主机，我们可以深入了解如何使ALLOWED_HOSTS 条目更灵活：

def validate_host(host, allowed_hosts):
    """
    Validate the given host for this site.

    Check that the host looks valid and matches a host or host pattern in the
    given list of ``allowed_hosts``. Any pattern beginning with a period
    matches a domain and all its subdomains (e.g. ``.example.com`` matches
    ``example.com`` and any subdomain), ``*`` matches anything, and anything
    else must match exactly.

    Note: This function assumes that the given host is lowercased and has
    already had the port, if any, stripped off.

    Return ``True`` for a valid host, ``False`` otherwise.
    """
    return any(pattern == '*' or is_same_domain(host, pattern) for pattern in allowed_hosts)

. . .

def is_same_domain(host, pattern):
    """
    Return ``True`` if the host is either an exact match or a match
    to the wildcard pattern.

    Any pattern beginning with a period matches a domain and all of its
    subdomains. (e.g. ``.example.com`` matches ``example.com`` and
    ``foo.example.com``). Anything else is an exact string match.
    """
    if not pattern:
        return False

    pattern = pattern.lower()
    return (
        pattern[0] == '.' and (host.endswith(pattern) or host == pattern[1:]) or
        pattern == host
    )

这是一个RegexHost 实用程序，可以通过此验证。

class RegexHost(str):
    def lower(self):
        return self

    def __init__(self, pattern):
        super().__init__()
        self.regex = re.compile(pattern)

    def __eq__(self, other):
        # override the equality operation to use regex matching
        # instead of str.__eq__(self, other) 
        return self.regex.match(other)

可以这样使用：

# this matches '172.17.*.*' and also many impossible IPs
host = RegexHost(r'172\.17\.[0-9]{1,3}\.[0-9]{1,3}')

# Un-comment the below assertions to prove to yourself that this host
# validation works. Do not leave these assertions active in 
# production code for startup performance considerations.

# assert all(host == f'172.17.{i}.{j}' for i in range(256) for j in range(256))
# assert not any(host == f'172.18.{i}.{j}' for i in range(256) for j in range(256))
ALLOWED_HOSTS = [host]