Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Permit access to all mirrors if the list of allowed mirrors is empty #14

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

madmajestro
Copy link
Contributor

No description provided.

@madmajestro
Copy link
Contributor Author

The list of allowed mirrors is empty by default, making apt-cacher-rs unusable in the default configuration. Therefore, this PR changes the behavior to allow access to all mirrors if the list is empty. This is the same behavior used for the list of allowed clients.

The list of allowed mirrors is empty by default, making apt-cacher-rs
unusable in the default configuration. Therefore, this commit changes
the behavior to allow access to all mirrors if the list is empty.
@madmajestro madmajestro force-pushed the permit-access-to-all-mirrors-if-allowed_mirros-is-empty branch from 3fe42a1 to 0632b43 Compare March 19, 2025 15:58
@cgzones
Copy link
Owner

cgzones commented Mar 23, 2025

Originally I disallowed all mirrors by default to avoid having a too permissive standard configuration (since by default all clients are also allowed).

Would a compromise of a default of [ *.debian.org, *.ubuntu.com ] make sense?

@madmajestro
Copy link
Contributor Author

I'm also concerned that apt-cacher-rs could be abused as an HTTP proxy to retrieve illegible content from the web. However, in my humble opinion, restricting mirrors isn't a good standard solution.

Therefore, I suggest restricting the allowed filenames using a regular expression, allowing only the filenames required by apt.
I just analyzed apt-cacher-ng and it seems to work like this (no mirror-restriction by default, but restricted file names).

This would make apt-cacher-rs unusable as a regular HTTP proxy. What do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants