Add option to disable fileserver in XAPI conf

[benjamreis]

New XAPI conf option: disable-webserver (default: false)
If true, all requests for the fileserver will get a 403 response.

[benjamreis]

We get this feature request from a lot of users that wan't to completely disable the webserver for security reason.

[lindig]

Could this expression not be extended to get the desired outcome? I don't like the deeper and deeper nesting if it could be avoided.

[lindig]

As a configuration option, this is fine with me.

[psafont]

I've tried using options, along with bind, to indicate whether a single reply has been sent back to the client, but it ends up more verbose, and not quite as clean as I would like:

let reply_maybe condition reply =
  if condition () then
    Some (reply ())
  else
    None

...

  let ( let* ) = Option.bind in
  let reply () =
    let* () =
      reply_maybe
      (fun () -> !Xapi_globs.disable_webserver)
      (fun () -> Http_svr.response_forbidden ~req s)
    in
    let* () =
      reply_maybe
        (fun () -> is_external_http && !Xapi_globs.website_https_only)
        (fun () -> Http_svr.response_forbidden ~req s)
    in

...

  in
  match reply () with
  | Some () ->
      ()
  | None ->
      Http_svr.response_missing s (missing uri)

[psafont]

What is it exactly that users complain about? We already allow a setting to disable port 80, to appease the port scanners

[stormi]

In XCP-ng 8.3, we provide a full client (XO Lite) directly available in HTTPS. Some users are afraid of it, despite it's just a client that ultimately runs in their browser. So we want to offer them the choice to disable it completely.

In addition to this, scanners may detect CVEs in JS dependencies of XO lite from time to time, which we will fix, but users may need to disable the web server temporarily to comply with security rules about detected CVEs in software until we publish the fix and they can schedule applying it.

[psafont]

My preference would be to filter the common http handler's list by name to not load the get_root handler on startup in ocaml/xapi/xapi.ml line 1106, depending on the conf, and see how it explodes when doing the request. This seems like the correct layer to handle the matter, rather than inside the fileserver

[benjamreis]

My preference would be to filter the common http handler's list by name to not load the get_root handler on startup in ocaml/xapi/xapi.ml line 1106, depending on the conf, and see how it explodes when doing the request. This seems like the correct layer to handle the matter, rather than inside the fileserver

Done! :)

[benjamreis]

Re-tested and validated.

[psafont]

Hiding the whitespace in the diff it's very easy to see that the change is correct