source: code/trunk/config/config.go@ 444

Last change on this file since 444 was 426, checked in by contact, 5 years ago

Don't accept any IP as a proxy by default

It's too easy to setup a reverse proxy which doesn't support the PROXY
protocol, or lets the X-Forwarded-For header fields pass through.
Disable this by default.

To restore the previous behaviour, add accept-proxy-ip localhost to
the config file.

File size: 2.3 KB
RevLine 
[62]1package config
2
3import (
4 "fmt"
[370]5 "net"
[62]6 "os"
[200]7
[424]8 "git.sr.ht/~emersion/go-scfg"
[62]9)
10
[370]11type IPSet []*net.IPNet
12
13func (set IPSet) Contains(ip net.IP) bool {
14 for _, n := range set {
15 if n.Contains(ip) {
16 return true
17 }
18 }
19 return false
20}
21
22// loopbackIPs contains the loopback networks 127.0.0.0/8 and ::1/128.
23var loopbackIPs = IPSet{
24 &net.IPNet{
25 IP: net.IP{127, 0, 0, 0},
26 Mask: net.CIDRMask(8, 32),
27 },
28 &net.IPNet{
29 IP: net.IPv6loopback,
30 Mask: net.CIDRMask(128, 128),
31 },
32}
33
[62]34type TLS struct {
35 CertPath, KeyPath string
36}
37
38type Server struct {
[370]39 Listen []string
40 Hostname string
41 TLS *TLS
42 SQLDriver string
43 SQLSource string
44 LogPath string
45 HTTPOrigins []string
46 AcceptProxyIPs IPSet
[62]47}
48
49func Defaults() *Server {
50 hostname, err := os.Hostname()
51 if err != nil {
52 hostname = "localhost"
53 }
54 return &Server{
[426]55 Hostname: hostname,
56 SQLDriver: "sqlite3",
57 SQLSource: "soju.db",
[62]58 }
59}
60
61func Load(path string) (*Server, error) {
[424]62 cfg, err := scfg.Load(path)
[62]63 if err != nil {
64 return nil, err
65 }
[424]66 return parse(cfg)
[62]67}
68
[424]69func parse(cfg scfg.Block) (*Server, error) {
[62]70 srv := Defaults()
[424]71 for _, d := range cfg {
[62]72 switch d.Name {
73 case "listen":
[317]74 var uri string
[424]75 if err := d.ParseParams(&uri); err != nil {
[62]76 return nil, err
77 }
[317]78 srv.Listen = append(srv.Listen, uri)
[62]79 case "hostname":
[424]80 if err := d.ParseParams(&srv.Hostname); err != nil {
[62]81 return nil, err
82 }
83 case "tls":
84 tls := &TLS{}
[424]85 if err := d.ParseParams(&tls.CertPath, &tls.KeyPath); err != nil {
[62]86 return nil, err
87 }
88 srv.TLS = tls
[77]89 case "sql":
[424]90 if err := d.ParseParams(&srv.SQLDriver, &srv.SQLSource); err != nil {
[77]91 return nil, err
92 }
[178]93 case "log":
[424]94 if err := d.ParseParams(&srv.LogPath); err != nil {
[178]95 return nil, err
96 }
[323]97 case "http-origin":
[371]98 srv.HTTPOrigins = d.Params
[370]99 case "accept-proxy-ip":
100 srv.AcceptProxyIPs = nil
101 for _, s := range d.Params {
[426]102 if s == "localhost" {
103 srv.AcceptProxyIPs = append(srv.AcceptProxyIPs, loopbackIPs...)
104 continue
105 }
[370]106 _, n, err := net.ParseCIDR(s)
107 if err != nil {
108 return nil, fmt.Errorf("directive %q: failed to parse CIDR: %v", d.Name, err)
109 }
110 srv.AcceptProxyIPs = append(srv.AcceptProxyIPs, n)
111 }
[62]112 default:
113 return nil, fmt.Errorf("unknown directive %q", d.Name)
114 }
115 }
116
117 return srv, nil
118}
Note: See TracBrowser for help on using the repository browser.