source: code/trunk/config/config.go@ 439

Last change on this file since 439 was 426, checked in by contact, 5 years ago

Don't accept any IP as a proxy by default

It's too easy to setup a reverse proxy which doesn't support the PROXY
protocol, or lets the X-Forwarded-For header fields pass through.
Disable this by default.

To restore the previous behaviour, add accept-proxy-ip localhost to
the config file.

File size: 2.3 KB
Line 
1package config
2
3import (
4 "fmt"
5 "net"
6 "os"
7
8 "git.sr.ht/~emersion/go-scfg"
9)
10
11type IPSet []*net.IPNet
12
13func (set IPSet) Contains(ip net.IP) bool {
14 for _, n := range set {
15 if n.Contains(ip) {
16 return true
17 }
18 }
19 return false
20}
21
22// loopbackIPs contains the loopback networks 127.0.0.0/8 and ::1/128.
23var loopbackIPs = IPSet{
24 &net.IPNet{
25 IP: net.IP{127, 0, 0, 0},
26 Mask: net.CIDRMask(8, 32),
27 },
28 &net.IPNet{
29 IP: net.IPv6loopback,
30 Mask: net.CIDRMask(128, 128),
31 },
32}
33
34type TLS struct {
35 CertPath, KeyPath string
36}
37
38type Server struct {
39 Listen []string
40 Hostname string
41 TLS *TLS
42 SQLDriver string
43 SQLSource string
44 LogPath string
45 HTTPOrigins []string
46 AcceptProxyIPs IPSet
47}
48
49func Defaults() *Server {
50 hostname, err := os.Hostname()
51 if err != nil {
52 hostname = "localhost"
53 }
54 return &Server{
55 Hostname: hostname,
56 SQLDriver: "sqlite3",
57 SQLSource: "soju.db",
58 }
59}
60
61func Load(path string) (*Server, error) {
62 cfg, err := scfg.Load(path)
63 if err != nil {
64 return nil, err
65 }
66 return parse(cfg)
67}
68
69func parse(cfg scfg.Block) (*Server, error) {
70 srv := Defaults()
71 for _, d := range cfg {
72 switch d.Name {
73 case "listen":
74 var uri string
75 if err := d.ParseParams(&uri); err != nil {
76 return nil, err
77 }
78 srv.Listen = append(srv.Listen, uri)
79 case "hostname":
80 if err := d.ParseParams(&srv.Hostname); err != nil {
81 return nil, err
82 }
83 case "tls":
84 tls := &TLS{}
85 if err := d.ParseParams(&tls.CertPath, &tls.KeyPath); err != nil {
86 return nil, err
87 }
88 srv.TLS = tls
89 case "sql":
90 if err := d.ParseParams(&srv.SQLDriver, &srv.SQLSource); err != nil {
91 return nil, err
92 }
93 case "log":
94 if err := d.ParseParams(&srv.LogPath); err != nil {
95 return nil, err
96 }
97 case "http-origin":
98 srv.HTTPOrigins = d.Params
99 case "accept-proxy-ip":
100 srv.AcceptProxyIPs = nil
101 for _, s := range d.Params {
102 if s == "localhost" {
103 srv.AcceptProxyIPs = append(srv.AcceptProxyIPs, loopbackIPs...)
104 continue
105 }
106 _, n, err := net.ParseCIDR(s)
107 if err != nil {
108 return nil, fmt.Errorf("directive %q: failed to parse CIDR: %v", d.Name, err)
109 }
110 srv.AcceptProxyIPs = append(srv.AcceptProxyIPs, n)
111 }
112 default:
113 return nil, fmt.Errorf("unknown directive %q", d.Name)
114 }
115 }
116
117 return srv, nil
118}
Note: See TracBrowser for help on using the repository browser.