Changeset 370 in code for trunk/config/config.go

Timestamp:

Jul 22, 2020, 3:03:01 PM (5 years ago)

Author:

contact

Message:

Add accept-proxy-ip config directive

This allows to set the list of IPs allowed to act as a proxy. This is
only used for WebSockets right now, but will be expanded to TCP as well
once the PROXY protocol is supported.

File:

• trunk/config/config.go (modified) (4 diffs)

trunk/config/config.go

@@ -5 +5 @@
         "fmt"
         "io"
+        "net"
         "os"
 
         "github.com/google/shlex"
 )
+
+type IPSet []*net.IPNet
+
+func (set IPSet) Contains(ip net.IP) bool {
+        for _, n := range set {
+                if n.Contains(ip) {
+                        return true
+                }
+        }
+        return false
+}
+
+// loopbackIPs contains the loopback networks 127.0.0.0/8 and ::1/128.
+var loopbackIPs = IPSet{
+        &net.IPNet{
+                IP:   net.IP{127, 0, 0, 0},
+                Mask: net.CIDRMask(8, 32),
+        },
+        &net.IPNet{
+                IP:   net.IPv6loopback,
+                Mask: net.CIDRMask(128, 128),
+        },
+}
 
 type TLS struct {
@@ -15 +39 @@
 
 type Server struct {
-        Listen      []string
-        Hostname    string
-        TLS         *TLS
-        SQLDriver   string
-        SQLSource   string
-        LogPath     string
-        HTTPOrigins []string
+        Listen         []string
+        Hostname       string
+        TLS            *TLS
+        SQLDriver      string
+        SQLSource      string
+        LogPath        string
+        HTTPOrigins    []string
+        AcceptProxyIPs IPSet
 }
 
@@ -30 +55 @@
         }
         return &Server{
-                Hostname:  hostname,
-                SQLDriver: "sqlite3",
-                SQLSource: "soju.db",
+                Hostname:       hostname,
+                SQLDriver:      "sqlite3",
+                SQLSource:      "soju.db",
+                AcceptProxyIPs: loopbackIPs,
         }
 }
@@ -94 +120 @@
                 case "http-origin":
                         srv.HTTPOrigins = append(srv.HTTPOrigins, d.Params...)
+                case "accept-proxy-ip":
+                        srv.AcceptProxyIPs = nil
+                        for _, s := range d.Params {
+                                _, n, err := net.ParseCIDR(s)
+                                if err != nil {
+                                        return nil, fmt.Errorf("directive %q: failed to parse CIDR: %v", d.Name, err)
+                                }
+                                srv.AcceptProxyIPs = append(srv.AcceptProxyIPs, n)
+                        }
                 default:
                         return nil, fmt.Errorf("unknown directive %q", d.Name)