Umputun
307e69e5c1
- chroma/v2: v2.20.0 → v2.21.1 - go-pkgz/auth/v2: v2.1.0 → v2.1.1 - go-pkgz/rest: v1.20.4 → v1.20.6 - golang.org/x/* packages to latest Also exclude "meaningless package names" revive warning in linter config.
58 lines
1.5 KiB
Go
58 lines
1.5 KiB
Go
package rest
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/go-pkgz/rest/realip"
|
|
)
|
|
|
|
// OnlyFrom middleware allows access for limited list of source IPs.
|
|
// Such IPs can be defined as complete ip (like 192.168.1.12), prefix (129.168.) or CIDR (192.168.0.0/16)
|
|
func OnlyFrom(onlyIps ...string) func(http.Handler) http.Handler {
|
|
return func(h http.Handler) http.Handler {
|
|
fn := func(w http.ResponseWriter, r *http.Request) {
|
|
if len(onlyIps) == 0 {
|
|
// no restrictions if no ips defined
|
|
h.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
matched, ip, err := matchSourceIP(r, onlyIps)
|
|
if err != nil {
|
|
_ = EncodeJSON(w, http.StatusInternalServerError, JSON{"error": fmt.Sprintf("can't get realip: %s", err)})
|
|
return
|
|
}
|
|
if matched {
|
|
// matched ip - allow
|
|
h.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
_ = EncodeJSON(w, http.StatusForbidden, JSON{"error": fmt.Sprintf("ip %q rejected", ip)})
|
|
}
|
|
return http.HandlerFunc(fn)
|
|
}
|
|
}
|
|
|
|
// matchSourceIP returns true if request's ip matches any of ips
|
|
func matchSourceIP(r *http.Request, ips []string) (result bool, match string, err error) {
|
|
ip, err := realip.Get(r)
|
|
if err != nil {
|
|
return false, "", fmt.Errorf("can't get realip: %w", err) // we can't get ip, so no match
|
|
}
|
|
// check for ip prefix or CIDR
|
|
for _, exclIP := range ips {
|
|
if _, cidrnet, err := net.ParseCIDR(exclIP); err == nil {
|
|
if cidrnet.Contains(net.ParseIP(ip)) {
|
|
return true, ip, nil
|
|
}
|
|
}
|
|
if strings.HasPrefix(ip, exclIP) {
|
|
return true, ip, nil
|
|
}
|
|
}
|
|
return false, ip, nil
|
|
}
|