mirrors/seaweedfs
1
0
Fork 0
mirror of https://github.com/chrislusf/seaweedfs synced 2024-07-08 10:07:25 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #187 from skx/master

Browse source 
Allow whitelisting by CIDR range, not just literally.
This commit is contained in:
chrislusf 2015-09-05 00:09:30 -07:00
parent 91db227b27 2a777a970c
commit 1e78b8bc28
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
go/security/guard.go
View file

@ -4,6 +4,7 @@ import (
"errors"
"fmt"
"net"
"regexp"
"net/http"
"github.com/chrislusf/seaweedfs/go/glog"
@ -88,6 +89,26 @@ func (g *Guard) checkWhiteList(w http.ResponseWriter, r *http.Request) error {
host, _, err := net.SplitHostPort(r.RemoteAddr)
if err == nil {
for _, ip := range g.whiteList {
// If the whitelist entry contains a "/" it
// is a CIDR range, and we should check the
// remote host is within it
match, _ := regexp.MatchString("/", ip)
if ( match ) {
_, cidrnet, err := net.ParseCIDR(ip)
if err != nil {
panic(err)
}
remote := net.ParseIP(host)
if cidrnet.Contains(remote) {
return nil
}
}
//
// Otherwise we're looking for a literal match.
//
if ip == host {
return nil
}