Added support for CIDR address checking in UserAllowedIP setting.
Ylian Saint-Hilaire committed
Jan 4, 2019 at 15:29 UTC
9e520998bda943be7ed00be3b1c63afa90fb267f
4 files changed
+9
-10
meshcentral.js
+1
@@ -252,6 +252,7 @@ function CreateMeshCentralServer(config, args) {
252
if (obj.args.mpsaliasport != null && (typeof obj.args.mpsaliasport != 'number')) obj.args.mpsaliasport = null;
253
if (obj.args.notls == null && obj.args.redirport == null) obj.args.redirport = 80;
254
if (obj.args.minifycore === 0) obj.args.minifycore = false;
255
+ if (typeof obj.args.userallowedip == 'string') { if (obj.args.userallowedip == '') { obj.args.userallowedip = null; } else { obj.args.userallowedip = obj.userallowedip.split(','); } }
256
if (typeof obj.args.debug == 'number') obj.debugLevel = obj.args.debug;
257
if (obj.args.debug == true) obj.debugLevel = 1;
258
obj.db = require('./db.js').CreateDB(obj);
package.json
+2
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.2.5-q",
3
+ "version": "0.2.5-r",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
@@ -35,6 +35,7 @@
35
"express-handlebars": "^3.0.0",
36
"express-session": "^1.15.6",
37
"express-ws": "^4.0.0",
38
+ "ipcheck": "^0.1.0",
39
"meshcentral": "*",
40
"minimist": "^1.2.0",
41
"multiparty": "^4.2.1",
sample-config.json
+1
@@ -31,6 +31,7 @@
31
"NewAccounts": 1,
32
"Footer": "<a href='https://twitter.com/mytwitter'>Twitter</a>",
33
"_CertUrl": "https://192.168.2.106:443/",
34
+ "_UserAllowedIP": "127.0.0.1,192.168.1.0/24",
35
"_PasswordRequirements": { "min": 8, "max": 128, "upper": 1, "lower": 1, "numeric": 1, "nonalpha": 1 }
36
},
37
"customer1": {
webserver.js
+5
-9
@@ -292,8 +292,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
292
if (req.connection) { type = 1; ip = req.ip; } // HTTP(S) request
293
else if (req._socket) { type = 2; ip = req._socket.remoteAddress; } // WebSocket request
294
if (!ip) return false;
295
- if (ip.startsWith('::ffff:')) { ip = ip.substring(7); } // Fix IPv4 IP's encoded in IPv6 form
296
- if ((ip != null) && (allowedIpList.indexOf(ip) >= 0)) { return true; }
295
+ for (var i = 0; i < allowedIpList.length; i++) { if (require('ipcheck').match(ip, allowedIpList[i])) { return true; } }
296
if (type == 1) { res.sendStatus(401); }
297
else if (type == 2) { try { req.close(); } catch (e) { } }
298
} catch (e) { console.log(e); }
@@ -302,15 +301,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
301
302
// Check if the source IP address is allowed, return domain if allowed
303
function checkUserIpAddress(req, res, rootonly) {
305
- if (obj.userAllowedIp != null) {
306
- if (typeof obj.userAllowedIp == 'string') { if (obj.userAllowedIp == "") { obj.userAllowedIp = null; return true; } else { obj.userAllowedIp = obj.userAllowedIp.split(','); } }
307
- if (checkUserIpAddressEx(req, res, obj.userAllowedIp) == false) return null;
308
- }
309
- if (rootonly == true) return;
304
+ if ((obj.userAllowedIp != null) && (checkUserIpAddressEx(req, res, obj.userAllowedIp) == false)) { return null; }
305
+ if (rootonly == true) { return; }
306
var domain;
307
if (req.url) { domain = getDomain(req); } else { domain = getDomain(res); }
308
if (domain.userallowedip == null) return domain;
313
- if (checkUserIpAddressEx(req, res, domain.userallowedip) == false) return null;
309
+ if (checkUserIpAddressEx(req, res, domain.userallowedip) == false) { return null; }
310
return domain;
311
}
312
@@ -321,7 +317,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
317
var x = req.url.split('/');
318
if (x.length < 2) return parent.config.domains[''];
319
var y = parent.config.domains[x[1].toLowerCase()];
324
- if ((y != null) && (y.dns == null)) return parent.config.domains[x[1].toLowerCase()];
320
+ if ((y != null) && (y.dns == null)) { return parent.config.domains[x[1].toLowerCase()]; }
321
return parent.config.domains[''];
322
}
323