When doing session IP address checkingin default 'lax' mode, if both addresses are private/loopback, it's now accepted as a match.
Ylian Saint-Hilaire committed
Jul 28, 2022 at 15:12 UTC
c8d8fc422c264389e7a0184ee28a0794ef2f47cb
1 file changed
+28
-1
webserver.js
+28
-1
@@ -8539,11 +8539,38 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
8539
for (var i in webRelaySessions) { webRelaySessions[i].checkTimeout(); }
8540
}
8541
8542
+ // Return true if this is a private IP address
8543
+ function isPrivateAddress(ip_addr) {
8544
+ // If this is a loopback address, return true
8545
+ if ((ip_addr == '127.0.0.1') || (ip_addr == '::1')) return true;
8546
+
8547
+ // Check IPv4 private addresses
8548
+ const ipcheck = require('ipcheck');
8549
+ const IPv4PrivateRanges = ['0.0.0.0/8', '10.0.0.0/8', '100.64.0.0/10', '127.0.0.0/8', '169.254.0.0/16', '172.16.0.0/12', '192.0.0.0/24', '192.0.0.0/29', '192.0.0.8/32', '192.0.0.9/32', '192.0.0.10/32', '192.0.0.170/32', '192.0.0.171/32', '192.0.2.0/24', '192.31.196.0/24', '192.52.193.0/24', '192.88.99.0/24', '192.168.0.0/16', '192.175.48.0/24', '198.18.0.0/15', '198.51.100.0/24', '203.0.113.0/24', '240.0.0.0/4', '255.255.255.255/32']
8550
+ for (var i in IPv4PrivateRanges) { if (ipcheck.match(ip_addr, IPv4PrivateRanges[i])) return true; }
8551
+
8552
+ // Check IPv6 private addresses
8553
+ return /^::$/.test(ip_addr) ||
8554
+ /^::1$/.test(ip_addr) ||
8555
+ /^::f{4}:([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/.test(ip_addr) ||
8556
+ /^::f{4}:0.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/.test(ip_addr) ||
8557
+ /^64:ff9b::([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/.test(ip_addr) ||
8558
+ /^100::([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4})$/.test(ip_addr) ||
8559
+ /^2001::([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4})$/.test(ip_addr) ||
8560
+ /^2001:2[0-9a-fA-F]:([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4})$/.test(ip_addr) ||
8561
+ /^2001:db8:([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4})$/.test(ip_addr) ||
8562
+ /^2002:([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4}):?([0-9a-fA-F]{0,4})$/.test(ip_addr) ||
8563
+ /^f[c-d]([0-9a-fA-F]{2,2}):/i.test(ip_addr) ||
8564
+ /^fe[8-9a-bA-B][0-9a-fA-F]:/i.test(ip_addr) ||
8565
+ /^ff([0-9a-fA-F]{2,2}):/i.test(ip_addr)
8566
+ }
8567
+
8568
// Check that a cookie IP is within the correct range depending on the active policy
8569
function checkCookieIp(cookieip, ip) {
8570
if (obj.args.cookieipcheck == 'none') return true; // 'none' - No IP address checking
8571
if (obj.args.cookieipcheck == 'strict') return (cookieip == ip); // 'strict' - Strict IP address checking, this can cause issues with HTTP proxies or load-balancers.
8546
- return require('ipcheck').match(cookieip, ip + '/24'); // 'lax' - IP address need to be in the some range
8572
+ if (require('ipcheck').match(cookieip, ip + '/24')) return true; // 'lax' - IP address need to be in the some range
8573
+ return (isPrivateAddress(cookieip) && isPrivateAddress(ip)); // 'lax' - If both IP addresses are private or loopback, accept it. This is needed because sometimes browsers will resolve IP addresses oddly on private networks.
8574
}
8575
8576
// Takes a formating string like "this {{{a}}} is an {{{b}}} example" and fills the a and b with input o.a and o.b