allow dns names in userallowedip,userblockedip,agentallowedip,agentblockedip #5089
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
Jun 21, 2025 at 20:32 UTC
f2bb94c8ca56e4494e4f7bebf525321f76b23b8b
1 file changed
+32
-1
meshcentral.js
+32
-1
@@ -855,7 +855,7 @@ function CreateMeshCentralServer(config, args) {
855
}
856
857
// Look for easy command line instructions and do them here.
858
- obj.StartEx = function () {
858
+ obj.StartEx = async function () {
859
var i;
860
//var wincmd = require('node-windows');
861
//wincmd.list(function (svc) { console.log(svc); }, true);
@@ -916,6 +916,13 @@ function CreateMeshCentralServer(config, args) {
916
if (typeof obj.args.trustedproxy == 'string') { obj.args.trustedproxy = obj.args.trustedproxy.split(' ').join('').split(','); }
917
if (typeof obj.args.tlsoffload == 'string') { obj.args.tlsoffload = obj.args.tlsoffload.split(' ').join('').split(','); }
918
919
+ // Check IP lists and ranges and if DNS return IP addresses
920
+ config.settings.userallowedip = await resolveDomainsToIps(config.settings.userallowedip);
921
+ config.settings.userblockedip = await resolveDomainsToIps(config.settings.userblockedip);
922
+ config.settings.agentallowedip = await resolveDomainsToIps(config.settings.agentallowedip);
923
+ config.settings.agentblockedip = await resolveDomainsToIps(config.settings.agentblockedip);
924
+ config.settings.swarmallowedip = await resolveDomainsToIps(config.settings.swarmallowedip);
925
+
926
// Check the "cookieIpCheck" value
927
if ((obj.args.cookieipcheck === false) || (obj.args.cookieipcheck == 'none')) { obj.args.cookieipcheck = 'none'; }
928
else if ((typeof obj.args.cookieipcheck != 'string') || (obj.args.cookieipcheck.toLowerCase() != 'strict')) { obj.args.cookieipcheck = 'lax'; }
@@ -1472,6 +1479,11 @@ function CreateMeshCentralServer(config, args) {
1479
if (typeof obj.config.domains[i].userblockedip == 'string') { if (obj.config.domains[i].userblockedip == '') { delete obj.config.domains[i].userblockedip; } else { obj.config.domains[i].userblockedip = obj.config.domains[i].userblockedip.split(' ').join('').split(','); } }
1480
if (typeof obj.config.domains[i].agentallowedip == 'string') { if (obj.config.domains[i].agentallowedip == '') { delete obj.config.domains[i].agentallowedip; } else { obj.config.domains[i].agentallowedip = obj.config.domains[i].agentallowedip.split(' ').join('').split(','); } }
1481
if (typeof obj.config.domains[i].agentblockedip == 'string') { if (obj.config.domains[i].agentblockedip == '') { delete obj.config.domains[i].agentblockedip; } else { obj.config.domains[i].agentblockedip = obj.config.domains[i].agentblockedip.split(' ').join('').split(','); } }
1482
+ // Check IP lists and ranges and if DNS return IP addresses
1483
+ obj.config.domains[i].userallowedip = await resolveDomainsToIps(obj.config.domains[i].userallowedip);
1484
+ obj.config.domains[i].userblockedip = await resolveDomainsToIps(obj.config.domains[i].userblockedip);
1485
+ obj.config.domains[i].agentallowedip = await resolveDomainsToIps(obj.config.domains[i].agentallowedip);
1486
+ obj.config.domains[i].agentblockedip = await resolveDomainsToIps(obj.config.domains[i].agentblockedip);
1487
if (typeof obj.config.domains[i].ignoreagenthashcheck == 'string') { if (obj.config.domains[i].ignoreagenthashcheck == '') { delete obj.config.domains[i].ignoreagenthashcheck; } else { obj.config.domains[i].ignoreagenthashcheck = obj.config.domains[i].ignoreagenthashcheck.split(','); } }
1488
if (typeof obj.config.domains[i].allowedorigin == 'string') { if (obj.config.domains[i].allowedorigin == '') { delete obj.config.domains[i].allowedorigin; } else { obj.config.domains[i].allowedorigin = obj.config.domains[i].allowedorigin.split(','); } }
1489
if ((obj.config.domains[i].passwordrequirements != null) && (typeof obj.config.domains[i].passwordrequirements == 'object')) {
@@ -4033,6 +4045,25 @@ function checkResolveAll(names, func) {
4045
}
4046
}
4047
4048
+// Resolve a list of domains to IP addresses, return a flat array of IPs.
4049
+async function resolveDomainsToIps(originalArray) {
4050
+ if (!Array.isArray(originalArray)) { return undefined; }
4051
+ const flatResult = [];
4052
+ for (const item of originalArray) {
4053
+ if (new require('ipcheck')(item).valid) {
4054
+ flatResult.push(item);
4055
+ continue;
4056
+ }
4057
+ try {
4058
+ const results = await require('dns').promises.lookup(item, { all: true });
4059
+ flatResult.push(...results.map(r => r.address));
4060
+ } catch (err) {
4061
+ console.log(`Could not resolve ${item}`);
4062
+ }
4063
+ }
4064
+ return flatResult;
4065
+}
4066
+
4067
// Return the server configuration
4068
function getConfig(createSampleConfig) {
4069
// Figure out the datapath location