@cryptotaxi247 / netdata-1 / commits / f21b0501a

added ACL for netdata.conf; #2636

Costa Tsaousis (ktsaou) committed Sep 18, 2017 at 00:41 UTC f21b0501a29a376fed02a52a3f146e5310f71197

3 files changed +6

src/main.c

@@ -87,6 +87,7 @@ void web_server_config_options(void) {

87 web_allow_badges_from = simple_pattern_create(config_get(CONFIG_SECTION_WEB, "allow badges from", "*"), SIMPLE_PATTERN_EXACT);

88 web_allow_registry_from = simple_pattern_create(config_get(CONFIG_SECTION_REGISTRY, "allow from", "*"), SIMPLE_PATTERN_EXACT);

89 web_allow_streaming_from = simple_pattern_create(config_get(CONFIG_SECTION_WEB, "allow streaming from", "*"), SIMPLE_PATTERN_EXACT);

90 + web_allow_netdataconf_from = simple_pattern_create(config_get(CONFIG_SECTION_WEB, "allow netdata.conf from", "::1 fd* 127.* 10.* 192.168.* 172.16.* 172.17.* 172.18.* 172.19.* 172.20.* 172.21.* 172.22.* 172.23.* 172.24.* 172.25.* 172.26.* 172.27.* 172.28.* 172.29.* 172.30.* 172.31.*"), SIMPLE_PATTERN_EXACT);

92 #ifdef NETDATA_WITH_ZLIB

93 web_enable_gzip = config_get_boolean(CONFIG_SECTION_WEB, "enable gzip compression", web_enable_gzip);

src/web_client.c

@@ -12,6 +12,7 @@ SIMPLE_PATTERN *web_allow_connections_from = NULL;

12 SIMPLE_PATTERN *web_allow_registry_from = NULL;

13 SIMPLE_PATTERN *web_allow_badges_from = NULL;

14 SIMPLE_PATTERN *web_allow_streaming_from = NULL;

15 +SIMPLE_PATTERN *web_allow_netdataconf_from = NULL;

17 #ifdef NETDATA_WITH_ZLIB

18 int web_enable_gzip = 1, web_gzip_level = 3, web_gzip_strategy = Z_DEFAULT_STRATEGY;

@@ -1158,6 +1159,9 @@ static inline int web_client_process_url(RRDHOST *host, struct web_client *w, ch

1159 return check_host_and_call(host, w, url, web_client_api_old_all_json);

1160 }

1161 else if(unlikely(hash == hash_netdata_conf && strcmp(tok, "netdata.conf") == 0)) { // netdata.conf

1162 + if(unlikely(web_allow_netdataconf_from && !simple_pattern_matches(web_allow_netdataconf_from, w->client_ip)))

1163 + return web_client_permission_denied(w);

1164 +

1165 debug(D_WEB_CLIENT_ACCESS, "%llu: generating netdata.conf ...", w->id);

1166 w->response.data->contenttype = CT_TEXT_PLAIN;

1167 buffer_flush(w->response.data);

src/web_client.h

@@ -146,6 +146,7 @@ extern SIMPLE_PATTERN *web_allow_connections_from;

146 extern SIMPLE_PATTERN *web_allow_registry_from;

147 extern SIMPLE_PATTERN *web_allow_badges_from;

148 extern SIMPLE_PATTERN *web_allow_streaming_from;

149 +extern SIMPLE_PATTERN *web_allow_netdataconf_from;

150

151 extern uid_t web_files_uid(void);

152 extern uid_t web_files_gid(void);