IP Filtering Patch
"Metzger, Michael" <[email protected]> Wed, 19 Feb 2003 18:47:58 -0600
| Newsgroups | gmane.music.equipment.slimp3.dev |
|---|---|
| Message-ID | <[email protected]> |
------_=_NextPart_000_01C2D879.B6C1C5B0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C2D879.B6C1C5B0" ------_=_NextPart_001_01C2D879.B6C1C5B0 Content-Type: text/plain; charset="iso-8859-1" Well, after a bit of hacking, I've added basic IP filtering options to the server code. This will allow you to specify IP addresses, wildcard addresses, and ranges to connect to the HTTP and/or CLI interfaces. This check occurs immediately after connection by the client to either server. After obtaining the IP, the server will validate the IP against the ruleset (if filtering is enabled) and either allow the connection to continue or immediately kill it. Some further info taken from the field descriptions: For example: 10.1.2.2 will allow only 10.1.2.2 to connect 10.1.2.* will allow anything with an IP in the 10.1.2.x addresses. For ranges, you can do something like 10.1.2.2-50 which will allow 10.1.2.2 - 10.1.2.50 to connect. Finally, these can be combined like 10.1.2.2,172.16.1.*,192.168.1-255.* NOTE: 127.0.0.1 is always added to the list to allow the local server to connect. Thanks Mike Metzger ------_=_NextPart_001_01C2D879.B6C1C5B0 Content-Type: text/html; charset=US-ASCII Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META content="MSHTML 6.00.2800.1141" name=GENERATOR></HEAD> <BODY> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2>Well, after a bit of hacking, I've added basic IP filtering options to the server code. This will allow you to specify IP addresses, wildcard addresses, and ranges to connect to the HTTP and/or CLI interfaces. This check occurs immediately after connection by the client to either server. After obtaining the IP, the server will validate the IP against the ruleset (if filtering is enabled) and either allow the connection to continue or immediately kill it.</FONT></SPAN></DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2></FONT></SPAN> </DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2>Some further info taken from the field descriptions:</FONT></SPAN></DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2></FONT></SPAN> </DIV> <DIV><SPAN class=641523200-20022003>For example:<BR>10.1.2.2 will allow only 10.1.2.2 to connect<BR>10.1.2.* will allow anything with an IP in the 10.1.2.x addresses.<BR>For ranges, you can do something like 10.1.2.2-50 which will allow 10.1.2.2 - 10.1.2.50 to connect.<BR>Finally, these can be combined like 10.1.2.2,172.16.1.*,192.168.1-255.*<BR>NOTE: 127.0.0.1 is always added to the list to allow the local server to connect.</SPAN></DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2></FONT></SPAN> </DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2>Thanks</FONT></SPAN></DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2></FONT></SPAN> </DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2>Mike Metzger</FONT></SPAN></DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2></FONT></SPAN> </DIV> <DIV><SPAN class=641523200-20022003><FONT face=Arial size=2></FONT></SPAN> </DIV> <br> <!-- |**|begin egp html banner|**| --> <table border=0 cellspacing=0 cellpadding=2> <tr bgcolor=#FFFFCC> <td align=center><font size="-1" color=#003399><b>Yahoo! Groups Sponsor</b></font></td> </tr> <tr bgcolor=#FFFFFF> <td align=center width=470><table border=0 cellpadding=0 cellspacing=0> <tr> <td align=center><font face=arial size=-2>ADVERTISEMENT</font><br><a href="http://rd.yahoo.com/M=245454.2895241.4313951.2848452/D=egroupweb/S=1708298795:HM/A=1457554/R=0/*http://ipunda.com/clk/beibunmaisuiyuiwabei"><img src="http://us.a1.yimg.com/us.yimg.com/a/qu/quinstreet/uofpoff_300_250_0001.gif" alt="" width="300" height="250" border="0"></a></td></tr></table></td> </tr> <tr><td><img alt="" width=1 height=1 src="http://us.adserver.yahoo.com/l?M=245454.2895241.4313951.2848452/D=egroupmail/S=:HM/A=1457554/rand=433643835"></td></tr> </table> <!-- |**|end egp html banner|**| --> <br> <tt> To unsubscribe from this group, send an email to:<BR> [email protected]<BR> <BR> </tt> <br> <br> <tt>Your use of Yahoo! Groups is subject to the <a href="http://docs.yahoo.com/info/terms/">Yahoo! Terms of Service</a>.</tt> </br> </BODY></HTML> ------_=_NextPart_001_01C2D879.B6C1C5B0-- ------_=_NextPart_000_01C2D879.B6C1C5B0 Content-Type: application/octet-stream; name="ipfiltering.patch" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="ipfiltering.patch" --- SLIMP3.PRF Thu Jan 1 00:00:00 1970 +++ SLIMP3.PRF Wed Feb 19 18:13:40 2003 @@ -0,0 +1,53 @@ +allowedHosts =3D 127.0.0.1 +animationLevel =3D 3 +artistinalbumsearch =3D 0 +cliport =3D 9090 +disabledplugins# =3D -1 +displaytexttimeout =3D 2 +filesort =3D 0 +filterHosts =3D 0 +httpport =3D 9000 +ignoreDirRE =3D=20 +ignoredarticles =3D The El La Los Las Le Les +itemsPerPage =3D 100 +itunes =3D 0 +language =3D EN +longdateFormat =3D %A, %B |%d, %Y +menuItem# =3D 7 +menuItem0 =3D NOW_PLAYING +menuItem1 =3D BROWSE_BY_GENRE +menuItem2 =3D BROWSE_BY_ARTIST +menuItem3 =3D BROWSE_BY_ALBUM +menuItem4 =3D BROWSE_MUSIC_FOLDER +menuItem5 =3D SEARCH +menuItem6 =3D SAVED_PLAYLISTS +menuItem7 =3D SETTINGS +mp3dir =3D=20 +playlistdir =3D C:/SLIMP3_Server_v3.1b2/Playlists +playtrackalbum =3D 1 +screensaverjump =3D 1 +screensavertimeout =3D 30 +shortdateFormat =3D %m/%d/%Y +skin =3D Moser +streamWriteMax =3D 30 +tcpChunkSize =3D 4096 +tcpConnectMax =3D 3 +tcpReadMax =3D 2 +tcpWriteMax =3D 2 +templatecache =3D 1 +timeFormat =3D |%I:%M:%S %p +titleFormat# =3D 8 +titleFormat0 =3D TITLE +titleFormat1 =3D TRACKNUM. TITLE +titleFormat2 =3D TRACKNUM. ARTIST - TITLE +titleFormat3 =3D TRACKNUM. TITLE (ARTIST) +titleFormat4 =3D TRACKNUM. TITLE - ARTIST - ALBUM +titleFormat5 =3D FILE.EXT +titleFormat6 =3D TRACKNUM. TITLE from ALBUM by ARTIST +titleFormat7 =3D TITLE (ARTIST) +titleFormat8 =3D ARTIST - TITLE +titleFormatWeb =3D 1 +udpChunkSize =3D 1400 +useinfocache =3D 1 +useplaylistcache =3D 1 +usetagdatabase =3D 0 --- lib/SliMP3/CLI.pm Sat Feb 15 07:20:18 2003 +++ lib/SliMP3/CLI.pm Wed Feb 19 16:25:58 2003 @@ -136,14 +136,24 @@ } =20 sub acceptSocket { my $clientsock =3D $server_socket->accept(); if ($clientsock) { + my $tmpaddr =3D inet_ntoa($clientsock->peeraddr); + if ( + !(SliMP3::Prefs::get('filterHosts')) ||=20 + (SliMP3::Misc::isAllowedHost($tmpaddr)) + ) + { $selRead->add($clientsock); $main::selRead->add($clientsock); $connected++; - $::d_cli && msg("Accepted connection $connected from ". = inet_ntoa($clientsock->peeraddr) . "\n"); + $::d_cli && msg("Accepted connection $connected from ". $tmpaddr . = "\n"); + } else { + $::d_cli && msg("Did not accept CLI connection from ". $tmpaddr . = ", unauthorized source\n"); + $clientsock->close(); + } =20 } else { $::d_cli && msg("Did not accept connection\n"); } } --- lib/SliMP3/HTTP.pm Sat Feb 15 07:20:18 2003 +++ lib/SliMP3/HTTP.pm Wed Feb 19 16:26:00 2003 @@ -228,20 +228,30 @@ =20 sub acceptHTTP { my $httpclientsock =3D $http_server_socket->accept(); if ($httpclientsock) { if ($httpclientsock->peeraddr) { - $peeraddr{$httpclientsock} =3D = inet_ntoa($httpclientsock->peeraddr); + my $tmpaddr =3D inet_ntoa($httpclientsock->peeraddr); + # Check if source address is valid + if ( + !(SliMP3::Prefs::get('filterHosts')) ||=20 + (SliMP3::Misc::isAllowedHost($tmpaddr)) + ) + { + $peeraddr{$httpclientsock} =3D $tmpaddr; $httpSelRead->add($httpclientsock); $main::selRead->add($httpclientsock); $connected++; + $::d_http && msg("Accepted connection $connected from ". = $peeraddr{$httpclientsock} . "\n"); + } else { + $::d_http && msg("Did not accept HTTP connection from ". $tmpaddr = . ", unauthorized source\n"); + $httpclientsock->close(); + } } else { $::d_http && msg("Did not accept connection, couldn't get peer = addr\n"); } =09 - $::d_http && msg("Accepted connection $connected from ". = $peeraddr{$httpclientsock} . "\n"); - } else { $::d_http && msg("Did not accept connection, accept returned = nothing\n"); } } =20 --- lib/SliMP3/Misc.pm Sat Feb 15 07:20:18 2003 +++ lib/SliMP3/Misc.pm Wed Feb 19 18:11:40 2003 @@ -488,10 +488,55 @@ my $len =3D shift;=20 my $sep =3D SliMP3::Strings::string('THOUSANDS_SEP'); 0 while $len =3D~ s/^(-?\d+)(\d{3})/$1$sep$2/; return $len; } + +# Check for allowed source IPs, called via CLI.pm and HTTP.pm +sub isAllowedHost { + my $host =3D shift; + my @rules =3D split /\,/, SliMP3::Prefs::get('allowedHosts'); + foreach my $item (@rules) + { + if ($item eq $host) + { + #If the host matches a specific IP, return valid + return 1; + } else { + my @matched =3D (0,0,0,0); + =09 + #Get each octet + my @allowedoctets =3D split /\./, $item; + my @hostoctets =3D split /\./, $host; + for (my $i =3D 0; $i < 4; ++$i) + { + $allowedoctets[$i] =3D~ s/\s+//g; + #if the octet is * or a specific match, pass octet match + if (($allowedoctets[$i] eq "*") || ($allowedoctets[$i] eq = $hostoctets[$i])) + { + $matched[$i] =3D 1; + } elsif ($allowedoctets[$i] =3D~ /-/) { #Look for a range = formatted octet rule + my ($low, $high) =3D split /-/,$allowedoctets[$i]; + if (($hostoctets[$i] >=3D $low) && ($hostoctets[$i] <=3D $high)) + { + #if it matches the range, pass octet match + $matched[$i] =3D 1; + } + }=20 + } + #check if all octets passed + if (($matched[0] eq '1') && ($matched[1] eq '1') && + ($matched[2] eq '1') && ($matched[3] eq '1')) + { + return 1; + } + } + } +=09 + # No rules matched, return invalid source + return 0; +} 1; __END__ =0C # Local Variables: # tab-width:4 --- lib/SliMP3/Prefs.pm Sat Feb 15 07:20:18 2003 +++ lib/SliMP3/Prefs.pm Wed Feb 19 18:26:16 2003 @@ -42,10 +42,12 @@ ,"tcpWriteMax" =3D> 2 ,"tcpConnectMax" =3D> 3 ,"streamWriteMax" =3D> 30 ,"tcpChunkSize" =3D> 4096 ,"udpChunkSize" =3D> 1400 + ,"filterHosts" =3D> 0 # use 0 for false, 1 for true + ,"allowedHosts" =3D> "127.0.0.1" ,"usetagdatabase" =3D> 0 # use 0 for false, 1 for true ,"templatecache" =3D> 1 # use 0 for false, 1 for true ,"useplaylistcache" =3D> 1 # use 0 for false, 1 for true ,"useinfocache" =3D> 1 # Perhaps should be 0 for unix? ,'animationLevel' =3D> 3 --- lib/SliMP3/Setup.pm Sat Feb 15 07:20:18 2003 +++ lib/SliMP3/Setup.pm Wed Feb 19 18:12:46 2003 @@ -309,11 +309,11 @@ } } } # end of setup{'playerir'} hash =09 ,'server' =3D> { - 'children' =3D> = ['interface','behavior','formatting','performance','network','debug'] + 'children' =3D> = ['interface','behavior','formatting','security','performance','network',= 'debug'] ,'title' =3D> string('SERVER_SETTINGS') ,'singleChildLinkText' =3D> string('ADDITIONAL_SERVER_SETTINGS') ,'preEval' =3D> sub { my ($client,$paramref,$pageref) =3D @_; if (SliMP3::iTunes::canUseiTunesLibrary()) { @@ -837,10 +837,38 @@ ,q(|%Hh%M) =3D> "h'h'mm (24h 03h00 15h00)" } } } } #end of setup{'formatting'} hash + ,'security' =3D> { + 'title' =3D> string('SECURITY_SETTINGS') + ,'parent' =3D> 'server' + ,'GroupOrder' =3D> ['Default'] + ,'Groups' =3D> { + 'Default' =3D> { + 'PrefOrder' =3D> ['filterHosts', 'allowedHosts'], + } + } + ,'Prefs' =3D> { + 'filterHosts' =3D> { + =09 + 'validate' =3D> \&validateTrueFalse + ,'PrefHead' =3D> string('SETUP_IPFILTER_HEAD') + ,'PrefDesc' =3D> string('SETUP_IPFILTER_DESC') + ,'options' =3D> { + '0' =3D> string('SETUP_NO_IPFILTER') + ,'1' =3D> string('SETUP_IPFILTER') + } + } + ,'allowedHosts' =3D> { + 'validate' =3D> \&validateAllowedHosts + ,'PrefHead' =3D> string('SETUP_FILTERRULE_HEAD') + ,'PrefDesc' =3D> string('SETUP_FILTERRULE_DESC') + ,'PrefSize' =3D> 'large' + } + } + } #end of setup{'security'} hash ,'performance' =3D> { 'title' =3D> string('PERFORMANCE_SETTINGS') ,'parent' =3D> 'server' ,'GroupOrder' =3D> ['Default'] ,'Groups' =3D> { @@ -1850,10 +1878,25 @@ my $val =3D shift; if (!defined($val)) { return undef; } elsif ($val eq '') { return $val; + } else { + return $val; + } +} + +#Verify allowed hosts is in somewhat proper format, always prepend = 127.0.0.1 if not there +sub validateAllowedHosts { + my $val =3D shift; + $val =3D~ s/\s+//g; + if (!defined($val)) { + return undef; + } elsif ($val eq '') { + return "127.0.0.1"; + } elsif ($val !~ /127\.0\.0\.1/) { + $val =3D "127.0.0.1," . $val; } else { return $val; } } =20 --- strings.txt Sat Feb 15 07:20:18 2003 +++ strings.txt Wed Feb 19 18:10:12 2003 @@ -1973,10 +1973,29 @@ FR Langue NL Taal RU =F1=DA=D9=CB SE Spr=E5k =20 + +=09 +SETUP_IPFILTER_HEAD + EN IP Filtering + +SETUP_IPFILTER_DESC + EN This option allows you to filter CLI and HTTP requests by source = IP address. + +SETUP_IPFILTER + EN Enable Filtering + +SETUP_NO_IPFILTER + EN Disable Filtering +=09 +SETUP_FILTERRULE_HEAD + EN IP Filter Rules +=09 +SETUP_FILTERRULE_DESC + EN This field accepts specific IP addresses, * style wildcards, and = ranges in a comma seperated list.<BR>For example:<BR>10.1.2.2 will = allow only 10.1.2.2 to connect<BR>10.1.2.* will allow anything with an = IP in the 10.1.2.x addresses.<BR>For ranges, you can do something like = 10.1.2.2-50 which will allow 10.1.2.2 - 10.1.2.50 to = connect.<BR>Finally, these can be combined like = 10.1.2.2,172.16.1.*,192.168.1-255.*<BR>NOTE: 127.0.0.1 is always added = to the list to allow the local server to connect. # # Web interface # CURRENT_PLAYER DE Aktueller Player @@ -3043,10 +3062,14 @@ DE Verhalten EN Behavior NL Gedrag SE Beteende =20 +SECURITY_SETTINGS + EN Security + NL Beveiliging +=09 PERFORMANCE_SETTINGS DE Leistung EN Performance NL Performance SE Prestanda ------_=_NextPart_000_01C2D879.B6C1C5B0--