RE: IP Filtering Patch

"Metzger, Michael" <[email protected]> Wed, 19 Feb 2003 22:13:15 -0600
Newsgroups gmane.music.equipment.slimp3.dev
Message-ID <[email protected]> 
------_=_NextPart_000_01C2D896.63C93560
Content-Type: multipart/alternative;
 boundary="----_=_NextPart_001_01C2D896.63C93560"

------_=_NextPart_001_01C2D896.63C93560
Content-Type: text/plain;
	charset="iso-8859-1"

Ok, sorry about that.  I was working off the base release sources as I
didn't have CVS installed previously.  This is a diff direct off cvs from
tonight.  It seems to work nicely with the HTTP Authentication patch for a
fair level of security.  
 
Let me know if there are any problems.
 
Thanks!
 
Mike
 
 

-----Original Message-----
From: dean blackketter [mailto:[email protected]]
Sent: Wednesday, February 19, 2003 8:26 PM
To: [email protected]
Subject: Re: [slimp3-dev] IP Filtering Patch



Hi Mike, 


It looks like the patch conflicts with the password protection patch that
was just applied this morning. 


Could you update and fix and resubmit the patch? 


-dean 



On Wednesday, February 19, 2003, at 04:47 PM, Metzger, Michael wrote: 


Well, after a bit of hacking, I've added basic IP filtering options to the
server code.  This will allow you to specify IP addresses, wildcard
addresses, and ranges to connect to the HTTP and/or CLI interfaces.  This
check occurs immediately after connection by the client to either server.
After obtaining the IP, the server will validate the IP against the ruleset
(if filtering is enabled) and either allow the connection to continue or
immediately kill it. 



Some further info taken from the field descriptions: 



For example: 

10.1.2.2 will allow only 10.1.2.2 to connect 

10.1.2.* will allow anything with an IP in the 10.1.2.x addresses. 

For ranges, you can do something like 10.1.2.2-50 which will allow 10.1.2.2
- 10.1.2.50 to connect. 

Finally, these can be combined like 10.1.2.2,172.16.1.*,192.168.1-255.* 

NOTE: 127.0.0.1 is always added to the list to allow the local server to
connect. 



Thanks 



Mike Metzger 






<image.tiff> 



To unsubscribe from this group, send an email to: 

[email protected] 




Your use of Yahoo! Groups is subject to the Yahoo! Terms of
Service.<ipfiltering.patch>


------_=_NextPart_001_01C2D896.63C93560
Content-Type: text/html; charset=US-ASCII
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE></TITLE>

<META content="MSHTML 6.00.2800.1141" name=GENERATOR></HEAD>
<BODY>


<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff size=2>Ok, 
sorry about that.&nbsp; I was working off the base release sources as I didn't 
have CVS installed previously.&nbsp; This is a diff direct off cvs from 
tonight.&nbsp; It seems to work nicely with the HTTP Authentication patch for a 
fair level of security.&nbsp; </FONT></SPAN></DIV>
<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff size=2>Let me 
know if there are any problems.</FONT></SPAN></DIV>
<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff 
size=2>Thanks!</FONT></SPAN></DIV>
<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff 
size=2>Mike</FONT></SPAN></DIV>
<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=226411004-20022003><FONT face=Arial color=#0000ff 
size=2></FONT></SPAN>&nbsp;</DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
  <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma 
  size=2>-----Original Message-----<BR><B>From:</B> dean blackketter 
  [mailto:[email protected]]<BR><B>Sent:</B> Wednesday, February 19, 2003 
  8:26 PM<BR><B>To:</B> [email protected]<BR><B>Subject:</B> Re: 
  [slimp3-dev] IP Filtering Patch<BR><BR></FONT></DIV>
  <P>Hi Mike, </P><BR>
  <P>It looks like the patch conflicts with the password protection patch that 
  was just applied this morning. </P><BR>
  <P>Could you update and fix and resubmit the patch? </P><BR>
  <P>-dean </P><BR><BR>
  <P>On Wednesday, February 19, 2003, at 04:47 PM, Metzger, Michael wrote: 
  </P><BR>
  <P><FONT face=Arial>Well, after&nbsp;a bit of&nbsp;hacking, I've added basic 
  IP filtering options to the server code.&nbsp; This will allow you to specify 
  IP addresses, wildcard addresses, and ranges to connect to the HTTP and/or CLI 
  interfaces.&nbsp; This check occurs immediately after connection by the client 
  to either server.&nbsp; After obtaining the IP, the server will validate the 
  IP against the ruleset (if filtering is enabled) and either allow the 
  connection to continue or immediately kill it.</FONT> </P>
  <P> </P>
  <P><FONT face=Arial>Some further info taken from the field 
  descriptions:</FONT> </P>
  <P> </P>
  <P>For example: </P>
  <P>10.1.2.2 will allow only 10.1.2.2 to connect </P>
  <P>10.1.2.* will allow anything with an IP in the 10.1.2.x addresses. </P>
  <P>For ranges, you can do something like 10.1.2.2-50 which will allow 10.1.2.2 
  - 10.1.2.50 to connect. </P>
  <P>Finally, these can be combined like 10.1.2.2,172.16.1.*,192.168.1-255.* 
</P>
  <P>NOTE: 127.0.0.1 is always added to the list to allow the local server to 
  connect. </P>
  <P> </P>
  <P><FONT face=Arial>Thanks</FONT> </P>
  <P> </P>
  <P><FONT face=Arial>Mike Metzger</FONT> </P>
  <P> </P>
  <P> </P><BR>
  <P>&lt;image.tiff&gt; </P><BR><BR>
  <P>To unsubscribe from this group, send an email to: </P>
  <P>[email protected] </P><BR><BR><BR>
  <P>Your use of Yahoo! Groups is subject to the<U> <FONT color=#1919ff>Yahoo! 
  Terms of 
Service</FONT></U><U></U>.&lt;ipfiltering.patch&gt;</P></BLOCKQUOTE>
<br>

<!-- |**|begin egp html banner|**| -->

<table border=0 cellspacing=0 cellpadding=2>
<tr bgcolor=#FFFFCC>
<td align=center><font size="-1" color=#003399><b>Yahoo! Groups Sponsor</b></font></td>
</tr>
<tr bgcolor=#FFFFFF>
<td align=center width=470><table border=0 cellpadding=0 cellspacing=0> <tr> <td align=center><font face=arial size=-2>ADVERTISEMENT</font><br><a href="http://rd.yahoo.com/M=245454.2994396.4323964.2848452/D=egroupweb/S=1708298795:HM/A=1457554/R=0/*http://ipunda.com/clk/beibunmaisuiyuiwabei"><img src="http://us.a1.yimg.com/us.yimg.com/a/qu/quinstreet/uofpoff_300_250_0001.gif" alt="" width="300" height="250" border="0"></a></td></tr></table></td>
</tr>
<tr><td><img alt="" width=1 height=1 src="http://us.adserver.yahoo.com/l?M=245454.2994396.4323964.2848452/D=egroupmail/S=:HM/A=1457554/rand=466937816"></td></tr>
</table>

<!-- |**|end egp html banner|**| -->


<br>
<tt>
To unsubscribe from this group, send an email to:<BR>
[email protected]<BR>
<BR>
</tt>
<br>

<br>
<tt>Your use of Yahoo! Groups is subject to the <a href="http://docs.yahoo.com/info/terms/">Yahoo! Terms of Service</a>.</tt>
</br>

</BODY></HTML>

------_=_NextPart_001_01C2D896.63C93560--

------_=_NextPart_000_01C2D896.63C93560
Content-Type: application/octet-stream;
	name="ipfilter-021903.diff"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
	filename="ipfilter-021903.diff"

? ipfilter.diff
Index: strings.txt
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/slimp3/slimp3/server/strings.txt,v
retrieving revision 1.156
diff -u -p -B -r1.156 strings.txt
--- strings.txt	19 Feb 2003 19:31:05 -0000	1.156
+++ strings.txt	20 Feb 2003 04:06:46 -0000
@@ -1887,6 +1887,24 @@ SETUP_TITLEFORMATWEB
 	RU	=F4=C5=CB=D5=DD=C9=CA =C6=CF=D2=CD=C1=D4 =
=DA=C1=C7=CF=CC=CF=D7=CB=C1 web
 	SE	Aktuellt titelformat f=F6r webb
=20
+SETUP_IPFILTER_HEAD
+	EN	IP Filtering
+
+SETUP_IPFILTER_DESC
+	EN	This option allows you to filter CLI and HTTP requests by source =
IP address.
+
+SETUP_IPFILTER
+	EN	Enable Filtering
+
+SETUP_NO_IPFILTER
+	EN	Disable Filtering
+=09
+SETUP_FILTERRULE_HEAD
+	EN	IP Filter Rules
+=09
+SETUP_FILTERRULE_DESC
+	EN	This field accepts specific IP addresses, * style wildcards, and =
ranges in a comma seperated list.<BR>For example:<BR>10.1.2.2 will =
allow only 10.1.2.2 to connect<BR>10.1.2.* will allow anything with an =
IP in the 10.1.2.x addresses.<BR>For ranges, you can do something like =
10.1.2.2-50 which will allow 10.1.2.2 - 10.1.2.50 to =
connect.<BR>Finally, these can be combined like =
10.1.2.2,172.16.1.*,192.168.1-255.*<BR>NOTE: 127.0.0.1 is always added =
to the list to allow the local server to connect.
+
 #miscellaneous setup strings
 SETUP_NEW_VALUE
 	DE	Neuer Wert f=FCr
Index: lib/SliMP3/CLI.pm
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/slimp3/slimp3/server/lib/SliMP3/CLI.pm,v
retrieving revision 1.7
diff -u -p -B -r1.7 CLI.pm
--- lib/SliMP3/CLI.pm	19 Feb 2003 05:17:30 -0000	1.7
+++ lib/SliMP3/CLI.pm	20 Feb 2003 04:06:48 -0000
@@ -159,12 +159,21 @@ sub connectedSocket {
 sub acceptSocket {
 	my $clientsock =3D $server_socket->accept();
 	if ($clientsock) {
-		$selRead->add($clientsock);
-		$main::selRead->add($clientsock);
-		$connected++;
-		$listen{$clientsock} =3D 0;
-		$::d_cli && msg("Accepted connection $connected from ". =
inet_ntoa($clientsock->peeraddr) . "\n");
-
+		my $tmpaddr =3D inet_ntoa($clientsock->peeraddr);
+		if (
+		    !(SliMP3::Prefs::get('filterHosts')) ||=20
+		    (SliMP3::Misc::isAllowedHost($tmpaddr))
+		   )
+		{
+			$selRead->add($clientsock);
+			$main::selRead->add($clientsock);
+			$connected++;
+			$listen{$clientsock} =3D 0;
+			$::d_cli && msg("Accepted connection $connected from ". $tmpaddr . =
"\n");
+		} else {
+			$::d_cli && msg("Did not accept CLI connection from ". $tmpaddr . =
", unauthorized source\n");
+			$clientsock->close();
+		}
 	} else {
 		$::d_cli && msg("Did not accept connection\n");
 	}
Index: lib/SliMP3/HTTP.pm
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/slimp3/slimp3/server/lib/SliMP3/HTTP.pm,v
retrieving revision 1.225
diff -u -p -B -r1.225 HTTP.pm
--- lib/SliMP3/HTTP.pm	19 Feb 2003 19:31:17 -0000	1.225
+++ lib/SliMP3/HTTP.pm	20 Feb 2003 04:06:50 -0000
@@ -231,16 +231,25 @@ sub acceptHTTP {
 	my $httpclientsock =3D $http_server_socket->accept();
 	if ($httpclientsock) {
 		if ($httpclientsock->peeraddr) {
-			$peeraddr{$httpclientsock} =3D =
inet_ntoa($httpclientsock->peeraddr);
-			$httpSelRead->add($httpclientsock);
-			$main::selRead->add($httpclientsock);
-			$connected++;
+			my $tmpaddr =3D inet_ntoa($httpclientsock->peeraddr);
+			# Check if source address is valid
+			if (
+			    !(SliMP3::Prefs::get('filterHosts')) ||=20
+			    (SliMP3::Misc::isAllowedHost($tmpaddr))
+			   )
+			{
+				$peeraddr{$httpclientsock} =3D $tmpaddr;
+				$httpSelRead->add($httpclientsock);
+				$main::selRead->add($httpclientsock);
+				$connected++;
+				$::d_http && msg("Accepted connection $connected from ". =
$peeraddr{$httpclientsock} . "\n");
+			} else {
+				$::d_http && msg("Did not accept HTTP connection from ". $tmpaddr =
. ", unauthorized source\n");
+				$httpclientsock->close();
+			}
 		} else {
 			$::d_http && msg("Did not accept connection, couldn't get peer =
addr\n");
 		}
-	=09
-		$::d_http && msg("Accepted connection $connected from ". =
$peeraddr{$httpclientsock} . "\n");
-
 	} else {
 		$::d_http && msg("Did not accept connection, accept returned =
nothing\n");
 	}
Index: lib/SliMP3/Misc.pm
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/slimp3/slimp3/server/lib/SliMP3/Misc.pm,v
retrieving revision 1.141
diff -u -p -B -r1.141 Misc.pm
--- lib/SliMP3/Misc.pm	17 Feb 2003 22:33:30 -0000	1.141
+++ lib/SliMP3/Misc.pm	20 Feb 2003 04:06:51 -0000
@@ -488,6 +488,52 @@ sub delimitThousands {
 	0 while $len =3D~ s/^(-?\d+)(\d{3})/$1$sep$2/;
 	return $len;
 }
+
+# Check for allowed source IPs, called via CLI.pm and HTTP.pm
+sub isAllowedHost {
+	my $host =3D shift;
+	my @rules =3D split /\,/, SliMP3::Prefs::get('allowedHosts');
+	foreach my $item (@rules)
+	{
+		if ($item eq $host)
+		{
+		#If the host matches a specific IP, return valid
+			return 1;
+		} else {
+			my @matched =3D (0,0,0,0);
+		=09
+			#Get each octet
+			my @allowedoctets =3D split /\./, $item;
+			my @hostoctets =3D split /\./, $host;
+			for (my $i =3D 0; $i < 4; ++$i)
+			{
+				$allowedoctets[$i] =3D~ s/\s+//g;
+				#if the octet is * or a specific match, pass octet match
+				if (($allowedoctets[$i] eq "*") || ($allowedoctets[$i] eq =
$hostoctets[$i]))
+			   	{
+					$matched[$i] =3D 1;
+				} elsif ($allowedoctets[$i] =3D~ /-/) {	#Look for a range =
formatted octet rule
+					my ($low, $high) =3D split /-/,$allowedoctets[$i];
+					if (($hostoctets[$i] >=3D $low) && ($hostoctets[$i] <=3D $high))
+					{
+						#if it matches the range, pass octet match
+						$matched[$i] =3D 1;
+					}
+				}=20
+			}
+			#check if all octets passed
+			if (($matched[0] eq '1') && ($matched[1] eq '1') &&
+			    ($matched[2] eq '1') && ($matched[3] eq '1'))
+			{
+				return 1;
+			}
+		}
+	}
+=09
+	# No rules matched, return invalid source
+	return 0;
+}
+
 1;
 __END__
 =0C
Index: lib/SliMP3/Prefs.pm
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/slimp3/slimp3/server/lib/SliMP3/Prefs.pm,v
retrieving revision 1.93
diff -u -p -B -r1.93 Prefs.pm
--- lib/SliMP3/Prefs.pm	19 Feb 2003 19:31:20 -0000	1.93
+++ lib/SliMP3/Prefs.pm	20 Feb 2003 04:06:52 -0000
@@ -41,6 +41,8 @@ my %DEFAULT =3D (
 	,"authorize"			=3D> 0				# No authorization by default
 	,"username"				=3D> ''
 	,"password"				=3D> ''
+	,"filterHosts"			=3D> 0				# use 0 for false, 1 for true
+	,"allowedHosts"			=3D> "127.0.0.1"
 	,"tcpReadMax"			=3D> 2
 	,"tcpWriteMax"			=3D> 2
 	,"tcpConnectMax"		=3D> 3
Index: lib/SliMP3/Setup.pm
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/slimp3/slimp3/server/lib/SliMP3/Setup.pm,v
retrieving revision 1.82
diff -u -p -B -r1.82 Setup.pm
--- lib/SliMP3/Setup.pm	19 Feb 2003 19:31:25 -0000	1.82
+++ lib/SliMP3/Setup.pm	20 Feb 2003 04:06:57 -0000
@@ -939,7 +939,7 @@ sub initSetupConfig {
 		,'GroupOrder' =3D> ['Default']
 		,'Groups' =3D> {
 			'Default' =3D> {
-					'PrefOrder' =3D> ['authorize','username','password']
+					'PrefOrder' =3D> =
['authorize','username','password','filterHosts', 'allowedHosts']
 				}
 			}
 		,'Prefs' =3D> {
@@ -960,6 +960,23 @@ sub initSetupConfig {
=20
 						,'PrefSize' =3D> 'large'
 					}
+			,'filterHosts' =3D> {
+					=09
+						'validate' =3D> \&validateTrueFalse
+						,'PrefHead' =3D> string('SETUP_IPFILTER_HEAD')
+						,'PrefDesc' =3D> string('SETUP_IPFILTER_DESC')
+						,'options' =3D> {
+								'0' =3D> string('SETUP_NO_IPFILTER')
+								,'1' =3D> string('SETUP_IPFILTER')
+							}
+					}
+			,'allowedHosts' =3D> {
+						'validate' =3D> \&validateAllowedHosts
+						,'PrefHead' =3D> string('SETUP_FILTERRULE_HEAD')
+						,'PrefDesc' =3D> string('SETUP_FILTERRULE_DESC')
+						,'PrefSize' =3D> 'large'
+					}
+
 			}
 		} #end of setup{'security'} hash
 	,'performance' =3D> {
@@ -2011,6 +2028,21 @@ sub validateFormat {
 		return $val;
 	}
 }
+
+#Verify allowed hosts is in somewhat proper format, always prepend =
127.0.0.1 if not there
+sub validateAllowedHosts {
+	my $val =3D shift;
+	$val =3D~ s/\s+//g;
+	if (!defined($val)) {
+		return undef;
+	} elsif ($val eq '') {
+		return "127.0.0.1";
+	} elsif ($val !~ /127\.0\.0\.1/) {
+		$val =3D "127.0.0.1," . $val;
+ 	} else {
+ 		return $val;
+ 	}
+ }
=20
 1;
=20

------_=_NextPart_000_01C2D896.63C93560--