RE: IP Filtering Patch
"Metzger, Michael" <[email protected]> Thu, 20 Feb 2003 08:54:46 -0600
| Newsgroups | gmane.music.equipment.slimp3.dev |
|---|---|
| Message-ID | <[email protected]> |
------_=_NextPart_001_01C2D8F0.02A5B4C0 Content-Type: text/plain; charset="iso-8859-1" I unfortunately don't have any access to OSX. I've noticed on Windows if you type in the machine name or the IP address, it will use the NIC address as the source and block the IP. If you type something like http://localhost:9000/ <http://localhost:9000/> it will use the localhost as the source and it works. The only option I can think of to work around this is grab the source IP from the request and add it in accordingly, but I'm not sure this is what is actually needed, especially if there are multiple NICs in the system. Any ideas? Thanks Mike -----Original Message----- From: dean blackketter [mailto:[email protected]] Sent: Thursday, February 20, 2003 12:57 AM To: [email protected] Subject: Re: [slimp3-dev] IP Filtering Patch I've checked in this patch (with some rewriting of the strings for clarity.) On my OS X machine, incoming connections from the same machine are blocked unless I explicitly put in the IP address for that machine, that is, even if 127.0.0.1 is allowed, I need to add 10.0.1.204 to make it work. I'd love a fix for this. -dean On Wednesday, February 19, 2003, at 08:13 PM, Metzger, Michael wrote: Ok, sorry about that. I was working off the base release sources as I didn't have CVS installed previously. This is a diff direct off cvs from tonight. It seems to work nicely with the HTTP Authentication patch for a fair level of security. Let me know if there are any problems. Thanks! Mike -----Original Message----- From: dean blackketter [mailto:[email protected]] Sent: Wednesday, February 19, 2003 8:26 PM To: [email protected] Subject: Re: [slimp3-dev] IP Filtering Patch Hi Mike, It looks like the patch conflicts with the password protection patch that was just applied this morning. Could you update and fix and resubmit the patch? -dean On Wednesday, February 19, 2003, at 04:47 PM, Metzger, Michael wrote: Well, after a bit of hacking, I've added basic IP filtering options to the server code. This will allow you to specify IP addresses, wildcard addresses, and ranges to connect to the HTTP and/or CLI interfaces. This check occurs immediately after connection by the client to either server. After obtaining the IP, the server will validate the IP against the ruleset (if filtering is enabled) and either allow the connection to continue or immediately kill it. Some further info taken from the field descriptions: For example: 10.1.2.2 will allow only 10.1.2.2 to connect 10.1.2.* will allow anything with an IP in the 10.1.2.x addresses. For ranges, you can do something like 10.1.2.2-50 which will allow 10.1.2.2 - 10.1.2.50 to connect. Finally, these can be combined like 10.1.2.2,172.16.1.*,192.168.1-255.* NOTE: 127.0.0.1 is always added to the list to allow the local server to connect. Thanks Mike Metzger <image.tiff> To unsubscribe from this group, send an email to: [email protected] Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.<ipfiltering.patch> <image.tiff> To unsubscribe from this group, send an email to: [email protected] Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.<ipfilter-021903.diff> ------_=_NextPart_001_01C2D8F0.02A5B4C0 Content-Type: text/html; charset=US-ASCII Content-Transfer-Encoding: 7bit <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <TITLE></TITLE> <META content="MSHTML 6.00.2800.1141" name=GENERATOR></HEAD> <BODY> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2>I unfortunately don't have any access to OSX. I've noticed on Windows if you type in the machine name or the IP address, it will use the NIC address as the source and block the IP. If you type something like <A href="http://localhost:9000/">http://localhost:9000/</A> it will use the localhost as the source and it works.</FONT></SPAN></DIV> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2>The only option I can think of to work around this is grab the source IP from the request and add it in accordingly, but I'm not sure this is what is actually needed, especially if there are multiple NICs in the system. </FONT></SPAN></DIV> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2>Any ideas?</FONT></SPAN></DIV> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2>Thanks</FONT></SPAN></DIV> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV><SPAN class=829364714-20022003><FONT face=Arial color=#0000ff size=2>Mike</FONT></SPAN></DIV> <BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px"> <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> dean blackketter [mailto:[email protected]]<BR><B>Sent:</B> Thursday, February 20, 2003 12:57 AM<BR><B>To:</B> [email protected]<BR><B>Subject:</B> Re: [slimp3-dev] IP Filtering Patch<BR><BR></FONT></DIV> <P>I've checked in this patch (with some rewriting of the strings for clarity.) </P><BR> <P>On my OS X machine, incoming connections from the same machine are blocked unless I explicitly put in the IP address for that machine, that is, even if 127.0.0.1 is allowed, I need to add 10.0.1.204 to make it work. I'd love a fix for this. </P><BR> <P>-dean </P><BR><BR> <P>On Wednesday, February 19, 2003, at 08:13 PM, Metzger, Michael wrote: </P><BR> <P><FONT face=Arial color=#000ff0>Ok, sorry about that. I was working off the base release sources as I didn't have CVS installed previously. This is a diff direct off cvs from tonight. It seems to work nicely with the HTTP Authentication patch for a fair level of security. </FONT> </P> <P> </P> <P><FONT face=Arial color=#000ff0>Let me know if there are any problems.</FONT> </P> <P> </P> <P><FONT face=Arial color=#000ff0>Thanks!</FONT> </P> <P> </P> <P><FONT face=Arial color=#000ff0>Mike</FONT> </P> <P> </P> <P> </P><BR> <P><FONT face=Tahoma>-----Original Message----- </FONT></P> <P><B><FONT face=Tahoma>From:</FONT></B><FONT face=Tahoma> dean blackketter [mailto:[email protected]] </FONT></P> <P><B><FONT face=Tahoma>Sent:</FONT></B><FONT face=Tahoma> Wednesday, February 19, 2003 8:26 PM </FONT></P> <P><B><FONT face=Tahoma>To:</FONT></B><FONT face=Tahoma> [email protected] </FONT></P> <P><B><FONT face=Tahoma>Subject:</FONT></B><FONT face=Tahoma> Re: [slimp3-dev] IP Filtering Patch </FONT></P><BR> <P>Hi Mike, </P><BR><BR> <P>It looks like the patch conflicts with the password protection patch that was just applied this morning. </P><BR><BR> <P>Could you update and fix and resubmit the patch? </P><BR><BR> <P>-dean </P><BR><BR><BR> <P>On Wednesday, February 19, 2003, at 04:47 PM, Metzger, Michael wrote: </P><BR><BR> <P><FONT face=Arial>Well, after a bit of hacking, I've added basic IP filtering options to the server code. This will allow you to specify IP addresses, wildcard addresses, and ranges to connect to the HTTP and/or CLI interfaces. This check occurs immediately after connection by the client to either server. After obtaining the IP, the server will validate the IP against the ruleset (if filtering is enabled) and either allow the connection to continue or immediately kill it.</FONT> </P><BR><BR><BR> <P><FONT face=Arial>Some further info taken from the field descriptions:</FONT> </P><BR><BR><BR> <P>For example: </P><BR> <P>10.1.2.2 will allow only 10.1.2.2 to connect </P><BR> <P>10.1.2.* will allow anything with an IP in the 10.1.2.x addresses. </P><BR> <P>For ranges, you can do something like 10.1.2.2-50 which will allow 10.1.2.2 - 10.1.2.50 to connect. </P><BR> <P>Finally, these can be combined like 10.1.2.2,172.16.1.*,192.168.1-255.* </P><BR> <P>NOTE: 127.0.0.1 is always added to the list to allow the local server to connect. </P><BR><BR><BR> <P><FONT face=Arial>Thanks</FONT> </P><BR><BR><BR> <P><FONT face=Arial>Mike Metzger</FONT> </P><BR><BR><BR><BR><BR><BR> <P><image.tiff> </P><BR><BR><BR> <P>To unsubscribe from this group, send an email to: </P><BR> <P>[email protected] </P><BR><BR><BR><BR> <P>Your use of Yahoo! Groups is subject to the<U> <FONT color=#199ff0>Yahoo! Terms of Service</FONT></U><U></U>.<ipfiltering.patch> </P><BR><BR> <P><image.tiff> </P><BR><BR> <P>To unsubscribe from this group, send an email to: </P> <P>[email protected] </P><BR><BR><BR> <P>Your use of Yahoo! Groups is subject to the<U> <FONT color=#199ff0>Yahoo! Terms of Service</FONT></U><U></U>.<ipfilter-021903.diff></P></BLOCKQUOTE> <br> <!-- |**|begin egp html banner|**| --> <table border=0 cellspacing=0 cellpadding=2> <tr bgcolor=#FFFFCC> <td align=center><font size="-1" color=#003399><b>Yahoo! Groups Sponsor</b></font></td> </tr> <tr bgcolor=#FFFFFF> <td align=center width=470><table border=0 cellpadding=0 cellspacing=0> <tr> <td align=center><font face=arial size=-2>ADVERTISEMENT</font><br><a href="http://rd.yahoo.com/M=245454.2994396.4323964.2848452/D=egroupweb/S=1708298795:HM/A=1457554/R=0/*http://ipunda.com/clk/beibunmaisuiyuiwabei"><img src="http://us.a1.yimg.com/us.yimg.com/a/qu/quinstreet/uofpoff_300_250_0001.gif" alt="" width="300" height="250" border="0"></a></td></tr></table></td> </tr> <tr><td><img alt="" width=1 height=1 src="http://us.adserver.yahoo.com/l?M=245454.2994396.4323964.2848452/D=egroupmail/S=:HM/A=1457554/rand=187454078"></td></tr> </table> <!-- |**|end egp html banner|**| --> <br> <tt> To unsubscribe from this group, send an email to:<BR> [email protected]<BR> <BR> </tt> <br> <br> <tt>Your use of Yahoo! Groups is subject to the <a href="http://docs.yahoo.com/info/terms/">Yahoo! Terms of Service</a>.</tt> </br> </BODY></HTML> ------_=_NextPart_001_01C2D8F0.02A5B4C0--