server/dashboard/restrict_ip.go

100 lines
2.0 KiB
Go
Raw Normal View History

package main
import (
"encoding/json"
"fmt"
"log"
"net/http"
"os"
"os/signal"
"path"
"strings"
"syscall"
"github.com/gin-gonic/gin"
"gopkg.in/fsnotify.v1"
)
func (app *App) loadAndWatchIPs(ipfile string) {
// First load of file if it exists
app.tryReloadIPList(ipfile)
// Register SIGHUP
c := make(chan os.Signal, 1)
signal.Notify(c, syscall.SIGHUP)
go func() {
for range c {
log.Println("SIGHUP received, reloading ip list...")
go app.tryReloadIPList(ipfile)
}
}()
// Watch the configuration file
if watcher, err := fsnotify.NewWatcher(); err != nil {
log.Fatal(err)
} else {
if err := watcher.Add(path.Dir(ipfile)); err != nil {
log.Fatal("Unable to watch: ", path.Dir(ipfile), ": ", err)
}
go func() {
defer watcher.Close()
for {
select {
case ev := <-watcher.Events:
if path.Base(ev.Name) == path.Base(ipfile) && ev.Op&(fsnotify.Write|fsnotify.Create) != 0 {
log.Println("IPs file changes, reloading them!")
go app.tryReloadIPList(ipfile)
}
case err := <-watcher.Errors:
log.Println("watcher error:", err)
}
}
}()
}
}
func (app *App) tryReloadIPList(ipfile string) {
if _, err := os.Stat(ipfile); !os.IsNotExist(err) {
if iplist, err := loadIPs(ipfile); err != nil {
log.Println("ERROR: Unable to read ip file:", err)
} else {
log.Printf("Loading %d IPs to authorized list", len(iplist))
app.ips = iplist
}
}
}
func loadIPs(file string) ([]string, error) {
fd, err := os.Open(file)
if err != nil {
return nil, err
}
defer fd.Close()
var ret []string
jdec := json.NewDecoder(fd)
if err := jdec.Decode(&ret); err != nil {
return ret, err
}
return ret, nil
}
func (app *App) Restrict2IPs(c *gin.Context) {
found := false
for _, ip := range app.ips {
if strings.HasPrefix(c.Request.RemoteAddr, ip) {
found = true
break
}
}
if found {
c.Next()
} else {
c.AbortWithError(http.StatusForbidden, fmt.Errorf("IP not authorized: %s", c.Request.RemoteAddr))
}
}