implement acl for webserver

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index cff84a2fb5e344125d1a9041f5c00e66ec403af2..fdeb14060c93c0664f2a99f82b50c3cda3ddc1af 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -117,6 +117,7 @@ void declareArguments()
   ::arg().set("webserver-address","IP Address of webserver to listen on")="127.0.0.1";
   ::arg().set("webserver-port","Port of webserver to listen on")="8081";
   ::arg().set("webserver-password","Password required for accessing the webserver")="";
+  ::arg().set("webserver-allow-from","Webserver access is only allowed from these subnets")="0.0.0.0/0,::/0";
 
   ::arg().setSwitch("out-of-zone-additional-processing","Do out of zone additional processing")="yes";
   ::arg().setSwitch("do-ipv6-additional-processing", "Do AAAA additional processing")="yes";

diff --git a/pdns/docs/pdns.xml b/pdns/docs/pdns.xml
index 5541c442baa96d6fb1734ffb29887e23be9b6b65..f74138c4ee55e6281c7a273669bdfbb410f3e2d7 100644 (file)
--- a/pdns/docs/pdns.xml
+++ b/pdns/docs/pdns.xml
@@ -12878,6 +12878,14 @@ UPDATE records SET auth=1 WHERE auth IS NULL;
             </para>
           </listitem>
         </varlistentry>
+        <varlistentry>
+          <term>webserver-allow-from</term>
+          <listitem>
+            <para>
+              Webserver access is only allowed from these subnets
+            </para>
+          </listitem>
+        </varlistentry>
       </variablelist>
       </sect3>
       <sect3><title>Removed options</title>

diff --git a/pdns/pdns.conf-dist b/pdns/pdns.conf-dist
index fc767ac65c680ea6d6eb65d3a06afcef52c95ee7..bb62365aba2db32cce6758aae6c1b2072dae99e8 100644 (file)
--- a/pdns/pdns.conf-dist
+++ b/pdns/pdns.conf-dist
@@ -499,6 +499,11 @@
 #
 # webserver-address=127.0.0.1
 
+#################################
+# webserver-allow-from Webserver access is only allowed from these subnets
+#
+# webserver-allow-from=0.0.0.0/0,::/0
+
 #################################
 # webserver-password   Password required for accessing the webserver
 #

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index 633db7623b79c20e4579304eb99d9087b4295e38..eabe3c708c01295ff36e732772290bd3a7b990bf 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -2099,6 +2099,7 @@ int main(int argc, char **argv)
     ::arg().set("experimental-webserver-address", "IP Address of webserver to listen on") = "127.0.0.1";
     ::arg().set("experimental-webserver-port", "Port of webserver to listen on") = "8082";
     ::arg().set("experimental-webserver-password", "Password required for accessing the webserver") = "";
+    ::arg().set("webserver-allow-from","Webserver access is only allowed from these subnets")="0.0.0.0/0,::/0";
     ::arg().set("experimental-api-config-dir", "Directory where REST API stores config and zones") = "";
     ::arg().set("carbon-ourname", "If set, overrides our reported hostname for carbon stats")="";
     ::arg().set("carbon-server", "If set, send metrics in carbon (graphite) format to this server")="";

diff --git a/pdns/sstuff.hh b/pdns/sstuff.hh
index 5a00362335e23b597de546b48a026364e3d1f3cd..03bcafc1d9387c81ab281a33eaf27903c543bc67 100644 (file)
--- a/pdns/sstuff.hh
+++ b/pdns/sstuff.hh
@@ -78,6 +78,17 @@ public:
     return new Socket(s);
   }
 
+  //! Check remote address aganst netmaskgroup ng
+  bool acl(NetmaskGroup &ng)
+  {
+    ComboAddress remote;
+    socklen_t remotelen=sizeof(remote);
+    if(getpeername(d_socket, (struct sockaddr *)&remote, &remotelen) >= 0)
+      return ng.match((ComboAddress *) &remote);
+
+    return false;
+  }
+
   //! Set the socket to non-blocking
   void setNonBlocking()
   {

diff --git a/pdns/webserver.cc b/pdns/webserver.cc
index 0e56af580aa90e2c2cdb6b4aa801d6296b762006..48b7d662f3ba4d240c4471c08ceacf13bdacf25a 100644 (file)
--- a/pdns/webserver.cc
+++ b/pdns/webserver.cc
@@ -28,6 +28,7 @@
 #include "dns.hh"
 #include "base64.hh"
 #include "json.hh"
+#include "arguments.hh"
 #include <yahttp/router.hpp>
 
 struct connectionThreadData {
@@ -287,14 +288,25 @@ void WebServer::go()
   try {
     pthread_t tid;
 
+    NetmaskGroup acl;
+    acl.toMasks(::arg()["webserver-allow-from"]);
+
     while(true) {
       // data and data->client will be freed by thread
       connectionThreadData *data = new connectionThreadData;
       data->webServer = this;
       data->client = d_server->accept();
-      pthread_create(&tid, 0, &WebServerConnectionThreadStart, (void *)data);
+      if (data->client->acl(acl)) {
+        pthread_create(&tid, 0, &WebServerConnectionThreadStart, (void *)data);
+      } else {
+        delete data->client; // close socket
+        delete data;
+      }
     }
   }
+  catch(PDNSException &e) {
+    L<<Logger::Error<<"PDNSException in main webserver thread: "<<e.reason<<endl;
+  }
   catch(std::exception &e) {
     L<<Logger::Error<<"STL Exception in main webserver thread: "<<e.what()<<endl;
   }