Add decorator to check if request is coming from a blacklisted host

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/backend/geoip.py b/src/backend/geoip.py
index fe28c480a3d94b336e0537742566dc9acf4b1fc5..564cf40348bf127f762284caf6c2b1f638b9e7da 100644 (file)
--- a/src/backend/geoip.py
+++ b/src/backend/geoip.py
@@ -259,11 +259,15 @@ class Address(Object):
 
                # Not found
                if not res:
+                       logging.debug("%s is not blacklisted on %s" % (self, blacklist))
                        return False, None
 
                # If the IP address is on a blacklist, we will try to fetch the TXT record
                reason = yield self.backend.geoip.resolver.query(rr, type=pycares.QUERY_TYPE_TXT)
 
+               # Log result
+               logging.debug("%s is blacklisted on %s: %s" % (self, blacklist, reason or "N/A"))
+
                # Take the first reason
                if reason:
                        for i in reason:
@@ -280,6 +284,9 @@ class Address(Object):
 
        @tornado.gen.coroutine
        def is_blacklisted(self):
+               logging.debug("Checking if %s is blacklisted..." % self)
+
+               # Perform checks
                blacklists = yield self.get_blacklists(important_only=True)
 
                # If we are blacklisted on one list, this one is screwed

diff --git a/src/web/auth.py b/src/web/auth.py
index bf481d971c16f127d615378b39e711f35a9eb744..82e6f0d8a8877339f444f0334eaba805bb748287 100644 (file)
--- a/src/web/auth.py
+++ b/src/web/auth.py
@@ -39,11 +39,13 @@ class AuthenticationMixin(object):
 
 
 class LoginHandler(AuthenticationMixin, base.BaseHandler):
+       @base.blacklisted
        def get(self):
                next = self.get_argument("next", None)
 
                self.render("auth/login.html", next=next)
 
+       @base.blacklisted
        def post(self):
                username = self.get_argument("username")
                password = self.get_argument("password")

diff --git a/src/web/base.py b/src/web/base.py
index b6fee9b5f68ef44c59c4933462902edf4bee9fb0..4c1b3a9e713713cad16d41beb100fb259e5517cd 100644 (file)
--- a/src/web/base.py
+++ b/src/web/base.py
@@ -2,6 +2,7 @@
 
 import datetime
 import dateutil.parser
+import functools
 import http.client
 import ipaddress
 import logging
@@ -12,6 +13,24 @@ import tornado.web
 from ..decorators import *
 from .. import util
 
+def blacklisted(method):
+       @tornado.gen.coroutine
+       @functools.wraps(method)
+       def wrapper(self, *args, **kwargs):
+               # Check if remote is blacklisted
+               is_blacklisted = yield self.remote.is_blacklisted()
+
+               # If so, redirect to the blocked page
+               if is_blacklisted:
+                       logging.warning("%s is blacklisted" % self.remote)
+
+                       return self.redirect("https://www.ipfire.org/blocked")
+
+               return method(self, *args, **kwargs)
+
+       return wrapper
+
+
 class BaseHandler(tornado.web.RequestHandler):
        def set_expires(self, seconds):
                # For HTTP/1.1
@@ -78,6 +97,13 @@ class BaseHandler(tornado.web.RequestHandler):
                # Return the last IP if nothing else worked
                return remote_ips.pop()
 
+       @lazy_property
+       def remote(self):
+               address = self.get_remote_ip()
+
+               if address:
+                       return self.backend.geoip.lookup(address)
+
        @lazy_property
        def current_country_code(self):
                remote_ip = self.get_remote_ip()

diff --git a/src/web/blog.py b/src/web/blog.py
index 375adfc371528f6c372f16fc6ea7251b347c2f60..70349f6fcefb4744aca50bd65227592d6425401c 100644 (file)
--- a/src/web/blog.py
+++ b/src/web/blog.py
@@ -119,6 +119,7 @@ class DraftsHandler(auth.CacheMixin, base.BaseHandler):
 
 
 class SearchHandler(auth.CacheMixin, base.BaseHandler):
+       @base.blacklisted
        def get(self):
                q = self.get_argument("q")
 

diff --git a/src/web/download.py b/src/web/download.py
index 2e588c4b38a02405873c8b79cd63b4acba491ef5..aaaebbf411cd6350053d4f24273e6a176b40ca3f 100644 (file)
--- a/src/web/download.py
+++ b/src/web/download.py
@@ -34,6 +34,7 @@ class FileHandler(base.BaseHandler):
        def prepare(self):
                self.set_header("Pragma", "no-cache")
 
+       @base.blacklisted
        def get(self, filename):
                mirror = self.backend.mirrors.get_for_download(filename,
                        country_code=self.current_country_code)

diff --git a/src/web/newsletter.py b/src/web/newsletter.py
index 49b9ca7fdbe80d0ec107f60543f6fd302142d321..12909ade6a669e023442b03e42737bfb6910d3d9 100644 (file)
--- a/src/web/newsletter.py
+++ b/src/web/newsletter.py
@@ -9,6 +9,7 @@ from . import base
 
 class SubscribeHandler(base.BaseHandler):
        @tornado.gen.coroutine
+       @base.blacklisted
        def post(self):
                address = self.get_argument("email")
 

diff --git a/src/web/nopaste.py b/src/web/nopaste.py
index 8a7784ef1c09b22d43d0c23e839b0bb43e7583b5..2b37fe32d880981e0f0b70eaf3e0262fef71a236 100644 (file)
--- a/src/web/nopaste.py
+++ b/src/web/nopaste.py
@@ -9,6 +9,7 @@ from . import ui_modules
 class CreateHandler(base.BaseHandler):
        MODES = ("paste", "upload")
 
+       @base.blacklisted
        def get(self):
                mode = self.get_argument("mode", "paste")
                if not mode in self.MODES:
@@ -17,6 +18,7 @@ class CreateHandler(base.BaseHandler):
                self.render("nopaste/create.html", mode=mode,
                        max_size=self._max_size)
 
+       @base.blacklisted
        def post(self):
                mode = self.get_argument("mode")
                if not mode in self.MODES:
@@ -65,6 +67,7 @@ class CreateHandler(base.BaseHandler):
 
 
 class RawHandler(base.BaseHandler):
+       @base.blacklisted
        def get(self, uid):
                entry = self.backend.nopaste.get(uid)
                if not entry:
@@ -85,6 +88,7 @@ class RawHandler(base.BaseHandler):
 
 
 class ViewHandler(auth.CacheMixin, base.BaseHandler):
+       @base.blacklisted
        def get(self, uid):
                entry = self.backend.nopaste.get(uid)
                if not entry: