Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue: 2926 whitelist by hostname #2953

Merged
merged 6 commits into from
Jan 30, 2019
Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 57 additions & 29 deletions dgraph/cmd/alpha/run.go
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ package alpha
import (
"bytes"
"crypto/tls"
"errors"
"fmt"
"io/ioutil"
"log"
Expand Down Expand Up @@ -176,44 +175,73 @@ func setupCustomTokenizers() {
}
}

// Parses the comma-delimited whitelist ip-range string passed in as an argument
// from the command line and returns slice of []IPRange
// Parses a comma-delimited list of IP addresses, IP ranges, CIDR blocks, or hostnames
// and returns a slice of []IPRange.
//
// ex. "144.142.126.222:144.124.126.400,190.59.35.57:190.59.35.99"
func parseIPsFromString(str string) ([]worker.IPRange, error) {
// e.g. "144.142.126.222:144.142.126.244,144.142.126.254,192.168.0.0/16,host.docker.internal"
func getIPsFromString(str string) ([]worker.IPRange, error) {
if str == "" {
return []worker.IPRange{}, nil
}

var ipRanges []worker.IPRange
ipRangeStrings := strings.Split(str, ",")

// Check that the each of the ranges are valid
for _, s := range ipRangeStrings {
ipsTuple := strings.Split(s, ":")
rangeStrings := strings.Split(str, ",")

for _, s := range rangeStrings {
isIPv6 := strings.Index(s, "::") >= 0
tuple := strings.Split(s, ":")
if isIPv6 || len(tuple) == 1 {
if strings.Index(s, "/") < 0 {
// string is hostname like host.docker.internal,
// or IPv4 address like 144.124.126.254,
// or IPv6 address like fd03:b188:0f3c:9ec4::babe:face
ipAddr := net.ParseIP(s)
if ipAddr != nil {
ipRanges = append(ipRanges, worker.IPRange{Lower: ipAddr, Upper: ipAddr})
} else {
ipAddrs, err := net.LookupIP(s)
if err != nil {
return nil, fmt.Errorf("invalid IP address or hostname: %s", s)
}

for _, addr := range ipAddrs {
ipRanges = append(ipRanges, worker.IPRange{Lower: addr, Upper: addr})
}
}
} else {
// string is CIDR block like 192.168.0.0/16 or fd03:b188:0f3c:9ec4::/64
rangeLo, network, err := net.ParseCIDR(s)
if err != nil {
return nil, fmt.Errorf("invalid CIDR block: %s", s)
}

// Assert that the range consists of an upper and lower bound
if len(ipsTuple) != 2 {
return nil, errors.New("IP range must have a lower and upper bound")
}
addrLen, maskLen := len(rangeLo), len(network.Mask)
rangeHi := make(net.IP, len(rangeLo))
copy(rangeHi, rangeLo)
for i := 1; i <= maskLen; i++ {
rangeHi[addrLen-i] |= ^network.Mask[maskLen-i]
}

lowerBoundIP := net.ParseIP(ipsTuple[0])
upperBoundIP := net.ParseIP(ipsTuple[1])

if lowerBoundIP == nil || upperBoundIP == nil {
// Assert that both upper and lower bound are valid IPs
return nil, errors.New(
ipsTuple[0] + " or " + ipsTuple[1] + " is not a valid IP address",
)
} else if bytes.Compare(lowerBoundIP, upperBoundIP) > 0 {
// Assert that the lower bound is less than the upper bound
return nil, errors.New(
ipsTuple[0] + " cannot be greater than " + ipsTuple[1],
)
ipRanges = append(ipRanges, worker.IPRange{Lower: rangeLo, Upper: rangeHi})
}
} else if len(tuple) == 2 {
// string is range like a.b.c.d:v.x.y.z
rangeLo := net.ParseIP(tuple[0])
rangeHi := net.ParseIP(tuple[1])
if rangeLo == nil {
return nil, fmt.Errorf("invalid IP address: %s", tuple[0])
} else if rangeHi == nil {
return nil, fmt.Errorf("invalid IP address: %s", tuple[1])
} else if bytes.Compare(rangeLo, rangeHi) > 0 {
return nil, fmt.Errorf("inverted IP address range: %s", s)
} else {
ipRanges = append(ipRanges, worker.IPRange{Lower: rangeLo, Upper: rangeHi})
}
} else {
ipRanges = append(ipRanges, worker.IPRange{Lower: lowerBoundIP, Upper: upperBoundIP})
return nil, fmt.Errorf("invalid IP address range: %s", s)
}
}

return ipRanges, nil
}

Expand Down Expand Up @@ -450,7 +478,7 @@ func run() {

edgraph.SetConfiguration(opts)

ips, err := parseIPsFromString(Alpha.Conf.GetString("whitelist"))
ips, err := getIPsFromString(Alpha.Conf.GetString("whitelist"))
x.Check(err)
worker.Config = worker.Options{
ExportPath: Alpha.Conf.GetString("export"),
Expand Down
41 changes: 41 additions & 0 deletions dgraph/cmd/alpha/run_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
"encoding/json"
"fmt"
"log"
"net"
"net/http"
"os"
"strings"
Expand All @@ -35,6 +36,7 @@ import (
"github.com/dgraph-io/dgraph/protos/pb"
"github.com/dgraph-io/dgraph/query"
"github.com/dgraph-io/dgraph/schema"
"github.com/dgraph-io/dgraph/worker"
"github.com/stretchr/testify/require"

"google.golang.org/grpc"
Expand Down Expand Up @@ -1651,6 +1653,45 @@ func TestTypeMutationAndQuery(t *testing.T) {
require.Equal(t, "Alice", name)
}

func TestIPStringParsing(t *testing.T) {
var addrRange []worker.IPRange
var err error

addrRange, err = getIPsFromString("144.142.126.222:144.142.126.244")
require.NoError(t, err)
require.Equal(t, net.IPv4(144, 142, 126, 222), addrRange[0].Lower)
require.Equal(t, net.IPv4(144, 142, 126, 244), addrRange[0].Upper)

addrRange, err = getIPsFromString("144.142.126.254")
require.NoError(t, err)
require.Equal(t, net.IPv4(144, 142, 126, 254), addrRange[0].Lower)
require.Equal(t, net.IPv4(144, 142, 126, 254), addrRange[0].Upper)

addrRange, err = getIPsFromString("192.168.0.0/16")
require.NoError(t, err)
require.Equal(t, net.IPv4(192, 168, 0, 0), addrRange[0].Lower)
require.Equal(t, net.IPv4(192, 168, 255, 255), addrRange[0].Upper)

addrRange, err = getIPsFromString("example.org")
require.NoError(t, err)
require.NotEqual(t, net.IPv4zero, addrRange[0].Lower)

addrRange, err = getIPsFromString("144.142.126.222:144.142.126.244,144.142.126.254" +
",192.168.0.0/16,example.org")
require.NoError(t, err)
require.NotEqual(t, 0, len(addrRange))

addrRange, err = getIPsFromString("fd03:b188:0f3c:9ec4::babe:face")
require.NoError(t, err)
require.NotEqual(t, net.IPv6zero, addrRange[0].Lower)
require.Equal(t, addrRange[0].Lower, addrRange[0].Upper)

addrRange, err = getIPsFromString("fd03:b188:0f3c:9ec4::/64")
require.NoError(t, err)
require.NotEqual(t, net.IPv6zero, addrRange[0].Lower)
require.NotEqual(t, addrRange[0].Lower, addrRange[0].Upper)
}

func TestMain(m *testing.M) {
// Increment lease, so that mutations work.
conn, err := grpc.Dial("localhost:5080", grpc.WithInsecure())
Expand Down