mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-14 20:08:02 +00:00
25ef3da9d5
chore(fmt): run gci on complete project Fix global import formatting in go code by running the `gci` command. This allows us to just use the command directly, instead of fixing the import order manually for the linter, on each PR. Co-authored-by: Elio Bischof <elio@zitadel.com>
107 lines
2.0 KiB
Go
107 lines
2.0 KiB
Go
package actions
|
|
|
|
import (
|
|
"net"
|
|
"reflect"
|
|
"strings"
|
|
|
|
"github.com/mitchellh/mapstructure"
|
|
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
func SetHTTPConfig(config *HTTPConfig) {
|
|
httpConfig = config
|
|
}
|
|
|
|
var httpConfig *HTTPConfig
|
|
|
|
type HTTPConfig struct {
|
|
DenyList []AddressChecker
|
|
}
|
|
|
|
func HTTPConfigDecodeHook(from, to reflect.Value) (interface{}, error) {
|
|
if to.Type() != reflect.TypeOf(HTTPConfig{}) {
|
|
return from.Interface(), nil
|
|
}
|
|
|
|
config := struct {
|
|
DenyList []string
|
|
}{}
|
|
|
|
decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
|
|
DecodeHook: mapstructure.StringToTimeDurationHookFunc(),
|
|
WeaklyTypedInput: true,
|
|
Result: &config,
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if err = decoder.Decode(from.Interface()); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
c := HTTPConfig{
|
|
DenyList: make([]AddressChecker, 0),
|
|
}
|
|
|
|
for _, unsplit := range config.DenyList {
|
|
for _, split := range strings.Split(unsplit, ",") {
|
|
parsed, parseErr := parseDenyListEntry(split)
|
|
if parseErr != nil {
|
|
return nil, parseErr
|
|
}
|
|
if parsed != nil {
|
|
c.DenyList = append(c.DenyList, parsed)
|
|
}
|
|
}
|
|
}
|
|
|
|
return c, nil
|
|
}
|
|
|
|
func parseDenyListEntry(entry string) (AddressChecker, error) {
|
|
if checker, err := NewIPChecker(entry); err == nil {
|
|
return checker, nil
|
|
}
|
|
return &DomainChecker{Domain: entry}, nil
|
|
}
|
|
|
|
func NewIPChecker(i string) (AddressChecker, error) {
|
|
_, network, err := net.ParseCIDR(i)
|
|
if err == nil {
|
|
return &IPChecker{Net: network}, nil
|
|
}
|
|
if ip := net.ParseIP(i); ip != nil {
|
|
return &IPChecker{IP: ip}, nil
|
|
}
|
|
return nil, zerrors.ThrowInvalidArgument(nil, "ACTIO-ddJ7h", "invalid ip")
|
|
}
|
|
|
|
type IPChecker struct {
|
|
Net *net.IPNet
|
|
IP net.IP
|
|
}
|
|
|
|
func (c *IPChecker) Matches(address string) bool {
|
|
ip := net.ParseIP(address)
|
|
if ip == nil {
|
|
return false
|
|
}
|
|
|
|
if c.IP != nil {
|
|
return c.IP.Equal(ip)
|
|
}
|
|
return c.Net.Contains(ip)
|
|
}
|
|
|
|
type DomainChecker struct {
|
|
Domain string
|
|
}
|
|
|
|
func (c *DomainChecker) Matches(domain string) bool {
|
|
//TODO: allow wild cards
|
|
return c.Domain == domain
|
|
}
|