beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Option to disable remote lapi registration (#2010)

Browse source 
* Allow to disable remote lapi registration

* Extract method and make it extendable as a generic middleware

* Change method name so it make sense to read abort remote if <config>

* golint
This commit is contained in:
Laurence Jones 2023-02-24 13:44:21 +00:00 committed by GitHub
parent addf60b3ee
commit 8acce4637a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 52 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
pkg/apiserver/apiserver.go
View file

@ -208,6 +208,7 @@ func NewServer(config *csconfig.LocalApiServerCfg) (*APIServer, error) {
Profiles: config.Profiles,
Log: clog,
ConsoleConfig: config.ConsoleConfig,
DisableRemoteLapiRegistration: config.DisableRemoteLapiRegistration,
}
var apiClient *apic

3
pkg/apiserver/controllers/controller.go
View file

@ -27,6 +27,7 @@ type Controller struct {
ConsoleConfig *csconfig.ConsoleConfig
TrustedIPs []net.IPNet
HandlerV1 *v1.Controller
DisableRemoteLapiRegistration bool
}
func (c *Controller) Init() error {
@ -85,7 +86,7 @@ func (c *Controller) NewV1() error {
})
groupV1 := c.Router.Group("/v1")
groupV1.POST("/watchers", c.HandlerV1.CreateMachine)
groupV1.POST("/watchers", c.HandlerV1.AbortRemoteIf(c.DisableRemoteLapiRegistration), c.HandlerV1.CreateMachine)
groupV1.POST("/watchers/login", c.HandlerV1.Middlewares.JWT.Middleware.LoginHandler)
jwtAuth := groupV1.Group("")

11
pkg/apiserver/controllers/v1/utils.go
View file

@ -2,6 +2,7 @@ package v1
import (
"fmt"
"net/http"
"github.com/crowdsecurity/crowdsec/pkg/database/ent"
"github.com/gin-gonic/gin"
@ -24,3 +25,13 @@ func getBouncerFromContext(ctx *gin.Context) (*ent.Bouncer, error) {
return bouncerInfo, nil
}
func (c *Controller) AbortRemoteIf(option bool) gin.HandlerFunc {
return func(gctx *gin.Context) {
incomingIP := gctx.ClientIP()
if option && incomingIP != "127.0.0.1" && incomingIP != "::1" {
gctx.JSON(http.StatusForbidden, gin.H{"message": "access forbidden"})
gctx.Abort()
}
}
}

1
pkg/csconfig/api.go
View file

@ -195,6 +195,7 @@ type LocalApiServerCfg struct {
LogMaxFiles int `yaml:"-"`
TrustedIPs []string `yaml:"trusted_ips,omitempty"`
PapiLogLevel *log.Level `yaml:"papi_log_level"`
DisableRemoteLapiRegistration bool `yaml:"disable_remote_lapi_registration,omitempty"`
}
type TLSCfg struct {