Step 2 of the WANT_RESTRICT_FULLSCRAPE feature (fixing a bug along the way)

4 files changed, 14 insertions, 1 deletions

diff --git a/man5/opentracker.conf.5 b/man5/opentracker.conf.5
index 2250fe5..db79d4b 100644
--- a/man5/opentracker.conf.5
+++ b/man5/opentracker.conf.5
@@ -78,6 +78,9 @@ Specifies the path to the stats location. You can configure opentracker to appea
 .It access.proxy Ar ip_address_or_network
 Specifies the IP address or network of the reverse proxies. Opentracker will take the X-Forwarded-For address instead of the source IP address. Can be added more than once.
 .Pp
+.It access.fullscrape Ar ip_address_or_network
+Specifies the IP address or network in CIDR notation allowed to fetch fullscrapes from opentracker, in case they're restricted.
+.Pp
 .It livesync.cluster.listen Ar ip_address:port
 Specifies the IP address and port opentracker will listen on for incoming live
 sync packets to keep a cluster of opentrackers synchronized. Every member of a
diff --git a/src/ot_config.c b/src/ot_config.c
index dfaef0d..9c5e8f0 100644
--- a/src/ot_config.c
+++ b/src/ot_config.c
@@ -276,7 +276,7 @@ static int parse_configfile(char *config_filename) {
   FILE  *config_file_handle;
   char   inbuf[512];
   ot_ip6 tmpip;
-#if defined(WANT_RESTRICT_STATS) || defined(WANT_IP_FROM_PROXY) || defined(WANT_SYNC_LIVE)
+#if defined(WANT_RESTRICT_STATS) || defined(WANT_RESTRICT_FULLSCRAPE) || defined(WANT_IP_FROM_PROXY) || defined(WANT_SYNC_LIVE)
   ot_net tmpnet;
 #endif
   int bound = 0;
diff --git a/src/ot_http.c b/src/ot_http.c
index d2dad67..cc11366 100644
--- a/src/ot_http.c
+++ b/src/ot_http.c
@@ -342,6 +342,10 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
   }
 
   if (mode == TASK_STATS_TPB) {
+#ifdef WANT_RESTRICT_FULLSCRAPE
+  if (!accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_FULLSCRAPE))
+    HTTPERROR_403_IP;
+#endif
 #ifdef WANT_COMPRESSION_GZIP
     ws->request[ws->request_size - 1] = 0;
 #ifndef WANT_COMPRESSION_GZIP_ALWAYS
@@ -402,6 +406,9 @@ static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct *
   struct http_data *cookie = fdstate_cookie(sock);
   int               format = 0;
 
+  if (!cookie)
+    HTTPERROR_500;
+
 #ifdef WANT_RESTRICT_FULLSCRAPE
   if (!accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_FULLSCRAPE))
     HTTPERROR_403_IP;
diff --git a/src/ot_stats.c b/src/ot_stats.c
index 7b5b1b9..d395275 100644
--- a/src/ot_stats.c
+++ b/src/ot_stats.c
@@ -588,6 +588,9 @@ static const char *const build_features[] = {
 #ifdef WANT_RESTRICT_STATS
     "WANT_RESTRICT_STATS",
 #endif
+#ifdef WANT_RESTRICT_FULLSCRAPE
+    "WANT_RESTRICT_FULLSCRAPE",
+#endif
 #ifdef WANT_LOG_NUMWANT
     "WANT_LOG_NUMWANT",
 #endif