2 files changed, 16 insertions, 0 deletions

diff --git a/src/ot_config.c b/src/ot_config.c
index 6b51c61..dfaef0d 100644
--- a/src/ot_config.c
+++ b/src/ot_config.c
@@ -205,6 +205,7 @@ typedef enum {
     CONFIG_ACCESS_STATS,
     CONFIG_ACCESS_STATS_PATH,
     CONFIG_ACCESS_PROXY,
+    CONFIG_ACCESS_FULLSCRAPE,
     CONFIG_TRACKER_REDIRECT_URL,
     CONFIG_LIVESYNC_CLUSTER_NODE_IP,
     CONFIG_LIVESYNC_CLUSTER_LISTEN,
@@ -244,6 +245,9 @@ static const config_key config_keys[] = {
 #ifdef WANT_IP_FROM_PROXY
     CONFIG_KEY("access.proxy",             CONFIG_ACCESS_PROXY),
 #endif
+#ifdef WANT_RESTRICT_FULLSCRAPE
+    CONFIG_KEY("access.fullscrape",        CONFIG_ACCESS_FULLSCRAPE),
+#endif
     CONFIG_KEY("tracker.redirect_url",     CONFIG_TRACKER_REDIRECT_URL),
 #ifdef WANT_SYNC_LIVE
     CONFIG_KEY("livesync.cluster.node_ip", CONFIG_LIVESYNC_CLUSTER_NODE_IP),
@@ -376,6 +380,13 @@ static int parse_configfile(char *config_filename) {
         accesslist_bless_net(&tmpnet, OT_PERMISSION_MAY_PROXY);
         break;
 #endif
+#ifdef WANT_RESTRICT_FULLSCRAPE
+      case CONFIG_ACCESS_FULLSCRAPE:
+        if (!scan_ip6_net(p, &tmpnet))
+          goto parse_error;
+        accesslist_bless_net(&tmpnet, OT_PERMISSION_MAY_FULLSCRAPE);
+        break;
+#endif
       case CONFIG_TRACKER_REDIRECT_URL:
         set_config_option(&g_redirecturl, p);
         break;
diff --git a/src/ot_http.c b/src/ot_http.c
index 533a876..d2dad67 100644
--- a/src/ot_http.c
+++ b/src/ot_http.c
@@ -402,6 +402,11 @@ static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct *
   struct http_data *cookie = fdstate_cookie(sock);
   int               format = 0;
 
+#ifdef WANT_RESTRICT_FULLSCRAPE
+  if (!accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_FULLSCRAPE))
+    HTTPERROR_403_IP;
+#endif
+
 #ifdef WANT_MODEST_FULLSCRAPES
   {
     ot_scrape_log this_peer, *new_peer;