From 6b4703f21deb0f140dbbeca682823f2b644a4e78 Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Thu, 5 Nov 2026 14:35:32 +0100 Subject: Actually implement the OT_PERMISSION_MAY_FULLSCRAPE mechanics and add a config file entry --- src/ot_config.c | 11 +++++++++++ src/ot_http.c | 5 +++++ 2 files changed, 16 insertions(+) (limited to 'src') diff --git a/src/ot_config.c b/src/ot_config.c index 6b51c61..dfaef0d 100644 --- a/src/ot_config.c +++ b/src/ot_config.c @@ -205,6 +205,7 @@ typedef enum { CONFIG_ACCESS_STATS, CONFIG_ACCESS_STATS_PATH, CONFIG_ACCESS_PROXY, + CONFIG_ACCESS_FULLSCRAPE, CONFIG_TRACKER_REDIRECT_URL, CONFIG_LIVESYNC_CLUSTER_NODE_IP, CONFIG_LIVESYNC_CLUSTER_LISTEN, @@ -243,6 +244,9 @@ static const config_key config_keys[] = { CONFIG_KEY("access.stats_path", CONFIG_ACCESS_STATS_PATH), #ifdef WANT_IP_FROM_PROXY CONFIG_KEY("access.proxy", CONFIG_ACCESS_PROXY), +#endif +#ifdef WANT_RESTRICT_FULLSCRAPE + CONFIG_KEY("access.fullscrape", CONFIG_ACCESS_FULLSCRAPE), #endif CONFIG_KEY("tracker.redirect_url", CONFIG_TRACKER_REDIRECT_URL), #ifdef WANT_SYNC_LIVE @@ -375,6 +379,13 @@ static int parse_configfile(char *config_filename) { goto parse_error; accesslist_bless_net(&tmpnet, OT_PERMISSION_MAY_PROXY); break; +#endif +#ifdef WANT_RESTRICT_FULLSCRAPE + case CONFIG_ACCESS_FULLSCRAPE: + if (!scan_ip6_net(p, &tmpnet)) + goto parse_error; + accesslist_bless_net(&tmpnet, OT_PERMISSION_MAY_FULLSCRAPE); + break; #endif case CONFIG_TRACKER_REDIRECT_URL: set_config_option(&g_redirecturl, p); diff --git a/src/ot_http.c b/src/ot_http.c index 533a876..d2dad67 100644 --- a/src/ot_http.c +++ b/src/ot_http.c @@ -402,6 +402,11 @@ static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct * struct http_data *cookie = fdstate_cookie(sock); int format = 0; +#ifdef WANT_RESTRICT_FULLSCRAPE + if (!accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_FULLSCRAPE)) + HTTPERROR_403_IP; +#endif + #ifdef WANT_MODEST_FULLSCRAPES { ot_scrape_log this_peer, *new_peer; -- cgit v1.3