Class: Faraday::RestrictIPAddresses

Inherits:
Middleware
  • Object
show all
Defined in:
lib/faraday/restrict_ip_addresses.rb

Defined Under Namespace

Classes: AddressNotAllowed

Constant Summary collapse

VERSION = 
'0.0.2'
RFC_1918_NETWORKS = 
%w(
  127.0.0.0/8
  10.0.0.0/8
  172.16.0.0/12
  192.168.0.0/16
).map { |net| IPAddr.new(net) }
RFC_6890_NETWORKS = 
RFC_1918_NETWORKS + [
  '0.0.0.0/8',         #  "This" Network [RFC1700, page 4]
  '100.64.0.0/10',     #  Shared address space [6598, 6890]
  #'128.0.0.0/16',      #  Reserved in 3330, not in 6890, has been assigned
  '169.254.0.0/16',    #  Link Local [3927, 6890]
  # '191.255.0.0/16'   #  Reserved in 3330, not in 6890, has been assigned
  '192.0.0.0/24',      #  Reserved but subject to allocation [6890]
  '192.0.0.0/29',      #  DS-Lite                        [6333, 6890]. Redundant with above, included for completeness.
  '192.0.2.0/24',      #  Documentation                  [5737, 6890]
  '192.88.99.0/24',    #  6to4 Relay Anycast             [3068, 6890]
  '198.18.0.0/15',     #  Network Interconnect Device Benchmark Testing [2544, 6890]
  '198.51.100.0/24',   #  Documentation                  [5737, 6890]
  '203.0.113.0/24',    #  Documentation                  [5737, 6890]
  '224.0.0.0/4',       #  Multicast                      [11112]
  '240.0.0.0/4',       #  Reserved for Future Use        [6890]
  '255.255.255.255/32' #  Reserved for Future Use        [6890]
].map { |net| IPAddr.new(net) }

Instance Method Summary collapse

Constructor Details

#initialize(app, options = {}) ⇒ RestrictIPAddresses

Returns a new instance of RestrictIPAddresses.



34
35
36
37
38
39
40
41
42
43
 
# File 'lib/faraday/restrict_ip_addresses.rb', line 34

def initialize(app, options = {})
  super(app)
  @denied_networks   = (options[:deny] || []).map  { |n| IPAddr.new(n) }
  @allowed_networks  = (options[:allow] || []).map { |n| IPAddr.new(n) }

  @denied_networks += RFC_1918_NETWORKS if options[:deny_rfc1918]
  @denied_networks += RFC_6890_NETWORKS if options[:deny_rfc6890]
  @denied_networks.uniq!
  @allowed_networks += [IPAddr.new('127.0.0.1')] if options[:allow_localhost]
end

Instance Method Details

#addresses(hostname) ⇒ Object 



62
63
64
 
# File 'lib/faraday/restrict_ip_addresses.rb', line 62

def addresses(hostname)
  Socket.gethostbyname(hostname).map { |a| IPAddr.new_ntoh(a) rescue nil }.compact
end

#allowed_ip?(address) ⇒ Boolean

Returns:

  • (Boolean) 


58
59
60
 
# File 'lib/faraday/restrict_ip_addresses.rb', line 58

def allowed_ip?(address)
  @allowed_networks.any? { |net| net.include? address }
end

#call(env) ⇒ Object 



45
46
47
48
 
# File 'lib/faraday/restrict_ip_addresses.rb', line 45

def call(env)
  raise AddressNotAllowed.new "Address not allowed for #{env[:url]}" if denied?(env)
  @app.call(env)
end

#denied?(env) ⇒ Boolean

Returns:

  • (Boolean) 


50
51
52
 
# File 'lib/faraday/restrict_ip_addresses.rb', line 50

def denied?(env)
  addresses(env[:url].host).any? { |a| denied_ip?(a) }
end

#denied_ip?(address) ⇒ Boolean

Returns:

  • (Boolean) 


54
55
56
 
# File 'lib/faraday/restrict_ip_addresses.rb', line 54

def denied_ip?(address)
  @denied_networks.any? { |net| net.include?(address) and !allowed_ip?(address) }
end