3 files changed, 3 insertions(+), 29 deletions(-)

M auth/middleware.go
M auth/middleware_test.go
M webhooks/legacy_test.go

@@ 243,8 243,7 @@ type InternalAuth struct {
 	OAuthClientUUID string `json:"oauth_client_id,omitempty"`
 }
 
-func internalAuth(internalNet []*net.IPNet, payload []byte,
-	w http.ResponseWriter, r *http.Request, next http.Handler) {
+func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next http.Handler) {
 	host, _, err := net.SplitHostPort(r.RemoteAddr)
 	if err != nil {
 		host = r.RemoteAddr


@@ 253,14 252,7 @@ func internalAuth(internalNet []*net.IPNet, payload []byte,
 	if ip == nil {
 		panic(fmt.Errorf("Unable to parse remote address"))
 	}
-	var ok bool = false
-	for _, ipnet := range internalNet {
-		ok = ok || ipnet.Contains(ip)
-		if ok {
-			break
-		}
-	}
-	if !ok {
+	if !config.IsInternalIP(ip) {
 		authError(w, fmt.Sprintf("Invalid source IP %s for internal auth", ip), http.StatusUnauthorized)
 		return
 	}


@@ 692,20 684,6 @@ func WebhookAuth(ctx context.Context, auth *AuthContext,
 }
 
 func Middleware(conf ini.File, apiconf string) func(http.Handler) http.Handler {
-	var internalNet []*net.IPNet
-	src, ok := conf.Get(apiconf, "internal-ipnet")
-	if !ok {
-		// Conservative default
-		src = "127.0.0.1/24,::1/64"
-	}
-	for _, cidr := range strings.Split(src, ",") {
-		_, ipnet, err := net.ParseCIDR(cidr)
-		if err != nil {
-			panic(err)
-		}
-		internalNet = append(internalNet, ipnet)
-	}
-
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			cookie, err := r.Cookie("sr.ht.unified-login.v1")


@@ 747,7 725,7 @@ func Middleware(conf ini.File, apiconf string) func(http.Handler) http.Handler {
 				return
 			case "internal":
 				payload := []byte(z[1])
-				internalAuth(internalNet, payload, w, r, next)
+				internalAuth(payload, w, r, next)
 				return
 			default:
 				authError(w, "Invalid Authorization header", http.StatusBadRequest)

@@ 160,8 160,6 @@ private-key=ebzsjPaN6E13ln/FeNWly1C92q6bVMVdOnDo1HPl5fc=
 
 [sr.ht]
 network-key=tbuG-7Vh44vrDq1L_HKWkHnWrDOtJhEkPKPiauaLeuk=
-
-[test::api]
 internal-ipnet=127.0.0.1/24,::1/64`))
 	if err != nil {
 		panic(err)

@@ 26,8 26,6 @@ private-key=ebzsjPaN6E13ln/FeNWly1C92q6bVMVdOnDo1HPl5fc=
 
 [sr.ht]
 network-key=tbuG-7Vh44vrDq1L_HKWkHnWrDOtJhEkPKPiauaLeuk=
-
-[test::api]
 internal-ipnet=127.0.0.1/24,::1/64`))
 	if err != nil {
 		panic(err)