From 6eae2199abdb5aeef125202d9a6854a099d8dd4a Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Thu, 9 Jan 2025 11:59:14 +0100
Subject: [PATCH] auth: use config.IsInternalIP

---
 auth/middleware.go      | 28 +++-------------------------
 auth/middleware_test.go |  2 --
 webhooks/legacy_test.go |  2 --
 3 files changed, 3 insertions(+), 29 deletions(-)

diff --git a/auth/middleware.go b/auth/middleware.go
index fb4b235df5afe74ea504c557b66594945a0ac950..ebfb5f814af2d55def697cb42e0368bd9c95f35b 100644
--- a/auth/middleware.go
+++ b/auth/middleware.go
@@ -243,8 +243,7 @@ type InternalAuth struct {
 	OAuthClientUUID string `json:"oauth_client_id,omitempty"`
 }
 
-func internalAuth(internalNet []*net.IPNet, payload []byte,
-	w http.ResponseWriter, r *http.Request, next http.Handler) {
+func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next http.Handler) {
 	host, _, err := net.SplitHostPort(r.RemoteAddr)
 	if err != nil {
 		host = r.RemoteAddr
@@ -253,14 +252,7 @@ func internalAuth(internalNet []*net.IPNet, payload []byte,
 	if ip == nil {
 		panic(fmt.Errorf("Unable to parse remote address"))
 	}
-	var ok bool = false
-	for _, ipnet := range internalNet {
-		ok = ok || ipnet.Contains(ip)
-		if ok {
-			break
-		}
-	}
-	if !ok {
+	if !config.IsInternalIP(ip) {
 		authError(w, fmt.Sprintf("Invalid source IP %s for internal auth", ip), http.StatusUnauthorized)
 		return
 	}
@@ -692,20 +684,6 @@ func WebhookAuth(ctx context.Context, auth *AuthContext,
 }
 
 func Middleware(conf ini.File, apiconf string) func(http.Handler) http.Handler {
-	var internalNet []*net.IPNet
-	src, ok := conf.Get(apiconf, "internal-ipnet")
-	if !ok {
-		// Conservative default
-		src = "127.0.0.1/24,::1/64"
-	}
-	for _, cidr := range strings.Split(src, ",") {
-		_, ipnet, err := net.ParseCIDR(cidr)
-		if err != nil {
-			panic(err)
-		}
-		internalNet = append(internalNet, ipnet)
-	}
-
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			cookie, err := r.Cookie("sr.ht.unified-login.v1")
@@ -747,7 +725,7 @@ func Middleware(conf ini.File, apiconf string) func(http.Handler) http.Handler {
 				return
 			case "internal":
 				payload := []byte(z[1])
-				internalAuth(internalNet, payload, w, r, next)
+				internalAuth(payload, w, r, next)
 				return
 			default:
 				authError(w, "Invalid Authorization header", http.StatusBadRequest)
diff --git a/auth/middleware_test.go b/auth/middleware_test.go
index 1efe99e409094ab652fec39502ae4ae27c7be68a..f4ff340be7334b4a05679f8102417869c946fbde 100644
--- a/auth/middleware_test.go
+++ b/auth/middleware_test.go
@@ -160,8 +160,6 @@ private-key=ebzsjPaN6E13ln/FeNWly1C92q6bVMVdOnDo1HPl5fc=
 
 [sr.ht]
 network-key=tbuG-7Vh44vrDq1L_HKWkHnWrDOtJhEkPKPiauaLeuk=
-
-[test::api]
 internal-ipnet=127.0.0.1/24,::1/64`))
 	if err != nil {
 		panic(err)
diff --git a/webhooks/legacy_test.go b/webhooks/legacy_test.go
index b3bfb685dd17f8a226c118b9b41a231860530ff5..f9ade0d81e6c99954719a9316ad03321b74d727b 100644
--- a/webhooks/legacy_test.go
+++ b/webhooks/legacy_test.go
@@ -26,8 +26,6 @@ private-key=ebzsjPaN6E13ln/FeNWly1C92q6bVMVdOnDo1HPl5fc=
 
 [sr.ht]
 network-key=tbuG-7Vh44vrDq1L_HKWkHnWrDOtJhEkPKPiauaLeuk=
-
-[test::api]
 internal-ipnet=127.0.0.1/24,::1/64`))
 	if err != nil {
 		panic(err)