release: v1.3.3

general: only build docker develop images on master branch push
build(deps): bump github.com/spf13/viper from 1.16.0 to 1.17.0 in /proxy (#86 )
2025-11-15 00:57:35 +01:00 · 2023-10-21 00:03:02 -07:00 · 2023-10-08 21:08:07 -07:00 · 2023-10-08 21:04:12 -07:00 · 2023-10-08 21:04:04 -07:00 · 2023-10-04 21:33:37 -07:00
15 changed files with 990 additions and 259 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,127 +0,0 @@
-version: 2.1
-
-workflows:
-  docker:
-    jobs:
-      - build
-      - docker-frontend-deploy:
-          context:
-            - docker
-          requires:
-            - build
-          filters:
-            branches:
-              only: master
-      - docker-proxy-deploy:
-          context:
-            - docker
-          requires:
-            - build
-          filters:
-            branches:
-              only: master
-
-jobs:
-  build:
-    docker:
-      - image: cimg/go:1.17
-    working_directory: /home/circleci/go/src/github.com/xddxdd/bird-lg-go
-    steps:
-      - checkout
-      - run: 
-          name: Test frontend
-          command: |
-            export GO111MODULE=on
-            cd frontend
-            go get -v -t -d ./...
-            go test -v ./...
-      - run: 
-          name: Test proxy
-          command: |
-            export GO111MODULE=on
-            cd proxy
-            go get -v -t -d ./...
-            go test -v ./...
-
-  docker-frontend-deploy:
-    machine:
-      image: ubuntu-2004:202111-02
-    environment:
-      BUILDX_PLATFORMS: linux/amd64,linux/arm64,linux/386,linux/arm/v7
-    steps:
-      - checkout
-      - run:
-          name: Install buildx
-          command: |
-            BUILDX_BINARY_URL="https://github.com/docker/buildx/releases/download/v0.7.1/buildx-v0.7.1.linux-amd64"
-
-            curl --output docker-buildx \
-              --silent --show-error --location --fail --retry 3 \
-              "$BUILDX_BINARY_URL"
-
-            mkdir -p ~/.docker/cli-plugins
-
-            mv docker-buildx ~/.docker/cli-plugins/
-            chmod a+x ~/.docker/cli-plugins/docker-buildx
-
-            docker buildx install
-            # Run binfmt
-            docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-      - run:
-          name: Build Docker image
-          environment:
-            BUILD_ID: << pipeline.number >>
-          command: |
-            echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin
-            docker buildx create --name mybuilder --use
-            docker buildx build \
-              --platform $BUILDX_PLATFORMS \
-              -t $DOCKER_USERNAME/bird-lg-go:circleci-build$BUILD_ID \
-              --progress plain \
-              --push frontend
-            docker buildx build \
-              --platform $BUILDX_PLATFORMS \
-              -t $DOCKER_USERNAME/bird-lg-go:latest \
-              --progress plain \
-              --push frontend
-
-  docker-proxy-deploy:
-    machine:
-      image: ubuntu-2004:202111-02
-    environment:
-      BUILDX_PLATFORMS: linux/amd64,linux/arm64,linux/386,linux/arm/v7
-    steps:
-      - checkout
-      - run:
-          name: Install buildx
-          command: |
-            BUILDX_BINARY_URL="https://github.com/docker/buildx/releases/download/v0.7.1/buildx-v0.7.1.linux-amd64"
-
-            curl --output docker-buildx \
-              --silent --show-error --location --fail --retry 3 \
-              "$BUILDX_BINARY_URL"
-
-            mkdir -p ~/.docker/cli-plugins
-
-            mv docker-buildx ~/.docker/cli-plugins/
-            chmod a+x ~/.docker/cli-plugins/docker-buildx
-
-            docker buildx install
-            # Run binfmt
-            docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-      - run:
-          name: Build Docker image
-          environment:
-            BUILD_ID: << pipeline.number >>
-          command: |
-            echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin
-            docker buildx create --name mybuilder --use
-            docker buildx build \
-              --platform $BUILDX_PLATFORMS \
-              -t $DOCKER_USERNAME/bird-lgproxy-go:circleci-build$BUILD_ID \
-              --push proxy
-            docker buildx build \
-              --platform $BUILDX_PLATFORMS \
-              -t $DOCKER_USERNAME/bird-lgproxy-go:latest \
-              --progress plain \
-              --push proxy
--- a/.github/workflows/develop.yaml
+++ b/.github/workflows/develop.yaml
@@ -0,0 +1,108 @@
+on:
+  push:
+    branches:
+      - 'master'
+  pull_request:
+    branches:
+      - 'master'
+
+jobs:
+  go-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Setup Golang
+        uses: actions/setup-go@v4
+
+      - name: Run frontend unit test
+        run: |
+          export GO111MODULE=on
+          cd frontend
+          go get -v -t -d ./...
+          go test -v ./...
+          cd ..
+
+      - name: Run proxy unit test
+        run: |
+          export GO111MODULE=on
+          cd proxy
+          go get -v -t -d ./...
+          go test -v ./...
+          cd ..
+
+  docker-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Test whois binary in frontend image
+        run: |
+          docker build -t local/frontend frontend/
+          docker run --rm --net host --entrypoint whois local/frontend github.com || exit 1
+          docker run --rm --net host --entrypoint whois local/frontend -h whois.ripe.net github.com || exit 1
+          docker run --rm --net host --entrypoint whois local/frontend -h whois.ripe.net:43 github.com || exit 1
+
+      - name: Test traceroute binary in proxy image
+        run: |
+          docker build -t local/proxy proxy/
+          docker run --rm --net host --entrypoint traceroute local/proxy 127.0.0.1 || exit 1
+          docker run --rm --net host --entrypoint traceroute local/proxy ::1 || exit 1
+
+  docker-develop:
+    runs-on: ubuntu-latest
+    needs:
+      - go-test
+      - docker-test
+    if: github.event_name != 'pull_request'
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build frontend docker image
+        uses: docker/build-push-action@v4
+        with:
+          context: '{{defaultContext}}:frontend'
+          platforms: linux/amd64,linux/arm64,linux/386,linux/arm/v7
+          push: true
+          tags: |
+            xddxdd/bird-lg-go:develop
+            xddxdd/bird-lg-go:develop-${{ github.sha }}
+            ghcr.io/xddxdd/bird-lg-go:frontend-develop
+            ghcr.io/xddxdd/bird-lg-go:frontend-develop-${{ github.sha }}
+
+      - name: Build proxy docker image
+        uses: docker/build-push-action@v4
+        with:
+          context: '{{defaultContext}}:proxy'
+          platforms: linux/amd64,linux/arm64,linux/386,linux/arm/v7
+          push: true
+          tags: |
+            xddxdd/bird-lgproxy-go:develop
+            xddxdd/bird-lgproxy-go:develop-${{ github.sha }}
+            ghcr.io/xddxdd/bird-lg-go:proxy-develop
+            ghcr.io/xddxdd/bird-lg-go:proxy-develop-${{ github.sha }}
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -3,10 +3,11 @@ on:
    types: [created]

 jobs:
-  releases-matrix:
+  go-release:
    name: Release Go Binary
    runs-on: ubuntu-latest
    strategy:
+      fail-fast: false
      matrix:
        goos: [linux, windows, darwin]
        goarch: ["386", amd64, "arm", arm64]
@@ -18,18 +19,69 @@ jobs:
          - goarch: "arm"
            goos: windows
    steps:
-    - uses: actions/checkout@v3
-    - uses: wangyoucao577/go-release-action@v1.34
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: Release frontend
+      uses: wangyoucao577/go-release-action@v1.40
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        goos: ${{ matrix.goos }}
        goarch: ${{ matrix.goarch }}
        project_path: "./frontend"
        binary_name: "bird-lg-go"
-    - uses: wangyoucao577/go-release-action@v1.34
+
+    - name: Release proxy
+      uses: wangyoucao577/go-release-action@v1.40
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        goos: ${{ matrix.goos }}
        goarch: ${{ matrix.goarch }}
        project_path: "./proxy"
        binary_name: "bird-lgproxy-go"
+
+  docker-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build frontend docker image
+        uses: docker/build-push-action@v4
+        with:
+          context: '{{defaultContext}}:frontend'
+          platforms: linux/amd64,linux/arm64,linux/386,linux/arm/v7
+          push: true
+          tags: |
+            xddxdd/bird-lg-go:latest
+            xddxdd/bird-lg-go:${{ github.event.release.tag_name }}
+            ghcr.io/xddxdd/bird-lg-go:frontend
+            ghcr.io/xddxdd/bird-lg-go:frontend-${{ github.event.release.tag_name }}
+
+      - name: Build proxy docker image
+        uses: docker/build-push-action@v4
+        with:
+          context: '{{defaultContext}}:proxy'
+          platforms: linux/amd64,linux/arm64,linux/386,linux/arm/v7
+          push: true
+          tags: |
+            xddxdd/bird-lgproxy-go:latest
+            xddxdd/bird-lgproxy-go:${{ github.event.release.tag_name }}
+            ghcr.io/xddxdd/bird-lg-go:proxy
+            ghcr.io/xddxdd/bird-lg-go:proxy-${{ github.event.release.tag_name }}
--- a/README.md
+++ b/README.md
@@ -90,7 +90,8 @@ Example: the following docker-compose.yml entry does the same as above, but by s
 ```yaml
 services:
  bird-lg:
-    image: xddxdd/bird-lg-go
+    # Use xddxdd/bird-lg-go:develop for the latest build from master branch
+    image: xddxdd/bird-lg-go:latest
    container_name: bird-lg
    restart: always
    environment:
@@ -124,7 +125,7 @@ Configuration is handled by [viper](https://github.com/spf13/viper), any config

 | Config Key | Parameter | Environment Variable | Description |
 | ---------- | --------- | -------------------- | ----------- |
-| allowed_ips | --allowed | ALLOWED_IPS | IPs allowed to access this proxy, separated by commas. Don't set to allow all IPs. (default "") |
+| allowed_ips | --allowed | ALLOWED_IPS | IPs or networks allowed to access this proxy, separated by commas. Don't set to allow all IPs. (default "") |
 | bird_socket | --bird | BIRD_SOCKET | socket file for bird, set either in parameter or environment variable BIRD_SOCKET (default "/var/run/bird/bird.ctl") |
 | listen | --listen | BIRDLG_PROXY_PORT | listen address, set either in parameter or environment variable  BIRDLG_PROXY_PORT(default "8000") |
 | traceroute_bin | --traceroute_bin | BIRDLG_TRACEROUTE_BIN | traceroute binary file, set either in parameter or environment variable  BIRDLG_TRACEROUTE_BIN |
@@ -165,7 +166,8 @@ Example: the following docker-compose.yml entry does the same as above, but by s
 ```yaml
 services:
  bird-lgproxy:
-    image: xddxdd/bird-lgproxy-go
+    # Use xddxdd/bird-lgproxy-go:develop for the latest build from master branch
+    image: xddxdd/bird-lgproxy-go:latest
    container_name: bird-lgproxy
    restart: always
    volumes:
--- a/2
+++ b/2
@@ -1 +1 @@
-v1.3.1
+v1.3.3
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:buster AS step_0
+FROM golang AS step_0
 ENV CGO_ENABLED=0 GO111MODULE=on
 WORKDIR /root
 COPY . .
@@ -6,6 +6,28 @@ RUN go build -ldflags "-w -s" -o /frontend

 ################################################################################

-FROM scratch AS step_1
+FROM alpine:edge AS step_1
+
+WORKDIR /root
+RUN apk add --no-cache build-base pkgconf perl gettext \
+    libidn2-dev libidn2-static libunistring-dev libunistring-static gnu-libiconv-dev
+
+RUN wget https://github.com/rfc1036/whois/archive/refs/tags/v5.5.18.tar.gz \
+    -O whois-5.5.18.tar.gz
+
+RUN tar xvf whois-5.5.18.tar.gz \
+    && cd whois-5.5.18 \
+    && sed -i "s/#if defined _POSIX_C_SOURCE && _POSIX_C_SOURCE >= 200112L/#if 1/g" config.h \
+    && make whois -j4 \
+      LDFLAGS="-static" CONFIG_FILE="/etc/whois.conf" PKG_CONFIG="pkg-config --static" HAVE_ICONV=1 \
+    && strip /root/whois-5.5.18/whois
+
+################################################################################
+
+FROM scratch AS step_2
+ENV PATH=/
+ENV BIRDLG_WHOIS=/whois
 COPY --from=step_0 /frontend /
+COPY --from=step_1 /root/whois-5.5.18/whois /
+COPY --from=step_1 /etc/services /etc/services
 ENTRYPOINT ["/frontend"]
--- a/frontend/go.mod
+++ b/frontend/go.mod
@@ -5,10 +5,10 @@ go 1.17
 require (
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/gorilla/handlers v1.5.1
-	github.com/jarcoal/httpmock v1.3.0
+	github.com/jarcoal/httpmock v1.3.1
 	github.com/magiconair/properties v1.8.7
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.16.0
+	github.com/spf13/viper v1.17.0
 )

 require (
@@ -16,14 +16,18 @@ require (
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
-	github.com/spf13/afero v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
+	github.com/sagikazarmark/locafero v0.3.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.10.0 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/subosito/gotenv v1.4.2 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	go.uber.org/atomic v1.9.0 // indirect
+	go.uber.org/multierr v1.9.0 // indirect
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
+	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
--- a/frontend/go.sum
+++ b/frontend/go.sum
--- a/frontend/whois.go
+++ b/frontend/whois.go
@@ -25,13 +25,14 @@ func whois(s string) string {

 		cmd := exec.Command(args[0], args[1:]...)
 		output, err := cmd.CombinedOutput()
-		if err != nil {
-			return err.Error()
-		}
 		if len(output) > 65535 {
 			output = output[:65535]
 		}
-		return string(output)
+		if err != nil {
+			return err.Error() + "\n" + string(output)
+		} else {
+			return string(output)
+		}
 	} else {
 		buf := make([]byte, 65536)

@@ -50,7 +51,7 @@ func whois(s string) string {

 		n, err := io.ReadFull(conn, buf)
 		if err != nil && err != io.EOF && err != io.ErrUnexpectedEOF {
-			return err.Error()
+			return err.Error() + "\n" + string(buf[:n])
 		}
 		return string(buf[:n])
 	}
--- a/proxy/Dockerfile
+++ b/proxy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:buster AS step_0
+FROM golang AS step_0

 ENV CGO_ENABLED=0 GO111MODULE=on
 WORKDIR /root
@@ -11,17 +11,18 @@ FROM alpine:edge AS step_1

 WORKDIR /root
 RUN apk add --no-cache build-base linux-headers
-RUN wget https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.0/traceroute-2.1.0.tar.gz/download \
-    -O traceroute-2.1.0.tar.gz
-RUN tar xvf traceroute-2.1.0.tar.gz \
-    && cd traceroute-2.1.0 \
+
+RUN wget https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/traceroute-2.1.3.tar.gz/download \
+    -O traceroute-2.1.3.tar.gz
+RUN tar xvf traceroute-2.1.3.tar.gz \
+    && cd traceroute-2.1.3 \
    && make -j4 LDFLAGS="-static" \
-    && strip /root/traceroute-2.1.0/traceroute/traceroute
+    && strip /root/traceroute-2.1.3/traceroute/traceroute

 ################################################################################

 FROM scratch AS step_2
 ENV PATH=/
 COPY --from=step_0 /proxy /
-COPY --from=step_1 /root/traceroute-2.1.0/traceroute/traceroute /
+COPY --from=step_1 /root/traceroute-2.1.3/traceroute/traceroute /
 ENTRYPOINT ["/proxy"]
--- a/proxy/go.mod
+++ b/proxy/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/gorilla/handlers v1.5.1
 	github.com/magiconair/properties v1.8.7
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.16.0
+	github.com/spf13/viper v1.17.0
 )

 require (
@@ -15,14 +15,18 @@ require (
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
-	github.com/spf13/afero v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
+	github.com/sagikazarmark/locafero v0.3.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.10.0 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/subosito/gotenv v1.4.2 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	go.uber.org/atomic v1.9.0 // indirect
+	go.uber.org/multierr v1.9.0 // indirect
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
+	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
--- a/proxy/go.sum
+++ b/proxy/go.sum
--- a/proxy/main.go
+++ b/proxy/main.go
@@ -22,8 +22,8 @@ func invalidHandler(httpW http.ResponseWriter, httpR *http.Request) {
 }

 func hasAccess(remoteAddr string) bool {
-	// setting.allowedIPs will always have at least one element because of how it's defined
-	if len(setting.allowedIPs) == 0 {
+	// setting.allowedNets will always have at least one element because of how it's defined
+	if len(setting.allowedNets) == 0 {
 		return true
 	}

@@ -40,8 +40,8 @@ func hasAccess(remoteAddr string) bool {
 		return false
 	}

-	for _, allowedIP := range setting.allowedIPs {
-		if ipObject.Equal(allowedIP) {
+	for _, net := range setting.allowedNets {
+		if net.Contains(ipObject) {
 			return true
 		}
 	}
@@ -49,7 +49,7 @@ func hasAccess(remoteAddr string) bool {
 	return false
 }

-// Access handler, check to see if client IP in allowed IPs, continue if it is, send to invalidHandler if not
+// Access handler, check to see if client IP in allowed nets, continue if it is, send to invalidHandler if not
 func accessHandler(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(httpW http.ResponseWriter, httpR *http.Request) {
 		if hasAccess(httpR.RemoteAddr) {
@@ -61,12 +61,12 @@ func accessHandler(next http.Handler) http.Handler {
 }

 type settingType struct {
-	birdSocket string
-	listen     string
-	allowedIPs []net.IP
-	tr_bin     string
-	tr_flags   []string
-	tr_raw     bool
+	birdSocket  string
+	listen      string
+	allowedNets []*net.IPNet
+	tr_bin      string
+	tr_flags    []string
+	tr_raw      bool
 }

 var setting settingType
--- a/proxy/main_test.go
+++ b/proxy/main_test.go
@@ -10,42 +10,61 @@ import (
 )

 func TestHasAccessNotConfigured(t *testing.T) {
-	setting.allowedIPs = []net.IP{}
+	setting.allowedNets = []*net.IPNet{}
 	assert.Equal(t, hasAccess("whatever"), true)
 }

 func TestHasAccessAllowIPv4(t *testing.T) {
-	setting.allowedIPs = []net.IP{net.ParseIP("1.2.3.4")}
+	_, netip, _ := net.ParseCIDR("1.2.3.4/32")
+	setting.allowedNets = []*net.IPNet{netip}
+	assert.Equal(t, hasAccess("1.2.3.4:4321"), true)
+}
+
+func TestHasAccessAllowIPv4Net(t *testing.T) {
+	_, netip, _ := net.ParseCIDR("1.2.3.0/24")
+	setting.allowedNets = []*net.IPNet{netip}
 	assert.Equal(t, hasAccess("1.2.3.4:4321"), true)
 }

 func TestHasAccessDenyIPv4(t *testing.T) {
-	setting.allowedIPs = []net.IP{net.ParseIP("4.3.2.1")}
+	_, netip, _ := net.ParseCIDR("4.3.2.1/32")
+	setting.allowedNets = []*net.IPNet{netip}
 	assert.Equal(t, hasAccess("1.2.3.4:4321"), false)
 }

 func TestHasAccessAllowIPv6(t *testing.T) {
-	setting.allowedIPs = []net.IP{net.ParseIP("2001:db8::1")}
+	_, netip, _ := net.ParseCIDR("2001:db8::1/128")
+	setting.allowedNets = []*net.IPNet{netip}
+	assert.Equal(t, hasAccess("[2001:db8::1]:4321"), true)
+}
+
+func TestHasAccessAllowIPv6Net(t *testing.T) {
+	_, netip, _ := net.ParseCIDR("2001:db8::/64")
+	setting.allowedNets = []*net.IPNet{netip}
 	assert.Equal(t, hasAccess("[2001:db8::1]:4321"), true)
 }

 func TestHasAccessAllowIPv6DifferentForm(t *testing.T) {
-	setting.allowedIPs = []net.IP{net.ParseIP("2001:0db8::1")}
+	_, netip, _ := net.ParseCIDR("2001:db8::1/128")
+	setting.allowedNets = []*net.IPNet{netip}
 	assert.Equal(t, hasAccess("[2001:db8::1]:4321"), true)
 }

 func TestHasAccessDenyIPv6(t *testing.T) {
-	setting.allowedIPs = []net.IP{net.ParseIP("2001:db8::2")}
+	_, netip, _ := net.ParseCIDR("2001:db8::2/128")
+	setting.allowedNets = []*net.IPNet{netip}
 	assert.Equal(t, hasAccess("[2001:db8::1]:4321"), false)
 }

 func TestHasAccessBadClientIP(t *testing.T) {
-	setting.allowedIPs = []net.IP{net.ParseIP("1.2.3.4")}
+	_, netip, _ := net.ParseCIDR("1.2.3.4/32")
+	setting.allowedNets = []*net.IPNet{netip}
 	assert.Equal(t, hasAccess("not an IP"), false)
 }

 func TestHasAccessBadClientIPPort(t *testing.T) {
-	setting.allowedIPs = []net.IP{net.ParseIP("1.2.3.4")}
+	_, netip, _ := net.ParseCIDR("1.2.3.4/32")
+	setting.allowedNets = []*net.IPNet{netip}
 	assert.Equal(t, hasAccess("not an IP:not a port"), false)
 }

@@ -57,7 +76,8 @@ func TestAccessHandlerAllow(t *testing.T) {
 	r.RemoteAddr = "1.2.3.4:4321"
 	w := httptest.NewRecorder()

-	setting.allowedIPs = []net.IP{net.ParseIP("1.2.3.4")}
+	_, netip, _ := net.ParseCIDR("1.2.3.4/32")
+	setting.allowedNets = []*net.IPNet{netip}

 	wrappedHandler.ServeHTTP(w, r)
 	assert.Equal(t, w.Code, http.StatusNotFound)
@@ -71,7 +91,8 @@ func TestAccessHandlerDeny(t *testing.T) {
 	r.RemoteAddr = "1.2.3.4:4321"
 	w := httptest.NewRecorder()

-	setting.allowedIPs = []net.IP{net.ParseIP("4.3.2.1")}
+	_, netip, _ := net.ParseCIDR("4.3.2.1/32")
+	setting.allowedNets = []*net.IPNet{netip}

 	wrappedHandler.ServeHTTP(w, r)
 	assert.Equal(t, w.Code, http.StatusInternalServerError)
--- a/proxy/settings.go
+++ b/proxy/settings.go
@@ -13,7 +13,7 @@ import (
 type viperSettingType struct {
 	BirdSocket      string `mapstructure:"bird_socket"`
 	Listen          string `mapstructure:"listen"`
-	AllowedIPs      string `mapstructure:"allowed_ips"`
+	AllowedNets     string `mapstructure:"allowed_ips"`
 	TracerouteBin   string `mapstructure:"traceroute_bin"`
 	TracerouteFlags string `mapstructure:"traceroute_flags"`
 	TracerouteRaw   bool   `mapstructure:"traceroute_raw"`
@@ -40,7 +40,7 @@ func parseSettings() {
 	pflag.String("listen", "8000", "listen address, set either in parameter or environment variable BIRDLG_PROXY_PORT")
 	viper.BindPFlag("listen", pflag.Lookup("listen"))

-	pflag.String("allowed", "", "IPs allowed to access this proxy, separated by commas. Don't set to allow all IPs.")
+	pflag.String("allowed", "", "IPs or networks allowed to access this proxy, separated by commas. Don't set to allow all IPs.")
 	viper.BindPFlag("allowed_ips", pflag.Lookup("allowed"))

 	pflag.String("traceroute_bin", "", "traceroute binary file, set either in parameter or environment variable BIRDLG_TRACEROUTE_BIN")
@@ -66,18 +66,31 @@ func parseSettings() {
 	setting.birdSocket = viperSettings.BirdSocket
 	setting.listen = viperSettings.Listen

-	if viperSettings.AllowedIPs != "" {
-		for _, ip := range strings.Split(viperSettings.AllowedIPs, ",") {
-			ipObject := net.ParseIP(ip)
-			if ipObject == nil {
-				fmt.Printf("Parse IP %s failed\n", ip)
-				continue
+	if viperSettings.AllowedNets != "" {
+		for _, arg := range strings.Split(viperSettings.AllowedNets, ",") {
+
+			// if argument is an IP address, convert to CIDR by adding a suitable mask
+			if !strings.Contains(arg, "/") {
+				if strings.Contains(arg, ":") {
+					// IPv6 address with /128 mask
+					arg += "/128"
+				} else {
+					// IPv4 address with /32 mask
+					arg += "/32"
+				}
 			}

-			setting.allowedIPs = append(setting.allowedIPs, ipObject)
+			// parse the network
+			_, netip, err := net.ParseCIDR(arg)
+			if err != nil {
+				fmt.Printf("Failed to parse CIDR %s: %s\n", arg, err.Error())
+				continue
+			}
+			setting.allowedNets = append(setting.allowedNets, netip)
+
 		}
 	} else {
-		setting.allowedIPs = []net.IP{}
+		setting.allowedNets = []*net.IPNet{}
 	}

 	var err error
Author	SHA1	Message	Date
Lan Tian	27c348a864	release: v1.3.3	2023-10-21 00:03:02 -07:00
Lan Tian	43b4ad93dd	general: only build docker develop images on master branch push	2023-10-08 21:08:07 -07:00
dependabot[bot]	6176c45006	build(deps): bump github.com/spf13/viper from 1.16.0 to 1.17.0 in /proxy (#86 ) Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.16.0 to 1.17.0. - [Release notes](https://github.com/spf13/viper/releases) - [Commits](https://github.com/spf13/viper/compare/v1.16.0...v1.17.0) --- updated-dependencies: - dependency-name: github.com/spf13/viper dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-08 21:04:12 -07:00
dependabot[bot]	47113184f4	build(deps): bump github.com/spf13/viper in /frontend (#85 ) Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.16.0 to 1.17.0. - [Release notes](https://github.com/spf13/viper/releases) - [Commits](https://github.com/spf13/viper/compare/v1.16.0...v1.17.0) --- updated-dependencies: - dependency-name: github.com/spf13/viper dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-08 21:04:04 -07:00
Simon Marsh	3c9a3e4339	Enable proxy to allow access by CIDR network as well as IP (#84 )	2023-10-04 21:33:37 -07:00
Lan Tian	8457b18d46	release: v1.3.2.2	2023-09-09 01:44:16 -07:00
Lan Tian	f8f64b03a6	general: add tag for release Docker images	2023-09-09 01:42:38 -07:00
Lan Tian	cc818c1cc0	release: v1.3.2.1	2023-09-09 01:33:24 -07:00
Lan Tian	6224b43808	general: update GitHub actions	2023-09-09 01:32:56 -07:00
Lan Tian	17e0b14243	general: update GitHub actions	2023-09-09 01:29:49 -07:00
Lan Tian	b4c1bed9ba	release: v1.3.2	2023-09-09 01:23:14 -07:00
Lan Tian	abb32abff3	general: add unit test for docker images	2023-09-08 18:45:58 -07:00
Lan Tian	b368c75aa3	frontend: fix whois client cannot get default whois port	2023-09-08 18:38:23 -07:00
Lan Tian	09405cdb38	frontend: also print whois client output on error	2023-09-08 18:22:31 -07:00
Lan Tian	f999d47d9f	frontend: force enable whois client regex parser on alpine/musl	2023-09-07 19:14:04 -07:00
Lan Tian	005dfb1435	frontend: make docker image whois client try to use config file	2023-09-07 00:51:56 -07:00
Lan Tian	4bd7a6bb95	general: also release docker image to GitHub container registry	2023-09-06 21:06:10 -07:00
Lan Tian	462d76a2d0	general: reenable docker multiarch build	2023-09-06 21:02:32 -07:00
Lan Tian	58f217578c	readme: add note about development version of docker image	2023-09-06 20:59:27 -07:00
Lan Tian	0e95727de1	general: reorganize GitHub Actions workflows and readd unit test	2023-09-06 20:55:45 -07:00
Lan Tian	a48f1c8040	general: move Docker image build to GitHub Actions	2023-09-06 20:48:14 -07:00
Lan Tian	81acde3a37	frontend: add whois client for more complex whois lookup	2023-09-06 20:35:30 -07:00
Lan Tian	7c0fe0d512	proxy: update traceroute version in Docker image	2023-09-06 20:33:40 -07:00
dependabot[bot]	a5f4452d02	build(deps): bump github.com/jarcoal/httpmock in /frontend (#82 ) Bumps [github.com/jarcoal/httpmock](https://github.com/jarcoal/httpmock) from 1.3.0 to 1.3.1. - [Release notes](https://github.com/jarcoal/httpmock/releases) - [Commits](https://github.com/jarcoal/httpmock/compare/v1.3.0...v1.3.1) --- updated-dependencies: - dependency-name: github.com/jarcoal/httpmock dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-08-25 00:44:30 -07:00