traefik/middlewares/ip_whitelister.go

package middlewares

import (
	"fmt"
	"net/http"

	"github.com/containous/traefik/ip"
	"github.com/containous/traefik/log"
	"github.com/containous/traefik/middlewares/tracing"
	"github.com/pkg/errors"
	"github.com/urfave/negroni"
)

// IPWhiteLister is a middleware that provides Checks of the Requesting IP against a set of Whitelists
type IPWhiteLister struct {
	handler     negroni.Handler
	whiteLister *ip.Checker
	strategy    ip.Strategy
}

// NewIPWhiteLister builds a new IPWhiteLister given a list of CIDR-Strings to whitelist
func NewIPWhiteLister(whiteList []string, strategy ip.Strategy) (*IPWhiteLister, error) {
	if len(whiteList) == 0 {
		return nil, errors.New("no white list provided")
	}

	checker, err := ip.NewChecker(whiteList)
	if err != nil {
		return nil, fmt.Errorf("parsing CIDR whitelist %s: %v", whiteList, err)
	}

	whiteLister := IPWhiteLister{
		strategy:    strategy,
		whiteLister: checker,
	}

	whiteLister.handler = negroni.HandlerFunc(whiteLister.handle)
	log.Debugf("configured IP white list: %s", whiteList)

	return &whiteLister, nil
}

func (wl *IPWhiteLister) handle(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
	err := wl.whiteLister.IsAuthorized(wl.strategy.GetIP(r))
	if err != nil {
		tracing.SetErrorAndDebugLog(r, "request %+v - rejecting: %v", r, err)
		reject(w)
		return
	}
	log.Debugf("Accept %s: %+v", wl.strategy.GetIP(r), r)
	tracing.SetErrorAndDebugLog(r, "request %+v matched white list %v - passing", r, wl.whiteLister)
	next.ServeHTTP(w, r)
}

func (wl *IPWhiteLister) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
	wl.handler.ServeHTTP(rw, r, next)
}

func reject(w http.ResponseWriter) {
	statusCode := http.StatusForbidden

	w.WriteHeader(statusCode)
	_, err := w.Write([]byte(http.StatusText(statusCode)))
	if err != nil {
		log.Error(err)
	}
}