uninterruptible 2.2.1 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ec0c8eaf7fcd4e6be024f10c74ea412c7b2e1c4a
-  data.tar.gz: 4dc641d56fcbdbf69237db8366ad89e094fd4008
+  metadata.gz: 4b2930d6fcae73edfbb4d6f39cd6e5995304d8a5
+  data.tar.gz: 6c22d922f5cd20810d5849d322af57bb69a22abe
 SHA512:
-  metadata.gz: 445bb79aef41ed50720a674fc9df82461eed9a63231648d53fe4cb567cc9900638f359709f060712c8c332a47596d1be9971e676b63d417d03bf060abc659af2
-  data.tar.gz: c72b8005bd3a954ad35d98555566e3fcdb67055b2b7d6b1764273515ec4f4864e9bf150b5260b56d95a16588ce692b14538e16687b386678cb9d4938b0b13a17
+  metadata.gz: 32742c8851a675116a8489b3f62b666eb0e1ede1ba54f9682d0c47287ead8d1ba6c4abe50bd9755f8bd1d579b35d20e880f3aa2b3328569cf45413104a322343
+  data.tar.gz: 740993f1d8a5d940acd874ba3f990846dfde887dd26124fd0944f59ef7d542104890ed879b4cb7bc369a8248318ec2fb98932433ac7e556ef3efc97f0aa73de7

data/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+# 2.3.0
+* Incoming connections can be restricted to certain networks by setting `allowed_networks` in the configuration.
+
 # 2.2.1
 * Allow multiple certificates to be used in one build file
 

data/README.md

@@ -69,6 +69,7 @@ echo_server.configure do |config|
   config.tls_certificate = nil # Certificate to use for TLS, reads file from ENV['TLS_CERTIFICATE'] if set
   config.verify_client_tls_certificate = false # Should client TLS certificates be required and verifiyed? Falls back to ENV['VERIFY_CLIENT_TLS_CERTIFICATE']
   config.client_tls_certificate_ca = nil # Path to a trusted CA for client certificates. Implies `config.verify_client_tls_certificate = true`. Falls back to ENV['CLIENT_TLS_CERTIFICATE_CA']
+  config.allowed_networks = ['127.0.0.1/8', '2001:db8::/32'] # A list of networks that clients are allowed to connect from. If blank, all networks are allowed. Falls back to a comma-separated list from ENV['ALLOWED_NETWORKS']
 end
 ```
 
@@ -96,8 +97,8 @@ By default, Uninterruptible operates on a very simple one thread per connection
 something more advanced such as a threadpool or an event driven pattern you can define this in your server class.
 
 By overriding `accept_client_connection` you can change how connections are accepted and handled. It is recommended
-that you call `process_request` from this method and still implement `handle_request` to do the bulk of the work since
-`process_request` tracks the number of active connections to the server.
+that you call `process_request` from this method and implement `handle_request` to do the bulk of the work since
+`process_request` tracks the number of active connections to the server and handles network restrictions.
 
 `accept_client_connection` is called whenever a connection is waiting to be accepted on the socket server.
 

data/lib/uninterruptible/configuration.rb

@@ -6,7 +6,7 @@ module Uninterruptible
     AVAILABLE_SSL_VERSIONS = %w[TLSv1_1 TLSv1_2].freeze
 
     attr_writer :bind, :bind_port, :bind_address, :pidfile_path, :start_command, :log_path, :log_level, :tls_version,
-      :tls_key, :tls_certificate, :verify_client_tls_certificate, :client_tls_certificate_ca
+      :tls_key, :tls_certificate, :verify_client_tls_certificate, :client_tls_certificate_ca, :allowed_networks
 
     # Available TCP Port for the server to bind to (required). Falls back to environment variable PORT if set.
     #
@@ -94,5 +94,17 @@ module Uninterruptible
     def client_tls_certificate_ca
       @client_tls_certificate_ca || ENV['CLIENT_TLS_CERTIFICATE_CA']
     end
+
+    # Specifiy allowed networks to reject all connections except those originating from allowed networks. Set to an
+    # array of networks in CIDR format. If environment variable ALLOWED_NETWORKS is set, a comma separated list will be
+    # read from that. Setting this enables #block_connections?
+    def allowed_networks
+      @allowed_networks || (ENV['ALLOWED_NETWORKS'] && ENV['ALLOWED_NETWORKS'].split(',')) || []
+    end
+
+    # True when allowed_networks is set
+    def block_connections?
+      !allowed_networks.empty?
+    end
   end
 end

data/lib/uninterruptible/network_restrictions.rb

@@ -0,0 +1,39 @@
+module Uninterruptible
+  class NetworkRestrictions
+    attr_reader :configuration
+
+    # @param [Uninterruptible::Configuration] configuration Object with allowed_networks configuration
+    def initialize(configuration)
+      @configuration = configuration
+      check_configuration!
+    end
+
+    # Should the incoming connection be allowed to connect?
+    #
+    # @param [TCPSocket] client_socket Incoming socket from the client connection
+    def connection_allowed_from?(client_address)
+      return true unless configuration.block_connections?
+      allowed_networks.any? { |allowed_network| allowed_network.include?(client_address) }
+    end
+
+    private
+
+    # Parse the list of allowed networks from the configuration and turn them into IPAddr objects
+    #
+    # @return [Array<IPAddr>] Parsed list of IP networks
+    def allowed_networks
+      @allowed_networks ||= configuration.allowed_networks.map do |network|
+        IPAddr.new(network)
+      end
+    end
+
+    # Check the configuration parameters for network restrictions
+    #
+    # @raise [Uninterruptible::ConfigurationError] Correct options are not set for network restrictions
+    def check_configuration!
+      unless configuration.bind.start_with?('tcp://')
+        raise ConfigurationError, "Network restrictions can only be used on TCP servers"
+      end
+    end
+  end
+end

data/lib/uninterruptible/server.rb

@@ -89,7 +89,6 @@ module Uninterruptible
     # concurrency model.
     def accept_client_connection
       Thread.start(socket_server.accept_nonblock) do |client_socket|
-        logger.debug "Accepted connection from #{client_socket.peeraddr.last}"
         process_request(client_socket)
       end
     end
@@ -101,7 +100,13 @@ module Uninterruptible
     def process_request(client_socket)
       mutex.synchronize { @active_connections += 1 }
       begin
-        handle_request(client_socket)
+        client_address = client_socket.peeraddr.last
+        if network_restrictions.connection_allowed_from?(client_address)
+          logger.debug "Accepting connection from #{client_address}"
+          handle_request(client_socket)
+        else
+          logger.debug "Rejecting connection from #{client_address}"
+        end
       ensure
         client_socket.close
         mutex.synchronize { @active_connections -= 1 }
@@ -196,6 +201,10 @@ module Uninterruptible
       end
     end
 
+    def network_restrictions
+      @network_restrictions ||= Uninterruptible::NetworkRestrictions.new(server_configuration)
+    end
+
     # The current configuration of this server
     #
     # @return [Uninterruptible::Configuration] Current or new configuration if unset.

data/lib/uninterruptible/version.rb

@@ -1,3 +1,3 @@
 module Uninterruptible
-  VERSION = "2.2.1".freeze
+  VERSION = "2.3.0".freeze
 end

data/lib/uninterruptible.rb

@@ -1,8 +1,11 @@
 require 'openssl'
+require 'ipaddr'
+
 require "uninterruptible/version"
 require 'uninterruptible/ssl_extensions'
 require 'uninterruptible/configuration'
 require 'uninterruptible/binder'
+require 'uninterruptible/network_restrictions'
 require 'uninterruptible/tls_server_factory'
 require 'uninterruptible/server'
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: uninterruptible
 version: !ruby/object:Gem::Version
-  version: 2.2.1
+  version: 2.3.0
 platform: ruby
 authors:
 - Dan Wentworth
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-10-06 00:00:00.000000000 Z
+date: 2018-03-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -75,6 +75,7 @@ files:
 - lib/uninterruptible.rb
 - lib/uninterruptible/binder.rb
 - lib/uninterruptible/configuration.rb
+- lib/uninterruptible/network_restrictions.rb
 - lib/uninterruptible/server.rb
 - lib/uninterruptible/ssl_extensions.rb
 - lib/uninterruptible/tls_server_factory.rb
@@ -100,7 +101,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.5.2.1
 signing_key: 
 specification_version: 4
 summary: Zero-downtime restarts for your trivial socket servers