cidr.go RawHistoryFolder

1package middleware
2
3import (
4	"encoding/json"
5	"net"
6	"net/http"
7
8	"github.com/bnema/zerowrap"
9
10	"github.com/bnema/gordon/internal/adapters/dto"
11)
12
13// localhostNets contains IPv4 and IPv6 loopback ranges that are always allowed.
14var localhostNets = ParseTrustedProxies([]string{"127.0.0.0/8", "::1"})
15
16// RegistryCIDRAllowlist returns middleware that restricts access to the given CIDR ranges.
17// Localhost is always allowed so Gordon can pull from its own registry.
18// An empty allowedNets slice is a no-op (all traffic passes through).
19func RegistryCIDRAllowlist(allowedNets, trustedNets []*net.IPNet, log zerowrap.Logger) func(http.Handler) http.Handler {
20	return func(next http.Handler) http.Handler {
21		if len(allowedNets) == 0 {
22			return next
23		}
24		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
25			clientIP := GetClientIP(r, trustedNets)
26
27			// Always allow localhost — Gordon must reach its own registry.
28			if IsTrustedProxy(clientIP, localhostNets) {
29				next.ServeHTTP(w, r)
30				return
31			}
32
33			if IsTrustedProxy(clientIP, allowedNets) {
34				next.ServeHTTP(w, r)
35				return
36			}
37
38			log.Warn().
39				Str(zerowrap.FieldLayer, "adapter").
40				Str(zerowrap.FieldAdapter, "http").
41				Str(zerowrap.FieldMethod, r.Method).
42				Str(zerowrap.FieldPath, r.URL.Path).
43				Str(zerowrap.FieldClientIP, clientIP).
44				Msg("registry access denied by CIDR allowlist")
45
46			w.Header().Set("Content-Type", "application/json")
47			w.WriteHeader(http.StatusForbidden)
48			_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Forbidden"})
49		})
50	}
51}