From da0d1cb754339eed125a5b0ee22386efbef7bb3f Mon Sep 17 00:00:00 2001 From: Matt <5032824+mdawsonuk@users.noreply.github.com> Date: Wed, 15 Dec 2021 23:05:51 +0000 Subject: [PATCH 1/2] Log successful login attempts in addition to failed ones --- internal/home/auth.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/internal/home/auth.go b/internal/home/auth.go index bfcc7267..f3001153 100644 --- a/internal/home/auth.go +++ b/internal/home/auth.go @@ -455,10 +455,11 @@ func handleLogin(w http.ResponseWriter, r *http.Request) { return } + + var ip net.IP + ip, err = realIP(r) if len(cookie) == 0 { - var ip net.IP - ip, err = realIP(r) if err != nil { log.Info("auth: getting real ip from request: %s", err) } else if ip == nil { @@ -473,6 +474,15 @@ func handleLogin(w http.ResponseWriter, r *http.Request) { return } + + if err != nil { + log.Info("auth: getting real ip from request: %s", err) + } else if ip == nil { + // Technically shouldn't happen. + log.Info("auth: user %q successfully logged in from unknown ip", req.Name) + } else { + log.Info("auth: user %q successfully logged in from ip %q", req.Name, ip) + } w.Header().Set("Set-Cookie", cookie) From d317e192910101b5e24a7b4f1a3d3a222f3572cf Mon Sep 17 00:00:00 2001 From: Ainar Garipov Date: Wed, 22 Dec 2021 21:27:36 +0300 Subject: [PATCH 2/2] home: imp auth --- internal/dnsforward/config.go | 8 ++--- internal/home/auth.go | 55 ++++++++++++++--------------------- 2 files changed, 26 insertions(+), 37 deletions(-) diff --git a/internal/dnsforward/config.go b/internal/dnsforward/config.go index 3834f79d..0c1ca017 100644 --- a/internal/dnsforward/config.go +++ b/internal/dnsforward/config.go @@ -98,10 +98,10 @@ type FilteringConfig struct { AllowedClients []string `yaml:"allowed_clients"` // IP addresses of whitelist clients DisallowedClients []string `yaml:"disallowed_clients"` // IP addresses of clients that should be blocked BlockedHosts []string `yaml:"blocked_hosts"` // hosts that should be blocked - // TrustedProxies is the list of IP addresses and CIDR networks to - // detect proxy servers addresses the DoH requests from which should be - // handled. The value of nil or an empty slice for this field makes - // Proxy not trust any address. + // TrustedProxies is the list of IP addresses and CIDR networks to detect + // proxy servers addresses the DoH requests from which should be handled. + // The value of nil or an empty slice for this field makes Proxy not trust + // any address. TrustedProxies []string `yaml:"trusted_proxies"` // DNS cache settings diff --git a/internal/home/auth.go b/internal/home/auth.go index f3001153..0477630d 100644 --- a/internal/home/auth.go +++ b/internal/home/auth.go @@ -403,8 +403,8 @@ func realIP(r *http.Request) (ip net.IP, err error) { return ip, nil } - // When everything else fails, just return the remote address as - // understood by the stdlib. + // When everything else fails, just return the remote address as understood + // by the stdlib. ipStr, err := netutil.SplitHost(r.RemoteAddr) if err != nil { return nil, fmt.Errorf("getting ip from client addr: %w", err) @@ -423,7 +423,8 @@ func handleLogin(w http.ResponseWriter, r *http.Request) { } var remoteAddr string - // The realIP couldn't be used here due to security issues. + // realIP cannot be used here without taking TrustedProxies into accound due + // to security issues. // // See https://github.com/AdguardTeam/AdGuardHome/issues/2799. // @@ -437,12 +438,7 @@ func handleLogin(w http.ResponseWriter, r *http.Request) { if blocker := Context.auth.blocker; blocker != nil { if left := blocker.check(remoteAddr); left > 0 { w.Header().Set("Retry-After", strconv.Itoa(int(left.Seconds()))) - httpError( - w, - http.StatusTooManyRequests, - "auth: blocked for %s", - left, - ) + httpError(w, http.StatusTooManyRequests, "auth: blocked for %s", left) return } @@ -455,40 +451,33 @@ func handleLogin(w http.ResponseWriter, r *http.Request) { return } - - var ip net.IP - ip, err = realIP(r) + + // Use realIP here, since this IP address is only used for logging. + ip, err := realIP(r) + if err != nil { + log.Error("auth: getting real ip from request: %s", err) + } else if ip == nil { + // Technically shouldn't happen. + log.Error("auth: unknown ip") + } if len(cookie) == 0 { - if err != nil { - log.Info("auth: getting real ip from request: %s", err) - } else if ip == nil { - // Technically shouldn't happen. - log.Info("auth: failed to login user %q from unknown ip", req.Name) - } else { - log.Info("auth: failed to login user %q from ip %q", req.Name, ip) - } + log.Info("auth: failed to login user %q from ip %v", req.Name, ip) + time.Sleep(1 * time.Second) http.Error(w, "invalid username or password", http.StatusBadRequest) return } - - if err != nil { - log.Info("auth: getting real ip from request: %s", err) - } else if ip == nil { - // Technically shouldn't happen. - log.Info("auth: user %q successfully logged in from unknown ip", req.Name) - } else { - log.Info("auth: user %q successfully logged in from ip %q", req.Name, ip) - } - w.Header().Set("Set-Cookie", cookie) + log.Info("auth: user %q successfully logged in from ip %v", req.Name, ip) - w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate") - w.Header().Set("Pragma", "no-cache") - w.Header().Set("Expires", "0") + h := w.Header() + h.Set("Set-Cookie", cookie) + h.Set("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate") + h.Set("Pragma", "no-cache") + h.Set("Expires", "0") returnOK(w) }