From 6b4703f21deb0f140dbbeca682823f2b644a4e78 Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Thu, 5 Nov 2026 14:35:32 +0100 Subject: Actually implement the OT_PERMISSION_MAY_FULLSCRAPE mechanics and add a config file entry --- Makefile | 1 + opentracker.conf.sample | 7 ++++++- src/ot_config.c | 11 +++++++++++ src/ot_http.c | 5 +++++ 4 files changed, 23 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index d2e0c2d..a928442 100644 --- a/Makefile +++ b/Makefile @@ -12,6 +12,7 @@ STRIP?=strip #FEATURES+=-DWANT_IP_FROM_QUERY_STRING #FEATURES+=-DWANT_RESTRICT_STATS +#FEATURES+=-DWANT_RESTRICT_FULLSCRAPE #FEATURES+=-DWANT_IP_FROM_PROXY #FEATURES+=-DWANT_LOG_NUMWANT #FEATURES+=-DWANT_MODEST_FULLSCRAPES diff --git a/opentracker.conf.sample b/opentracker.conf.sample index 7b35369..ba8497f 100644 --- a/opentracker.conf.sample +++ b/opentracker.conf.sample @@ -119,7 +119,6 @@ # # access.stats_path stats # -# II # If opentracker lives behind one or multiple reverse proxies, # every http connection appears to come from these proxies. In order to # take the X-Forwarded-For address instead, compile opentracker with the @@ -128,6 +127,12 @@ # access.proxy 10.0.1.23 # access.proxy 192.0.0.0/8 # +# Symmetrically, if you have restricted the access to fullscrapes with +# the WANT_RESTRICT_FULLSCRAPE compile option, this is how you bless ip +# addresses to fetch fullscrapes +# +# access.fullscrape 10.1.1.23 +# # III) Live sync uses udp multicast packets to keep a cluster of opentrackers # synchronized. This option tells opentracker which port to listen for diff --git a/src/ot_config.c b/src/ot_config.c index 6b51c61..dfaef0d 100644 --- a/src/ot_config.c +++ b/src/ot_config.c @@ -205,6 +205,7 @@ typedef enum { CONFIG_ACCESS_STATS, CONFIG_ACCESS_STATS_PATH, CONFIG_ACCESS_PROXY, + CONFIG_ACCESS_FULLSCRAPE, CONFIG_TRACKER_REDIRECT_URL, CONFIG_LIVESYNC_CLUSTER_NODE_IP, CONFIG_LIVESYNC_CLUSTER_LISTEN, @@ -243,6 +244,9 @@ static const config_key config_keys[] = { CONFIG_KEY("access.stats_path", CONFIG_ACCESS_STATS_PATH), #ifdef WANT_IP_FROM_PROXY CONFIG_KEY("access.proxy", CONFIG_ACCESS_PROXY), +#endif +#ifdef WANT_RESTRICT_FULLSCRAPE + CONFIG_KEY("access.fullscrape", CONFIG_ACCESS_FULLSCRAPE), #endif CONFIG_KEY("tracker.redirect_url", CONFIG_TRACKER_REDIRECT_URL), #ifdef WANT_SYNC_LIVE @@ -375,6 +379,13 @@ static int parse_configfile(char *config_filename) { goto parse_error; accesslist_bless_net(&tmpnet, OT_PERMISSION_MAY_PROXY); break; +#endif +#ifdef WANT_RESTRICT_FULLSCRAPE + case CONFIG_ACCESS_FULLSCRAPE: + if (!scan_ip6_net(p, &tmpnet)) + goto parse_error; + accesslist_bless_net(&tmpnet, OT_PERMISSION_MAY_FULLSCRAPE); + break; #endif case CONFIG_TRACKER_REDIRECT_URL: set_config_option(&g_redirecturl, p); diff --git a/src/ot_http.c b/src/ot_http.c index 533a876..d2dad67 100644 --- a/src/ot_http.c +++ b/src/ot_http.c @@ -402,6 +402,11 @@ static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct * struct http_data *cookie = fdstate_cookie(sock); int format = 0; +#ifdef WANT_RESTRICT_FULLSCRAPE + if (!accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_FULLSCRAPE)) + HTTPERROR_403_IP; +#endif + #ifdef WANT_MODEST_FULLSCRAPES { ot_scrape_log this_peer, *new_peer; -- cgit v1.3