0ct0pu5/ente
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[server] Restrict casting to same IP

Browse source
This commit is contained in:
Neeraj Gupta 2024-04-25 14:03:25 +05:30
parent badd9263f4
commit 8038583d5a
3 changed files with 34 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
server/ente/errors.go
View file

@ -149,6 +149,12 @@ var ErrCastPermissionDenied = ApiError{
HttpStatusCode: http.StatusForbidden,
}
var ErrCastIPMismatch = ApiError{
Code: "CAST_IP_MISMATCH",
Message: "IP mismatch",
HttpStatusCode: http.StatusForbidden,
}
type ErrorCode string
const (

23
server/pkg/controller/cast/controller.go
View file

@ -2,12 +2,15 @@ package cast
import (
"context"
"github.com/ente-io/museum/ente"
"github.com/ente-io/museum/ente/cast"
"github.com/ente-io/museum/pkg/controller/access"
castRepo "github.com/ente-io/museum/pkg/repo/cast"
"github.com/ente-io/museum/pkg/utils/auth"
"github.com/ente-io/museum/pkg/utils/network"
"github.com/ente-io/stacktrace"
"github.com/gin-gonic/gin"
"github.com/sirupsen/logrus"
)
type Controller struct {
@ -24,12 +27,24 @@ func NewController(castRepo *castRepo.Repository,
}
}
func (c *Controller) RegisterDevice(ctx context.Context, request *cast.RegisterDeviceRequest) (string, error) {
return c.CastRepo.AddCode(ctx, request.DeviceCode, request.PublicKey)
func (c *Controller) RegisterDevice(ctx *gin.Context, request *cast.RegisterDeviceRequest) (string, error) {
return c.CastRepo.AddCode(ctx, request.DeviceCode, request.PublicKey, network.GetClientIP(ctx))
}
func (c *Controller) GetPublicKey(ctx context.Context, deviceCode string) (string, error) {
return c.CastRepo.GetPubKey(ctx, deviceCode)
func (c *Controller) GetPublicKey(ctx *gin.Context, deviceCode string) (string, error) {
pubKey, ip, err := c.CastRepo.GetPubKeyAndIp(ctx, deviceCode)
if err != nil {
return "", stacktrace.Propagate(err, "")
}
if ip != network.GetClientIP(ctx) {
logrus.WithFields(logrus.Fields{
"deviceCode": deviceCode,
"ip": ip,
"clientIP": network.GetClientIP(ctx),
}).Warn("GetPublicKey: IP mismatch")
return "", &ente.ErrCastIPMismatch
}
return pubKey, nil
}
func (c *Controller) GetEncCastData(ctx context.Context, deviceCode string) (*string, error) {

18
server/pkg/repo/cast/repo.go
View file

@ -14,7 +14,7 @@ type Repository struct {
DB *sql.DB
}
func (r *Repository) AddCode(ctx context.Context, code *string, pubKey string) (string, error) {
func (r *Repository) AddCode(ctx context.Context, code *string, pubKey string, ip string) (string, error) {
var codeValue string
var err error
if code == nil || *code == "" {
@ -25,7 +25,7 @@ func (r *Repository) AddCode(ctx context.Context, code *string, pubKey string) (
} else {
codeValue = strings.TrimSpace(*code)
}
_, err = r.DB.ExecContext(ctx, "INSERT INTO casting (code, public_key, id) VALUES ($1, $2, $3)", codeValue, pubKey, uuid.New())
_, err = r.DB.ExecContext(ctx, "INSERT INTO casting (code, public_key, id, ip) VALUES ($1, $2, $3, $4)", codeValue, pubKey, uuid.New(), ip)
if err != nil {
return "", err
}
@ -38,17 +38,17 @@ func (r *Repository) InsertCastData(ctx context.Context, castUserID int64, code
return err
}
func (r *Repository) GetPubKey(ctx context.Context, code string) (string, error) {
var pubKey string
row := r.DB.QueryRowContext(ctx, "SELECT public_key FROM casting WHERE code = $1 and is_deleted=false", code)
err := row.Scan(&pubKey)
func (r *Repository) GetPubKeyAndIp(ctx context.Context, code string) (string, string, error) {
var pubKey, ip string
row := r.DB.QueryRowContext(ctx, "SELECT public_key, ip FROM casting WHERE code = $1 and is_deleted=false", code)
err := row.Scan(&pubKey, &ip)
if err != nil {
if err == sql.ErrNoRows {
return "", ente.ErrNotFoundError.NewErr("code not found")
return "", "", ente.ErrNotFoundError.NewErr("code not found")
}
return "", err
return "", "", err
}
return pubKey, nil
return pubKey, ip, nil
}
func (r *Repository) GetEncCastData(ctx context.Context, code string) (*string, error) {