Michel2/ESPEasy
1
0
Fork 0
mirror of https://github.com/letscontrolit/ESPEasy.git synced 2026-07-27 19:57:38 +00:00
Code Issues Releases Activity

[AccessControl] Fix checking for allowed IP range

Browse Source
This commit is contained in:
TD-er
2026-05-25 01:27:28 +02:00
parent 59d972d4aa
commit ecfa569c93
7 changed files with 55 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platformio_core_defs.ini
+1 -1
View File
@@ -191,7 +191,7 @@ extra_scripts = ${esp82xx_common.extra_scripts}
;platform_packages = framework-arduinoespressif32 @ https://github.com/Jason2866/esp32-arduino-lib-builder/releases/download/2904-2115-5.5/framework-arduinoespressif32-release_v5.5-f2a3fa2b.tar.xz
platform = https://github.com/Jason2866/platform-espressif32.git#Arduino/IDF55_gcc152
platform_packages = framework-arduinoespressif32 @ https://github.com/Jason2866/esp32-arduino-lib-builder/releases/download/1905-1208-5.5/framework-arduinoespressif32-release_v5.5-f3cdb9d0.tar.xz
platform_packages = framework-arduinoespressif32 @ https://github.com/Jason2866/esp32-arduino-lib-builder/releases/download/2305-1355-5.5/framework-arduinoespressif32-release_v5.5-f3cdb9d0.tar.xz
custom_remove_include = true
src/ESPEasy/net/Globals/NWPlugins.cpp
+31 -23
View File
@@ -4,24 +4,24 @@
#include "../../../src/DataStructs/TimingStats.h"
#include "../../../src/DataTypes/ESPEasy_plugin_functions.h"
#ifdef ESP32
#include "../../../src/Globals/SecuritySettings.h"
# include "../../../src/Globals/SecuritySettings.h"
#endif
#include "../../../src/Globals/Settings.h"
#include "../Helpers/_NWPlugin_init.h"
#ifdef ESP32
#include "../Helpers/NWAccessControl.h"
# include "../Helpers/NWAccessControl.h"
#endif
#include "../../../src/Globals/ESPEasy_Scheduler.h"
#include "../../../src/Helpers/Networking.h"
#include "../_NWPlugin_Helper.h"
#ifdef ESP8266
#include "../wifi/ESPEasyWifi.h"
# include "../wifi/ESPEasyWifi.h"
#endif
#include "../ESPEasyNetwork.h"
namespace ESPEasy {
namespace net {
@@ -324,11 +324,11 @@ bool NWPluginCall(NWPlugin::Function Function, EventStruct *event, String& str)
// calls to specific network which need to be enabled before calling
case NWPlugin::Function::NWPLUGIN_INIT:
// case NWPlugin::Function::NWPLUGIN_CONNECT_SUCCESS:
// case NWPlugin::Function::NWPLUGIN_CONNECT_FAIL:
// case NWPlugin::Function::NWPLUGIN_CONNECT_SUCCESS:
// case NWPlugin::Function::NWPLUGIN_CONNECT_FAIL:
case NWPlugin::Function::NWPLUGIN_WEBFORM_SHOW_ACTIVE:
case NWPlugin::Function::NWPLUGIN_WEBFORM_SHOW_CONNECTED:
// case NWPlugin::Function::NWPLUGIN_WEBFORM_SHOW_EXTENDED:
// case NWPlugin::Function::NWPLUGIN_WEBFORM_SHOW_EXTENDED:
case NWPlugin::Function::NWPLUGIN_WEBFORM_SHOW_HW_ADDRESS:
case NWPlugin::Function::NWPLUGIN_WEBFORM_SHOW_IP:
#ifdef ESP32
@@ -356,7 +356,7 @@ bool NWPluginCall(NWPlugin::Function Function, EventStruct *event, String& str)
case NWPlugin::Function::NWPLUGIN_WEBFORM_LOAD:
case NWPlugin::Function::NWPLUGIN_WEBFORM_SAVE:
// case NWPlugin::Function::NWPLUGIN_DRIVER_TEMPLATE:
// case NWPlugin::Function::NWPLUGIN_DRIVER_TEMPLATE:
{
const networkIndex_t networkIndex = event->NetworkIndex;
bool success = false;
@@ -468,20 +468,26 @@ bool NWPluginCall(NWPlugin::Function Function, EventStruct *event, String& str)
case NWPlugin::Function::NWPLUGIN_CLIENT_IP_WEB_ACCESS_ALLOWED:
{
IPAddress client_ip;
client_ip.fromString(str);
if (!Settings.getNetworkInterfaceSubnetBlockClientIP(event->NetworkIndex)) {
IPAddress client_ip;
client_ip.fromString(str);
if ((SecuritySettings.IPblockLevel == LOCAL_SUBNET_ALLOWED) &&
!Settings.getNetworkInterfaceSubnetBlockClientIP(event->NetworkIndex)) {
success = NWPlugin::IP_in_subnet(client_ip, event->networkInterface);
} else if (SecuritySettings.IPblockLevel == ONLY_IP_RANGE_ALLOWED) {
const IPAddress low(SecuritySettings.AllowedIPrangeLow);
const IPAddress high(SecuritySettings.AllowedIPrangeHigh);
success = NWPlugin::ipInRange(client_ip, low, high) &&
NWPlugin::IP_in_subnet(low, event->networkInterface) &&
NWPlugin::IP_in_subnet(high, event->networkInterface);
} else {
success = true;
if (SecuritySettings.IPblockLevel == LOCAL_SUBNET_ALLOWED) {
success = NWPlugin::IP_in_subnet(client_ip, event->networkInterface);
} else if (SecuritySettings.IPblockLevel == ONLY_IP_RANGE_ALLOWED) {
const IPAddress low(SecuritySettings.AllowedIPrangeLow);
const IPAddress high(SecuritySettings.AllowedIPrangeHigh);
if (IPAddressSet(low) && IPAddressSet(high))
{
success =
NWPlugin::ipInRange(client_ip, low, high) &&
NWPlugin::IP_in_subnet(low, event->networkInterface) &&
NWPlugin::IP_in_subnet(high, event->networkInterface);
} else { success = true; }
} else {
success = true;
}
}
break;
}
@@ -493,7 +499,8 @@ bool NWPluginCall(NWPlugin::Function Function, EventStruct *event, String& str)
}
#endif // ifdef ESP32
}
//#ifdef ESP32
// #ifdef ESP32
if (Function == NWPlugin::Function::NWPLUGIN_EXIT) {
// Cache.clearNetworkSettings(networkIndex);
@@ -505,7 +512,8 @@ bool NWPluginCall(NWPlugin::Function Function, EventStruct *event, String& str)
}
clearNWPluginData(event->NetworkIndex);
}
//#endif // ifdef ESP32
// #endif // ifdef ESP32
}
return success;
}
src/ESPEasy/net/_NW001_WiFi_STA.cpp
+4 -1
View File
@@ -304,7 +304,10 @@ bool NWPlugin_001(NWPlugin::Function function, EventStruct *event, String& strin
} else if (SecuritySettings.IPblockLevel == ONLY_IP_RANGE_ALLOWED) {
const IPAddress low(SecuritySettings.AllowedIPrangeLow);
const IPAddress high(SecuritySettings.AllowedIPrangeHigh);
success = NWPlugin::ipInRange(client_ip, low, high);
success =
!IPAddressSet(low) ||
!IPAddressSet(high) ||
NWPlugin::ipInRange(client_ip, low, high);
} else {
success = true;
}
src/ESPEasy/net/_NW002_WiFi_AP.cpp
+1 -1
View File
@@ -219,6 +219,7 @@ bool NWPlugin_002(NWPlugin::Function function, EventStruct *event, String& strin
}
break;
}
# endif // ifdef ESP8266
case NWPlugin::Function::NWPLUGIN_CLIENT_IP_WEB_ACCESS_ALLOWED:
{
@@ -240,7 +241,6 @@ bool NWPlugin_002(NWPlugin::Function function, EventStruct *event, String& strin
}
break;
}
# endif // ifdef ESP8266
case NWPlugin::Function::NWPLUGIN_WEBFORM_SAVE:
{
src/src/ESPEasyCore/ESPEasy_Log.cpp
+10
View File
@@ -273,6 +273,16 @@ void addToLogMove(uint8_t logLevel, String&& str)
void processLogs(bool serialOnly)
{
#ifdef ESP32
if (xPortInIsrContext()) {
// When called from an ISR, you should not send out logs.
// Allocating memory from within an ISR is a big no-no.
// Also long-time blocking like sending logs (especially to a syslog server)
// is also really not a good idea from an ISR call.
return;
}
#endif // ifdef ESP32
process_serialWriteBuffer();
Logging.loop(serialOnly);
#if FEATURE_SYSLOG
src/src/Helpers/PeriodicalActions.cpp
+6 -1
View File
@@ -411,7 +411,12 @@ void updateMQTTclient_connected() {
const bool actual_MQTTclient_connected = ESPEasy::net::NetworkConnected(true) && MQTTclient.connected();
if (MQTTclient_connected != actual_MQTTclient_connected) {
MQTTclient_connected = actual_MQTTclient_connected;
if (!actual_MQTTclient_connected) mqtt.stop(); // Make sure PubSubClient isn't trying to do a graceful disconnect
if (!actual_MQTTclient_connected) {
// Make sure PubSubClient isn't trying to do a graceful disconnect
// FIXME TD-er: This seems to cause a crash on ESP32-xx, though no idea how to fix.
// See also: https://github.com/espressif/arduino-esp32/issues/12517
mqtt.stop();
}
MQTTclient_connected_stats.set(actual_MQTTclient_connected);
if (!MQTTclient_connected) {
if (loglevelActiveFor(LOG_LEVEL_ERROR)) {
src/src/WebServer/AccessControl.cpp
+2 -12
View File
@@ -33,24 +33,14 @@ bool clientIPallowed()
// return true;
#endif
const IPAddress remoteIP = web_server.client().remoteIP();
if (remoteIP == IPAddress(0, 0, 0, 0)
#if ESP_IDF_VERSION_MAJOR>=5
|| remoteIP.type() == IPv6
#else
|| !remoteIP.isV4()
#endif
) {
if (!IPAddressSet(remoteIP))
{
// FIXME TD-er: Must see what's going on here, why the client doesn't send remote IP for some reason
return true;
}
if (ESPEasy::net::ipInAllowedSubnet(remoteIP)) {
return true;
}
if ( ESPEasy::net::wifi::WifiIsAP(WiFi.getMode())) {
// @TD-er Fixme: Should match subnet of SoftAP.
return true;
}
String response = concat(F("IP blocked: "), formatIP(remoteIP));
web_server.send(403, F("text/html"), response);