Ori.livneh has uploaded a new change for review.
https://gerrit.wikimedia.org/r/61920
Change subject: Allow multiple, comma-separated CIDR ranges to be specified
......................................................................
Allow multiple, comma-separated CIDR ranges to be specified
This patch allows multiple CIDR ranges to be specified by joining the ranges
with a comma character, like so: {"cidr": "2001:db8::/46,::1/128"}.
Change-Id: I35c043361b60ea99efb5f06117bd6f107280dde5
---
M modules/tcpircbot/README
M modules/tcpircbot/files/tcpircbot.py
M modules/tcpircbot/manifests/instance.pp
3 files changed, 9 insertions(+), 5 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/20/61920/1
diff --git a/modules/tcpircbot/README b/modules/tcpircbot/README
index dacb567..81b79e6 100644
--- a/modules/tcpircbot/README
+++ b/modules/tcpircbot/README
@@ -8,7 +8,8 @@
By default, it will connect to Freenode using SSL and listen for incoming
connections on port 9200. If the configuration specifies a CIDR range, only
clients within that range are allowed to connect. The default behavior is to
-allow clients from private and loopback IPs only.
+allow clients from private and loopback IPs only. Multiple, comma-separated
+CIDR ranges may be specified.
The defaults are sane and fit the most common use-case. There are three values
which you must specify: a nickname for your bot, a nickserv password for that
diff --git a/modules/tcpircbot/files/tcpircbot.py
b/modules/tcpircbot/files/tcpircbot.py
index b66c722..88d22a6 100755
--- a/modules/tcpircbot/files/tcpircbot.py
+++ b/modules/tcpircbot/files/tcpircbot.py
@@ -83,7 +83,7 @@
def log_event(self, connection, event):
if connection.real_nickname in [event._source, event._target]:
logging.info('%(_eventtype)s [%(_source)s -> %(_target)s]'
- % vars(event))
+ % vars(event))
def on_welcome(self, connection, event):
connection.join(self.channel)
@@ -109,6 +109,7 @@
sockets = [server]
+
def close_sockets():
for sock in sockets:
try:
@@ -122,11 +123,12 @@
def is_ip_allowed(ip):
"""Check if we should accept a connection from remote IP `ip`. If
the config specifies a CIDR, test against that; otherwise allow only
- private and loopback IPs.
+ private and loopback IPs. Multiple comma-separated CIDRs may be specified.
"""
ip = netaddr.IPAddress(ip)
if 'cidr' in config['tcp']:
- return ip in netaddr.IPNetwork(config['tcp']['cidr'])
+ cidrs = config['tcp']['cidr'].split(',')
+ return any(ip in netaddr.IPNetwork(cidr) for cidr in cidrs)
try:
ip = ip.ipv4()
except netaddr.core.AddrConversionError:
diff --git a/modules/tcpircbot/manifests/instance.pp
b/modules/tcpircbot/manifests/instance.pp
index aede997..8c72152 100644
--- a/modules/tcpircbot/manifests/instance.pp
+++ b/modules/tcpircbot/manifests/instance.pp
@@ -27,7 +27,8 @@
# IPv6 CIDR range. Optional. If defined, inbound connections from addresses
# outside this range will be rejected. If not defined (the default), the
# service will only accept connections from private and loopback IPs.
-# Example: "fc00::/7".
+# Multiple ranges may be indicated by separating values with a comma.
+# Example: "fc00::/7,::1/128".
#
# [*ssl*]
# Whether to use SSL to connect to IRC server (default: true).
--
To view, visit https://gerrit.wikimedia.org/r/61920
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I35c043361b60ea99efb5f06117bd6f107280dde5
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Ori.livneh <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
