OpenPrinting / pappl-retrofit

PPD/Classic CUPS driver retro-fit Printer Application Library
Apache License 2.0
7 stars 10 forks source link

Feature: restrict access to LAN only #14

Open ValdikSS opened 1 year ago

ValdikSS commented 1 year ago

First of all, thanks for such a beautiful software! I've converted my Samsung MFP from 2005 into a driverless networked printer+scanner, and it works perfectly fine!

Current ghostscript-printer-app version listens on 0.0.0.0/[::] and does not support IP-level access control, which may be a security issue due to rather widespread IPv6 connectivity with 'real' addresses. CUPS has 'allow LAN access only' convenient checkbox, it would be great to have the same functionality in pappl-retrofit-based applications without nginx/other web front-end.

# snap list | grep printer
ghostscript-printer-app  10.01.2-1     769    latest/stable  openprinting**  -

# ss -nlpt | grep 8000
LISTEN 0      4096                             0.0.0.0:8000        0.0.0.0:*     users:(("ghostscript-pri",pid=625431,fd=7))                                    
LISTEN 0      4096                                [::]:8000           [::]:*     users:(("ghostscript-pri",pid=625431,fd=8))

It should be implemented by enumerating IP addresses on the interfaces and allowing access by the network segment and its mask. I saw that libcups function is already used to enumerate addresses.
Thanks.

ValdikSS commented 1 year ago

Example host found with censys: http://103.160.82.52:5100/

Screenshot_20230929_170253-fs8