antonioribeiro / firewall

Firewall package for Laravel applications
BSD 3-Clause "New" or "Revised" License
1.39k stars 162 forks source link

Don't allow same range of IPs in black and whitelist #99

Open meyer59 opened 6 years ago

meyer59 commented 6 years ago

Hi, First, i would like to thank you your amazing package! I just installed the latest version of the firewall and when i'm trying to get any route, i ran into this issue: Call to undefined function PragmaRX\Firewall\ipv4_in_range() in Firewall.php (line 375) I have the range ip activated with a bunch of ips in the whitelist array like 192.168.*.* I'm on Laravel 5.4. Any help wil be greatly appreciated, Thank you

antonioribeiro commented 6 years ago

Yeah, sorry, I just tagged 2.1.0 and it should be fixed.

antonioribeiro commented 6 years ago

I also changed the way we configure response, so you should also add this to your config/firewall.php:

    'responses' => [
        'blacklist' => [
            'code' => 403, // 200 = log && notify, but keep pages rendering

            'message' => null,

            'view' => null,

            'redirect_to' => null,

            'abort' => false, // return abort() instead of Response::make() - disabled by default
        ],

        'whitelist' => [
            'code' => 403, // 200 = log && notify, but keep pages rendering

            'message' => null,

            'view' => null,

            'redirect_to' => null,

            'abort' => false, // return abort() instead of Response::make() - disabled by default
        ],
    ],
meyer59 commented 6 years ago

Thanks, just updated and no more exception. However, the range filter doesn't seem to work properly. My ip is 192.168.0.250, this doesn't work 'blacklist' => [ '192.168.0.*'] This is working: 'blacklist' => [ '192.168.0.250'] Maybe i am missing something in the config ?

antonioribeiro commented 6 years ago

Try to use it as

'blacklist' => [ '192.168.0.0/24' ]
antonioribeiro commented 6 years ago

And I'm not sure why it's not working with you, because tests are passing:

public function test_wildcard()
{
    Firewall::whitelist('172.17.*.*');

    $this->assertTrue(Firewall::isWhitelisted($ip = '172.17.0.100'));

    $this->assertTrue(Firewall::isWhitelisted($ip = '172.17.1.101'));

    $this->assertTrue(Firewall::isWhitelisted($ip = '172.17.2.102'));

    $this->assertTrue(Firewall::isWhitelisted($ip = '172.17.255.255'));
}
meyer59 commented 6 years ago

The 'blacklist' => [ '192.168.0.0/24' ] don't work too. How i can run the test_wildcard method in my project to see if it passes ?

antonioribeiro commented 6 years ago

Go to the firewall path: vendor/pragmarx/firewall and run:

composer install

then

phpunit
meyer59 commented 6 years ago

Here's the output: Runtime: PHP 5.6.31-1~dotdeb+zts+7.1 with Xdebug 2.4.0 Configuration: /home/html/site2/web/TV/vendor/pragmarx/firewall/phpunit.xml

................................................................. 65 / 74 ( 87%) ......... 74 / 74 (100%)

Time: 1.88 minutes, Memory: 73.75MB

OK (74 tests, 150 assertions)

Generating code coverage report in Clover XML format ... done

Generating code coverage report in HTML format ... done

antonioribeiro commented 6 years ago

Do you get anything in your laravel.log?

antonioribeiro commented 6 years ago

Tests passing, all of them. And I just tested it in an application here

When blacklisting:

image

I get:

image

Removing localhost:

image

I get the page back:

image

Then I cleared the database:

image

Added it to the array:

image

And it worked.

meyer59 commented 6 years ago

Thank you for your detailled response. I think i got what's going on. I have the same range in the whitelist and the blacklist. I was doing some test on blacklisted/whitelisted routes that's why i had the same range here and there.
when i did php artisan firewall:list i got that image All seems to work, Thanks!

antonioribeiro commented 6 years ago

Cool! I'll add a test for that too and a warning in the log.

Thank you!

antonioribeiro commented 6 years ago

And I'll leave it open until I get this done.