From ba738d33a72d64c8dbb03e8d6b76df50d7c64d1d Mon Sep 17 00:00:00 2001 From: dev0 <> Date: Sat, 10 Jun 2017 08:13:00 +0000 Subject: [PATCH] 34_ESPEasy.pm: add IPv6 ULA to local IPs, add regexps to ACLs git-svn-id: https://svn.fhem.de/fhem/trunk@14489 2b470e98-0d58-463d-a4d8-8e2adae1ed80 --- fhem/CHANGED | 1 + fhem/FHEM/34_ESPEasy.pm | 96 ++++++++++++++++++++++++++++++----------- 2 files changed, 71 insertions(+), 26 deletions(-) diff --git a/fhem/CHANGED b/fhem/CHANGED index c6f16699e..8bd7a026b 100644 --- a/fhem/CHANGED +++ b/fhem/CHANGED @@ -1,5 +1,6 @@ # Add changes at the top of the list. Keep it in ASCII, and 80-char wide. # Do not insert empty lines here, update check depends on it. + - change: 34_ESPEasy: add IPv6 ULA to local IPs, add regexps to ACLs - bugfix: 93_DbLog: V2.16.11, lock SQLite from logging if deleteOldDaysNbl or reduceLogNbL is running in async mode - feature: ESPEasy: improved dual ip stack support diff --git a/fhem/FHEM/34_ESPEasy.pm b/fhem/FHEM/34_ESPEasy.pm index 5b684f9a3..67cf74321 100644 --- a/fhem/FHEM/34_ESPEasy.pm +++ b/fhem/FHEM/34_ESPEasy.pm @@ -36,7 +36,7 @@ use Color; # ------------------------------------------------------------------------------ # global/default values # ------------------------------------------------------------------------------ -my $module_version = 1.15; # Version of this module +my $module_version = 1.16; # Version of this module my $minEEBuild = 128; # informational my $minJsonVersion = 1.02; # checked in received data @@ -56,6 +56,9 @@ my $d_displayTextWidth = 0; # display width, 0 => disable formating my $d_allowedIPs = "192.168.0.0/16,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12," . "fe80::/10,fc00::/7,::1"; +my $d_localIPs = "^(127|192.168|172.(1[6-9]|2[0-9]|3[01])|10|169.254)\\.|" + . "^(f(e[89ab]|[cd])|::1)"; + # ------------------------------------------------------------------------------ # "setCmds" => "min. number of parameters" # ------------------------------------------------------------------------------ @@ -609,11 +612,9 @@ sub ESPEasy_Read($) { my $logHeader = { %$header }; # public IPs - my $re = "^(127|192.168|172.(1[6-9]|2[0-9]|3[01])|10|169.254)\\.|" - . "^(fe[89ab]|::1)"; - if (!defined $logHeader->{Authorization} && $peer !~ m/$re/) { - Log3 $bname, 2, "$btype $name: No basic auth set while using a public IP " - . "address from peer $peer." + if (!defined $logHeader->{Authorization} && $peer !~ m/$d_localIPs/) { + Log3 $bname, 2, "$btype $name: No basic auth set while using public IP " + . "address $peer"; } $logHeader->{Authorization} =~ s/Basic\s.*\s/Basic ***** / if defined $logHeader->{Authorization}; @@ -917,8 +918,8 @@ sub ESPEasy_Attr(@) if $cmd eq "set" && !(ESPEasy_isAttrCombineDevices($aVal) || $aVal =~ m/^[01]$/ )} elsif ($aName =~ m/^(allowedIPs|deniedIPs)$/) { - $ret = "ip[/netmask][,ip[/netmask]][,...]" - if $cmd eq "set" && !ESPEasy_isIPv64Range($aVal)} + $ret = "[comma separated list of] ip[/netmask] or a regexp" + if $cmd eq "set" && !ESPEasy_isIPv64Range($aVal,"regexp")} elsif ($aName =~ m/^(pollGPIOs|rgbGPIOs|wwcwGPIOs)$/) { $ret = "GPIO_No[,GPIO_No][...]" @@ -2312,12 +2313,13 @@ sub ESPEasy_isValidPeer($) # ------------------------------------------------------------------------------ # check if given ip or ip range is guilty # argument can be: -# - ipv4, ipv4/CIDR, ipv4/dotted, ipv6, ipv6/CIDR +# - ipv4, ipv4/CIDR, ipv4/dotted, ipv6, ipv6/CIDR (or a regexp if opt. argument +# $regexChk is set) # - space or comma separated list of above. # ------------------------------------------------------------------------------ -sub ESPEasy_isIPv64Range($) +sub ESPEasy_isIPv64Range($;$) { - my ($addr) = @_; + my ($addr,$regexChk) = @_; return 0 if !defined $addr; my @ranges = split(/,| /,$addr); foreach (@ranges) { @@ -2329,6 +2331,11 @@ sub ESPEasy_isIPv64Range($) elsif (ESPEasy_isIPv6($ip)) { return 0 if defined $nm && !ESPEasy_isNmCIDRv6($nm); } + elsif (defined $regexChk && !defined $nm) { + return 0 if $ip =~ m/^\*/ || $ip =~ m/^\d+\.\d+\.\d+\.\d+$/; # faulty regexp/ip + eval { "Hallo" =~ m/^$ip$/ }; + return $@ ? 0 : 1; + } else { return 0; } @@ -2347,10 +2354,10 @@ sub ESPEasy_isPeerAllowed($$) my ($peer,$allowed) = @_; return $allowed if $allowed =~ m/^[01]$/; #return 1 if $allowed =~ /^0.0.0.0\/0(.0.0.0)?$/; # not necessary but faster - my $binPeer = ESPEasy_ip2bin($peer); my @a = split(/,| /,$allowed); foreach (@a) { + return 1 if $peer =~ m/^$_$/; # a regexp is been used next if !ESPEasy_isIPv64Range($_); # needed for combinedDevices my ($addr,$ip,$mask) = ESPEasy_addrToCIDR($_); return 0 if !defined $ip || !defined $mask; # return if ip or mask !guilty @@ -2576,7 +2583,11 @@ sub ESPEasy_removeGit($) port and the FHEM ESPEasy bridge port must be the same.
  • Max. 2 ESPEasy bridges can be defined at the same time: 1 for IPv4 and - 1 for IPv6 + 1 for IPv6 +
    • +
  • Further information about this module is available here: + Forum #55728 +

    • @@ -2653,7 +2664,7 @@ sub ESPEasy_removeGit($)