diff options
author | Péter Szilágyi <peterke@gmail.com> | 2017-08-18 16:23:56 +0800 |
---|---|---|
committer | Péter Szilágyi <peterke@gmail.com> | 2017-08-18 16:23:56 +0800 |
commit | 059c767adf4956d6d7bae16066a798d02a367f01 (patch) | |
tree | 1cbcce71bd2933d1e4ac1be7270d61f661cb20ba /cmd/puppeth/module_ethstats.go | |
parent | 104375f398bdfca88183010cc3693e377ea74163 (diff) | |
download | go-tangerine-059c767adf4956d6d7bae16066a798d02a367f01.tar go-tangerine-059c767adf4956d6d7bae16066a798d02a367f01.tar.gz go-tangerine-059c767adf4956d6d7bae16066a798d02a367f01.tar.bz2 go-tangerine-059c767adf4956d6d7bae16066a798d02a367f01.tar.lz go-tangerine-059c767adf4956d6d7bae16066a798d02a367f01.tar.xz go-tangerine-059c767adf4956d6d7bae16066a798d02a367f01.tar.zst go-tangerine-059c767adf4956d6d7bae16066a798d02a367f01.zip |
cmd/puppeth: support blacklisting malicious IPs on ethstats
Diffstat (limited to 'cmd/puppeth/module_ethstats.go')
-rw-r--r-- | cmd/puppeth/module_ethstats.go | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/cmd/puppeth/module_ethstats.go b/cmd/puppeth/module_ethstats.go index da34acb3b..5d3fa5fc0 100644 --- a/cmd/puppeth/module_ethstats.go +++ b/cmd/puppeth/module_ethstats.go @@ -42,7 +42,7 @@ RUN \ WORKDIR /eth-netstats EXPOSE 3000 -RUN echo 'module.exports = {trusted: [{{.Trusted}}], banned: []};' > lib/utils/config.js +RUN echo 'module.exports = {trusted: [{{.Trusted}}], banned: [{{.Banned}}]};' > lib/utils/config.js CMD ["npm", "start"] ` @@ -59,7 +59,8 @@ services: - "{{.Port}}:3000"{{end}} environment: - WS_SECRET={{.Secret}}{{if .VHost}} - - VIRTUAL_HOST={{.VHost}}{{end}} + - VIRTUAL_HOST={{.VHost}}{{end}}{{if .Banned}} + - BANNED={{.Banned}}{{end}} logging: driver: "json-file" options: @@ -71,18 +72,24 @@ services: // deployEthstats deploys a new ethstats container to a remote machine via SSH, // docker and docker-compose. If an instance with the specified network name // already exists there, it will be overwritten! -func deployEthstats(client *sshClient, network string, port int, secret string, vhost string, trusted []string) ([]byte, error) { +func deployEthstats(client *sshClient, network string, port int, secret string, vhost string, trusted []string, banned []string) ([]byte, error) { // Generate the content to upload to the server workdir := fmt.Sprintf("%d", rand.Int63()) files := make(map[string][]byte) + trustedLabels := make([]string, len(trusted)) for i, address := range trusted { - trusted[i] = fmt.Sprintf("\"%s\"", address) + trustedLabels[i] = fmt.Sprintf("\"%s\"", address) + } + bannedLabels := make([]string, len(banned)) + for i, address := range banned { + bannedLabels[i] = fmt.Sprintf("\"%s\"", address) } dockerfile := new(bytes.Buffer) template.Must(template.New("").Parse(ethstatsDockerfile)).Execute(dockerfile, map[string]interface{}{ - "Trusted": strings.Join(trusted, ", "), + "Trusted": strings.Join(trustedLabels, ", "), + "Banned": strings.Join(bannedLabels, ", "), }) files[filepath.Join(workdir, "Dockerfile")] = dockerfile.Bytes() @@ -92,6 +99,7 @@ func deployEthstats(client *sshClient, network string, port int, secret string, "Port": port, "Secret": secret, "VHost": vhost, + "Banned": strings.Join(banned, ","), }) files[filepath.Join(workdir, "docker-compose.yaml")] = composefile.Bytes() @@ -112,11 +120,12 @@ type ethstatsInfos struct { port int secret string config string + banned []string } // String implements the stringer interface. func (info *ethstatsInfos) String() string { - return fmt.Sprintf("host=%s, port=%d, secret=%s", info.host, info.port, info.secret) + return fmt.Sprintf("host=%s, port=%d, secret=%s, banned=%v", info.host, info.port, info.secret, info.banned) } // checkEthstats does a health-check against an ethstats server to verify whether @@ -150,6 +159,9 @@ func checkEthstats(client *sshClient, network string) (*ethstatsInfos, error) { if port != 80 && port != 443 { config += fmt.Sprintf(":%d", port) } + // Retrieve the IP blacklist + banned := strings.Split(infos.envvars["BANNED"], ",") + // Run a sanity check to see if the port is reachable if err = checkPort(host, port); err != nil { log.Warn("Ethstats service seems unreachable", "server", host, "port", port, "err", err) @@ -160,5 +172,6 @@ func checkEthstats(client *sshClient, network string) (*ethstatsInfos, error) { port: port, secret: secret, config: config, + banned: banned, }, nil } |