0c6c502aab
Matches the Real-Debrid-Downloader's rd-diagnostics-mcp model so the read-only
diagnostics agent is reachable over Tailscale (or any private tunnel) the same way
the downloader is, instead of requiring an SSH local-forward.
- lib/ip-allowlist.js (NEW): fail-closed IP allowlist — normalizeIp strips
::ffff:, loopback is always allowed, an empty allowlist accepts loopback ONLY
(fail-closed), exact IP + CIDR (incl. the Tailscale CGNAT range 100.64.0.0/10) +
wildcard rules. The real socket peer IP is the authority (never a forwarded header).
- remote-server.js: rejects non-allowlisted peers at connection (close 4005). Opt-in
via config.allowlist (the existing remote-control server, which passes none, is
unaffected). Loopback always passes, so local + SSH-forward use keeps working.
- Two bind modes (config diagnostics.bindMode): "local" -> 127.0.0.1 (default),
"network" -> 0.0.0.0 but ONLY when a non-empty allowlist is set (else it stays
loopback, fail-closed). The allowlist + token gate access; the tunnel
(Tailscale/WireGuard) is the confidentiality layer (transport is still plaintext ws://).
- The connection code now carries the host: mhu1_<base64url{v,h,p,t,n,fp?,s?}>. The
gateway decode is tolerant of the legacy {port,token,label} keys; connect_server
takes the host from the code (host arg is an optional override). Proven end-to-end:
the integration harness now connects with NO host arg and resolves it from the code.
- Renderer: Sichtbarkeit selector (local/network), public-host input with
suggested-host chips (os.networkInterfaces — the Tailscale IP shows up there),
allowlist textarea (network mode), and network-requires-allowlist validation.
- main.js: bindMode->host, getSuggestedRemoteHosts, host-in-code, allowlist plumbed
into startDiagnosticAgent + the diagnostics IPC (get/save/status).
- docs: rewritten for Tailscale (set the allowlist to your tailnet, put the Tailscale
IP/MagicDNS in the code address — no SSH forward needed).
This supersedes the v3.3.85 hard loopback-lock with the downloader's allowlist model.
Tests: lib/ip-allowlist (8) + remote-server allowlist wiring/loopback (2) + gateway
decode (host short-key + legacy tolerance). 393 app tests + 9 gateway tests + e2e +
host-in-code integration + adversarial all green; lint 0 errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
2.4 KiB
JavaScript
53 lines
2.4 KiB
JavaScript
const { test } = require('node:test');
|
|
const assert = require('node:assert');
|
|
const { normalizeIp, isLoopbackIp, matchIpRule, evaluateClientAllowed } = require('../lib/ip-allowlist');
|
|
|
|
test('normalizeIp strips ::ffff: and lowercases', () => {
|
|
assert.equal(normalizeIp('::ffff:100.64.0.5'), '100.64.0.5');
|
|
assert.equal(normalizeIp('::FFFF:127.0.0.1'), '127.0.0.1');
|
|
assert.equal(normalizeIp(' 100.64.0.5 '), '100.64.0.5');
|
|
});
|
|
|
|
test('loopback is always allowed, even with a non-matching allowlist', () => {
|
|
for (const ip of ['127.0.0.1', '::1', '::ffff:127.0.0.1', '', 'localhost', '127.5.5.5']) {
|
|
assert.equal(evaluateClientAllowed(ip, ['203.0.113.5']), true, `${ip} loopback`);
|
|
}
|
|
});
|
|
|
|
test('fail-closed: empty allowlist rejects every non-loopback peer', () => {
|
|
for (const ip of ['100.64.0.5', '203.0.113.5', '10.0.0.2', '::ffff:192.168.1.9']) {
|
|
assert.equal(evaluateClientAllowed(ip, []), false, `${ip} must be rejected with empty allowlist`);
|
|
}
|
|
});
|
|
|
|
test('exact IP allow + reject', () => {
|
|
assert.equal(evaluateClientAllowed('203.0.113.5', ['203.0.113.5']), true);
|
|
assert.equal(evaluateClientAllowed('203.0.113.6', ['203.0.113.5']), false);
|
|
});
|
|
|
|
test('CIDR matching incl. the Tailscale CGNAT range 100.64.0.0/10', () => {
|
|
assert.equal(evaluateClientAllowed('100.64.0.5', ['100.64.0.0/10']), true);
|
|
assert.equal(evaluateClientAllowed('100.127.255.254', ['100.64.0.0/10']), true);
|
|
assert.equal(evaluateClientAllowed('100.128.0.1', ['100.64.0.0/10']), false, 'just outside the /10');
|
|
assert.equal(evaluateClientAllowed('::ffff:100.64.0.5', ['100.64.0.0/10']), true, 'mapped v4 in CIDR');
|
|
assert.equal(evaluateClientAllowed('10.0.0.5', ['10.0.0.0/24']), true);
|
|
assert.equal(evaluateClientAllowed('10.0.1.5', ['10.0.0.0/24']), false);
|
|
});
|
|
|
|
test('wildcard rules allow everything', () => {
|
|
assert.equal(evaluateClientAllowed('8.8.8.8', ['*']), true);
|
|
assert.equal(evaluateClientAllowed('8.8.8.8', ['0.0.0.0/0']), true);
|
|
});
|
|
|
|
test('matchIpRule rejects malformed rules and out-of-range octets', () => {
|
|
assert.equal(matchIpRule('1.2.3.4', 'not-an-ip'), false);
|
|
assert.equal(matchIpRule('1.2.3.4', '1.2.3.0/33'), false);
|
|
assert.equal(matchIpRule('1.2.3.999', '1.2.3.0/24'), false);
|
|
});
|
|
|
|
test('isLoopbackIp recognizes loopback forms', () => {
|
|
assert.equal(isLoopbackIp('127.0.0.1'), true);
|
|
assert.equal(isLoopbackIp('::1'), true);
|
|
assert.equal(isLoopbackIp('100.64.0.1'), false);
|
|
});
|