Allow binding tang http server to a given IP address

[lespinasse]

As tang is generally intended to be accessed only from a given local network, it would be nice if its listening socket could be bound to a given IP address (most likely an rfc1918 one).

[n80fr1n60]

@lespinasse considering it was asked quite a while ago, are u still interested in this ?

[lespinasse]

I still think this would be nice. I'm coming from the point of view of an openwrt user, every other service I have installed on my openwrt systems allows specifying the address(es) they will bind to, except for tang which does not.

[n80fr1n60]

@lespinasse Yep I know, used to have openwrt running myself...
i have a very special use case where i need sth like this too, but found a way around it (lock it down with ip6tables and iptables)

Code wise it is rather straight forward to implement, if you can give more functional requirements (eg ipv4/ipv6 etc), and or a cmd line flag of how to specify the ip (-l , -p is already taken (afaik) ) maybe -a "w.x.y.z"

If i have that, I can do a "first version", which u can try - if thats ok for you

[lespinasse]

@n80fr1n60 yes, iptables / ip6tables works too, it just adds an extra dependency (I normally only have them on my main openwrt router, which is not where I serve tang from :)

I think the "nicest" way would be to extend the -p option so that instead of specifying a port, it would specify an optional address and a port. This is how dropbear and uhttpd do it (both with their -p arguments, too), and it avoids adding a separate option for address vs port. it does make option parsing a bit more cumbersome though, as you would need to separate the address from the port. I think all following formats should be handled:

• port
• :port
• addr:port
• [addr]:port
  where addr is an ipv4 or ipv6 numerical address (I don't think handling host names is necessary here).

I think having a single listen address is sufficient.

On the openwrt side, the contents of option port in /etc/config/tang could be passed as-is as the -p argument, or, there could be a new option listen which would take priority over option port if present. No strong preferences there, and I could probably take care of the openwrt side if you like (and if we decide that changes are necessary there).

optionally: the tangd side could also have a (possibly repeated) -a option, to specify ipv4 or ipv6 address ranges to accept connections from. Format would be -a subnet, where the subnet would be either a single ipv4 or ipv6 address, or addr/mask in CIDR notation (for example 10.0.0.0/8). If this is added, then the openwrt side would need to be changed too, I would propose adding list accept in /etc/config/tang to specify such ranges (again, I can take care of the openwrt side if that helps).

What do you think ?

[n80fr1n60]

Thanks for the input, really appreciated....

For the optional part, i need to give it a thought

Yep I try to avoid the cumbersome parsing part ... ;) , as the tangd code where it does the binding already iterates over the interfaces, I think it would be easier to specify a "listen interface" or "interface list" that would remove the specifying of "ipv4"and/or "ipv6" on the cmd line... then we can do sth along these lines: tangd -l -p 9099 -i "eth0, lo"

Whats your thought on this ?

[lespinasse]

my worry about specifying kernel network interfaces names rather than addresses, is that each kernel network interface may have many IP addresses associated to it. Possibly, a mix of IPv4 and IPv6 ones, private and public and (for IPv6) link-local. I think a common use case would be to want to bind to a private address but not any public ones, even if those may be configured on the same kernel network interface.

[n80fr1n60]

valid point

[n80fr1n60]

@lespinasse will ipv4 or ipv6 ( whatever u prefer) be sufficient for testing a PoC style setup ?
i would do sth like: -p IP:PORT ( but not final as optparse is a pain in the ... ,and lower layer functions do not have the option to pass in ip addresses directly, just a port ...)
Need to think abt how to structure the full blown ipv4/ipv6 etc setup w/o changing too much code, and how to do testing

[lespinasse]

For my own use, I would only need to specify a single numerical ipv4 address to bind to. I don't need ipv6 address parsing for my use cases.

I do have the case of network interfaces having both public and private ipv4 addresses though, so just being able to specify 'all ipv4 on this specific interface' wouldn't help me much.