forked from zaclys/searxng
f3763d73ad
A blocklist and a passlist can be configured in /etc/searxng/limiter.toml::
[botdetection.ip_lists]
pass_ip = [
'51.15.252.168', # IPv4 of check.searx.space
]
block_ip = [
'93.184.216.34', # IPv4 of example.org
]
Closes: https://github.com/searxng/searxng/issues/2127
Closes: https://github.com/searxng/searxng/pull/2129
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
86 lines
2.7 KiB
Python
86 lines
2.7 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
# lint: pylint
|
|
""".. _botdetection.ip_lists:
|
|
|
|
Method ``ip_lists``
|
|
-------------------
|
|
|
|
The ``ip_lists`` method implements IP :py:obj:`block- <block_ip>` and
|
|
:py:obj:`pass-lists <pass_ip>`.
|
|
|
|
.. code:: toml
|
|
|
|
[botdetection.ip_lists]
|
|
|
|
pass_ip = [
|
|
'140.238.172.132', # IPv4 of check.searx.space
|
|
'192.168.0.0/16', # IPv4 private network
|
|
'fe80::/10' # IPv6 linklocal
|
|
]
|
|
block_ip = [
|
|
'93.184.216.34', # IPv4 of example.org
|
|
'257.1.1.1', # invalid IP --> will be ignored, logged in ERROR class
|
|
]
|
|
|
|
"""
|
|
# pylint: disable=unused-argument
|
|
|
|
from __future__ import annotations
|
|
from typing import Tuple
|
|
from ipaddress import (
|
|
ip_network,
|
|
IPv4Address,
|
|
IPv6Address,
|
|
)
|
|
|
|
from searx.tools import config
|
|
from ._helpers import logger
|
|
|
|
logger = logger.getChild('ip_limit')
|
|
|
|
SEARXNG_ORG = [
|
|
# https://github.com/searxng/searxng/pull/2484#issuecomment-1576639195
|
|
'140.238.172.132', # IPv4 check.searx.space
|
|
'2603:c022:0:4900::/56', # IPv6 check.searx.space
|
|
]
|
|
"""Passlist of IPs from the SearXNG organization, e.g. `check.searx.space`."""
|
|
|
|
|
|
def pass_ip(real_ip: IPv4Address | IPv6Address, cfg: config.Config) -> Tuple[bool, str]:
|
|
"""Checks if the IP on the subnet is in one of the members of the
|
|
``botdetection.ip_lists.pass_ip`` list.
|
|
"""
|
|
|
|
if cfg.get('botdetection.ip_lists.pass_searxng_org', default=True):
|
|
for net in SEARXNG_ORG:
|
|
net = ip_network(net, strict=False)
|
|
if real_ip.version == net.version and real_ip in net:
|
|
return True, f"IP matches {net.compressed} in SEARXNG_ORG list."
|
|
return ip_is_subnet_of_member_in_list(real_ip, 'botdetection.ip_lists.pass_ip', cfg)
|
|
|
|
|
|
def block_ip(real_ip: IPv4Address | IPv6Address, cfg: config.Config) -> Tuple[bool, str]:
|
|
"""Checks if the IP on the subnet is in one of the members of the
|
|
``botdetection.ip_lists.block_ip`` list.
|
|
"""
|
|
|
|
block, msg = ip_is_subnet_of_member_in_list(real_ip, 'botdetection.ip_lists.block_ip', cfg)
|
|
if block:
|
|
msg += " To remove IP from list, please contact the maintainer of the service."
|
|
return block, msg
|
|
|
|
|
|
def ip_is_subnet_of_member_in_list(
|
|
real_ip: IPv4Address | IPv6Address, list_name: str, cfg: config.Config
|
|
) -> Tuple[bool, str]:
|
|
|
|
for net in cfg.get(list_name, default=[]):
|
|
try:
|
|
net = ip_network(net, strict=False)
|
|
except ValueError:
|
|
logger.error("invalid IP %s in %s", net, list_name)
|
|
continue
|
|
if real_ip.version == net.version and real_ip in net:
|
|
return True, f"IP matches {net.compressed} in {list_name}."
|
|
return False, f"IP is not a member of an item in the f{list_name} list"
|