RequireAddress returns an error if the given address is not authorized in the context.
(ctx context.Context, addr string)
| 37 | |
| 38 | // RequireAddress returns an error if the given address is not authorized in the context. |
| 39 | func (Authorizer) RequireAddress(ctx context.Context, addr string) error { |
| 40 | var authInfo authInfo |
| 41 | if nsAuthInfo, ok := NetworkServerAuthInfoFromContext(ctx); ok { |
| 42 | authInfo = nsAuthInfo |
| 43 | } else if asAuthInfo, ok := ApplicationServerAuthInfoFromContext(ctx); !ok { |
| 44 | return errUnauthenticated.New() |
| 45 | } else { |
| 46 | authInfo = asAuthInfo |
| 47 | } |
| 48 | |
| 49 | patterns := authInfo.addressPatterns() |
| 50 | if len(patterns) == 0 { |
| 51 | return errCallerNotAuthorized.WithAttributes("target", addr) |
| 52 | } |
| 53 | |
| 54 | host := addr |
| 55 | if hostURL, err := url.Parse(addr); err == nil && hostURL.Host != "" { |
| 56 | host = hostURL.Host |
| 57 | } |
| 58 | if h, _, err := net.SplitHostPort(addr); err == nil { |
| 59 | host = h |
| 60 | } |
| 61 | if len(host) == 0 { |
| 62 | return errCallerNotAuthorized.WithAttributes("target", addr) |
| 63 | } |
| 64 | hostParts := strings.Split(host, ".") |
| 65 | |
| 66 | nextPattern: |
| 67 | for _, pattern := range patterns { |
| 68 | patternParts := strings.Split(pattern, ".") |
| 69 | if len(patternParts) != len(hostParts) { |
| 70 | return errCallerNotAuthorized.WithAttributes("target", addr) |
| 71 | } |
| 72 | for i, patternPart := range patternParts { |
| 73 | if i == 0 && patternPart == "*" { |
| 74 | continue |
| 75 | } |
| 76 | if patternPart != hostParts[i] { |
| 77 | continue nextPattern |
| 78 | } |
| 79 | } |
| 80 | return nil |
| 81 | } |
| 82 | return errCallerNotAuthorized.WithAttributes("target", addr) |
| 83 | } |
| 84 | |
| 85 | // RequireNetID returns an error if the given NetID is not authorized in the context. |
| 86 | func (Authorizer) RequireNetID(ctx context.Context, netID types.NetID) error { |