ring-firewall-middleware.core — org.clojars.rutledgepaulv/ring-firewall-middleware 0.1.0

default-deny-handler clj

(default-deny-handler request)

Provides a default ring response for users who didn't meet the firewall requirements.

get-forwarded-ip-addresses clj

(get-forwarded-ip-addresses request)

Gets all the forwarded ip addresses from a request.

honored-proxy-headers clj

in-cidr-range? clj

(in-cidr-range? cidr client-ip)

Is a given client ip within a given cidr range?

in-cidr-ranges? clj

(in-cidr-ranges? cidr-ranges ip-address)

Is a given ip address in one of the provided cidr ranges?

private-address? clj

(private-address? ip-address)

Is this a private ip address as defined by RFC 1918 or RFC 4193?

private-subnets clj

public-address? clj

(public-address? ip-address)

Is this not a private ip address as defined by RFC 1918 or RFC 4193?

request-matches? clj

(request-matches? request access-list)

Does the ring request satisfy the access list?

rfc1918-private-subnets clj

rfc4193-private-subnets clj

wrap-allow-ips clj

(wrap-allow-ips handler)

(wrap-allow-ips handler
                {:keys [allow-list deny-handler]
                 :or {allow-list private-subnets
                      deny-handler default-deny-handler}})

Protect a ring handler with source ip authentication. Your allow-list ranges must cover any permitted clients as well as any intermediate proxy servers. The default allow-list ranges are the entire internal network space as defined by RFC 1918 and RFC 4193.

deny-list - cidr ranges collection that, if matched, will result in an allowed request. optionally provide a ref type in which case it will be dereferenced before use.

deny-handler - a function of a ring request that returns a ring response in the event of a denied request.

wrap-deny-ips clj

(wrap-deny-ips handler)

(wrap-deny-ips handler
               {:keys [deny-list deny-handler]
                :or {deny-list private-subnets
                     deny-handler default-deny-handler}})

Protect a ring handler with source ip authentication. Your deny-list ranges must cover any forbidden clients / proxy servers. The default deny-list ranges are the entire internal network space as defined by RFC 1918 and RFC 4193.

deny-list - cidr ranges collection that, if matched, will result in a denied request. optionally provide a ref type in which case it will be dereferenced before use.

deny-handler - a function of a ring request that returns a ring response in the event of a denied request.