Protect webserver::bans and webserver::allowances

etr · Jul 25, 2023 · 2f7b4ff · 2f7b4ff
1 parent d4a89d8
commit 2f7b4ff
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/src/httpserver/webserver.hpp b/src/httpserver/webserver.hpp
@@ -179,6 +179,7 @@ class webserver {
      std::map<details::http_endpoint, http_resource*> registered_resources;
      std::map<std::string, http_resource*> registered_resources_str;
 
+     std::shared_mutex bans_and_allowances_mutex;
      std::set<http::ip_representation> bans;
      std::set<http::ip_representation> allowances;
 

diff --git a/src/webserver.cpp b/src/webserver.cpp
@@ -370,6 +370,7 @@ void webserver::unregister_resource(const string& resource) {
 }
 
 void webserver::ban_ip(const string& ip) {
+    std::unique_lock bans_and_allowances_lock(bans_and_allowances_mutex);
     ip_representation t_ip(ip);
     set<ip_representation>::iterator it = bans.find(t_ip);
     if (it != bans.end() && (t_ip.weight() < (*it).weight())) {
@@ -381,6 +382,7 @@ void webserver::ban_ip(const string& ip) {
 }
 
 void webserver::allow_ip(const string& ip) {
+    std::unique_lock bans_and_allowances_lock(bans_and_allowances_mutex);
     ip_representation t_ip(ip);
     set<ip_representation>::iterator it = allowances.find(t_ip);
     if (it != allowances.end() && (t_ip.weight() < (*it).weight())) {
@@ -392,10 +394,12 @@ void webserver::allow_ip(const string& ip) {
 }
 
 void webserver::unban_ip(const string& ip) {
+    std::unique_lock bans_and_allowances_lock(bans_and_allowances_mutex);
     bans.erase(ip_representation(ip));
 }
 
 void webserver::disallow_ip(const string& ip) {
+    std::unique_lock bans_and_allowances_lock(bans_and_allowances_mutex);
     allowances.erase(ip_representation(ip));
 }
 
@@ -405,6 +409,7 @@ MHD_Result policy_callback(void *cls, const struct sockaddr* addr, socklen_t add
 
     if (!(static_cast<webserver*>(cls))->ban_system_enabled) return MHD_YES;
 
+    std::shared_lock bans_and_allowances_lock((static_cast<webserver*>(cls))->bans_and_allowances_mutex);
     if ((((static_cast<webserver*>(cls))->default_policy == http_utils::ACCEPT) &&
                 ((static_cast<webserver*>(cls))->bans.count(ip_representation(addr))) &&
                 (!(static_cast<webserver*>(cls))->allowances.count(ip_representation(addr)))) ||