[feature] enable + document explicit IP dialer allowing/denying (#1950)v0.10.0-rc1

* [feature] enable + document explicit IP dialer allowing/denying

* lord have mercy

* allee jonge

* shortcut check ipv6 prefixes

* comment

* separate httpclient_test, export Sanitizer

6 files changed, 144 insertions, 4 deletions

diff --git a/internal/config/config.go b/internal/config/config.go
index c809bbc1b..53514e20b 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -150,6 +150,9 @@ type Configuration struct {
 	AdvancedThrottlingRetryAfter time.Duration `name:"advanced-throttling-retry-after" usage:"Retry-After duration response to send for throttled requests."`
 	AdvancedSenderMultiplier     int           `name:"advanced-sender-multiplier" usage:"Multiplier to use per cpu for batching outgoing fedi messages. 0 or less turns batching off (not recommended)."`
 
+	// HTTPClient configuration vars.
+	HTTPClient HTTPClientConfiguration `name:"http-client"`
+
 	// Cache configuration vars.
 	Cache CacheConfiguration `name:"cache"`
 
@@ -163,6 +166,12 @@ type Configuration struct {
 	RequestIDHeader string `name:"request-id-header" usage:"Header to extract the Request ID from. Eg.,'X-Request-Id'."`
 }
 
+type HTTPClientConfiguration struct {
+	AllowIPs []string      `name:"allow-ips"`
+	BlockIPs []string      `name:"block-ips"`
+	Timeout  time.Duration `name:"timeout"`
+}
+
 type CacheConfiguration struct {
 	GTS GTSCacheConfiguration `name:"gts"`
 
diff --git a/internal/config/defaults.go b/internal/config/defaults.go
index 1cb53c8e2..34e46b342 100644
--- a/internal/config/defaults.go
+++ b/internal/config/defaults.go
@@ -208,6 +208,12 @@ var Defaults = Configuration{
 		VisibilitySweepFreq: time.Minute,
 	},
 
+	HTTPClient: HTTPClientConfiguration{
+		AllowIPs: make([]string, 0),
+		BlockIPs: make([]string, 0),
+		Timeout:  10 * time.Second,
+	},
+
 	AdminMediaPruneDryRun: true,
 
 	RequestIDHeader: "X-Request-Id",
diff --git a/internal/config/flags.go b/internal/config/flags.go
index c9899b67e..c42b5c7b2 100644
--- a/internal/config/flags.go
+++ b/internal/config/flags.go
@@ -55,6 +55,11 @@ func (s *ConfigState) AddGlobalFlags(cmd *cobra.Command) {
 		cmd.PersistentFlags().String(DbSqliteSynchronousFlag(), cfg.DbSqliteSynchronous, fieldtag("DbSqliteSynchronous", "usage"))
 		cmd.PersistentFlags().Uint64(DbSqliteCacheSizeFlag(), uint64(cfg.DbSqliteCacheSize), fieldtag("DbSqliteCacheSize", "usage"))
 		cmd.PersistentFlags().Duration(DbSqliteBusyTimeoutFlag(), cfg.DbSqliteBusyTimeout, fieldtag("DbSqliteBusyTimeout", "usage"))
+
+		// HTTPClient
+		cmd.PersistentFlags().StringSlice(HTTPClientAllowIPsFlag(), cfg.HTTPClient.AllowIPs, "no usage string")
+		cmd.PersistentFlags().StringSlice(HTTPClientBlockIPsFlag(), cfg.HTTPClient.BlockIPs, "no usage string")
+		cmd.PersistentFlags().Duration(HTTPClientTimeoutFlag(), cfg.HTTPClient.Timeout, "no usage string")
 	})
 }
 
diff --git a/internal/config/gen/gen.go b/internal/config/gen/gen.go
index 30994c652..1c2c11747 100644
--- a/internal/config/gen/gen.go
+++ b/internal/config/gen/gen.go
@@ -96,16 +96,22 @@ func generateFields(output io.Writer, prefixes []string, t reflect.Type) {
 		flagPath := strings.Join(append(prefixes, field.Tag.Get("name")), "-")
 		flagPath = strings.ToLower(flagPath)
 
+		// Get type without "config." prefix.
+		fieldType := strings.ReplaceAll(
+			field.Type.String(),
+			"config.", "",
+		)
+
 		// ConfigState structure helper methods
 		fmt.Fprintf(output, "// Get%s safely fetches the Configuration value for state's '%s' field\n", name, fieldPath)
-		fmt.Fprintf(output, "func (st *ConfigState) Get%s() (v %s) {\n", name, field.Type.String())
+		fmt.Fprintf(output, "func (st *ConfigState) Get%s() (v %s) {\n", name, fieldType)
 		fmt.Fprintf(output, "\tst.mutex.Lock()\n")
 		fmt.Fprintf(output, "\tv = st.config.%s\n", fieldPath)
 		fmt.Fprintf(output, "\tst.mutex.Unlock()\n")
 		fmt.Fprintf(output, "\treturn\n")
 		fmt.Fprintf(output, "}\n\n")
 		fmt.Fprintf(output, "// Set%s safely sets the Configuration value for state's '%s' field\n", name, fieldPath)
-		fmt.Fprintf(output, "func (st *ConfigState) Set%s(v %s) {\n", name, field.Type.String())
+		fmt.Fprintf(output, "func (st *ConfigState) Set%s(v %s) {\n", name, fieldType)
 		fmt.Fprintf(output, "\tst.mutex.Lock()\n")
 		fmt.Fprintf(output, "\tdefer st.mutex.Unlock()\n")
 		fmt.Fprintf(output, "\tst.config.%s = v\n", fieldPath)
@@ -117,8 +123,8 @@ func generateFields(output io.Writer, prefixes []string, t reflect.Type) {
 		fmt.Fprintf(output, "// %sFlag returns the flag name for the '%s' field\n", name, fieldPath)
 		fmt.Fprintf(output, "func %sFlag() string { return \"%s\" }\n\n", name, flagPath)
 		fmt.Fprintf(output, "// Get%s safely fetches the value for global configuration '%s' field\n", name, fieldPath)
-		fmt.Fprintf(output, "func Get%[1]s() %[2]s { return global.Get%[1]s() }\n\n", name, field.Type.String())
+		fmt.Fprintf(output, "func Get%[1]s() %[2]s { return global.Get%[1]s() }\n\n", name, fieldType)
 		fmt.Fprintf(output, "// Set%s safely sets the value for global configuration '%s' field\n", name, fieldPath)
-		fmt.Fprintf(output, "func Set%[1]s(v %[2]s) { global.Set%[1]s(v) }\n\n", name, field.Type.String())
+		fmt.Fprintf(output, "func Set%[1]s(v %[2]s) { global.Set%[1]s(v) }\n\n", name, fieldType)
 	}
 }
diff --git a/internal/config/helpers.gen.go b/internal/config/helpers.gen.go
index c82eba3b3..56360a6c2 100644
--- a/internal/config/helpers.gen.go
+++ b/internal/config/helpers.gen.go
@@ -2299,6 +2299,81 @@ func GetAdvancedSenderMultiplier() int { return global.GetAdvancedSenderMultipli
 // SetAdvancedSenderMultiplier safely sets the value for global configuration 'AdvancedSenderMultiplier' field
 func SetAdvancedSenderMultiplier(v int) { global.SetAdvancedSenderMultiplier(v) }
 
+// GetHTTPClientAllowIPs safely fetches the Configuration value for state's 'HTTPClient.AllowIPs' field
+func (st *ConfigState) GetHTTPClientAllowIPs() (v []string) {
+	st.mutex.Lock()
+	v = st.config.HTTPClient.AllowIPs
+	st.mutex.Unlock()
+	return
+}
+
+// SetHTTPClientAllowIPs safely sets the Configuration value for state's 'HTTPClient.AllowIPs' field
+func (st *ConfigState) SetHTTPClientAllowIPs(v []string) {
+	st.mutex.Lock()
+	defer st.mutex.Unlock()
+	st.config.HTTPClient.AllowIPs = v
+	st.reloadToViper()
+}
+
+// HTTPClientAllowIPsFlag returns the flag name for the 'HTTPClient.AllowIPs' field
+func HTTPClientAllowIPsFlag() string { return "httpclient-allow-ips" }
+
+// GetHTTPClientAllowIPs safely fetches the value for global configuration 'HTTPClient.AllowIPs' field
+func GetHTTPClientAllowIPs() []string { return global.GetHTTPClientAllowIPs() }
+
+// SetHTTPClientAllowIPs safely sets the value for global configuration 'HTTPClient.AllowIPs' field
+func SetHTTPClientAllowIPs(v []string) { global.SetHTTPClientAllowIPs(v) }
+
+// GetHTTPClientBlockIPs safely fetches the Configuration value for state's 'HTTPClient.BlockIPs' field
+func (st *ConfigState) GetHTTPClientBlockIPs() (v []string) {
+	st.mutex.Lock()
+	v = st.config.HTTPClient.BlockIPs
+	st.mutex.Unlock()
+	return
+}
+
+// SetHTTPClientBlockIPs safely sets the Configuration value for state's 'HTTPClient.BlockIPs' field
+func (st *ConfigState) SetHTTPClientBlockIPs(v []string) {
+	st.mutex.Lock()
+	defer st.mutex.Unlock()
+	st.config.HTTPClient.BlockIPs = v
+	st.reloadToViper()
+}
+
+// HTTPClientBlockIPsFlag returns the flag name for the 'HTTPClient.BlockIPs' field
+func HTTPClientBlockIPsFlag() string { return "httpclient-block-ips" }
+
+// GetHTTPClientBlockIPs safely fetches the value for global configuration 'HTTPClient.BlockIPs' field
+func GetHTTPClientBlockIPs() []string { return global.GetHTTPClientBlockIPs() }
+
+// SetHTTPClientBlockIPs safely sets the value for global configuration 'HTTPClient.BlockIPs' field
+func SetHTTPClientBlockIPs(v []string) { global.SetHTTPClientBlockIPs(v) }
+
+// GetHTTPClientTimeout safely fetches the Configuration value for state's 'HTTPClient.Timeout' field
+func (st *ConfigState) GetHTTPClientTimeout() (v time.Duration) {
+	st.mutex.Lock()
+	v = st.config.HTTPClient.Timeout
+	st.mutex.Unlock()
+	return
+}
+
+// SetHTTPClientTimeout safely sets the Configuration value for state's 'HTTPClient.Timeout' field
+func (st *ConfigState) SetHTTPClientTimeout(v time.Duration) {
+	st.mutex.Lock()
+	defer st.mutex.Unlock()
+	st.config.HTTPClient.Timeout = v
+	st.reloadToViper()
+}
+
+// HTTPClientTimeoutFlag returns the flag name for the 'HTTPClient.Timeout' field
+func HTTPClientTimeoutFlag() string { return "httpclient-timeout" }
+
+// GetHTTPClientTimeout safely fetches the value for global configuration 'HTTPClient.Timeout' field
+func GetHTTPClientTimeout() time.Duration { return global.GetHTTPClientTimeout() }
+
+// SetHTTPClientTimeout safely sets the value for global configuration 'HTTPClient.Timeout' field
+func SetHTTPClientTimeout(v time.Duration) { global.SetHTTPClientTimeout(v) }
+
 // GetCacheGTSAccountMaxSize safely fetches the Configuration value for state's 'Cache.GTS.AccountMaxSize' field
 func (st *ConfigState) GetCacheGTSAccountMaxSize() (v int) {
 	st.mutex.Lock()
diff --git a/internal/config/util.go b/internal/config/util.go
new file mode 100644
index 000000000..a9df08b3c
--- /dev/null
+++ b/internal/config/util.go
@@ -0,0 +1,39 @@
+// GoToSocial
+// Copyright (C) GoToSocial Authors admin@gotosocial.org
+// SPDX-License-Identifier: AGPL-3.0-or-later
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package config
+
+import (
+	"net/netip"
+
+	"github.com/superseriousbusiness/gotosocial/internal/log"
+)
+
+func MustParseIPPrefixes(in []string) []netip.Prefix {
+	prefs := make([]netip.Prefix, 0, len(in))
+
+	for _, i := range in {
+		pref, err := netip.ParsePrefix(i)
+		if err != nil {
+			log.Panicf(nil, "error parsing ip prefix from %q: %v", i, err)
+		}
+
+		prefs = append(prefs, pref)
+	}
+
+	return prefs
+}