AirCon icon indicating copy to clipboard operation
AirCon copied to clipboard

Restrict binding to specific IP

Open mgc8 opened this issue 1 year ago • 0 comments

Currently, the server binds to the default of all interfaces, due to having an empty host parameter in the web.TCPSite invocation. This is insecure in case of servers spanning multiple networks, as some may have external access.

Recently, the local_ip argument was added, which specifies the correct IP for the A/C to talk to the server. We can use that as well to bind to that IP specifically with a simple change like below (this also solves the issue of people being confused by the functionality of this parameter):

--- a/aircon/__main__.py
+++ b/aircon/__main__.py
@@ -153,7 +153,8 @@ async def setup_and_run_http_server(parsed_args, devices: [Device]):
   ])
   runner = web.AppRunner(app)
   await runner.setup()
-  site = web.TCPSite(runner, port=parsed_args.port)
+  local_ip = parsed_args.local_ip if hasattr(parsed_args, 'local_ip') else ''
+  site = web.TCPSite(runner, host=local_ip, port=parsed_args.port)
   await site.start()

Alternatively, a new option can be added similar to --port, e.g. --host to specify that on startup.

Would it be possible to add this to the codebase?

mgc8 avatar Feb 13 '24 22:02 mgc8