Make exposing Valetudo to the internet harder

[ccoors]

Over the past weeks we repeatedly found Valetudo instances publicly available on the internet. People either configured some port forwarding or are using a reverse proxy.
While most people activate HTTP basic auth, some don't, allowing access to their vacuum robot to basically everyone.

I propose a new configurable Express middleware, checking the source address of a request and blocking it, if the source address is not in a private network area.

A basic middleware could look like this:

function isInternallIP(ip) {
    if (ip.indexOf(":") === -1) {
        // IPv4
        return ipInAddressBlock(ip, "10.0.0.0/8") ||
            ipInAddressBlock(ip, "172.16.0.0/12") ||
            ipInAddressBlock(ip, "192.168.0.0/16");
    } else if (ip.toLowerCase().startsWith("fd00:")) {
        return true;
    } else if (ip.toLowerCase().startsWith("::ffff:")) {
        // Some weird case of a mixed IPv6/IPv4 Address (e.g. "::ffff:127.0.0.1")
        return isExternalIP(ip.split(":").pop());
    }
    return false;
}

this.app.use((req, res, next) => {
    if (!isInternallIP(req.ip)) {
        return res.status(401).send("External access to Valetudo is blocked. Check the configuration/docs/whatever.");
    }
    next();
});

Which should be disableable like the basic auth.

It would also be required to configure a useful value for express trust proxy to get the correct address behind reverse proxies. That should also be user-configurable, since enabling it without using a reverse proxy would allow an attacker to spoof the HTTP header X-Forwarded-For.

[Hypfer]

10b1662