1

src/control_server.c

@@ -270,6 +270,24 @@ void control_server_shutdown(struct control_server* server) {
  * Client Connection Handling
  * ============================================================================ */
 
+static int is_control_ip_allowed(const struct control_server* server, uint32_t client_ip) {
+    if (!server || !server->instance || !server->instance->config) {
+        DEBUG_WARN(DEBUG_CATEGORY_CONTROL, "Control IP check: no config available");
+        return 0;
+    }
+    const struct global_config *g = &server->instance->config->global;
+    if (g->control_allow_count == 0) {
+        DEBUG_WARN(DEBUG_CATEGORY_CONTROL, "Control connection denied (no allow rules) - add control_allow=IP/mask to [control] in config");
+        return 0;
+    }
+    for (int i = 0; i < g->control_allow_count; i++) {
+        const struct CFG_CONTROL_ALLOW *r = &g->control_allows[i];
+        if ((client_ip & r->netmask) == r->network) return 1;
+    }
+    DEBUG_WARN(DEBUG_CATEGORY_CONTROL, "Control connection denied from IP (not in allow list) - add control_allow=IP/mask to [control]");
+    return 0;
+}
+
 static void accept_callback(socket_t fd, void* arg) {
     struct control_server* server = (struct control_server*)arg;
     
@@ -318,6 +336,28 @@ static void accept_callback(socket_t fd, void* arg) {
         fcntl(client_fd, F_SETFL, flags | O_NONBLOCK);
     }
 #endif
+    /* Check allowed IP (default deny all) */
+    uint32_t client_ip = 0;
+    if (client_addr.ss_family == AF_INET) {
+        struct sockaddr_in* sin = (struct sockaddr_in*)&client_addr;
+        client_ip = ntohl(sin->sin_addr.s_addr);
+    } else {
+        DEBUG_WARN(DEBUG_CATEGORY_CONTROL, "IPv6 not supported for control allow list");
+#ifdef _WIN32
+        closesocket(client_fd);
+#else
+        close(client_fd);
+#endif
+        return;
+    }
+    if (!is_control_ip_allowed(server, client_ip)) {
+#ifdef _WIN32
+        closesocket(client_fd);
+#else
+        close(client_fd);
+#endif
+        return;
+    }
     DEBUG_WARN(DEBUG_CATEGORY_CONTROL, "Accept...");
     
     /* Check max clients */