Node / public / rns-proxy / files / src / filter.rs

Displaying Raw • Download

Tff7b72use Te6edf3std::Te6edf3net::Tb4b4b4{Te6edf3IpAddr::Tb4b4b4{Tff7b72selfTb4b4b4, Te6edf3V4Tb4b4b4, Te6edf3V6Tb4b4b4}Tb4b4b4, Te6edf3Ipv4AddrTb4b4b4, Te6edf3SocketAddrTb4b4b4}Tb4b4b4;

Tff7b72use Te6edf3fast_socks5::Te6edf3util::Te6edf3target_addr::Te6edf3TargetAddrTb4b4b4;

Tff7b72use Te6edf3log::Te6edf3warnTb4b4b4;

Tff7b72use Tff7b72crate::Tb4b4b4{Te6edf3filter::Tb4b4b4{Te6edf3AddressFilter::Tb4b4b4{Te6edf3AddressTb4b4b4, Te6edf3LocalhostTb4b4b4, Te6edf3PrivateTb4b4b4}Tb4b4b4, Te6edf3PortFilterType::Te6edf3SingleTb4b4b4}Tb4b4b4, Te6edf3forwarding::Te6edf3PortTypeTb4b4b4, Tb4b4b4}Tb4b4b4;

T8b949e///! Socket Filter

T8b949e///!

T8b949e///! This allows the server side client to restrict what ips are allowed. as well as what ports

T8b949e///!

T8b949e///! This allows for generals socksv5 proxying while for example disabling accessing the localhost or computer's private network or disabling all UDP.

T8b949e///! but can also be used for more restrictive purposes like only allowing clients to connect to a certain localhost.

T8b949e///!

T8b949e///! # Filter list

T8b949e///! the filter list consists of a list of filters which can either be include or exclude

T8b949e///! with the top having the least prioty and more granular settings and the bottom having the most priorty.

T8b949e///!

T8b949e///! by defeault an addressj

T8b949e///!

T8b949e///! # examples

T8b949e///! ## example 1, only allow dns requests

T8b949e///! All:53:udp Include

T8b949e///! ## example 2, allow connections only to a local IRC chat

T8b949e///! All:194 Include

T8b949e///! ## example 3, generic sockets server that blocks udp, private and localhost except for a localhost web server

T8b949e///! All Include

T8b949e///! Private Exclude

T8b949e///! Localhost Exclude

T8b949e///! Localhost:80:tcp

T8b949e///!

Tff7b72pub Tff7b72trait Te6edf3FilterSocket Tb4b4b4{

Tff7b72fn Td2a8fffilterTb4b4b4(Tff7b72&Tff7b72selfTb4b4b4, Te6edf3addr: Tff7b72&T56d364SocketAddrTb4b4b4) -> Tffa657boolTb4b4b4;

Tb4b4b4}

Tff7b72#[Tff7b72derive(Clone)Tff7b72]

Tff7b72pub Tff7b72enum T56d364FilterResult Tb4b4b4{

Te6edf3ExcludeTb4b4b4,

Te6edf3IncludeTb4b4b4,

Tb4b4b4} T8b949e// filters can also do neither if they are not applicable.

Tff7b72#[Tff7b72derive(Clone)Tff7b72]

Tff7b72pub Tff7b72enum T56d364AddressFilter Tb4b4b4{

Te6edf3AllTb4b4b4,

Te6edf3AddressTb4b4b4(Te6edf3IpAddrTb4b4b4)Tb4b4b4,

Te6edf3PrivateTb4b4b4,

Te6edf3LocalhostTb4b4b4,

Tb4b4b4}

Tff7b72impl Te6edf3FilterSocket Tff7b72for Te6edf3AddressFilter Tb4b4b4{

Tff7b72fn Td2a8fffilterTb4b4b4(Tff7b72&Tff7b72selfTb4b4b4, Te6edf3addr: Tff7b72&T56d364SocketAddrTb4b4b4) -> Tffa657bool Tb4b4b4{

Tff7b72match Tff7b72*Tff7b72self Tb4b4b4{

Te6edf3AddressFilter::Te6edf3All Tff7b72=Tff7b72> Tff7b72trueTb4b4b4,

Te6edf3AddressTb4b4b4(Te6edf3filterTb4b4b4) Tff7b72=Tff7b72> Te6edf3addrTb4b4b4.Te6edf3ipTb4b4b4(Tb4b4b4) Tff7b72=Tff7b72= Te6edf3filterTb4b4b4,

Te6edf3Private Tff7b72=Tff7b72> Tff7b72match Te6edf3addrTb4b4b4.Te6edf3ipTb4b4b4(Tb4b4b4) Tb4b4b4{

Te6edf3V4Tb4b4b4(Te6edf3addrTb4b4b4) Tff7b72=Tff7b72> Te6edf3addrTb4b4b4.Te6edf3is_privateTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3V6Tb4b4b4(Te6edf3addrTb4b4b4) Tff7b72=Tff7b72> Te6edf3addrTb4b4b4.Te6edf3is_unique_localTb4b4b4(Tb4b4b4)Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Te6edf3Localhost Tff7b72=Tff7b72> Tff7b72match Te6edf3addrTb4b4b4.Te6edf3ipTb4b4b4(Tb4b4b4) Tb4b4b4{

Te6edf3V4Tb4b4b4(Te6edf3addrTb4b4b4) Tff7b72=Tff7b72> Te6edf3addr Tff7b72=Tff7b72= Te6edf3Ipv4Addr::Te6edf3LOCALHOSTTb4b4b4, T8b949e// loopback may not technically be localhost

T8b949e// in ipv4 cause it can be any of 16 million addressses.

Te6edf3V6Tb4b4b4(Te6edf3addrTb4b4b4) Tff7b72=Tff7b72> Te6edf3addrTb4b4b4.Te6edf3is_loopbackTb4b4b4(Tb4b4b4)Tb4b4b4,

Tb4b4b4}

Tb4b4b4}

Tb4b4b4}

Tb4b4b4}

Tff7b72#[Tff7b72derive(Clone)Tff7b72]

Tff7b72pub Tff7b72enum T56d364PortFilterType Tb4b4b4{

Te6edf3SingleTb4b4b4(Tffa657u16Tb4b4b4)Tb4b4b4,

Te6edf3AllTb4b4b4,

Tb4b4b4}

Tff7b72#[Tff7b72derive(Clone)Tff7b72]

Tff7b72pub Tff7b72struct T56d364PortFilter Tb4b4b4{

Tff7b72pub Te6edf3port_filter: T56d364PortFilterTypeTb4b4b4,

Tff7b72pub Te6edf3port_type: T56d364PortTypeTb4b4b4,

Tb4b4b4}

Tff7b72impl Te6edf3FilterSocket Tff7b72for Te6edf3PortFilter Tb4b4b4{

Tff7b72fn Td2a8fffilterTb4b4b4(Tff7b72&Tff7b72selfTb4b4b4, Te6edf3addr: Tff7b72&T56d364SocketAddrTb4b4b4) -> Tffa657bool Tb4b4b4{

Tff7b72match Tff7b72selfTb4b4b4.Te6edf3port_filter Tb4b4b4{

Te6edf3SingleTb4b4b4(Te6edf3checking_portTb4b4b4) Tff7b72=Tff7b72> Tb4b4b4{

Te6edf3addrTb4b4b4.Te6edf3portTb4b4b4(Tb4b4b4) Tff7b72=Tff7b72= Te6edf3checking_port

Tb4b4b4}Tb4b4b4,

Te6edf3PortFilterType::Te6edf3All Tff7b72=Tff7b72> Tff7b72trueTb4b4b4,

Tb4b4b4}

Tb4b4b4}

Tb4b4b4}

Tff7b72#[Tff7b72derive(Clone)Tff7b72]

Tff7b72pub Tff7b72struct T56d364Filter Tb4b4b4{

Tff7b72pub Te6edf3address_filter: T56d364AddressFilterTb4b4b4,

Tff7b72pub Te6edf3port_filter: T56d364PortFilterTb4b4b4,

Tff7b72pub Te6edf3filter_result: T56d364FilterResultTb4b4b4,

Tb4b4b4}

Tff7b72#[Tff7b72derive(Clone)Tff7b72]

Tff7b72pub Tff7b72struct T56d364FilterConfig Tb4b4b4{

Tff7b72pub Te6edf3filters: Tffa657VecTff7b72<Te6edf3FilterTff7b72>Tb4b4b4, T8b949e// last filter has the most priority.

Tb4b4b4}

T8b949e/// Note that this functionality could potentially be used to expose the real ip address of the server

T8b949e/// by making the reticulum server do a bogus dns request and using that a marker to find where it came from.

T8b949e/// Unlikey but possible and filtering by everything wouldn't prevent this. as we perform filtering

T8b949e/// after having having resolved the real ip. Adding a "deny domainname" to FilterConfig may make sense

T8b949e/// to reduce the possible attack surface

T8b949e///

T8b949e/// Something to keep in mind.

Tff7b72pub Tff7b72async Tff7b72fn Td2a8fftarget_to_socketTb4b4b4(Te6edf3addr: T56d364TargetAddrTb4b4b4) -> Tffa657OptionTff7b72<Te6edf3SocketAddrTff7b72> Tb4b4b4{

Tff7b72match Te6edf3addrTb4b4b4.Te6edf3resolve_dnsTb4b4b4(Tb4b4b4)Tb4b4b4.Tff7b72await Tb4b4b4{

Tffa657OkTb4b4b4(Te6edf3socket_packedTb4b4b4) Tff7b72=Tff7b72> Tb4b4b4{ T8b949e// idk why this function signature is like this.

Tff7b72if Tff7b72let Te6edf3TargetAddr::Te6edf3IpTb4b4b4(Te6edf3socketTb4b4b4) Tff7b72= Te6edf3socket_packed Tb4b4b4{

Tffa657SomeTb4b4b4(Te6edf3socketTb4b4b4)

Tb4b4b4} Tff7b72else Tb4b4b4{

T8b949e// this can never happen

Te6edf3warnTff7b72!Tb4b4b4(Ta5d6ff"Ta5d6ffthis did happenTa5d6ff"Tb4b4b4)Tb4b4b4;

Tff7b72return Tffa657NoneTb4b4b4;

Tb4b4b4}

Tb4b4b4}

Tffa657ErrTb4b4b4(Te6edf3_Tb4b4b4) Tff7b72=Tff7b72> Tb4b4b4{

Tff7b72return Tffa657NoneTb4b4b4;

Tb4b4b4}

Tb4b4b4}

Tb4b4b4}

Tff7b72pub Tff7b72async Tff7b72fn Td2a8ffallowed_ipTb4b4b4(Te6edf3socket_addr: T56d364SocketAddrTb4b4b4, Te6edf3filter_config: Tff7b72&T56d364FilterConfigTb4b4b4) -> Tffa657bool Tb4b4b4{

Tff7b72let Tff7b72mut Te6edf3include Tff7b72= Tff7b72falseTb4b4b4; T8b949e// by default we don't allow anything.

Tff7b72for Te6edf3filter Tff7b72in Tff7b72&Te6edf3filter_configTb4b4b4.Te6edf3filters Tb4b4b4{

Tff7b72if Te6edf3filterTb4b4b4.Te6edf3address_filterTb4b4b4.Te6edf3filterTb4b4b4(Tff7b72&Te6edf3socket_addrTb4b4b4) Tff7b72&Tff7b72& Te6edf3filterTb4b4b4.Te6edf3port_filterTb4b4b4.Te6edf3filterTb4b4b4(Tff7b72&Te6edf3socket_addrTb4b4b4) Tb4b4b4{

Tff7b72match Te6edf3filterTb4b4b4.Te6edf3filter_result Tb4b4b4{

Te6edf3FilterResult::Te6edf3Exclude Tff7b72=Tff7b72> Tb4b4b4{Te6edf3include Tff7b72= Tff7b72falseTb4b4b4}

Te6edf3FilterResult::Te6edf3Include Tff7b72=Tff7b72> Tb4b4b4{Te6edf3include Tff7b72= Tff7b72trueTb4b4b4}

Tb4b4b4}

Tb4b4b4}

Tb4b4b4}

Te6edf3include

Tb4b4b4}

T8b949e/// note that we are converting from TargetAddr to SocketAddr as well as filtering

T8b949e/// the difference being that TargetAddr can also be a domain name and port number

T8b949e/// instead of an ip address and port number. Most functions require ip rather than

T8b949e/// domain name and resolving dns and then using it to connect makes everything a

T8b949e/// this means that if the user has put a hostname into the socks proxy we are actually

T8b949e/// getting the real ip and then passing it back. This is prevent some sneaky stuff from happening.

T8b949e///

T8b949e/// also we don't currently discriminate against tcp or udp. that's a todo for later

Tff7b72pub Tff7b72async Tff7b72fn Td2a8fffilter_and_convertTb4b4b4(Te6edf3addr: T56d364TargetAddrTb4b4b4, Te6edf3filter_config: Tffa657OptionTff7b72<Tff7b72&Te6edf3FilterConfigTff7b72>Tb4b4b4) -> Tffa657OptionTff7b72<Te6edf3SocketAddrTff7b72> Tb4b4b4{

Tff7b72let Te6edf3socket_addr Tff7b72= Te6edf3target_to_socketTb4b4b4(Te6edf3addrTb4b4b4)Tb4b4b4.Tff7b72awaitTff7b72?Tb4b4b4;

Tff7b72if Tff7b72let Tffa657SomeTb4b4b4(Te6edf3filter_configTb4b4b4) Tff7b72= Te6edf3filter_config Tb4b4b4{

Tff7b72if Te6edf3allowed_ipTb4b4b4(Te6edf3socket_addrTb4b4b4, Te6edf3filter_configTb4b4b4)Tb4b4b4.Tff7b72await Tb4b4b4{

Tff7b72return Tffa657SomeTb4b4b4(Te6edf3socket_addrTb4b4b4)

Tb4b4b4} Tff7b72else Tb4b4b4{

Tff7b72return Tffa657None

Tb4b4b4}

Tb4b4b4} Tff7b72else Tb4b4b4{

Tffa657SomeTb4b4b4(Te6edf3socket_addrTb4b4b4)

Tb4b4b4}

Tb4b4b4}