daxi20/AdGuardHome
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pull request: 5035-netip-maps-access

Browse Source 
Updates #5035.

Squashed commit of the following:

commit 0c9f80761419dc50d89e0e82f68cdb462569417d
Author: Ainar Garipov <A.Garipov@AdGuard.COM>
Date:   Mon Oct 24 16:11:03 2022 +0300

    dnsforward: fix access check

commit df981acb4816cfba11bf6bbe4ef7796a6e365ea9
Author: Ainar Garipov <A.Garipov@AdGuard.COM>
Date:   Mon Oct 24 15:27:45 2022 +0300

    dnsforward: mv access to netip.Addr
This commit is contained in:
Ainar Garipov
2022-10-24 16:29:44 +03:00
parent b86250737e
commit a272b61ed6
9 changed files with 91 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
internal/dnsforward/dnsforward.go
View File

@@ -10,6 +10,7 @@ import (
"sync"
"time"
"github.com/AdguardTeam/AdGuardHome/internal/aghalg"
"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
"github.com/AdguardTeam/AdGuardHome/internal/filtering"
@@ -25,6 +26,8 @@ import (
"github.com/miekg/dns"
)
//lint:file-ignore SA1019 TODO(a.garipov): Replace [*netutil.IPMap].
// DefaultTimeout is the default upstream timeout
const DefaultTimeout = 10 * time.Second
@@ -63,7 +66,7 @@ type Server struct {
dhcpServer dhcpd.Interface // DHCP server instance (optional)
queryLog querylog.QueryLog // Query log instance
stats stats.Interface
access *accessCtx
access *accessManager
// localDomainSuffix is the suffix used to detect internal hosts. It
// must be a valid domain name plus dots on each side.
@@ -673,27 +676,37 @@ func (s *Server) IsBlockedClient(ip net.IP, clientID string) (blocked bool, rule
s.serverLock.RLock()
defer s.serverLock.RUnlock()
blockedByIP := false
if ip != nil {
// TODO(a.garipov): Remove once we switch to netip.Addr more fully.
ipAddr, err := netutil.IPToAddrNoMapped(ip)
if err != nil {
log.Error("dnsforward: bad client ip %v: %s", ip, err)
return false, ""
}
blockedByIP, rule = s.access.isBlockedIP(ipAddr)
}
allowlistMode := s.access.allowlistMode()
blockedByIP, rule := s.access.isBlockedIP(ip)
blockedByClientID := s.access.isBlockedClientID(clientID)
// Allow if at least one of the checks allows in allowlist mode, but
// block if at least one of the checks blocks in blocklist mode.
// Allow if at least one of the checks allows in allowlist mode, but block
// if at least one of the checks blocks in blocklist mode.
if allowlistMode && blockedByIP && blockedByClientID {
log.Debug("client %s (id %q) is not in access allowlist", ip, clientID)
log.Debug("client %v (id %q) is not in access allowlist", ip, clientID)
// Return now without substituting the empty rule for the
// clientID because the rule can't be empty here.
return true, rule
} else if !allowlistMode && (blockedByIP || blockedByClientID) {
log.Debug("client %s (id %q) is in access blocklist", ip, clientID)
log.Debug("client %v (id %q) is in access blocklist", ip, clientID)
blocked = true
}
if rule == "" {
rule = clientID
}
rule = aghalg.Coalesce(rule, clientID)
return blocked, rule
}