Просмотр исходного кода

Fix broken whitelists

tags/v2.1.5^2
9seconds 4 лет назад
Родитель
Сommit
0ce0c668b9
6 измененных файлов: 29 добавлений и 5 удалений
  1. 5
    3
      internal/cli/run_proxy.go
  2. 1
    1
      ipblocklist/firehol.go
  3. 4
    1
      ipblocklist/noop.go
  4. 7
    0
      ipblocklist/noop_test.go
  5. 6
    0
      mtglib/init.go
  6. 6
    0
      mtglib/proxy.go

+ 5
- 3
internal/cli/run_proxy.go Просмотреть файл

110
 		return nil, fmt.Errorf("incorrect parameters for firehol: %w", err)
110
 		return nil, fmt.Errorf("incorrect parameters for firehol: %w", err)
111
 	}
111
 	}
112
 
112
 
113
+	go firehol.Run(conf.UpdateEach.Get(ipblocklist.DefaultFireholUpdateEach))
114
+
113
 	return firehol, nil
115
 	return firehol, nil
114
 }
116
 }
115
 
117
 
162
 		return fmt.Errorf("cannot build network: %w", err)
164
 		return fmt.Errorf("cannot build network: %w", err)
163
 	}
165
 	}
164
 
166
 
165
-	blocklist, err := makeIPBlocklist(conf.Defense.Blocklist, logger, ntw)
167
+	blocklist, err := makeIPBlocklist(conf.Defense.Blocklist, logger.Named("blocklist"), ntw)
166
 	if err != nil {
168
 	if err != nil {
167
 		return fmt.Errorf("cannot build ip blocklist: %w", err)
169
 		return fmt.Errorf("cannot build ip blocklist: %w", err)
168
 	}
170
 	}
170
 	var whitelist mtglib.IPBlocklist
172
 	var whitelist mtglib.IPBlocklist
171
 
173
 
172
 	if conf.Defense.Allowlist.Enabled.Get(false) {
174
 	if conf.Defense.Allowlist.Enabled.Get(false) {
173
-		whlist, err := makeIPBlocklist(conf.Defense.Allowlist, logger, ntw)
175
+		whlist, err := makeIPBlocklist(conf.Defense.Allowlist, logger.Named("allowlist"), ntw)
174
 		if err != nil {
176
 		if err != nil {
175
-			return fmt.Errorf("cannot build ip blocklist: %w", err)
177
+			return fmt.Errorf("cannot build ip allowlist: %w", err)
176
 		}
178
 		}
177
 
179
 
178
 		whitelist = whlist
180
 		whitelist = whlist

+ 1
- 1
ipblocklist/firehol.go Просмотреть файл

163
 	f.treeV4 = v4tree
163
 	f.treeV4 = v4tree
164
 	f.treeV6 = v6tree
164
 	f.treeV6 = v6tree
165
 
165
 
166
-	f.logger.Info("blocklist was updated")
166
+	f.logger.Info("ip list was updated")
167
 }
167
 }
168
 
168
 
169
 func (f *Firehol) updateFromFile(mutex sync.Locker,
169
 func (f *Firehol) updateFromFile(mutex sync.Locker,

+ 4
- 1
ipblocklist/noop.go Просмотреть файл

2
 
2
 
3
 import (
3
 import (
4
 	"net"
4
 	"net"
5
+	"time"
5
 
6
 
6
 	"github.com/9seconds/mtg/v2/mtglib"
7
 	"github.com/9seconds/mtg/v2/mtglib"
7
 )
8
 )
8
 
9
 
9
 type noop struct{}
10
 type noop struct{}
10
 
11
 
11
-func (n noop) Contains(ip net.IP) bool { return false }
12
+func (n noop) Contains(ip net.IP) bool      { return false }
13
+func (n noop) Run(updateEach time.Duration) {}
14
+func (n noop) Shutdown()                    {}
12
 
15
 
13
 // NewNoop returns a dummy ipblocklist which allows all incoming
16
 // NewNoop returns a dummy ipblocklist which allows all incoming
14
 // connections.
17
 // connections.

+ 7
- 0
ipblocklist/noop_test.go Просмотреть файл

17
 	suite.False(ipblocklist.NewNoop().Contains(net.ParseIP("10.0.0.10")))
17
 	suite.False(ipblocklist.NewNoop().Contains(net.ParseIP("10.0.0.10")))
18
 }
18
 }
19
 
19
 
20
+func (suite *NoopTestSuite) TestRun() {
21
+	blocklist := ipblocklist.NewNoop()
22
+
23
+	blocklist.Run(0)
24
+	blocklist.Shutdown()
25
+}
26
+
20
 func TestNoop(t *testing.T) {
27
 func TestNoop(t *testing.T) {
21
 	t.Parallel()
28
 	t.Parallel()
22
 	suite.Run(t, &NoopTestSuite{})
29
 	suite.Run(t, &NoopTestSuite{})

+ 6
- 0
mtglib/init.go Просмотреть файл

176
 	// Contains checks if given IP address belongs to this blocklist If.
176
 	// Contains checks if given IP address belongs to this blocklist If.
177
 	// it is, a connection is terminated                               .
177
 	// it is, a connection is terminated                               .
178
 	Contains(net.IP) bool
178
 	Contains(net.IP) bool
179
+
180
+	// Run starts a background update procedure for a blocklist
181
+	Run(time.Duration)
182
+
183
+	// Shutdown stops a blocklist. It is assumed that none will access it after.
184
+	Shutdown()
179
 }
185
 }
180
 
186
 
181
 // Event is a data structure which is populated during mtg request
187
 // Event is a data structure which is populated during mtg request

+ 6
- 0
mtglib/proxy.go Просмотреть файл

144
 	p.ctxCancel()
144
 	p.ctxCancel()
145
 	p.streamWaitGroup.Wait()
145
 	p.streamWaitGroup.Wait()
146
 	p.workerPool.Release()
146
 	p.workerPool.Release()
147
+
148
+	if p.whitelist != nil {
149
+		p.whitelist.Shutdown()
150
+	}
151
+
152
+	p.blocklist.Shutdown()
147
 }
153
 }
148
 
154
 
149
 func (p *Proxy) doFakeTLSHandshake(ctx *streamContext) bool {
155
 func (p *Proxy) doFakeTLSHandshake(ctx *streamContext) bool {

Загрузка…
Отмена
Сохранить