Explorar el Código

Merge pull request #40 from 9seconds/secure-only

"Secure only" mode
tags/0.14^2
Sergey Arkhipov hace 7 años
padre
commit
ac33abbbb1
No account linked to committer's email address
Se han modificado 4 ficheros con 21 adiciones y 2 borrados
  1. 6
    0
      README.md
  2. 4
    1
      config/config.go
  3. 6
    1
      main.go
  4. 5
    0
      proxy/proxy.go

+ 6
- 0
README.md Ver fichero

130
 echo dd$(head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' ')
130
 echo dd$(head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' ')
131
 ```
131
 ```
132
 
132
 
133
+If you want to enforce the usage of secure mode, please pass `-s` or
134
+`--secure-only` flags. In that case, clients which do not use dd-secrets
135
+are going to be disconnected from the proxy.
136
+
137
+
133
 ## Environment variables
138
 ## Environment variables
134
 
139
 
135
 It is possible to configure this tool using environment variables. You
140
 It is possible to configure this tool using environment variables. You
156
 | `MTG_STATSD_TAGS`        | `--statsd-tags`        |                                   | Which tags should we send to statsd with our metrics. Please specify them as `key=value` pairs.                                                                                                                                                                            |
161
 | `MTG_STATSD_TAGS`        | `--statsd-tags`        |                                   | Which tags should we send to statsd with our metrics. Please specify them as `key=value` pairs.                                                                                                                                                                            |
157
 | `MTG_BUFFER_WRITE`       | `-w`, `--write-buffer` | `65536`                           | The size of TCP write buffer in bytes. Write buffer is the buffer for messages which are going from client to Telegram.                                                                                                                                                    |
162
 | `MTG_BUFFER_WRITE`       | `-w`, `--write-buffer` | `65536`                           | The size of TCP write buffer in bytes. Write buffer is the buffer for messages which are going from client to Telegram.                                                                                                                                                    |
158
 | `MTG_BUFFER_READ`        | `-r`, `--read-buffer`  | `131072`                          | The size of TCP read buffer in bytes. Read buffer is the buffer for messages from Telegram to client.                                                                                                                                                                      |
163
 | `MTG_BUFFER_READ`        | `-r`, `--read-buffer`  | `131072`                          | The size of TCP read buffer in bytes. Read buffer is the buffer for messages from Telegram to client.                                                                                                                                                                      |
164
+| `MTG_SECURE_ONLY`        | `-s`, `--secure-only`  | `false`                           | Support only clients with secure mode (i.e only clients with dd-secrets).                                                                                                                                                                                                  |
159
 
165
 
160
 Usually you want to modify only read/write buffer sizes. If you feel
166
 Usually you want to modify only read/write buffer sizes. If you feel
161
 that proxy is slow, try to increase both sizes giving more priority to
167
 that proxy is slow, try to increase both sizes giving more priority to

+ 4
- 1
config/config.go Ver fichero

16
 	Debug      bool
16
 	Debug      bool
17
 	Verbose    bool
17
 	Verbose    bool
18
 	SecureMode bool
18
 	SecureMode bool
19
+	SecureOnly bool
19
 
20
 
20
 	ReadBufferSize  int
21
 	ReadBufferSize  int
21
 	WriteBufferSize int
22
 	WriteBufferSize int
116
 	bindPort, publicIPv4Port, publicIPv6Port, statsPort, statsdPort uint16,
117
 	bindPort, publicIPv4Port, publicIPv6Port, statsPort, statsdPort uint16,
117
 	statsdIP, statsdNetwork, statsdPrefix, statsdTagsFormat string,
118
 	statsdIP, statsdNetwork, statsdPrefix, statsdTagsFormat string,
118
 	statsdTags map[string]string,
119
 	statsdTags map[string]string,
120
+	secureOnly bool,
119
 	secret, adtag []byte) (*Config, error) {
121
 	secret, adtag []byte) (*Config, error) {
120
-	secureMode := false
122
+	secureMode := secureOnly
121
 	if bytes.HasPrefix(secret, []byte{0xdd}) && len(secret) == 17 {
123
 	if bytes.HasPrefix(secret, []byte{0xdd}) && len(secret) == 17 {
122
 		secureMode = true
124
 		secureMode = true
123
 		secret = bytes.TrimPrefix(secret, []byte{0xdd})
125
 		secret = bytes.TrimPrefix(secret, []byte{0xdd})
157
 	conf := &Config{
159
 	conf := &Config{
158
 		Debug:           debug,
160
 		Debug:           debug,
159
 		Verbose:         verbose,
161
 		Verbose:         verbose,
162
+		SecureOnly:      secureOnly,
160
 		BindIP:          bindIP,
163
 		BindIP:          bindIP,
161
 		BindPort:        bindPort,
164
 		BindPort:        bindPort,
162
 		PublicIPv4:      publicIPv4,
165
 		PublicIPv4:      publicIPv4,

+ 6
- 1
main.go Ver fichero

122
 		Envar("MTG_BUFFER_READ").
122
 		Envar("MTG_BUFFER_READ").
123
 		Default("131072").
123
 		Default("131072").
124
 		Uint32()
124
 		Uint32()
125
+	secureOnly = app.Flag("secure-only",
126
+		"Support clients with dd-secrets only.").
127
+		Short('s').
128
+		Envar("MTG_SECURE_ONLY").
129
+		Bool()
125
 
130
 
126
 	secret = app.Arg("secret", "Secret of this proxy.").Required().HexBytes()
131
 	secret = app.Arg("secret", "Secret of this proxy.").Required().HexBytes()
127
 	adtag  = app.Arg("adtag", "ADTag of the proxy.").HexBytes()
132
 	adtag  = app.Arg("adtag", "ADTag of the proxy.").HexBytes()
146
 		*bindIP, *publicIPv4, *publicIPv6, *statsIP,
151
 		*bindIP, *publicIPv4, *publicIPv6, *statsIP,
147
 		*bindPort, *publicIPv4Port, *publicIPv6Port, *statsPort, *statsdPort,
152
 		*bindPort, *publicIPv4Port, *publicIPv6Port, *statsPort, *statsdPort,
148
 		*statsdIP, *statsdNetwork, *statsdPrefix, *statsdTagsFormat,
153
 		*statsdIP, *statsdNetwork, *statsdPrefix, *statsdTagsFormat,
149
-		*statsdTags,
154
+		*statsdTags, *secureOnly,
150
 		*secret, *adtag,
155
 		*secret, *adtag,
151
 	)
156
 	)
152
 	if err != nil {
157
 	if err != nil {

+ 5
- 0
proxy/proxy.go Ver fichero

65
 	}
65
 	}
66
 	defer clientConn.(io.Closer).Close() // nolint: errcheck
66
 	defer clientConn.(io.Closer).Close() // nolint: errcheck
67
 
67
 
68
+	if p.conf.SecureOnly && opts.ConnectionType != mtproto.ConnectionTypeSecure {
69
+		log.Errorw("Proxy supports only secure connections", "connection_type", opts.ConnectionType)
70
+		return
71
+	}
72
+
68
 	stats.ClientConnected(opts.ConnectionType, clientConn.RemoteAddr())
73
 	stats.ClientConnected(opts.ConnectionType, clientConn.RemoteAddr())
69
 	defer stats.ClientDisconnected(opts.ConnectionType, clientConn.RemoteAddr())
74
 	defer stats.ClientDisconnected(opts.ConnectionType, clientConn.RemoteAddr())
70
 
75
 

Loading…
Cancelar
Guardar