2019-10-30 12:11:16 +00:00
|
|
|
package dnsforward
|
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
2020-03-20 11:41:13 +00:00
|
|
|
"fmt"
|
2019-10-30 12:11:16 +00:00
|
|
|
"net"
|
|
|
|
"net/http"
|
2020-03-20 11:41:13 +00:00
|
|
|
"strings"
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
|
2019-10-30 12:11:16 +00:00
|
|
|
"github.com/AdguardTeam/golibs/log"
|
2021-07-29 15:40:31 +01:00
|
|
|
"github.com/AdguardTeam/golibs/stringutil"
|
2020-03-20 11:41:13 +00:00
|
|
|
"github.com/AdguardTeam/urlfilter"
|
|
|
|
"github.com/AdguardTeam/urlfilter/filterlist"
|
2019-10-30 12:11:16 +00:00
|
|
|
)
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
// accessCtx controls IP and client blocking that takes place before all other
|
|
|
|
// processing. An accessCtx is safe for concurrent use.
|
2019-10-30 12:11:16 +00:00
|
|
|
type accessCtx struct {
|
2021-06-29 13:53:28 +01:00
|
|
|
allowedIPs *aghnet.IPMap
|
|
|
|
blockedIPs *aghnet.IPMap
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-07-29 15:40:31 +01:00
|
|
|
allowedClientIDs *stringutil.Set
|
|
|
|
blockedClientIDs *stringutil.Set
|
2021-04-20 14:26:19 +01:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
blockedHostsEng *urlfilter.DNSEngine
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
// TODO(a.garipov): Create a type for a set of IP networks.
|
|
|
|
// aghnet.IPNetSet?
|
|
|
|
allowedNets []*net.IPNet
|
|
|
|
blockedNets []*net.IPNet
|
|
|
|
}
|
|
|
|
|
|
|
|
// unit is a convenient alias for struct{}
|
|
|
|
type unit = struct{}
|
|
|
|
|
|
|
|
// processAccessClients is a helper for processing a list of client strings,
|
|
|
|
// which may be an IP address, a CIDR, or a ClientID.
|
|
|
|
func processAccessClients(
|
|
|
|
clientStrs []string,
|
|
|
|
ips *aghnet.IPMap,
|
|
|
|
nets *[]*net.IPNet,
|
2021-07-29 15:40:31 +01:00
|
|
|
clientIDs *stringutil.Set,
|
2021-06-29 13:53:28 +01:00
|
|
|
) (err error) {
|
|
|
|
for i, s := range clientStrs {
|
|
|
|
if ip := net.ParseIP(s); ip != nil {
|
|
|
|
ips.Set(ip, unit{})
|
|
|
|
} else if cidrIP, ipnet, cidrErr := net.ParseCIDR(s); cidrErr == nil {
|
|
|
|
ipnet.IP = cidrIP
|
|
|
|
*nets = append(*nets, ipnet)
|
|
|
|
} else {
|
|
|
|
idErr := ValidateClientID(s)
|
|
|
|
if idErr != nil {
|
|
|
|
return fmt.Errorf(
|
|
|
|
"value %q at index %d: bad ip, cidr, or clientid",
|
|
|
|
s,
|
|
|
|
i,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
clientIDs.Add(s)
|
|
|
|
}
|
|
|
|
}
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
return nil
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
// newAccessCtx creates a new accessCtx.
|
|
|
|
func newAccessCtx(allowed, blocked, blockedHosts []string) (a *accessCtx, err error) {
|
2021-04-20 14:26:19 +01:00
|
|
|
a = &accessCtx{
|
2021-06-29 13:53:28 +01:00
|
|
|
allowedIPs: aghnet.NewIPMap(0),
|
|
|
|
blockedIPs: aghnet.NewIPMap(0),
|
|
|
|
|
2021-07-29 15:40:31 +01:00
|
|
|
allowedClientIDs: stringutil.NewSet(),
|
|
|
|
blockedClientIDs: stringutil.NewSet(),
|
2021-04-20 14:26:19 +01:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
err = processAccessClients(allowed, a.allowedIPs, &a.allowedNets, a.allowedClientIDs)
|
2019-10-30 12:11:16 +00:00
|
|
|
if err != nil {
|
2021-06-29 13:53:28 +01:00
|
|
|
return nil, fmt.Errorf("adding allowed: %w", err)
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
err = processAccessClients(blocked, a.blockedIPs, &a.blockedNets, a.blockedClientIDs)
|
2019-10-30 12:11:16 +00:00
|
|
|
if err != nil {
|
2021-06-29 13:53:28 +01:00
|
|
|
return nil, fmt.Errorf("adding blocked: %w", err)
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
2021-04-07 18:16:06 +01:00
|
|
|
b := &strings.Builder{}
|
2021-06-29 13:53:28 +01:00
|
|
|
for _, h := range blockedHosts {
|
2021-07-29 15:40:31 +01:00
|
|
|
stringutil.WriteToBuilder(b, strings.ToLower(h), "\n")
|
2020-03-20 11:41:13 +00:00
|
|
|
}
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
lists := []filterlist.RuleList{
|
|
|
|
&filterlist.StringRuleList{
|
|
|
|
ID: int(0),
|
|
|
|
RulesText: b.String(),
|
|
|
|
IgnoreCosmetic: true,
|
|
|
|
},
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
2021-06-29 13:53:28 +01:00
|
|
|
|
|
|
|
rulesStrg, err := filterlist.NewRuleStorage(lists)
|
2020-03-20 11:41:13 +00:00
|
|
|
if err != nil {
|
2021-06-29 13:53:28 +01:00
|
|
|
return nil, fmt.Errorf("adding blocked hosts: %w", err)
|
2020-03-20 11:41:13 +00:00
|
|
|
}
|
2021-06-29 13:53:28 +01:00
|
|
|
|
|
|
|
a.blockedHostsEng = urlfilter.NewDNSEngine(rulesStrg)
|
2020-03-20 11:41:13 +00:00
|
|
|
|
2021-04-20 14:26:19 +01:00
|
|
|
return a, nil
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
// allowlistMode returns true if this *accessCtx is in the allowlist mode.
|
|
|
|
func (a *accessCtx) allowlistMode() (ok bool) {
|
|
|
|
return a.allowedIPs.Len() != 0 || a.allowedClientIDs.Len() != 0 || len(a.allowedNets) != 0
|
|
|
|
}
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
// isBlockedClientID returns true if the ClientID should be blocked.
|
|
|
|
func (a *accessCtx) isBlockedClientID(id string) (ok bool) {
|
|
|
|
allowlistMode := a.allowlistMode()
|
|
|
|
if id == "" {
|
|
|
|
// In allowlist mode, consider requests without client IDs
|
|
|
|
// blocked by default.
|
|
|
|
return allowlistMode
|
|
|
|
}
|
2021-04-20 14:26:19 +01:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
if allowlistMode {
|
|
|
|
return !a.allowedClientIDs.Has(id)
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
return a.blockedClientIDs.Has(id)
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
// isBlockedHost returns true if host should be blocked.
|
|
|
|
func (a *accessCtx) isBlockedHost(host string) (ok bool) {
|
|
|
|
_, ok = a.blockedHostsEng.Match(strings.ToLower(host))
|
2021-01-20 14:27:53 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
return ok
|
|
|
|
}
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
// isBlockedIP returns the status of the IP address blocking as well as the rule
|
|
|
|
// that blocked it.
|
|
|
|
func (a *accessCtx) isBlockedIP(ip net.IP) (blocked bool, rule string) {
|
|
|
|
blocked = true
|
|
|
|
ips := a.blockedIPs
|
|
|
|
ipnets := a.blockedNets
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
if a.allowlistMode() {
|
|
|
|
// Enable allowlist mode and use the allowlist sets.
|
|
|
|
blocked = false
|
|
|
|
ips = a.allowedIPs
|
|
|
|
ipnets = a.allowedNets
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
if _, ok := ips.Get(ip); ok {
|
|
|
|
return blocked, ip.String()
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
for _, ipnet := range ipnets {
|
|
|
|
if ipnet.Contains(ip) {
|
|
|
|
return blocked, ipnet.String()
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
return !blocked, ""
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type accessListJSON struct {
|
|
|
|
AllowedClients []string `json:"allowed_clients"`
|
|
|
|
DisallowedClients []string `json:"disallowed_clients"`
|
|
|
|
BlockedHosts []string `json:"blocked_hosts"`
|
|
|
|
}
|
|
|
|
|
2021-05-26 15:55:19 +01:00
|
|
|
func (s *Server) accessListJSON() (j accessListJSON) {
|
|
|
|
s.serverLock.RLock()
|
|
|
|
defer s.serverLock.RUnlock()
|
|
|
|
|
|
|
|
return accessListJSON{
|
2021-07-29 15:40:31 +01:00
|
|
|
AllowedClients: stringutil.CloneSlice(s.conf.AllowedClients),
|
|
|
|
DisallowedClients: stringutil.CloneSlice(s.conf.DisallowedClients),
|
|
|
|
BlockedHosts: stringutil.CloneSlice(s.conf.BlockedHosts),
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
2021-05-26 15:55:19 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) handleAccessList(w http.ResponseWriter, r *http.Request) {
|
|
|
|
j := s.accessListJSON()
|
2019-10-30 12:11:16 +00:00
|
|
|
|
|
|
|
w.Header().Set("Content-Type", "application/json")
|
|
|
|
err := json.NewEncoder(w).Encode(j)
|
|
|
|
if err != nil {
|
2021-06-29 13:53:28 +01:00
|
|
|
httpError(r, w, http.StatusInternalServerError, "encoding response: %s", err)
|
2019-10-30 12:11:16 +00:00
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
return
|
2019-10-30 12:11:16 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) handleAccessSet(w http.ResponseWriter, r *http.Request) {
|
2021-06-29 13:53:28 +01:00
|
|
|
list := accessListJSON{}
|
|
|
|
err := json.NewDecoder(r.Body).Decode(&list)
|
2019-10-30 12:11:16 +00:00
|
|
|
if err != nil {
|
2021-06-29 13:53:28 +01:00
|
|
|
httpError(r, w, http.StatusBadRequest, "decoding request: %s", err)
|
2019-10-30 12:11:16 +00:00
|
|
|
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-04-20 14:26:19 +01:00
|
|
|
var a *accessCtx
|
2021-06-29 13:53:28 +01:00
|
|
|
a, err = newAccessCtx(list.AllowedClients, list.DisallowedClients, list.BlockedHosts)
|
2019-10-30 12:11:16 +00:00
|
|
|
if err != nil {
|
2021-04-20 14:26:19 +01:00
|
|
|
httpError(r, w, http.StatusBadRequest, "creating access ctx: %s", err)
|
|
|
|
|
2019-10-30 12:11:16 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
defer log.Debug(
|
|
|
|
"access: updated lists: %d, %d, %d",
|
|
|
|
len(list.AllowedClients),
|
|
|
|
len(list.DisallowedClients),
|
|
|
|
len(list.BlockedHosts),
|
|
|
|
)
|
2021-05-26 15:55:19 +01:00
|
|
|
|
|
|
|
defer s.conf.ConfigModified()
|
|
|
|
|
|
|
|
s.serverLock.Lock()
|
|
|
|
defer s.serverLock.Unlock()
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
s.conf.AllowedClients = list.AllowedClients
|
|
|
|
s.conf.DisallowedClients = list.DisallowedClients
|
|
|
|
s.conf.BlockedHosts = list.BlockedHosts
|
2019-10-30 12:11:16 +00:00
|
|
|
s.access = a
|
|
|
|
}
|