vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-09-02 10:39:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improve api firewall bypass

Browse source
This commit is contained in:
Daniel 2019-08-09 17:16:56 +02:00
parent fc8fab1a03
commit 0a5981c657
2 changed files with 8 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
firewall/api.go
View file

@ -23,8 +23,7 @@ import (
var ( var (
dataRoot *utils.DirStructure dataRoot *utils.DirStructure
apiAddressSet bool apiPortSet bool
apiIP net.IP
apiPort uint16 apiPort uint16
) )
@ -35,11 +34,13 @@ func prepAPIAuth() error {
func startAPIAuth() { func startAPIAuth() {
var err error var err error
apiIP, apiPort, err = parseHostPort(apiListenAddress()) _, apiPort, err = parseHostPort(apiListenAddress())
if err != nil { if err != nil {
log.Warningf("firewall: failed to parse API address for improved api auth mechanism: %s", err) log.Warningf("firewall: failed to parse API address for improved api auth mechanism: %s", err)
return
} }
apiAddressSet = true apiPortSet = true
log.Tracef("firewall: api port set to %d", apiPort)
} }
func apiAuthenticator(s *http.Server, r *http.Request) (grantAccess bool, err error) { func apiAuthenticator(s *http.Server, r *http.Request) (grantAccess bool, err error) {

4
firewall/firewall.go
View file

@ -111,8 +111,8 @@ func handlePacket(pkt packet.Packet) {
} }
// allow api access, if address was parsed successfully // allow api access, if address was parsed successfully
if apiAddressSet { if apiPortSet {
if (pkt.Info().DstPort == apiPort && pkt.Info().Dst.Equal(apiIP)) || (pkt.Info().SrcPort == apiPort && pkt.Info().Src.Equal(apiIP)) { if (pkt.Info().DstPort == apiPort || pkt.Info().SrcPort == apiPort) && pkt.Info().Src.Equal(pkt.Info().Dst) {
log.Debugf("accepting api connection: %s", pkt) log.Debugf("accepting api connection: %s", pkt)
pkt.PermanentAccept() pkt.PermanentAccept()
return return