vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-09-02 02:29:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Move blocking of invalid IPs behind rules

Browse source
This commit is contained in:
Daniel 2023-09-19 10:04:26 +02:00
parent efc0a015f8
commit 81c801237d
1 changed files with 19 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
firewall/master.go
View file

@ -33,6 +33,7 @@ var defaultDeciders = []deciderFn{
checkConnectionType, checkConnectionType,
checkConnectionScope, checkConnectionScope,
checkEndpointLists, checkEndpointLists,
checkInvalidIP,
checkResolverScope, checkResolverScope,
checkConnectivityDomain, checkConnectivityDomain,
checkBypassPrevention, checkBypassPrevention,
@ -371,7 +372,8 @@ func checkConnectionScope(_ context.Context, conn *network.Connection, p *profil
return true return true
} }
case netutils.Undefined, netutils.Invalid: case netutils.Undefined, netutils.Invalid:
fallthrough // Block Invalid / Undefined IPs _after_ the rules.
return false
default: default:
conn.Deny("invalid IP", noReasonOptionKey) // Block Outbound / Drop Inbound conn.Deny("invalid IP", noReasonOptionKey) // Block Outbound / Drop Inbound
return true return true
@ -380,6 +382,22 @@ func checkConnectionScope(_ context.Context, conn *network.Connection, p *profil
return false return false
} }
func checkInvalidIP(_ context.Context, conn *network.Connection, p *profile.LayeredProfile, _ packet.Packet) bool {
// Only applies to IP connections.
if conn.Type != network.IPConnection {
return false
}
// Block Invalid / Undefined IPs.
switch conn.Entity.IPScope { //nolint:exhaustive // Only looking for specific values.
case netutils.Undefined, netutils.Invalid:
conn.Deny("invalid IP", noReasonOptionKey) // Block Outbound / Drop Inbound
return true
}
return false
}
func checkBypassPrevention(ctx context.Context, conn *network.Connection, p *profile.LayeredProfile, _ packet.Packet) bool { func checkBypassPrevention(ctx context.Context, conn *network.Connection, p *profile.LayeredProfile, _ packet.Packet) bool {
if p.PreventBypassing() { if p.PreventBypassing() {
// check for bypass protection // check for bypass protection