vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-09-02 18:49:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request #189 from safing/feature/improve-firewall-blocking

Browse source 
Improve firewall blocking
This commit is contained in:
Patrick Pacher 2020-11-05 10:05:05 +01:00 • committed by GitHub
commit a7df1097a0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 14 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
firewall/interception.go
View file

@ -2,6 +2,7 @@ package firewall
import ( import (
"context" "context"
"net"
"os" "os"
"sync/atomic" "sync/atomic"
"time" "time"
@ -29,6 +30,9 @@ var (
packetsBlocked = new(uint64) packetsBlocked = new(uint64)
packetsDropped = new(uint64) packetsDropped = new(uint64)
packetsFailed = new(uint64) packetsFailed = new(uint64)
blockedIPv4 = net.IPv4(0, 0, 0, 17)
blockedIPv6 = net.ParseIP("::17")
) )
func init() { func init() {
@ -84,6 +88,11 @@ func handlePacket(ctx context.Context, pkt packet.Packet) {
func fastTrackedPermit(pkt packet.Packet) (handled bool) { func fastTrackedPermit(pkt packet.Packet) (handled bool) {
meta := pkt.Info() meta := pkt.Info()
// Check for blocked IP
if meta.Dst.Equal(blockedIPv4) || meta.Dst.Equal(blockedIPv6) {
_ = pkt.PermanentBlock()
}
switch meta.Protocol { switch meta.Protocol {
case packet.ICMP: case packet.ICMP:
// Always permit ICMP. // Always permit ICMP.

2
firewall/master.go
View file

@ -44,9 +44,9 @@ var deciders = []deciderFn{
checkPortmasterConnection, checkPortmasterConnection,
checkSelfCommunication, checkSelfCommunication,
checkConnectionType, checkConnectionType,
checkConnectivityDomain,
checkConnectionScope, checkConnectionScope,
checkEndpointLists, checkEndpointLists,
checkConnectivityDomain,
checkBypassPrevention, checkBypassPrevention,
checkFilterLists, checkFilterLists,
dropInbound, dropInbound,

8
nameserver/nsutil/nsutil.go
View file

@ -58,9 +58,9 @@ func ZeroIP(msgs ...string) ResponderFunc {
switch question.Qtype { switch question.Qtype {
case dns.TypeA: case dns.TypeA:
rr, err = dns.NewRR(question.Name + " 0 IN A 0.0.0.0") rr, err = dns.NewRR(question.Name + " 1 IN A 0.0.0.17")
case dns.TypeAAAA: case dns.TypeAAAA:
rr, err = dns.NewRR(question.Name + " 0 IN AAAA ::") rr, err = dns.NewRR(question.Name + " 1 IN AAAA ::17")
} }
switch { switch {
@ -100,9 +100,9 @@ func Localhost(msgs ...string) ResponderFunc {
switch question.Qtype { switch question.Qtype {
case dns.TypeA: case dns.TypeA:
rr, err = dns.NewRR("localhost. 0 IN A 127.0.0.1") rr, err = dns.NewRR("localhost. 1 IN A 127.0.0.1")
case dns.TypeAAAA: case dns.TypeAAAA:
rr, err = dns.NewRR("localhost. 0 IN AAAA ::1") rr, err = dns.NewRR("localhost. 1 IN AAAA ::1")
} }
switch { switch {