server: support allow_ips (#10)

Signed-off-by: Xiaobo Liu <cppcoffee@gmail.com>

Cargo.toml

@@ -16,15 +16,16 @@ anyhow = "1.0"
 nfq = "0.2"
 # dashmap = "5.5"
 clap = { version = "4.4", features = ["derive"] }
-pnet = { version = "0.34", features = ["serde"] }
+pnet = { version = "0.34", default-features = false, features = ["std", "serde"] }
 libc = "0.2"
+ipnet = { version = "2.9", default-features = false, features = ["std", "serde"] }
 
 # crypto
 rand = "0.8"
-rsa = { version = "0.9", features = ["sha2", "std", "pem"] }
+rsa = { version = "0.9", default-features = false, features = ["sha2", "std", "pem"] }
 
 # serde
-serde = { version = "1.0", features = ["derive"] }
+serde = { version = "1.0", default-features = false, features = ["std", "derive"] }
 toml = "0.8"
 
 crypto = { path = "./crypto" }

README.md

@@ -85,7 +85,6 @@ $ cargo build --release
 
 ## TODO
 
-- Allow IP list
 - Add query and reject connection Interfaces
 - More certificate signing algorithms
 - Reload configuration file

server/Cargo.toml

@@ -15,6 +15,7 @@ nfq = { workspace = true }
 clap = { workspace = true }
 pnet = { workspace = true }
 libc = { workspace = true }
+ipnet = { workspace = true }
 
 # crypto
 rand = { workspace = true }

server/config/netguard.toml

@@ -37,8 +37,7 @@ connection_timeout = 300
 #  1min. unit: seconds
 reclaim_interval = 60
 
-# TODO: more filter
-# allow_ips = ["192.168.1.0/24"]
+allow_ips = ["192.168.1.0/24"]
 
 [filter.tcp]
 # filter tcp 8000 port

server/src/config.rs

@@ -3,6 +3,7 @@ use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use anyhow::{bail, Context, Result};
+use ipnet::IpNet;
 use serde::Deserialize;
 
 #[derive(Debug, Deserialize)]
@@ -51,6 +52,7 @@ pub struct Filter {
     pub connection_timeout: u64,
     pub tcp: Rule,
     pub udp: Rule,
+    pub allow_ips: Vec<IpNet>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -62,13 +64,18 @@ pub struct Rule {
 impl Config {
     pub fn from_file(path: &Path) -> Result<Arc<Self>> {
         let s = fs::read_to_string(path).context(format!("can't read file: {}", path.display()))?;
-        let config: Config = toml::from_str(&s)?;
+        let mut config: Config = toml::from_str(&s)?;
 
         config.verify()?;
+        config.aggregate();
 
         Ok(Arc::new(config))
     }
 
+    pub fn aggregate(&mut self) {
+        self.filter.allow_ips = IpNet::aggregate(&self.filter.allow_ips);
+    }
+
     fn verify(&self) -> Result<()> {
         if self.setting.queue_count == 0 {
             bail!("queue_count must be greater than 0");
@@ -128,6 +135,7 @@ mod tests {
                     ports: vec![],
                     reject: false,
                 },
+                allow_ips: vec![],
             },
         };
 

server/src/worker.rs

@@ -3,7 +3,8 @@ use std::sync::Arc;
 use std::thread;
 use std::time::Instant;
 
-use anyhow::{anyhow, Result};
+use anyhow::{anyhow, Context, Result};
+use ipnet::IpNet;
 use nfq::{Queue, Verdict};
 use pnet::packet::ip::{IpNextHeaderProtocol, IpNextHeaderProtocols};
 use pnet::packet::ipv4::Ipv4Packet;
@@ -19,6 +20,9 @@ use tracing::{debug, error, info};
 
 use crate::{util, Config, ConntrackEntry, ConntrackMap, Protocol, Sender};
 
+const IPV4_ADDR_BITS: u8 = 32;
+const IPV6_ADDR_BITS: u8 = 128;
+
 pub struct Worker {
     queue_num: u16,
     config: Arc<Config>,
@@ -98,6 +102,11 @@ impl Worker {
         let ip_header = Ipv4Packet::new(payload).ok_or(anyhow!("Malformed IPv4 packet"))?;
 
         let source = IpAddr::V4(ip_header.get_source());
+
+        if self.is_allow_ip(&source)? {
+            return Ok(Verdict::Accept);
+        }
+
         let destination = IpAddr::V4(ip_header.get_destination());
         let protocol = ip_header.get_next_level_protocol();
 
@@ -118,6 +127,11 @@ impl Worker {
         let ip_header = Ipv6Packet::new(payload).ok_or(anyhow!("Malformed IPv6 packet"))?;
 
         let source = IpAddr::V6(ip_header.get_source());
+
+        if self.is_allow_ip(&source)? {
+            return Ok(Verdict::Accept);
+        }
+
         let destination = IpAddr::V6(ip_header.get_destination());
         let protocol = ip_header.get_next_header();
 
@@ -256,6 +270,22 @@ impl Worker {
         Ok(Verdict::Drop)
     }
 
+    fn is_allow_ip(&self, source: &IpAddr) -> Result<bool> {
+        if self.config.filter.allow_ips.is_empty() {
+            return Ok(false);
+        }
+
+        let bits = match source {
+            IpAddr::V4(_) => IPV4_ADDR_BITS,
+            IpAddr::V6(_) => IPV6_ADDR_BITS,
+        };
+
+        let src_ip =
+            IpNet::new(*source, bits).context(format!("IpNet::new({}, {}) fail", source, bits))?;
+
+        Ok(self.config.filter.allow_ips.contains(&src_ip))
+    }
+
     fn is_auth_port(&self, protocol: Protocol, dst_port: u16) -> bool {
         self.config.auth.protocol == protocol && self.config.auth.port == dst_port
     }