Skip to content

Commit 71e7bd7

Browse files
myleshortonmyleshorton
authored
Only forward traffic to global unicast (#660)
* Only forward traffic to global unicast * Use latest netx * Code review suggestion * Fixed test IP
1 parent 41537cb commit 71e7bd7

4 files changed

Lines changed: 22 additions & 34 deletions

File tree

‎go.mod‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ require (
2121
github.com/getlantern/gonat v0.0.0-20201001145726-634575ba87fb
2222
github.com/getlantern/grtrack v0.0.0-20231025115619-bfbfadb228f3
2323
github.com/getlantern/idletiming v0.0.0-20200228204104-10036786eac5
24-
github.com/getlantern/iptool v0.0.0-20230112135223-c00e863b2696
2524
github.com/getlantern/kcpwrapper v0.0.0-20230327091313-c12d7c17c6de
2625
github.com/getlantern/keyman v0.0.0-20230503155501-4e864ca2175b
2726
github.com/getlantern/lampshade v0.0.0-20200303040944-fe53f13203e9
@@ -31,8 +30,8 @@ require (
3130
github.com/getlantern/memhelper v0.0.0-20220104170102-df557102babd
3231
github.com/getlantern/mockconn v0.0.0-20200818071412-cb30d065a848
3332
github.com/getlantern/multipath v0.0.0-20230510135141-717ed305ef50
34-
github.com/getlantern/netx v0.0.0-20211206143627-7ccfeb739cbd
35-
github.com/getlantern/ops v0.0.0-20230424193308-26325dfed3cf
33+
github.com/getlantern/netx v0.0.0-20251021221514-279deb2cfd40
34+
github.com/getlantern/ops v0.0.0-20230519221840-1283e026181c
3635
github.com/getlantern/packetforward v0.0.0-20201001150407-c68a447b0360
3736
github.com/getlantern/proxy/v3 v3.0.0-20240328103708-9185589b6a99
3837
github.com/getlantern/psmux v1.5.15
@@ -127,8 +126,8 @@ require (
127126
github.com/getlantern/eventual v0.0.0-20180125201821-84b02499361b // indirect
128127
github.com/getlantern/filepersist v0.0.0-20210901195658-ed29a1cb0b7c // indirect
129128
github.com/getlantern/framed v0.0.0-20190601192238-ceb6431eeede // indirect
130-
github.com/getlantern/hex v0.0.0-20190417191902-c6586a6fe0b7 // indirect
131-
github.com/getlantern/hidden v0.0.0-20201229170000-e66e7f878730 // indirect
129+
github.com/getlantern/hex v0.0.0-20220104173244-ad7e4b9194dc // indirect
130+
github.com/getlantern/hidden v0.0.0-20220104173330-f221c5a24770 // indirect
132131
github.com/getlantern/kcp-go/v5 v5.0.0-20220503142114-f0c1cd6e1b54 // indirect
133132
github.com/getlantern/keepcurrent v0.0.0-20221014183517-fcee77376b89 // indirect
134133
github.com/getlantern/mtime v0.0.0-20200417132445-23682092d1f7 // indirect
@@ -224,10 +223,9 @@ require (
224223
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
225224
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
226225
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
227-
go.uber.org/atomic v1.9.0 // indirect
228226
go.uber.org/mock v0.5.0 // indirect
229-
go.uber.org/multierr v1.8.0 // indirect
230-
go.uber.org/zap v1.21.0 // indirect
227+
go.uber.org/multierr v1.11.0 // indirect
228+
go.uber.org/zap v1.26.0 // indirect
231229
golang.org/x/crypto v0.33.0 // indirect
232230
golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
233231
golang.org/x/mod v0.18.0 // indirect

‎go.sum‎

Lines changed: 14 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,6 @@ github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb
114114
github.com/aristanetworks/goarista v0.0.0-20190628000427-15fc8b0bfcde/go.mod h1:D/tb0zPVXnP7fmsLZjtdUhSsumbK/ij54UXjjVgMGxQ=
115115
github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
116116
github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
117-
github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
118117
github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
119118
github.com/benbjohnson/immutable v0.2.0/go.mod h1:uc6OHo6PN2++n98KHLxW8ef4W42ylHiQSENghE1ezxI=
120119
github.com/benbjohnson/immutable v0.3.0 h1:TVRhuZx2wG9SZ0LRdqlbs9S5BZ6Y24hJEHTCgWHZEIw=
@@ -232,7 +231,6 @@ github.com/getlantern/geo v0.0.0-20241129152027-2fc88c10f91e/go.mod h1:RjQ0krF8N
232231
github.com/getlantern/golog v0.0.0-20190809085441-26e09e6dd330/go.mod h1:zx/1xUUeYPy3Pcmet8OSXLbF47l+3y6hIPpyLWoR9oc=
233232
github.com/getlantern/golog v0.0.0-20190830074920-4ef2e798c2d7/go.mod h1:zx/1xUUeYPy3Pcmet8OSXLbF47l+3y6hIPpyLWoR9oc=
234233
github.com/getlantern/golog v0.0.0-20200929154820-62107891371a/go.mod h1:ZyIjgH/1wTCl+B+7yH1DqrWp6MPJqESmwmEQ89ZfhvA=
235-
github.com/getlantern/golog v0.0.0-20210606115803-bce9f9fe5a5f/go.mod h1:ZyIjgH/1wTCl+B+7yH1DqrWp6MPJqESmwmEQ89ZfhvA=
236234
github.com/getlantern/golog v0.0.0-20230503153817-8e72de7e0a65 h1:NlQedYmPI3pRAXJb+hLVVDGqfvvXGRPV8vp7XOjKAZ0=
237235
github.com/getlantern/golog v0.0.0-20230503153817-8e72de7e0a65/go.mod h1:+ZU1h+iOVqWReBpky6d5Y2WL0sF2Llxu+QcxJFs2+OU=
238236
github.com/getlantern/gonat v0.0.0-20201001145726-634575ba87fb h1:tDQA66mL1vTHKSMu3Ras/9Tk884ipPAhcdQHXpnDhxg=
@@ -241,17 +239,15 @@ github.com/getlantern/gotun v0.0.0-20190809092752-6d35bb1397ee/go.mod h1:zvsZQrs
241239
github.com/getlantern/grtrack v0.0.0-20160824195228-cbf67d3fa0fd/go.mod h1:RkQEgBdrJCH5tYJP2D+a/aJ216V3c9q8w/tCJtEiDoY=
242240
github.com/getlantern/grtrack v0.0.0-20231025115619-bfbfadb228f3 h1:3eOqQA2WKd5tvepSwHXcN1IteDBnWcrs4dAoKVpGZ9k=
243241
github.com/getlantern/grtrack v0.0.0-20231025115619-bfbfadb228f3/go.mod h1:esUcij+yiXH9mSlzZChtoSClQ9vr8cjNgEbcDHVqJfI=
244-
github.com/getlantern/hex v0.0.0-20190417191902-c6586a6fe0b7 h1:micT5vkcr9tOVk1FiH8SWKID8ultN44Z+yzd2y/Vyb0=
245242
github.com/getlantern/hex v0.0.0-20190417191902-c6586a6fe0b7/go.mod h1:dD3CgOrwlzca8ed61CsZouQS5h5jIzkK9ZWrTcf0s+o=
243+
github.com/getlantern/hex v0.0.0-20220104173244-ad7e4b9194dc h1:sue+aeVx7JF5v36H1HfvcGFImLpSD5goj8d+MitovDU=
244+
github.com/getlantern/hex v0.0.0-20220104173244-ad7e4b9194dc/go.mod h1:D9RWpXy/EFPYxiKUURo2TB8UBosbqkiLhttRrZYtvqM=
246245
github.com/getlantern/hidden v0.0.0-20190325191715-f02dbb02be55/go.mod h1:6mmzY2kW1TOOrVy+r41Za2MxXM+hhqTtY3oBKd2AgFA=
247-
github.com/getlantern/hidden v0.0.0-20201229170000-e66e7f878730 h1:oKJVQbWZ2CAJ71jYnm6A3+e6h5bkPJ0okIMwkaYB5HI=
248-
github.com/getlantern/hidden v0.0.0-20201229170000-e66e7f878730/go.mod h1:6mmzY2kW1TOOrVy+r41Za2MxXM+hhqTtY3oBKd2AgFA=
246+
github.com/getlantern/hidden v0.0.0-20220104173330-f221c5a24770 h1:cSrD9ryDfTV2yaur9Qk3rHYD414j3Q1rl7+L0AylxrE=
247+
github.com/getlantern/hidden v0.0.0-20220104173330-f221c5a24770/go.mod h1:GOQsoDnEHl6ZmNIL+5uVo+JWRFWozMEp18Izcb++H+A=
249248
github.com/getlantern/idletiming v0.0.0-20190529182719-d2fbc83372a5/go.mod h1:MGP8kEgZGgAhvHISt0hJGQgxg/VAqGdw3+kSZBnfC/4=
250249
github.com/getlantern/idletiming v0.0.0-20200228204104-10036786eac5 h1:HSxg8YIb4yUn/62i3M/2Eo/9Bz4u+n7yHOiGiiKEE5I=
251250
github.com/getlantern/idletiming v0.0.0-20200228204104-10036786eac5/go.mod h1:McaLC6faRlxJ9QjjqSjpEeYIjKnKA8+dzjoR+eYXCio=
252-
github.com/getlantern/iptool v0.0.0-20210721034953-519bf8ce0147/go.mod h1:hfspzdRcvJ130tpTPL53/L92gG0pFtvQ6ln35ppwhHE=
253-
github.com/getlantern/iptool v0.0.0-20230112135223-c00e863b2696 h1:D7wbL2Ww6QN5SblEDMiQcFulqz2jgcvawKaNBTzHLvQ=
254-
github.com/getlantern/iptool v0.0.0-20230112135223-c00e863b2696/go.mod h1:hfspzdRcvJ130tpTPL53/L92gG0pFtvQ6ln35ppwhHE=
255251
github.com/getlantern/kcp-go/v5 v5.0.0-20220503142114-f0c1cd6e1b54 h1:JqIiaDpL6CLgkq9Mfyd7GXSFm8EvgG0mVUd6I7TxNfw=
256252
github.com/getlantern/kcp-go/v5 v5.0.0-20220503142114-f0c1cd6e1b54/go.mod h1:KFBWdR0PdEQK0JtGcE1lhAoYFVTRxWDFfYBARPb0t9Q=
257253
github.com/getlantern/kcpwrapper v0.0.0-20230327091313-c12d7c17c6de h1:RS4Tx7aVExrAXsgvrXSln9iQ5HZNPpvHjJGM/MQH8ZE=
@@ -284,13 +280,13 @@ github.com/getlantern/multipath v0.0.0-20230510135141-717ed305ef50/go.mod h1:uzx
284280
github.com/getlantern/nettest v1.0.0 h1:xg8vq9JrGzrFGFkFGwZwIJ5+kwtvyqNDIADwrANvhQg=
285281
github.com/getlantern/nettest v1.0.0/go.mod h1:8wY0QwrdpkayCBQXjhZoJuwu2IHfp4UErrxgwaJ2UM4=
286282
github.com/getlantern/netx v0.0.0-20190110220209-9912de6f94fd/go.mod h1:wKdY0ikOgzrWSeB9UyBVKPRhjXQ+vTb+BPeJuypUuNE=
287-
github.com/getlantern/netx v0.0.0-20211206143627-7ccfeb739cbd h1:z5IehLDMqMwJ0oeFIaMHhySRU8r1lRMh7WQ0Wn0LioA=
288-
github.com/getlantern/netx v0.0.0-20211206143627-7ccfeb739cbd/go.mod h1:WEXF4pfIfnHBUAKwLa4DW7kcEINtG6wjUkbL2btwXZQ=
283+
github.com/getlantern/netx v0.0.0-20251021221514-279deb2cfd40 h1:zu2V5FtvPABScePihwsJFXRUd/hmo9VXVKYqwVTadfc=
284+
github.com/getlantern/netx v0.0.0-20251021221514-279deb2cfd40/go.mod h1:3KTbdBdzav5r9VIzxj6aGSFa5GmBozBN772EUmeCnkw=
289285
github.com/getlantern/ops v0.0.0-20190325191751-d70cb0d6f85f/go.mod h1:D5ao98qkA6pxftxoqzibIBBrLSUli+kYnJqrgBf9cIA=
290286
github.com/getlantern/ops v0.0.0-20200403153110-8476b16edcd6/go.mod h1:D5ao98qkA6pxftxoqzibIBBrLSUli+kYnJqrgBf9cIA=
291287
github.com/getlantern/ops v0.0.0-20220713155959-1315d978fff7/go.mod h1:D5ao98qkA6pxftxoqzibIBBrLSUli+kYnJqrgBf9cIA=
292-
github.com/getlantern/ops v0.0.0-20230424193308-26325dfed3cf h1:q8nsH0Lx9fP8HY6T9rA1zogvOzO9JtbUI5BXkh7wxxI=
293-
github.com/getlantern/ops v0.0.0-20230424193308-26325dfed3cf/go.mod h1:R7HfJVLsnSeqaDWkiUlU+ANBjac4oYmXGrrps8vW7CM=
288+
github.com/getlantern/ops v0.0.0-20230519221840-1283e026181c h1:qcPAzA1ZDnwx618jAgQmxo6UvJkw2SkM1L4ofncmEhI=
289+
github.com/getlantern/ops v0.0.0-20230519221840-1283e026181c/go.mod h1:g2ueCncOwWenlAr56Fh90FwsACkelqqtFUDLAHg1mng=
294290
github.com/getlantern/packetforward v0.0.0-20201001150407-c68a447b0360 h1:pijUoofaQcAM/8zbDzZM2LQ90kGVbKfnSAkFnQwLZZU=
295291
github.com/getlantern/packetforward v0.0.0-20201001150407-c68a447b0360/go.mod h1:nsJPNYUSY96xB+p7uiDW8O4uiKea+KjeUdS5d6tf9IU=
296292
github.com/getlantern/panicwrap v0.0.0-20200707191944-9ba45baf8e51 h1:MNDmhQwPAeX1tOxDvAI4Dwxh90SuDgmRzrTVJNhraoU=
@@ -756,19 +752,17 @@ go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVf
756752
go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
757753
go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
758754
go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
759-
go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
760-
go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
761755
go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
762-
go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI=
763-
go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
756+
go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
757+
go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
764758
go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
765759
go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
766760
go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
767-
go.uber.org/multierr v1.8.0 h1:dg6GjLku4EH+249NNmoIciG9N/jURbDG+pFlTkhzIC8=
768-
go.uber.org/multierr v1.8.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
761+
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
762+
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
769763
go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
770-
go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8=
771-
go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
764+
go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
765+
go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
772766
golang.org/x/arch v0.0.0-20190909030613-46d78d1859ac/go.mod h1:flIaEI6LNU6xOCD5PaJvn9wGP0agmIOqjrtsKGRguv4=
773767
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
774768
golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -977,8 +971,6 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
977971
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
978972
gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
979973
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
980-
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
981-
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
982974
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
983975
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
984976
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

‎instrument/instrument_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ func TestOriginRoot(t *testing.T) {
2424
requireSuccess("facebook.com", "sub.facebook.com")
2525
requireSuccess("facebook.com", "facebook.com")
2626
requireSuccess("facebook", "facebook")
27-
requireSuccess("facebook.com", "157.240.221.48")
27+
requireSuccess("facebook.com", "57.144.218.1")
2828
requireSuccess("AS62041", ipWithASN) // Telegram IP addresses don't resolve, but we can get their ASN
2929
}
3030

‎proxyfilters/blocklocal.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"net/http"
77
"strings"
88

9-
"github.com/getlantern/iptool"
109
"github.com/getlantern/proxy/v3/filters"
1110
)
1211

@@ -23,7 +22,6 @@ func (r *Resolver) ResolveIPAddr(network string, address string) (*net.IPAddr, e
2322
// BlockLocal blocks attempted accesses to localhost unless they're one of the
2423
// listed exceptions.
2524
func BlockLocal(exceptions []string, r resolver) filters.Filter {
26-
ipt, _ := iptool.New()
2725
isException := func(host string) bool {
2826
for _, exception := range exceptions {
2927
if strings.EqualFold(host, exception) {
@@ -50,7 +48,7 @@ func BlockLocal(exceptions []string, r resolver) filters.Filter {
5048
// If there was an error resolving is probably because it wasn't an address
5149
// in the form host or host:port
5250
if err == nil {
53-
if ipt.IsPrivate(ipAddr) {
51+
if ipAddr.IP.IsPrivate() || !ipAddr.IP.IsGlobalUnicast() {
5452
return fail(cs, req, http.StatusForbidden, "%v requested local address %v (%v)", req.RemoteAddr, req.Host, ipAddr)
5553
}
5654
}

0 commit comments

Comments
 (0)