moesocks 1.0.0.20 → 1.0.0.30
raw patch · 11 files changed
+84/−55 lines, 11 files
Files
- CHANGELOG.md +5/−0
- README.md +1/−19
- moesocks.cabal +1/−1
- src/Network/MoeSocks/Common.hs +22/−11
- src/Network/MoeSocks/Default.hs +6/−4
- src/Network/MoeSocks/Options.hs +7/−0
- src/Network/MoeSocks/Runtime.hs +28/−8
- src/Network/MoeSocks/TCP.hs +6/−6
- src/Network/MoeSocks/Type/Bootstrap/Option.hs +1/−0
- src/Network/MoeSocks/Type/Runtime.hs +1/−0
- src/Network/MoeSocks/UDP.hs +6/−6
CHANGELOG.md view
@@ -1,3 +1,8 @@+1.0.0.30+--------+* Add `deny-list` option to specify an access control list file for blocking a+ large list of IPs.+ 1.0.0.20 -------- * Fix respect '--disable-socks5'
README.md view
@@ -53,7 +53,7 @@ * TCP per connection throttling (as a side effect of trying to find a bug in the remote) * SOCKS5 service on local can be turned off-* Understand ss' configuration file+* Understand ss's configuration file Drawbacks ==========@@ -97,24 +97,6 @@ tcpdump port 8388 -i any -X -v -Explicit Congestion Notification ([ECN])-=========================================--## No buffer by default--After version v1.0.0.0, moesocks will default to no buffer at the application-level. Smart buffer is expected from the kernel.--In app buffer can still be tuned on by setting "tcpBufferSize" in-`config.json` a value greater then 1.--## Force ECN--On Linux 2.4.20+ (as root)-- echo 1 > /proc/sys/net/ipv4/tcp_ecn--ECN is recommended only on `remote`. Credits =======
moesocks.cabal view
@@ -1,6 +1,6 @@ name: moesocks category: Network-version: 1.0.0.20+version: 1.0.0.30 license: Apache-2.0 synopsis: A functional firewall killer description: A SOCKS5 proxy using the client / server architecture.
src/Network/MoeSocks/Common.hs view
@@ -16,28 +16,39 @@ makePrisms ''IPRange -checkForbidden_IP_List :: AddressType -> [IPRange] -> Bool-checkForbidden_IP_List _address@(IPv4_Address _) aForbidden_IP_List =+check_IP_List :: AddressType -> [IPRange] -> Bool+check_IP_List _address@(IPv4_Address _) a_IP_List = isJust - do _ip <- show _address ^? _Show- findOf (each . _IPv4Range) (isMatchedTo _ip) aForbidden_IP_List+ findOf (each . _IPv4Range) (isMatchedTo _ip) a_IP_List -checkForbidden_IP_List _address@(IPv6_Address _) aForbidden_IP_List =+check_IP_List _address@(IPv6_Address _) a_IP_List = isJust - do _ip <- show _address ^? _Show- findOf (each . _IPv6Range) (isMatchedTo _ip) aForbidden_IP_List+ findOf (each . _IPv6Range) (isMatchedTo _ip) a_IP_List -checkForbidden_IP_List _ _ = False+check_IP_List _ _ = False -withCheckedForbidden_IP_List :: AddressType -> [IPRange] -> IO a -> IO ()-withCheckedForbidden_IP_List aAddressType aForbidden_IP_List aIO = - if checkForbidden_IP_List aAddressType aForbidden_IP_List +withChecked_IP_List :: AddressType -> ([IPRange], Maybe [IPRange]) + -> IO a -> IO ()+withChecked_IP_List aAddressType (aDenyList, aAllowList) aIO = + if check_IP_List aAddressType aDenyList then error_ - show aAddressType- <> " is in forbidden-ip list"- else () <$ aIO+ <> " is in the denied list"+ else + case aAllowList of+ Nothing -> () <$ aIO+ Just _allowList ->+ if not - check_IP_List aAddressType _allowList+ then error_ - show aAddressType+ <> " is NOT in the allowed list"+ else+ () <$ aIO +getIPLists :: Env -> ([IPRange], Maybe [IPRange])+getIPLists aEnv = (aEnv ^. denyList <> aEnv ^. forbidden_IPs, mempty) showConnectionType :: ConnectionType -> String showConnectionType TCP_IP_StreamConnection = "TCP_Stream"
src/Network/MoeSocks/Default.hs view
@@ -75,7 +75,7 @@ defaultOptions = O.Options { O._runningMode = O.DebugMode- , O._configFile = Nothing+ , O._configFile = mempty , O._verbosity = DEBUG , O._forward_TCPs = [] , O._forward_UDPs = []@@ -84,10 +84,11 @@ , O._listMethods = False , O._showDefaultConfig = False , O._params = []+ , O._denyList = mempty } -parseForbidden_IPs :: [Text] -> [IPRange]-parseForbidden_IPs =+parseIPRangeList :: [Text] -> [IPRange]+parseIPRangeList = toListOf $ each . to T.strip . _Text@@ -110,7 +111,8 @@ , _socketOption_TCP_NOTSENT_LOWAT = _c ^. C.socketOption_TCP_NOTSENT_LOWAT , _obfuscation = _o ^. O.obfuscation , _forbidden_IPs = _c ^. C.forbidden_IPs - & parseForbidden_IPs+ & parseIPRangeList+ , _denyList = [] {-, _config = defaultConfig-} , _cipherBox = let (a,b,c,d) = constCipherBox in CipherBox a b c d }
src/Network/MoeSocks/Options.hs view
@@ -97,6 +97,12 @@ <> metavar "CONFIG" <> help "Set the path of the configuration file" + _denyList = optional - textOption -+ long "deny-list"+ <> metavar "ACL"+ <> help "Block IPs from an access control list file."+ + _remoteHost = textParam - short 's' <> metavar "REMOTE"@@ -265,6 +271,7 @@ <*> _listMethods <*> _showDefaultConfig <*> _params+ <*> _denyList opts :: ParserInfo Options opts = info (helper <*> optionParser) -
src/Network/MoeSocks/Runtime.hs view
@@ -4,20 +4,25 @@ module Network.MoeSocks.Runtime where import Control.Lens-import Control.Monad.Writer hiding (listen) import Control.Monad.Except-import Network.MoeSocks.Helper-import Network.MoeSocks.Type+import Control.Monad.Writer hiding (listen)+import Data.IP+{-import Data.List (intercalate)-}+{-import Data.Text (Text)-}+import Data.Text.IO as T+import Data.Text.Lens import Network.MoeSocks.Bootstrap-import Network.MoeSocks.Encrypt import Network.MoeSocks.Default-import Data.Text.Lens-import qualified Network.MoeSocks.Type.Bootstrap.Config as C-import qualified Network.MoeSocks.Type.Bootstrap.Option as O+import Network.MoeSocks.Encrypt+import Network.MoeSocks.Helper+import Network.MoeSocks.Type import Prelude hiding ((-), take) import System.Log.Formatter import System.Log.Handler.Simple import System.Log.Logger+import qualified Data.Text as T+import qualified Network.MoeSocks.Type.Bootstrap.Config as C+import qualified Network.MoeSocks.Type.Bootstrap.Option as O import qualified System.IO as IO import qualified System.Log.Handler as LogHandler @@ -112,8 +117,23 @@ <> _method ^. _Text Just (a, b, c, d) -> pure - CipherBox a b c d + let _readDenyList :: IO [IPRange]+ _readDenyList = + case someOptions ^. O.denyList of+ Nothing -> pure []+ Just _denyListPath ->+ T.readFile (_denyListPath ^. _Text)+ <&> T.lines + <&> parseIPRangeList+ ++ _denyList <- io - _readDenyList++ io - debug_ - "denyList: " <> show (length _denyList) <> " items"+ let _env = defaultEnv & cipherBox .~ _cipherBox+ & denyList .~ _denyList pure - _env @@ -135,7 +155,7 @@ & socketOption_TCP_NOTSENT_LOWAT .~ _s & obfuscation .~ _o ^. O.obfuscation & forbidden_IPs .~ (_c ^. C.forbidden_IPs- & parseForbidden_IPs)+ & parseIPRangeList)
src/Network/MoeSocks/TCP.hs view
@@ -92,10 +92,10 @@ (_partialBytesAfterClientRequest, _clientRequest) shouldReplyClient aSocket = do let _addr = _clientRequest ^. addressType- _forbidden_IPs = aEnv ^. forbidden_IPs+ _IPLists = getIPLists aEnv - debug_ - "checking: " <> show _addr <> " ? " <> show _forbidden_IPs- withCheckedForbidden_IP_List _addr _forbidden_IPs - do+ debug_ - "checking: " <> show _addr + withChecked_IP_List _addr _IPLists - do let _cipherBox = aEnv ^. cipherBox _obfuscation = aEnv ^. obfuscation@@ -234,10 +234,10 @@ logSA "R target socket" (initTarget _clientRequest) - \_r -> do let (_targetSocket, _targetHost) = _r (_addr, _) = sockAddr_To_Pair _targetHost- _forbidden_IPs = aEnv ^. forbidden_IPs+ _IPLists = getIPLists aEnv - debug_ - "checking: " <> show _addr <> " ? " <> show _forbidden_IPs- withCheckedForbidden_IP_List _addr _forbidden_IPs - do+ debug_ - "checking: " <> show _addr + withChecked_IP_List _addr _IPLists - do setSocketConfig aEnv _targetSocket _remotePeerAddr <- getPeerName aSocket
src/Network/MoeSocks/Type/Bootstrap/Option.hs view
@@ -24,6 +24,7 @@ , _listMethods :: Bool , _showDefaultConfig :: Bool , _params :: [(Text, Value)]+ , _denyList :: Maybe Text } deriving (Show, Eq)
src/Network/MoeSocks/Type/Runtime.hs view
@@ -131,6 +131,7 @@ , _socketOption_TCP_NOTSENT_LOWAT :: Bool , _obfuscation :: Bool , _forbidden_IPs :: [IPRange]+ , _denyList :: [IPRange] , _cipherBox :: CipherBox }
src/Network/MoeSocks/UDP.hs view
@@ -64,11 +64,11 @@ {-debug_ - "L UDP: " <> show _clientRequest-} let _addr = _clientRequest ^. addressType- _forbidden_IPs = aEnv ^. forbidden_IPs+ _IPLists = getIPLists aEnv - debug_ - "checking: " <> show _addr <> " ? " <> show _forbidden_IPs+ debug_ - "checking: " <> show _addr - withCheckedForbidden_IP_List _addr _forbidden_IPs - do+ withChecked_IP_List _addr _IPLists - do _sa <- getSocket aRemoteHost aRemotePort Datagram logSA "L UDP -->:" (pure _sa) -@@ -130,10 +130,10 @@ let (_targetSocket, _targetSocketAddress) = _r (_addr, _) = sockAddr_To_Pair _targetSocketAddress- _forbidden_IPs = aEnv ^. forbidden_IPs+ _IPLists = getIPLists aEnv - debug_ - "checking: " <> show _addr <> " ? " <> show _forbidden_IPs- withCheckedForbidden_IP_List _addr _forbidden_IPs - do+ debug_ - "checking: " <> show _addr + withChecked_IP_List _addr _IPLists - do let _msg = showRelay aSockAddr _clientRequest info_ - "RU: " <> _msg