160 lines
3.3 KiB
Go
160 lines
3.3 KiB
Go
package endpoints
|
|
|
|
import (
|
|
"regexp"
|
|
"strings"
|
|
|
|
"github.com/safing/portmaster/intel"
|
|
"github.com/safing/portmaster/network/netutils"
|
|
)
|
|
|
|
const (
|
|
domainMatchTypeExact uint8 = iota
|
|
domainMatchTypeZone
|
|
domainMatchTypeSuffix
|
|
domainMatchTypePrefix
|
|
domainMatchTypeContains
|
|
)
|
|
|
|
var (
|
|
containsRegex = regexp.MustCompile(`^\*?[a-z0-9\.-]+\*$`)
|
|
)
|
|
|
|
// EndpointDomain matches domains.
|
|
type EndpointDomain struct {
|
|
EndpointBase
|
|
|
|
OriginalValue string
|
|
Domain string
|
|
DomainZone string
|
|
MatchType uint8
|
|
}
|
|
|
|
func (ep *EndpointDomain) check(entity *intel.Entity, domain string) (EPResult, Reason) {
|
|
result, reason := ep.match(ep, entity, ep.OriginalValue, "domain matches")
|
|
|
|
switch ep.MatchType {
|
|
case domainMatchTypeExact:
|
|
if domain == ep.Domain {
|
|
return result, reason
|
|
}
|
|
case domainMatchTypeZone:
|
|
if domain == ep.Domain {
|
|
return result, reason
|
|
}
|
|
if strings.HasSuffix(domain, ep.DomainZone) {
|
|
return result, reason
|
|
}
|
|
case domainMatchTypeSuffix:
|
|
if strings.HasSuffix(domain, ep.Domain) {
|
|
return result, reason
|
|
}
|
|
case domainMatchTypePrefix:
|
|
if strings.HasPrefix(domain, ep.Domain) {
|
|
return result, reason
|
|
}
|
|
case domainMatchTypeContains:
|
|
if strings.Contains(domain, ep.Domain) {
|
|
return result, reason
|
|
}
|
|
}
|
|
return NoMatch, nil
|
|
}
|
|
|
|
// Matches checks whether the given entity matches this endpoint definition.
|
|
func (ep *EndpointDomain) Matches(entity *intel.Entity) (EPResult, Reason) {
|
|
if entity.Domain == "" {
|
|
return NoMatch, nil
|
|
}
|
|
|
|
result, reason := ep.check(entity, entity.Domain)
|
|
if result != NoMatch {
|
|
return result, reason
|
|
}
|
|
|
|
if entity.CNAMECheckEnabled() {
|
|
for _, domain := range entity.CNAME {
|
|
result, reason = ep.check(entity, domain)
|
|
if result == Denied {
|
|
return result, reason
|
|
}
|
|
}
|
|
}
|
|
|
|
return NoMatch, nil
|
|
}
|
|
|
|
func (ep *EndpointDomain) String() string {
|
|
return ep.renderPPP(ep.OriginalValue)
|
|
}
|
|
|
|
func isValidEndpointDomain(value string) bool {
|
|
// Check for root domain
|
|
if value == "." {
|
|
return true
|
|
}
|
|
|
|
// Check for a "contains" value.
|
|
if containsRegex.MatchString(value) {
|
|
return true
|
|
}
|
|
|
|
// Remove special leading characters.
|
|
value = strings.TrimLeft(value, ".*")
|
|
|
|
// Check if value is now a valid domain.
|
|
return netutils.IsValidFqdn(value)
|
|
}
|
|
|
|
func parseTypeDomain(fields []string) (Endpoint, error) {
|
|
domain := fields[1]
|
|
|
|
ep := &EndpointDomain{
|
|
OriginalValue: domain,
|
|
}
|
|
|
|
// fix domain ending
|
|
switch domain[len(domain)-1] {
|
|
case '.':
|
|
case '*':
|
|
default:
|
|
domain += "."
|
|
}
|
|
|
|
// Check if domain is valid.
|
|
if !isValidEndpointDomain(domain) {
|
|
return nil, nil
|
|
}
|
|
|
|
// fix domain case
|
|
domain = strings.ToLower(domain)
|
|
|
|
switch {
|
|
case strings.HasPrefix(domain, "*") && strings.HasSuffix(domain, "*"):
|
|
ep.MatchType = domainMatchTypeContains
|
|
ep.Domain = strings.Trim(domain, "*")
|
|
return ep.parsePPP(ep, fields)
|
|
|
|
case strings.HasSuffix(domain, "*"):
|
|
ep.MatchType = domainMatchTypePrefix
|
|
ep.Domain = strings.Trim(domain, "*")
|
|
return ep.parsePPP(ep, fields)
|
|
|
|
case strings.HasPrefix(domain, "*"):
|
|
ep.MatchType = domainMatchTypeSuffix
|
|
ep.Domain = strings.Trim(domain, "*")
|
|
return ep.parsePPP(ep, fields)
|
|
|
|
case strings.HasPrefix(domain, "."):
|
|
ep.MatchType = domainMatchTypeZone
|
|
ep.Domain = strings.TrimLeft(domain, ".")
|
|
ep.DomainZone = "." + ep.Domain
|
|
return ep.parsePPP(ep, fields)
|
|
|
|
default:
|
|
ep.MatchType = domainMatchTypeExact
|
|
ep.Domain = domain
|
|
return ep.parsePPP(ep, fields)
|
|
}
|
|
}
|