From 52e391962faa960e370cc9d203af16cb9374d4af Mon Sep 17 00:00:00 2001 From: Max Lv Date: Thu, 17 Nov 2016 15:18:46 +0800 Subject: [PATCH] Add option for firewall rules --- doc/ss-server.asciidoc | 13 +++++++++++-- src/acl.c | 13 +++++++++---- src/acl.h | 2 +- src/local.c | 2 +- src/manager.c | 2 +- src/redir.c | 2 +- src/server.c | 22 ++++++++++++++++------ src/tunnel.c | 2 +- src/utils.c | 6 ++++++ 9 files changed, 47 insertions(+), 17 deletions(-) diff --git a/doc/ss-server.asciidoc b/doc/ss-server.asciidoc index 8a5a6326..7a38f11e 100644 --- a/doc/ss-server.asciidoc +++ b/doc/ss-server.asciidoc @@ -13,8 +13,9 @@ SYNOPSIS [-k ] [-m ] [-f ] [-t ] [-c ] [-i ] [-a ] [-d ] [-n ] - [-b ] - [--mtu ] [--manager-address ] + [-b ] [--mtu ] + [--manager-address ] DESCRIPTION ----------- @@ -105,6 +106,14 @@ Enable TCP fast open. + Only available with Linux kernel > 3.7.0. +--mptcp:: +Enable Multipath TCP. ++ +Only available with MPTCP enabled Linux kernel. + +--firewall:: +Setup firewall rules for auto blocking. + --acl :: Enable ACL (Access Control List) and specify config file. diff --git a/src/acl.c b/src/acl.c index be004a9d..60d4b727 100644 --- a/src/acl.c +++ b/src/acl.c @@ -236,11 +236,14 @@ free_firewall_rule(void *key, void *element) #endif void -init_block_list() +init_block_list(int firewall) { // Initialize cache #ifdef __linux__ - init_firewall(); + if (firewall) + init_firewall(); + else + mode = NO_FIREWALL_MODE; cache_create(&block_list, 256, free_firewall_rule); #else cache_create(&block_list, 256, NULL); @@ -251,7 +254,8 @@ void free_block_list() { #ifdef __linux__ - reset_firewall(); + if (mode != NO_FIREWALL_MODE) + reset_firewall(); #endif cache_clear(block_list, 0); // Remove all items } @@ -303,7 +307,8 @@ update_block_list(char *addr, int err_level) *count = 1; cache_insert(block_list, addr, addr_len, count); #ifdef __linux__ - set_firewall_rule(addr, 1); + if (mode != NO_FIREWALL_MODE) + set_firewall_rule(addr, 1); #endif } diff --git a/src/acl.h b/src/acl.h index 6e404175..d6f18b80 100644 --- a/src/acl.h +++ b/src/acl.h @@ -42,7 +42,7 @@ int acl_remove_ip(const char *ip); int get_acl_mode(void); -void init_block_list(); +void init_block_list(int firewall); void free_block_list(); int check_block_list(char *addr); int update_block_list(char *addr, int err_level); diff --git a/src/local.c b/src/local.c index e31a6a22..9bea647f 100644 --- a/src/local.c +++ b/src/local.c @@ -1446,7 +1446,7 @@ main(int argc, char **argv) #ifndef __MINGW32__ if (geteuid() == 0){ - LOGI("You are running this process as the root user!"); + LOGI("running from root user"); } #endif diff --git a/src/manager.c b/src/manager.c index 0407648a..9d9d1332 100644 --- a/src/manager.c +++ b/src/manager.c @@ -851,7 +851,7 @@ main(int argc, char **argv) #ifndef __MINGW32__ if (geteuid() == 0){ - LOGI("You are running this process as the root user!"); + LOGI("running from root user"); } #endif diff --git a/src/redir.c b/src/redir.c index f1776ad5..25497bfa 100644 --- a/src/redir.c +++ b/src/redir.c @@ -1026,7 +1026,7 @@ main(int argc, char **argv) } if (geteuid() == 0){ - LOGI("You are running this process as the root user!"); + LOGI("running from root user"); } ev_run(loop, 0); diff --git a/src/server.c b/src/server.c index b173692e..e6753539 100644 --- a/src/server.c +++ b/src/server.c @@ -1538,6 +1538,7 @@ main(int argc, char **argv) int i, c; int pid_flags = 0; int mptcp = 0; + int firewall = 0; int mtu = 0; char *user = NULL; char *password = NULL; @@ -1559,8 +1560,11 @@ main(int argc, char **argv) { "acl", required_argument, 0, 0 }, { "manager-address", required_argument, 0, 0 }, { "mtu", required_argument, 0, 0 }, - { "mptcp", no_argument, 0, 0 }, { "help", no_argument, 0, 0 }, +#ifdef __linux__ + { "mptcp", no_argument, 0, 0 }, + { "firewall", no_argument, 0, 0 }, +#endif { 0, 0, 0, 0 } }; @@ -1583,11 +1587,14 @@ main(int argc, char **argv) mtu = atoi(optarg); LOGI("set MTU to %d", mtu); } else if (option_index == 4) { - mptcp = 1; - LOGI("enable multipath TCP"); - } else if (option_index == 5) { usage(); exit(EXIT_SUCCESS); + } else if (option_index == 5) { + mptcp = 1; + LOGI("enable multipath TCP"); + } else if (option_index == 6) { + firewall = 1; + LOGI("enable firewall rules"); } break; case 's': @@ -1876,12 +1883,15 @@ main(int argc, char **argv) #ifndef __MINGW32__ if (geteuid() == 0){ - LOGI("You are running this process as the root user!"); + LOGI("running from root user"); + } else if (firewall) { + LOGE("firewall setup requires running from root user"); + exit(-1); } #endif // init block list - init_block_list(); + init_block_list(firewall); // Init connections cork_dllist_init(&connections); diff --git a/src/tunnel.c b/src/tunnel.c index 8cfb0441..df140306 100644 --- a/src/tunnel.c +++ b/src/tunnel.c @@ -1034,7 +1034,7 @@ main(int argc, char **argv) #ifndef __MINGW32__ if (geteuid() == 0){ - LOGI("You are running this process as the root user!"); + LOGI("running from root user"); } #endif diff --git a/src/utils.c b/src/utils.c index ee15f3f6..4c7a7660 100644 --- a/src/utils.c +++ b/src/utils.c @@ -341,8 +341,14 @@ usage() #endif printf( " [--mtu ] MTU of your network interface.\n"); +#ifdef __linux__ printf( " [--mptcp] Enable Multipath TCP on MPTCP Kernel.\n"); +#ifdef MODULE_REMOTE + printf( + " [--firewall] Setup firewall rules for auto blocking.\n"); +#endif +#endif printf("\n"); printf( " [-v] Verbose mode.\n");