2412f23646
The UDP relay treated the destination address as packet-scoped while
applying ACL/outbound policy only once when a new session was created.
After an authenticated client opened a UDP session using a permitted
first destination, later packets carrying a different Addr in the same
SessionID were written via the established outbound socket without
re-checking policy, allowing the client to reach destinations that ACL
should reject — including localhost and RFC1918 from the server's
network perspective. See GHSA-vgrc-hq28-p3xp.
Add a no-I/O CheckUDP method to the Outbound / PluggableOutbound
chain. The UDP session entry now consults CheckUDP for every packet
whose destination differs from the session's first one, dropping
rejected packets before WriteTo. Decisions are cached per destination
within the session (bounded at 256 entries with simple eviction) so
steady-state cost is one map lookup per packet and no extra sockets
or dials. CheckUDP propagates through the existing chain:
- aclEngine routes through the matched outbound's CheckUDP, with
aclRejectOutbound returning the rejection error.
- directOutbound / socks5Outbound / speedtestHandler return nil.
- httpOutbound returns errHTTPUDPNotSupported.
- Resolvers (system / dot / doh) run resolve() then forward to
Next.CheckUDP so IP-based ACL rules keep matching.
Regression tests in core/internal/integration_tests/udp_acl_test.go
use an in-package stub Outbound to assert that a rejected destination
is not relayed after the session is opened on a permitted one, and
that multi-destination sessions over permitted addresses still work.
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
94 lines
2.1 KiB
Go
94 lines
2.1 KiB
Go
package outbounds
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"fmt"
|
|
"net"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/apernet/hysteria/extras/v2/outbounds/tinydoh"
|
|
)
|
|
|
|
// dohResolver is a PluggableOutbound DNS resolver that resolves hostnames
|
|
// using the user-provided DNS-over-HTTPS server.
|
|
type dohResolver struct {
|
|
Resolver *tinydoh.Resolver
|
|
Next PluggableOutbound
|
|
}
|
|
|
|
func NewDoHResolver(addr string, timeout time.Duration, sni string, insecure bool, next PluggableOutbound) PluggableOutbound {
|
|
// User may provide just the IP address or full URL
|
|
if !strings.HasPrefix(addr, "https://") {
|
|
addr = fmt.Sprintf("https://%s/dns-query", addr)
|
|
}
|
|
tr := http.DefaultTransport.(*http.Transport).Clone()
|
|
tr.TLSClientConfig = &tls.Config{
|
|
ServerName: sni,
|
|
InsecureSkipVerify: insecure,
|
|
}
|
|
return &dohResolver{
|
|
Resolver: &tinydoh.Resolver{
|
|
URL: addr,
|
|
HTTPClient: &http.Client{
|
|
Transport: tr,
|
|
Timeout: timeoutOrDefault(timeout),
|
|
},
|
|
},
|
|
Next: next,
|
|
}
|
|
}
|
|
|
|
func (r *dohResolver) resolve(reqAddr *AddrEx) {
|
|
if tryParseIP(reqAddr) {
|
|
// The host is already an IP address, we don't need to resolve it.
|
|
return
|
|
}
|
|
type lookupResult struct {
|
|
ip net.IP
|
|
err error
|
|
}
|
|
ch4, ch6 := make(chan lookupResult, 1), make(chan lookupResult, 1)
|
|
go func() {
|
|
ips, err := r.Resolver.LookupA(reqAddr.Host)
|
|
var ip net.IP
|
|
if err == nil && len(ips) > 0 {
|
|
ip = ips[0]
|
|
}
|
|
ch4 <- lookupResult{ip, err}
|
|
}()
|
|
go func() {
|
|
ips, err := r.Resolver.LookupAAAA(reqAddr.Host)
|
|
var ip net.IP
|
|
if err == nil && len(ips) > 0 {
|
|
ip = ips[0]
|
|
}
|
|
ch6 <- lookupResult{ip, err}
|
|
}()
|
|
result4, result6 := <-ch4, <-ch6
|
|
reqAddr.ResolveInfo = &ResolveInfo{
|
|
IPv4: result4.ip,
|
|
IPv6: result6.ip,
|
|
}
|
|
if result4.err != nil {
|
|
reqAddr.ResolveInfo.Err = result4.err
|
|
} else if result6.err != nil {
|
|
reqAddr.ResolveInfo.Err = result6.err
|
|
}
|
|
}
|
|
|
|
func (r *dohResolver) TCP(reqAddr *AddrEx) (net.Conn, error) {
|
|
r.resolve(reqAddr)
|
|
return r.Next.TCP(reqAddr)
|
|
}
|
|
|
|
func (r *dohResolver) UDP(reqAddr *AddrEx) (UDPConn, error) {
|
|
r.resolve(reqAddr)
|
|
return r.Next.UDP(reqAddr)
|
|
}
|
|
|
|
func (r *dohResolver) CheckUDP(reqAddr *AddrEx) error {
|
|
r.resolve(reqAddr)
|
|
return r.Next.CheckUDP(reqAddr)
|
|
}
|