").append(m.parseHTML(a)).find(d):a)}).complete(c&&function(a,b){g.each(c,e||[a.responseText,b,a])}),this},m.expr.filters.animated=function(a){return m.grep(m.timers,function(b){return a===b.elem}).length};var cd=a.document.documentElement;function dd(a){return m.isWindow(a)?a:9===a.nodeType?a.defaultView||a.parentWindow:!1}m.offset={setOffset:function(a,b,c){var d,e,f,g,h,i,j,k=m.css(a,"position"),l=m(a),n={};"static"===k&&(a.style.position="relative"),h=l.offset(),f=m.css(a,"top"),i=m.css(a,"left"),j=("absolute"===k||"fixed"===k)&&m.inArray("auto",[f,i])>-1,j?(d=l.position(),g=d.top,e=d.left):(g=parseFloat(f)||0,e=parseFloat(i)||0),m.isFunction(b)&&(b=b.call(a,c,h)),null!=b.top&&(n.top=b.top-h.top+g),null!=b.left&&(n.left=b.left-h.left+e),"using"in b?b.using.call(a,n):l.css(n)}},m.fn.extend({offset:function(a){if(arguments.length)return void 0===a?this:this.each(function(b){m.offset.setOffset(this,a,b)});var b,c,d={top:0,left:0},e=this[0],f=e&&e.ownerDocument;if(f)return b=f.documentElement,m.contains(b,e)?(typeof e.getBoundingClientRect!==K&&(d=e.getBoundingClientRect()),c=dd(f),{top:d.top+(c.pageYOffset||b.scrollTop)-(b.clientTop||0),left:d.left+(c.pageXOffset||b.scrollLeft)-(b.clientLeft||0)}):d},position:function(){if(this[0]){var a,b,c={top:0,left:0},d=this[0];return"fixed"===m.css(d,"position")?b=d.getBoundingClientRect():(a=this.offsetParent(),b=this.offset(),m.nodeName(a[0],"html")||(c=a.offset()),c.top+=m.css(a[0],"borderTopWidth",!0),c.left+=m.css(a[0],"borderLeftWidth",!0)),{top:b.top-c.top-m.css(d,"marginTop",!0),left:b.left-c.left-m.css(d,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){var a=this.offsetParent||cd;while(a&&!m.nodeName(a,"html")&&"static"===m.css(a,"position"))a=a.offsetParent;return a||cd})}}),m.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(a,b){var c=/Y/.test(b);m.fn[a]=function(d){return V(this,function(a,d,e){var f=dd(a);return void 0===e?f?b in f?f[b]:f.document.documentElement[d]:a[d]:void(f?f.scrollTo(c?m(f).scrollLeft():e,c?e:m(f).scrollTop()):a[d]=e)},a,d,arguments.length,null)}}),m.each(["top","left"],function(a,b){m.cssHooks[b]=Lb(k.pixelPosition,function(a,c){return c?(c=Jb(a,b),Hb.test(c)?m(a).position()[b]+"px":c):void 0})}),m.each({Height:"height",Width:"width"},function(a,b){m.each({padding:"inner"+a,content:b,"":"outer"+a},function(c,d){m.fn[d]=function(d,e){var f=arguments.length&&(c||"boolean"!=typeof d),g=c||(d===!0||e===!0?"margin":"border");return V(this,function(b,c,d){var e;return m.isWindow(b)?b.document.documentElement["client"+a]:9===b.nodeType?(e=b.documentElement,Math.max(b.body["scroll"+a],e["scroll"+a],b.body["offset"+a],e["offset"+a],e["client"+a])):void 0===d?m.css(b,c,g):m.style(b,c,d,g)},b,f?d:void 0,f,null)}})}),m.fn.size=function(){return this.length},m.fn.andSelf=m.fn.addBack,"function"==typeof define&&define.amd&&define("jquery",[],function(){return m});var ed=a.jQuery,fd=a.$;return m.noConflict=function(b){return a.$===m&&(a.$=fd),b&&a.jQuery===m&&(a.jQuery=ed),m},typeof b===K&&(a.jQuery=a.$=m),m});
5 |
--------------------------------------------------------------------------------
/js/respond.min.js:
--------------------------------------------------------------------------------
1 | /*! Respond.js v1.4.2: min/max-width media query polyfill * Copyright 2013 Scott Jehl
2 | * Licensed under https://github.com/scottjehl/Respond/blob/master/LICENSE-MIT
3 | * */
4 |
5 | !function(a){"use strict";a.matchMedia=a.matchMedia||function(a){var b,c=a.documentElement,d=c.firstElementChild||c.firstChild,e=a.createElement("body"),f=a.createElement("div");return f.id="mq-test-1",f.style.cssText="position:absolute;top:-100em",e.style.background="none",e.appendChild(f),function(a){return f.innerHTML='',c.insertBefore(e,d),b=42===f.offsetWidth,c.removeChild(e),{matches:b,media:a}}}(a.document)}(this),function(a){"use strict";function b(){u(!0)}var c={};a.respond=c,c.update=function(){};var d=[],e=function(){var b=!1;try{b=new a.XMLHttpRequest}catch(c){b=new a.ActiveXObject("Microsoft.XMLHTTP")}return function(){return b}}(),f=function(a,b){var c=e();c&&(c.open("GET",a,!0),c.onreadystatechange=function(){4!==c.readyState||200!==c.status&&304!==c.status||b(c.responseText)},4!==c.readyState&&c.send(null))};if(c.ajax=f,c.queue=d,c.regex={media:/@media[^\{]+\{([^\{\}]*\{[^\}\{]*\})+/gi,keyframes:/@(?:\-(?:o|moz|webkit)\-)?keyframes[^\{]+\{(?:[^\{\}]*\{[^\}\{]*\})+[^\}]*\}/gi,urls:/(url\()['"]?([^\/\)'"][^:\)'"]+)['"]?(\))/g,findStyles:/@media *([^\{]+)\{([\S\s]+?)$/,only:/(only\s+)?([a-zA-Z]+)\s?/,minw:/\([\s]*min\-width\s*:[\s]*([\s]*[0-9\.]+)(px|em)[\s]*\)/,maxw:/\([\s]*max\-width\s*:[\s]*([\s]*[0-9\.]+)(px|em)[\s]*\)/},c.mediaQueriesSupported=a.matchMedia&&null!==a.matchMedia("only all")&&a.matchMedia("only all").matches,!c.mediaQueriesSupported){var g,h,i,j=a.document,k=j.documentElement,l=[],m=[],n=[],o={},p=30,q=j.getElementsByTagName("head")[0]||k,r=j.getElementsByTagName("base")[0],s=q.getElementsByTagName("link"),t=function(){var a,b=j.createElement("div"),c=j.body,d=k.style.fontSize,e=c&&c.style.fontSize,f=!1;return b.style.cssText="position:absolute;font-size:1em;width:1em",c||(c=f=j.createElement("body"),c.style.background="none"),k.style.fontSize="100%",c.style.fontSize="100%",c.appendChild(b),f&&k.insertBefore(c,k.firstChild),a=b.offsetWidth,f?k.removeChild(c):c.removeChild(b),k.style.fontSize=d,e&&(c.style.fontSize=e),a=i=parseFloat(a)},u=function(b){var c="clientWidth",d=k[c],e="CSS1Compat"===j.compatMode&&d||j.body[c]||d,f={},o=s[s.length-1],r=(new Date).getTime();if(b&&g&&p>r-g)return a.clearTimeout(h),h=a.setTimeout(u,p),void 0;g=r;for(var v in l)if(l.hasOwnProperty(v)){var w=l[v],x=w.minw,y=w.maxw,z=null===x,A=null===y,B="em";x&&(x=parseFloat(x)*(x.indexOf(B)>-1?i||t():1)),y&&(y=parseFloat(y)*(y.indexOf(B)>-1?i||t():1)),w.hasquery&&(z&&A||!(z||e>=x)||!(A||y>=e))||(f[w.media]||(f[w.media]=[]),f[w.media].push(m[w.rules]))}for(var C in n)n.hasOwnProperty(C)&&n[C]&&n[C].parentNode===q&&q.removeChild(n[C]);n.length=0;for(var D in f)if(f.hasOwnProperty(D)){var E=j.createElement("style"),F=f[D].join("\n");E.type="text/css",E.media=D,q.insertBefore(E,o.nextSibling),E.styleSheet?E.styleSheet.cssText=F:E.appendChild(j.createTextNode(F)),n.push(E)}},v=function(a,b,d){var e=a.replace(c.regex.keyframes,"").match(c.regex.media),f=e&&e.length||0;b=b.substring(0,b.lastIndexOf("/"));var g=function(a){return a.replace(c.regex.urls,"$1"+b+"$2$3")},h=!f&&d;b.length&&(b+="/"),h&&(f=1);for(var i=0;f>i;i++){var j,k,n,o;h?(j=d,m.push(g(a))):(j=e[i].match(c.regex.findStyles)&&RegExp.$1,m.push(RegExp.$2&&g(RegExp.$2))),n=j.split(","),o=n.length;for(var p=0;o>p;p++)k=n[p],l.push({media:k.split("(")[0].match(c.regex.only)&&RegExp.$2||"all",rules:m.length-1,hasquery:k.indexOf("(")>-1,minw:k.match(c.regex.minw)&&parseFloat(RegExp.$1)+(RegExp.$2||""),maxw:k.match(c.regex.maxw)&&parseFloat(RegExp.$1)+(RegExp.$2||"")})}u()},w=function(){if(d.length){var b=d.shift();f(b.href,function(c){v(c,b.href,b.media),o[b.href]=!0,a.setTimeout(function(){w()},0)})}},x=function(){for(var b=0;b
= 0; i-- {
175 | if !twm.internalCheck(sites[i]) { // if it is still not allowed, push it back
176 | twm.stack.Push(sites[i])
177 | }
178 | }
179 | }
180 |
--------------------------------------------------------------------------------
/memorywhitelist_test.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "fmt"
5 | "net"
6 | "net/url"
7 | "os"
8 | "testing"
9 | "time"
10 | )
11 |
12 | var dummyIP net.IP
13 |
14 | func BenchmarkMemoryManagerMatching(b *testing.B) {
15 | fmt.Println()
16 | b.StopTimer()
17 | twm, err := NewMemoryWhitelistManager("tempmem.csv")
18 | if err != nil {
19 | b.Fatalf("Error starting memory whitelist manager - %t", err)
20 | }
21 | defer func() {
22 | twm.file.Close()
23 | os.RemoveAll("tempmem.csv")
24 | }()
25 | benchManager(twm, b)
26 | b.StopTimer()
27 | }
28 |
29 | func benchManager(wlm WhiteListManager, b *testing.B) {
30 | b.StartTimer()
31 | patterns := []struct {
32 | val int
33 | e Entry
34 | }{
35 | {1, NewEntry("www.google.com", false, "", "", 0)},
36 | {-1, NewEntry("www.google.com", true, "", "", 0)},
37 | {1, NewEntry("other.google.com", true, "", "", 0)},
38 | {-2, NewEntry("google.com", true, "", "", 0)},
39 | {0, NewEntry("explicit.google.com", false, "", "", 0)},
40 | {0, NewEntry("wildcard.google.com", true, "", "", 0)},
41 | {1, NewEntry("path.com", false, "/path", "", 0)},
42 | {0, NewEntry("path.com", false, "/path/too", "", 0)},
43 | {1, NewEntry("travis-ci.org", false, "", "", 0)},
44 | {1, NewEntry("com", true, "", "", 0)}, // this in invalid input, use NewEntry to "clean" it and make it a non-wildcard entry
45 | {0, NewEntry("com", false, "", "", 0)}, // test that this is not added as it is a duplicate
46 | {0, NewEntry("com", false, "/path", "", 0)}, // test that this is not added as it is superceded by path
47 | }
48 | for _, p := range patterns {
49 | wlm.Add(dummyIP, "", p.e, false)
50 | }
51 | testingSites := []struct {
52 | URL string
53 | Check bool
54 | Referer string
55 | }{
56 | {"http://www.google.com", true, "http://referer"},
57 | {"https://www.google.com", true, "http://referer"},
58 | {"http://child.www.google.com", true, "http://referer"},
59 | {"https://child.www.google.com", true, "http://referer"},
60 | {"http://google.com", true, "http://referer"},
61 | {"http://google.com?query=true", true, "http://referer"},
62 | {"http://google.com/?query=true", true, "http://referer"},
63 | {"http://www.google.company", false, "http://referer"},
64 | {"https://www.google.company", false, "http://referer"},
65 | {"http://child.www.google.company", false, "http://referer"},
66 | {"https://child.www.google.company", false, "http://referer"},
67 | {"http://google.company", false, "http://referer"},
68 | {"http://google.company?query=true", false, "http://referer"},
69 | {"http://google.company/?query=true", false, "http://referer"},
70 | {"http://path.com/path?query=true", true, "http://referer"},
71 | {"http://path.com/path/?query=true", true, "http://referer"},
72 | {"http://www.path.com/path?query=true", false, "http://referer"},
73 | {"http://www.path.com/path/?query=true", false, "http://referer"},
74 | {"http://path.com/path/good?query=true", true, "http://referer"},
75 | {"https://path.com/path/good?query=true", true, "http://referer"},
76 | {"http://path.com/path/good/?query=true", true, "http://referer"},
77 | {"http://path.com/falsepath?query=true", false, "http://referer"},
78 | {"http://path.com/falsepath/?query=true", false, "http://referer"},
79 | {"http://path.com/falsepath/", false, "http://referer"},
80 | {"http://path.com/falsepath", false, "http://referer"},
81 | {"http://path.com/pathfalse?query=true", false, "http://referer"},
82 | {"http://path.com/pathfalse/?query=true", false, "http://referer"},
83 | {"http://path.com/pathfalse/", false, "http://referer"},
84 | {"http://path.com/pathfalse", false, "http://referer"},
85 | {"http://path.com/", false, "http://referer"},
86 | {"http://path.com", false, "http://referer"},
87 | {"http://travis-ci.org", true, "http://referer"},
88 | {"https://travis-ci.org", true, "http://referer"},
89 | {"http://www.travis-ci.org", false, "http://referer"},
90 | {"http://www.mdlottery.com", false, "http://referer"},
91 | }
92 | for i := 0; i < b.N; i++ {
93 | for j, s := range testingSites {
94 | u, _ := url.Parse(s.URL)
95 | result := wlm.Check(dummyIP, Site{URL: u})
96 | if result != s.Check {
97 | b.Errorf("[%d] For URL %s - expected %t, got %t", j, u, s.Check, result)
98 | }
99 | }
100 | }
101 | }
102 |
103 | func TestMemoryWhiteListManagerExpire(t *testing.T) {
104 | fmt.Println()
105 | twm, err := NewMemoryWhitelistManager("tempmem.json")
106 | if err != nil {
107 | t.Fatalf("Error starting memory whitelist manager - %t", err)
108 | }
109 | defer func() {
110 | twm.file.Close()
111 | os.RemoveAll("tempmem.json")
112 | }()
113 | patterns := []struct {
114 | val int
115 | e Entry
116 | }{
117 | {1, NewEntry("www.google.com", false, "", "", -10*time.Second)}, // 1
118 | {-1, NewEntry("www.google.com", true, "", "", -5*time.Second)}, // 2, will be added and remove the first, 2
119 | {1, NewEntry("www.google.com", false, "", "", 0)}, // 3, will be added but no removal, 2, 3
120 | {-1, NewEntry("www.google.com", true, "", "", 5*time.Second)}, //4, will be added and remove the 2nd, 3, 4
121 | {-1, NewEntry("google.com", true, "", "", 10*time.Second)}, // 5, will be added and remove the 4th, 3, 5
122 | {-1, NewEntry("www.google.com", true, "", "", 0)}, // 6, will be added and remove the 3rd, 5, 6
123 | }
124 | for i, p := range patterns {
125 | got := twm.add(p.e, false)
126 | if p.val != got {
127 | t.Errorf("Got %d, wanted %v, for entry #%d - %v", got, p.val, i, p.e)
128 | }
129 | }
130 | if len(twm.entries) != 2 {
131 | t.Fatalf("Should only be two entries but instead have:\n%v", twm.entries)
132 | }
133 | if twm.entries[0].Host != "google.com" {
134 | t.Errorf("Expected the first entry to be google.com but got %s", twm.entries[0].Host)
135 | }
136 | twm.entries[0].Expires = time.Now() // make sure to expire the primary one
137 | tests := map[string]bool{
138 | "http://google.com": false,
139 | "http://www.google.com": true,
140 | "http://other.google.com": false,
141 | }
142 | for u, expected := range tests {
143 | parsed, err := url.Parse(u)
144 | if err != nil {
145 | t.Error(err)
146 | }
147 | if got := twm.Check(dummyIP, Site{URL: parsed}); got != expected {
148 | t.Errorf("got %t, expected %t, for site - %s", got, expected, u)
149 | }
150 | }
151 | }
152 |
153 | func TestMemoryWhiteListManagerAdd(t *testing.T) {
154 | fmt.Println()
155 | twm, err := NewMemoryWhitelistManager("tempmem.json")
156 | if err != nil {
157 | t.Fatalf("Error starting memory whitelist manager - %t", err)
158 | }
159 | defer func() {
160 | twm.file.Close()
161 | os.RemoveAll("tempmem.csv")
162 | }()
163 | twm.entries = twm.entries[:0]
164 | patterns := []struct {
165 | val int
166 | e Entry
167 | }{
168 | {1, NewEntry("www.google.com", false, "", "", 0)},
169 | {-1, NewEntry("www.google.com", true, "", "", 0)},
170 | {1, NewEntry("other.google.com", true, "", "", 0)},
171 | {-2, NewEntry("google.com", true, "", "", 0)},
172 | {0, NewEntry("explicit.google.com", false, "", "", 0)},
173 | {0, NewEntry("wildcard.google.com", true, "", "", 0)},
174 | {1, NewEntry("path.com", false, "/path", "", 0)},
175 | {0, NewEntry("path.com", false, "/path/too", "", 0)},
176 | {1, NewEntry("travis-ci.org", false, "", "", 0)},
177 | {1, NewEntry("com", true, "", "", 0)}, // this in invalid input, use NewEntry to "clean" it and make it a non-wildcard entry
178 | {0, NewEntry("com", false, "", "", 0)}, // test that this is not added as it is a duplicate
179 | {0, NewEntry("com", false, "/path", "", 0)}, // test that this is not added as it is superceded by path
180 | }
181 | for i, p := range patterns {
182 | got := twm.add(p.e, false)
183 | if p.val != got {
184 | t.Errorf("Got %d, wanted %v, for entry #%d - %v", got, p.val, i, p.e)
185 | }
186 | }
187 | }
188 |
--------------------------------------------------------------------------------
/stack.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import "sync"
4 |
5 | func NewStack(max int) *Stack {
6 | return &Stack{
7 | elements: make([]Site, max),
8 | }
9 | }
10 |
11 | type Stack struct {
12 | elements []Site
13 | newest int // inclusive
14 | length int
15 | sync.RWMutex
16 | }
17 |
18 | func (s *Stack) Len() int {
19 | s.RLock()
20 | defer s.RUnlock()
21 | return s.length
22 | }
23 |
24 | // Push a new element onto the stack
25 | func (s *Stack) Push(site Site) {
26 | s.Lock()
27 | defer s.Unlock()
28 | s.newest++
29 | if s.newest == cap(s.elements) {
30 | s.newest = 0
31 | }
32 | s.elements[s.newest] = site
33 | if s.length < cap(s.elements) {
34 | s.length++
35 | }
36 | }
37 |
38 | // Return the (num) most recently blocked sites
39 | func (s *Stack) View(num int) (sites []Site) {
40 | s.Lock()
41 | defer s.Unlock()
42 | if s.length == 0 {
43 | return sites
44 | }
45 | if s.length < num {
46 | num = s.length
47 | }
48 | sites = make([]Site, num)
49 | walker := s.newest
50 | for x := range sites {
51 | sites[x] = s.elements[walker]
52 | walker--
53 | if walker == -1 {
54 | walker = cap(s.elements) - 1
55 | }
56 | }
57 | return sites
58 | }
59 |
60 | // Remove the top element from the stack and return it's value
61 | // If the stack is empty, return nil
62 | func (s *Stack) Pop() (site *Site) {
63 | s.Lock()
64 | defer s.Unlock()
65 | if s.length == 0 {
66 | return nil
67 | }
68 | s.length--
69 | victim := s.elements[s.newest]
70 | s.newest--
71 | if s.newest == -1 {
72 | s.newest = cap(s.elements) - 1
73 | }
74 | return &victim
75 | }
76 |
--------------------------------------------------------------------------------
/stack_test.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "net/url"
5 | "testing"
6 | )
7 |
8 | func pushAll(s *Stack, data []*url.URL) {
9 | for _, x := range data {
10 | s.Push(Site{URL: x})
11 | }
12 | }
13 |
14 | func TestStack(t *testing.T) {
15 | testData := []string{
16 | "google.com",
17 | "helpme.com",
18 | "github.com",
19 | "other",
20 | "testme:8080",
21 | }
22 | urls := make([]*url.URL, len(testData))
23 | for x := range testData {
24 | urls[x], _ = url.Parse(testData[x])
25 | }
26 | s := NewStack(2)
27 | if want, got := 0, s.Len(); got != want {
28 | t.Errorf("Wanted %v, got %v", want, got)
29 | }
30 | pushAll(s, urls)
31 | if want, got := 2, s.Len(); got != want {
32 | t.Errorf("Wanted %v, got %v", want, got)
33 | }
34 | if want, got := urls[4], s.Pop().URL; got != want {
35 | t.Errorf("Wanted %v, got %v", want, got)
36 | }
37 | if want, got := urls[3], s.Pop().URL; got != want {
38 | t.Errorf("Wanted %v, got %v", want, got)
39 | }
40 | if want, got := (*Site)(nil), s.Pop(); got != want {
41 | t.Errorf("Wanted %v, got %v", want, got)
42 | }
43 | if want, got := 0, s.Len(); got != want {
44 | t.Errorf("Wanted %v, got %v", want, got)
45 | }
46 | }
47 |
--------------------------------------------------------------------------------
/template.html:
--------------------------------------------------------------------------------
1 | {{define "header"}}
2 |
3 |
4 |
5 |
6 |
7 |
8 | {{.}}
9 |
10 |
11 |
12 | {{end}}
13 |
14 | {{define "footer"}}
15 |
16 |
17 |
18 |
19 |
32 |
33 |
34 |
35 |
36 |
40 |
41 | {{end}}
42 |
43 | {{/*
44 | whitelist has .Path .Host .URL .Redirect and .Durations
45 | URL is not displayed, only passed on to /add
46 | TODO: .Redirect is a boolean defining whether the client code should follow the redirect response or ignore it (ajax)
47 | */}}
48 | {{define "whitelist"}}
49 | {{$paths := paths .Path}}
50 | {{if $paths}}
51 | Whitelist by path
52 |
53 | {{range $_, $path := $paths}}
54 | -
55 | {{range $dur := $.Durations}}
56 | {{$dur.N}}
57 | {{end}}
58 | {{$.Host}}{{$path}}
59 | {{end}}
60 |
61 | {{end}}
62 | Whitelist by host
63 |
64 | -
65 | {{range $dur := $.Durations}}
66 | {{$dur.N}}
67 | {{end}}
68 | {{.Host}}
69 |
70 | Whitelist by wildcard
71 |
72 | {{range $_, $root := rootDomains .Host}}
73 | -
74 | {{range $dur := $.Durations}}
75 | {{$dur.N}}
76 | {{end}}
77 | *.{{$root}}
78 | {{end}}
79 |
80 | {{end}}
81 |
82 | {{define "deny"}}
83 | {{template "header" "Access Denied"}}
84 | Access Denied
85 | {{.Request.Host}} is not in the whitelist from IP {{.Request.RemoteAddr}}.
86 | {{template "whitelist" makeWhitelistArgs .Request.URL.Path .Request.Host .Request.URL true}}
87 | {{template "footer" .}}
88 | {{end}}
89 |
90 | {{define "error"}}
91 |
92 |
93 | Error
94 | Error adding site: {{.Error}}
95 |
96 |
97 | {{end}}
98 |
99 | {{define "/list"}}
100 | {{template "header" "Recent blocked sites"}}
101 | Recent blocked sites
102 | {{range $outindex, $item := .List}}
103 |
104 | {{if $item.Referer}}
105 |
Referer {{$item.Referer}}
106 | {{else}}
107 |
No Referer
108 | {{end}}
109 |
110 | {{range $inindex, $url := $item.Sites}}
111 |
112 |
119 |
120 |
121 | {{template "whitelist" makeWhitelistArgs $url.Path $url.Host $url false}}
122 |
123 |
124 |
125 | {{end}}
126 |
127 |
Currently allowed sites
136 |
137 | | Host | Match Subdomains | Path | Creator | Created | Expires |
|---|
138 | {{range .List}}
139 |
140 | | {{.Host}} |
141 | {{.MatchSubdomains}} |
142 | {{.Path}} |
143 | {{.Creator}} |
144 | {{.Created}} |
145 | {{if .Created.Equal .Expires}}Never{{else}}{{.Expires}}{{end}} |
146 |
147 | {{end}}
148 |
149 | {{template "footer" .}}
150 |
151 | {{end}}
152 |
153 | {{define "/auth"}}
154 |
155 |
156 | {{if .Error}}{{.Error}}
{{end}}
157 |
158 | | Host | Match Subdomains | Path | Duration |
|---|
159 | | {{.Host}} | {{.MatchSubdomains}} | {{.Path}} | {{.Duration}} |
160 |
161 |
171 |
172 |
173 | {{end}}
174 |
--------------------------------------------------------------------------------
/transparent.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "bufio"
5 | "bytes"
6 | "crypto/tls"
7 | "flag"
8 | "fmt"
9 | "html/template"
10 | "io"
11 | "io/ioutil"
12 | "log"
13 | "net"
14 | "net/http"
15 | "net/http/httptest"
16 | "net/url"
17 | "os/exec"
18 | "strings"
19 | "time"
20 |
21 | "github.com/elazarl/goproxy"
22 | "github.com/gorilla/sessions"
23 | vhost "github.com/inconshreveable/go-vhost"
24 | ldap "github.com/mzimmerman/ldap"
25 | )
26 |
27 | var (
28 | store *sessions.CookieStore
29 | ldc LDAPConnector
30 | verbose *bool
31 | http_addr *string
32 | https_addr *string
33 | proxy_hostname *string
34 | )
35 |
36 | type LDAPConnector struct {
37 | BindPrefix string
38 | BindSuffix string
39 | Address string
40 | }
41 |
42 | func (auth LDAPConnector) Authenticate(user, pass string) error {
43 | conn, err := ldap.DialTLS("tcp", auth.Address, &tls.Config{InsecureSkipVerify: true})
44 | if err != nil {
45 | return err
46 | }
47 | return conn.Bind(auth.BindPrefix+ldap.EscapeFilter(user)+auth.BindSuffix, pass)
48 | }
49 |
50 | func (auth LDAPConnector) ChangePass(user, oldpass, newpass string) error {
51 | conn, err := ldap.DialTLS("tcp", auth.Address, &tls.Config{InsecureSkipVerify: true})
52 | if err != nil {
53 | return err
54 | }
55 | err = conn.Bind(user, oldpass)
56 | if err != nil {
57 | return err
58 | }
59 | pmr := ldap.NewPasswordModifyRequest(user, oldpass, newpass)
60 | _, err = conn.PasswordModify(pmr)
61 | return err
62 | }
63 |
64 | var wlm WhiteListManager
65 |
66 | type WhiteListManager interface {
67 | Add(net.IP, string, Entry, bool) error // fails with wrong user
68 | Check(net.IP, Site) bool
69 | RecentBlocks(net.IP, int) []Site
70 | Current(ip net.IP) []Entry
71 | }
72 |
73 | var tmpl *template.Template
74 |
75 | type Entry struct {
76 | Host string
77 | MatchSubdomains bool
78 | Path string
79 | Creator string
80 | Created time.Time
81 | Expires time.Time
82 | }
83 |
84 | func NewEntry(host string, subdomains bool, path, creator string, duration time.Duration) Entry {
85 | if !strings.Contains(host, ".") { // don't allow root domains be wildcarded, but allow "internal" hosts
86 | subdomains = false
87 | }
88 | now := time.Now()
89 | return Entry{
90 | Host: host,
91 | MatchSubdomains: subdomains,
92 | Path: path,
93 | Creator: creator,
94 | Created: now,
95 | Expires: now.Add(duration),
96 | }
97 | }
98 |
99 | func (e Entry) Supercedes(f Entry) bool {
100 | return e.timeSupercedes(f) && e.pathSupercedes(f)
101 | }
102 |
103 | func (e Entry) Expired(now time.Time) bool {
104 | if e.Expires.Equal(e.Created) {
105 | return false
106 | }
107 | if e.Expires.Before(now) {
108 | return true
109 | }
110 | return false
111 | }
112 |
113 | func (e Entry) timeSupercedes(f Entry) bool {
114 | if e.Created.Equal(e.Expires) { // e does not expire
115 | return true
116 | }
117 | if f.Created.Equal(f.Expires) { // f does not expire
118 | return false
119 | }
120 | if !e.Expires.Before(f.Expires) {
121 | return true
122 | }
123 | return false
124 | }
125 |
126 | func (e Entry) pathSupercedes(f Entry) bool {
127 | if e.Host == f.Host {
128 | if e.MatchSubdomains == f.MatchSubdomains {
129 | if e.MatchSubdomains {
130 | return true // they're the same, paths won't exist when matching subdomains
131 | }
132 | // neither entry matches a path
133 | if strings.HasPrefix(f.Path+"/", e.Path+"/") {
134 | return true
135 | }
136 | return false
137 | }
138 | // e.MatchSubdomains != f.MatchSubdomains
139 | if e.MatchSubdomains {
140 | return true
141 | }
142 | } else if e.MatchSubdomains && strings.HasSuffix(f.Host, "."+e.Host) {
143 | return true
144 | }
145 | return false
146 | }
147 |
148 | var durations = []struct {
149 | N string
150 | D string
151 | S string
152 | }{
153 | {"5Min", "5m", "primary"},
154 | {"Hour", "1h", "success"},
155 | {"Day", "24h", "info"},
156 | {"Week", "168h", "warning"},
157 | {"Forever", "0s", "danger"},
158 | }
159 |
160 | func makeWhitelistArgs(path, host string, u *url.URL, redirect bool) map[string]interface{} {
161 | return map[string]interface{}{
162 | "Path": path,
163 | "Host": host,
164 | "URL": u,
165 | "Redirect": redirect,
166 | "Durations": durations,
167 | }
168 | }
169 |
170 | var whiteListHandler goproxy.FuncReqHandler = func(req *http.Request, ctx *goproxy.ProxyCtx) (*http.Request, *http.Response) {
171 | ip, _, err := net.SplitHostPort(req.RemoteAddr)
172 | if err != nil {
173 | panic(fmt.Sprintf("userip: %q is not IP:port", req.RemoteAddr))
174 | }
175 | userIP := net.ParseIP(ip)
176 | if userIP == nil {
177 | panic(fmt.Sprintf("userip: %q is not IP", ip))
178 | }
179 |
180 | buf := bytes.Buffer{}
181 | if ok := wlm.Check(userIP, Site{
182 | URL: req.URL,
183 | Referer: req.Referer(),
184 | }); ok {
185 | log.Printf("IP %s visited - %v - referred from - %v", ip, req.URL, req.Referer())
186 | return req, nil
187 | }
188 | log.Printf("IP %s was blocked visiting - %v - referred from - %v", ip, req.URL, req.Referer())
189 | err = tmpl.ExecuteTemplate(&buf, "deny", map[string]interface{}{
190 | "Request": req,
191 | })
192 | if err != nil {
193 | buf.WriteString(fmt.Sprintf("Requested destination not in whitelist, error writing template - %v", err))
194 | }
195 |
196 | return nil, &http.Response{
197 | StatusCode: 400,
198 | ProtoMajor: 1,
199 | ProtoMinor: 1,
200 | Request: ctx.Req,
201 | Header: http.Header{"Cache-Control": []string{"no-cache"}},
202 | Body: ioutil.NopCloser(&buf),
203 | ContentLength: int64(buf.Len()),
204 | }
205 | }
206 |
207 | func responseFromResponseRecorder(req *http.Request, w *httptest.ResponseRecorder) (*http.Request, *http.Response) {
208 | resp := goproxy.NewResponse(req, "", w.Code, w.Body.String())
209 | resp.Header = make(http.Header)
210 | for key, vals := range w.HeaderMap {
211 | for _, val := range vals {
212 | resp.Header.Add(key, val)
213 | }
214 | }
215 | return req, resp
216 | }
217 |
218 | func whitelistService(r *http.Request, ctx *goproxy.ProxyCtx) (*http.Request, *http.Response) {
219 | ip, _, err := net.SplitHostPort(r.RemoteAddr)
220 | if err != nil {
221 | panic(fmt.Sprintf("userip: %q is not IP:port", r.RemoteAddr))
222 | }
223 | userIP := net.ParseIP(ip)
224 | if userIP == nil {
225 | panic(fmt.Sprintf("userip: %q is not IP", ip))
226 | }
227 |
228 | w := httptest.NewRecorder()
229 | if strings.HasPrefix(r.URL.Path, "/js") {
230 | http.StripPrefix("/js", http.FileServer(http.Dir("js"))).ServeHTTP(w, r)
231 | return responseFromResponseRecorder(r, w)
232 | }
233 | w.Header().Add("Cache-Control", "no-cache")
234 | switch r.URL.Path {
235 | case "/auth":
236 | r.ParseForm()
237 | err := ldc.Authenticate(r.Form.Get("user"), r.Form.Get("pass"))
238 | if err != nil {
239 | log.Printf("Unsuccessful authentication as %s from %s", r.Form.Get("user"), ip)
240 | w.Write([]byte(fmt.Sprintf("Error authenticating - %v", err)))
241 | return responseFromResponseRecorder(r, w)
242 | }
243 | log.Printf("User %s authenticated successfully from %s", r.Form.Get("user"), ip)
244 | session, _ := store.Get(r, "session")
245 | session.Values["user"] = r.Form.Get("user")
246 | err = session.Save(r, w)
247 | if err != nil {
248 | log.Printf("Authenticated successfully but could not save the cookie - %v", err)
249 | }
250 | fallthrough
251 | case "/add":
252 | r.ParseForm()
253 | decURL, err := url.QueryUnescape(r.Form.Get("url"))
254 | if err != nil {
255 | w.WriteHeader(400)
256 | err = tmpl.ExecuteTemplate(w, "error", map[string]interface{}{"Error": err})
257 | if err != nil {
258 | w.Write([]byte(fmt.Sprintf("Error adding site to whitelist, error writing template - %v", err)))
259 | }
260 | return responseFromResponseRecorder(r, w)
261 | }
262 | decHost, err := url.QueryUnescape(r.Form.Get("host"))
263 | if err != nil {
264 | w.WriteHeader(400)
265 | err = tmpl.ExecuteTemplate(w, "error", map[string]interface{}{"Error": err})
266 | if err != nil {
267 | w.Write([]byte(fmt.Sprintf("Error adding site to whitelist, error writing template - %v", err)))
268 | }
269 | return responseFromResponseRecorder(r, w)
270 | }
271 | decPath, err := url.QueryUnescape(r.Form.Get("path"))
272 | if err != nil {
273 | w.WriteHeader(400)
274 | err = tmpl.ExecuteTemplate(w, "error", map[string]interface{}{"Error": err})
275 | if err != nil {
276 | w.Write([]byte(fmt.Sprintf("Error adding site to whitelist, error writing template - %v", err)))
277 | }
278 | return responseFromResponseRecorder(r, w)
279 | }
280 | decDuration, err := url.QueryUnescape(r.Form.Get("duration"))
281 | if err != nil {
282 | w.WriteHeader(400)
283 | err = tmpl.ExecuteTemplate(w, "error", map[string]interface{}{"Error": err})
284 | if err != nil {
285 | w.Write([]byte(fmt.Sprintf("Error adding site to whitelist, error writing template - %v", err)))
286 | }
287 | return responseFromResponseRecorder(r, w)
288 | }
289 | duration, _ := time.ParseDuration(decDuration)
290 | user := ""
291 | if ldc.Address != "" {
292 | session, err := store.Get(r, "session")
293 | if err == nil {
294 | user, _ = session.Values["user"].(string)
295 | }
296 | } else {
297 | user = ip
298 | }
299 | entry := NewEntry(decHost, r.Form.Get("match") == "true", decPath, user, duration)
300 | err = wlm.Add(userIP, user, entry, ldc.Address != "") // wait till host is added, otherwise we might get blocked again on redirect
301 | if err != nil {
302 | err = tmpl.ExecuteTemplate(w, "/auth", map[string]interface{}{
303 | "URL": r.Form.Get("url"),
304 | "Path": r.Form.Get("path"),
305 | "Host": r.Form.Get("host"),
306 | "MatchSubstring": r.Form.Get("match"),
307 | "Error": err,
308 | })
309 | return responseFromResponseRecorder(r, w)
310 | }
311 | log.Printf("User %s from %s added site - %#v", user, ip, entry)
312 | http.Redirect(w, r, decURL, http.StatusMovedPermanently)
313 | return responseFromResponseRecorder(r, w)
314 | default: // case: "/list"
315 | list := wlm.RecentBlocks(userIP, 50) // get up to the last 50
316 | type rg struct {
317 | Referer string
318 | Sites []*url.URL
319 | }
320 | referers := make([]*rg, 0, len(list))
321 | outer:
322 | for _, site := range list {
323 | for _, x := range referers {
324 | if x.Referer == site.Referer {
325 | x.Sites = append(x.Sites, site.URL)
326 | continue outer
327 | }
328 | }
329 | referers = append(referers, &rg{
330 | Referer: site.Referer,
331 | Sites: []*url.URL{site.URL},
332 | })
333 | }
334 | var buf bytes.Buffer
335 | err := tmpl.ExecuteTemplate(&buf, "/list", map[string]interface{}{"List": referers,
336 | "Durations": durations,
337 | })
338 | if err != nil {
339 | w.WriteHeader(500)
340 | w.Write([]byte(fmt.Sprintf("Error fetching recently blocked sites - %v", err)))
341 | } else {
342 | io.Copy(w, &buf)
343 | }
344 | return responseFromResponseRecorder(r, w)
345 | case "/current":
346 | currentList := make(chan Entry)
347 | done := make(chan struct{})
348 | defer func() {
349 | done <- struct{}{}
350 | }()
351 | go func() {
352 | now := time.Now()
353 | for _, e := range wlm.Current(userIP) {
354 | if e.Expired(now) {
355 | continue
356 | }
357 | select {
358 | case currentList <- e:
359 | case <-done:
360 | return
361 | }
362 | }
363 | close(currentList)
364 | <-done
365 | }()
366 | var buf bytes.Buffer
367 | err := tmpl.ExecuteTemplate(&buf, "/current", map[string]interface{}{"List": currentList})
368 | if err != nil {
369 | w.WriteHeader(500)
370 | w.Write([]byte(fmt.Sprintf("Error fetching current whitelist - %v", err)))
371 | } else {
372 | io.Copy(w, &buf)
373 | }
374 | return responseFromResponseRecorder(r, w)
375 | }
376 | }
377 |
378 | func init() {
379 | cookie_pass := flag.String("cookiepass", "defaultpassword", "the encryptionkey used to manage session cookies")
380 | ldap_address := flag.String("ldapaddress", "", "the address and port (addr:port) of the LDAP server")
381 | ldap_bind_prefix := flag.String("ldapprefix", "uid=", "the prefix used before the userid in an LDAP bind")
382 | ldap_bind_suffix := flag.String("ldapsuffix", ",ou=People,ou=whitelistproxy,ou=com", "the suffix used after the userid in an LDAP bind")
383 | whitelist_filename := flag.String("whitelistfile", "", "The path/name of the file where the whitelist will be read/written to")
384 | zones_filename := flag.String("zonesfile", "", "The path/name of the file where the configuration of zones will be read from")
385 | verbose = flag.Bool("v", false, "should every proxy request be logged to stdout")
386 | http_addr = flag.String("httpaddr", ":3129", "proxy http listen address")
387 | https_addr = flag.String("httpsaddr", ":3128", "proxy https listen address")
388 | proxy_hostname = flag.String("hostname", "whitelistproxy", "The hostname of the whitelistproxy in order to manipulate the whitelist")
389 | flag.Parse()
390 |
391 | // initialize the gorilla session store
392 | store = sessions.NewCookieStore([]byte(*cookie_pass))
393 | store.Options = &sessions.Options{
394 | Path: "/",
395 | MaxAge: 86400, // one day
396 | }
397 |
398 | ldc = LDAPConnector{
399 | Address: *ldap_address,
400 | BindPrefix: *ldap_bind_prefix,
401 | BindSuffix: *ldap_bind_suffix,
402 | }
403 |
404 | var err error
405 | switch {
406 | case *zones_filename != "" && *whitelist_filename != "":
407 | panic(fmt.Sprintf("Cannot use both zonesfile and whitelistfile options - %s - %s", *zones_filename, *whitelist_filename))
408 | case *zones_filename != "":
409 | wlm, err = NewZoneManager(*zones_filename)
410 | case *whitelist_filename != "":
411 | wlm, err = NewMemoryWhitelistManager(*whitelist_filename)
412 | default:
413 | wlm, err = NewMemoryWhitelistManager("whitelist.json") // legacy default
414 | }
415 | if err != nil {
416 | log.Fatalf("Error loading Whitelist - %v", err)
417 | }
418 | tmpl, err = template.New("default").Funcs(template.FuncMap{
419 | "paths": paths,
420 | "rootDomains": rootDomains,
421 | "makeWhitelistArgs": makeWhitelistArgs,
422 | "proxyHostname": func() string {
423 | return *proxy_hostname
424 | },
425 | }).ParseFiles("template.html")
426 | if err != nil {
427 | log.Fatalf("Error parsing template - %v", err)
428 | }
429 | }
430 |
431 | func main() {
432 | proxy := goproxy.NewProxyHttpServer()
433 | proxy.Verbose = *verbose
434 | if proxy.Verbose {
435 | log.Printf("Server starting up! - configured to listen on http interface %s and https interface %s with hostname %s", *http_addr, *https_addr, *proxy_hostname)
436 | }
437 |
438 | proxy.NonproxyHandler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
439 | if req.Host == "" {
440 | fmt.Fprintln(w, "Cannot handle requests without Host header, e.g., HTTP 1.0")
441 | return
442 | }
443 | req.URL.Scheme = "http"
444 | req.URL.Host = req.Host
445 | proxy.ServeHTTP(w, req)
446 | })
447 | cert, err := tls.LoadX509KeyPair("ca.crt", "ca.key")
448 | if err != nil {
449 | log.Fatalf("Unable to load certificate - %v", err)
450 | }
451 |
452 | proxy.OnRequest(goproxy.DstHostIs(*proxy_hostname)).DoFunc(whitelistService)
453 | proxy.OnRequest().DoFunc(whiteListHandler)
454 | proxy.OnRequest().HandleConnectFunc(func(host string, ctx *goproxy.ProxyCtx) (*goproxy.ConnectAction, string) {
455 | ip, _, err := net.SplitHostPort(ctx.Req.RemoteAddr)
456 | if err != nil {
457 | panic(fmt.Sprintf("userip: %q is not IP:port", ctx.Req.RemoteAddr))
458 | }
459 | userIP := net.ParseIP(ip)
460 | if userIP == nil {
461 | panic(fmt.Sprintf("userip: %q is not IP", ip))
462 | }
463 | log.Printf("Handled connect from ip - %s - for host %s", ip, host)
464 | if err != nil {
465 | log.Printf("Error creating URL for host %s", host)
466 | } else if host != *proxy_hostname && wlm.Check(userIP, Site{
467 | URL: ctx.Req.URL,
468 | Referer: "pressl",
469 | }) {
470 | // don't tear down the SSL session
471 | return &goproxy.ConnectAction{
472 | Action: goproxy.ConnectAccept,
473 | }, host + ":443"
474 | }
475 | return &goproxy.ConnectAction{
476 | Action: goproxy.ConnectMitm,
477 | TLSConfig: goproxy.TLSConfigFromCA(&cert),
478 | }, host + ":443"
479 | })
480 |
481 | go func() {
482 | log.Fatalln(http.ListenAndServe(*http_addr, proxy))
483 | }()
484 |
485 | // listen to the TLS ClientHello but make it a CONNECT request instead
486 | ln, err := net.Listen("tcp", *https_addr)
487 | if err != nil {
488 | log.Fatalf("Error listening for https connections - %v", err)
489 | }
490 | for {
491 | c, err := ln.Accept()
492 | if err != nil {
493 | log.Printf("Error accepting new connection - %v", err)
494 | continue
495 | }
496 | go func(c net.Conn) {
497 | tlsConn, err := vhost.TLS(c)
498 | if err != nil {
499 | log.Printf("Error accepting new connection - %v", err)
500 | }
501 | host := tlsConn.Host()
502 | if host == "" {
503 | log.Printf("Cannot support non-SNI enabled clients, attempting to make an educated guess")
504 | // TODO: add other options than dnsmasq through journald
505 | cmd := exec.Command(
506 | "/usr/bin/sudo",
507 | "/usr/bin/journalctl",
508 | "-n 20",
509 | )
510 | output, err := cmd.CombinedOutput()
511 | if err != nil {
512 | log.Printf("Could not find a recent DNS lookup in the dnsmasq logs - %v", err)
513 | } else {
514 | lines := bufio.NewScanner(bytes.NewReader(output))
515 | requestor, _, _ := net.SplitHostPort(c.RemoteAddr().String())
516 | for lines.Scan() {
517 | if strings.Contains(lines.Text(), requestor) {
518 | split := strings.Split(lines.Text(), " ")
519 | if len(split) >= 7 {
520 | host = split[6]
521 | break
522 | }
523 | }
524 | }
525 | }
526 | if host == "" {
527 | // At this point we're going to error, give the client a hint as to why
528 | host = "yourclientdoesnotsuppportsni"
529 | }
530 | log.Printf("Guessing with %s", host)
531 | }
532 | connectReq := &http.Request{
533 | RemoteAddr: c.RemoteAddr().String(),
534 | Method: "CONNECT",
535 | URL: &url.URL{
536 | Opaque: host,
537 | Host: host,
538 | },
539 | Host: host,
540 | Header: make(http.Header),
541 | }
542 | log.Printf("Making faux CONNECT request with URL - %s", connectReq.URL)
543 | log.Printf("Request.URL.Host - %v", connectReq.URL.Host)
544 | resp := dumbResponseWriter{tlsConn}
545 | proxy.ServeHTTP(resp, connectReq)
546 | }(c)
547 | }
548 | }
549 |
550 | func paths(path string) []string {
551 | data := strings.Split(path, "/")
552 | response := make([]string, 0)
553 | if path == "/" {
554 | return response
555 | }
556 | if len(path) < 1 {
557 | return response
558 | }
559 | if path[0] != '/' {
560 | return response
561 | }
562 | for i := 1; i < len(data); i++ {
563 | response = append([]string{"/" + strings.Join(data[1:i+1], "/")}, response...)
564 | }
565 | return response
566 | }
567 |
568 | func rootDomains(host string) []string {
569 | data := strings.Split(host, ".")
570 | response := make([]string, 0)
571 | if len(data) <= 1 {
572 | return response
573 | }
574 | for i := 0; i < len(data)-1; i++ {
575 | response = append(response, strings.Join(data[i:], "."))
576 | }
577 | return response
578 | }
579 |
580 | // copied/converted from https.go
581 | func dial(proxy *goproxy.ProxyHttpServer, network, addr string) (c net.Conn, err error) {
582 | if proxy.Tr.Dial != nil {
583 | return proxy.Tr.Dial(network, addr)
584 | }
585 | return net.Dial(network, addr)
586 | }
587 |
588 | // copied/converted from https.go
589 | func connectDial(proxy *goproxy.ProxyHttpServer, network, addr string) (c net.Conn, err error) {
590 | if proxy.ConnectDial == nil {
591 | return dial(proxy, network, addr)
592 | }
593 | return proxy.ConnectDial(network, addr)
594 | }
595 |
596 | type dumbResponseWriter struct {
597 | net.Conn
598 | }
599 |
600 | func (dumb dumbResponseWriter) Header() http.Header {
601 | panic("Header() should not be called on this ResponseWriter")
602 | }
603 |
604 | func (dumb dumbResponseWriter) Write(buf []byte) (int, error) {
605 | if bytes.Equal(buf, []byte("HTTP/1.0 200 OK\r\n\r\n")) {
606 | return len(buf), nil // throw away the HTTP OK response from the faux CONNECT request
607 | }
608 | return dumb.Conn.Write(buf)
609 | }
610 |
611 | func (dumb dumbResponseWriter) WriteHeader(code int) {
612 | panic("WriteHeader() should not be called on this ResponseWriter")
613 | }
614 |
615 | func (dumb dumbResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
616 | return dumb, bufio.NewReadWriter(bufio.NewReader(dumb), bufio.NewWriter(dumb)), nil
617 | }
618 |
--------------------------------------------------------------------------------
/transparent_test.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "fmt"
5 | "net/http"
6 | "net/http/httptest"
7 | "net/url"
8 | "os"
9 | "reflect"
10 | "testing"
11 | "time"
12 | )
13 |
14 | func TestPaths(t *testing.T) {
15 | testPaths := []struct {
16 | source string
17 | expected []string
18 | }{
19 | {"/", []string{}},
20 | {"blah", []string{}},
21 | {"/go", []string{"/go"}},
22 | {"/go/be", []string{"/go/be", "/go"}},
23 | {"/go/be/gopher", []string{"/go/be/gopher", "/go/be", "/go"}},
24 | }
25 | for _, tp := range testPaths {
26 | result := paths(tp.source)
27 | if !reflect.DeepEqual(result, tp.expected) {
28 | t.Errorf("on %s, got %v, expected %v", tp.source, result, tp.expected)
29 | }
30 | }
31 | }
32 |
33 | func TestRoots(t *testing.T) {
34 | testRoots := []struct {
35 | source string
36 | expected []string
37 | }{
38 | {"org", []string{}},
39 | {"golang.org", []string{"golang.org"}},
40 | {"me.golang.org", []string{"me.golang.org", "golang.org"}},
41 | {"you.me.golang.org", []string{"you.me.golang.org", "me.golang.org", "golang.org"}},
42 | {"all.you.me.golang.org", []string{"all.you.me.golang.org", "you.me.golang.org", "me.golang.org", "golang.org"}},
43 | }
44 | for _, tr := range testRoots {
45 | result := rootDomains(tr.source)
46 | if !reflect.DeepEqual(result, tr.expected) {
47 | t.Errorf("on %s, got %v, expected %v", tr.source, result, tr.expected)
48 | }
49 | }
50 | }
51 |
52 | func TestExpiresEntry(t *testing.T) {
53 | e := NewEntry("host.com", false, "", "", -time.Hour)
54 | want, got := true, e.Expired(time.Now())
55 | if want != got {
56 | t.Errorf("want = %t, got = %t", want, got)
57 | }
58 | }
59 |
60 | func TestSupercedes(t *testing.T) {
61 | patterns := []Entry{
62 | /*0*/ NewEntry("www.google.com", false, "", "", -time.Hour),
63 | /*1*/ NewEntry("www.google.com", true, "", "", -time.Minute),
64 | /*2*/ NewEntry("other.google.com", true, "", "", -time.Second),
65 | /*3*/ NewEntry("google.com", true, "", "", -time.Millisecond),
66 | /*4*/ NewEntry("explicit.google.com", false, "", "", 0),
67 | /*5*/ NewEntry("wildcard.google.com", true, "", "", 0),
68 | /*6*/ NewEntry("path.com", false, "/path", "", time.Millisecond),
69 | /*7*/ NewEntry("path.com", false, "/path/too", "", time.Second),
70 | /*8*/ NewEntry("travis-ci.org", false, "", "", time.Minute),
71 | /*9*/ NewEntry("com", true, "", "", time.Hour), // this in invalid input, use NewEntry to "clean" it and make it a non-wildcard entry
72 | /*10*/ NewEntry("com", false, "", "", time.Hour*24), // test that this is not added as it is a duplicate
73 | /*11*/ NewEntry("com", false, "/path", "", time.Hour*50), // test that this is not added as it is superceded by path
74 | }
75 | pathAnswers := [][]bool{
76 | // ------------0----1-------2-------3-----4-------5------6------7------8------9-----10-----11
77 | /*0*/ []bool{true, false, false, false, false, false, false, false, false, false, false, false},
78 | /*1*/ []bool{true, true, false, false, false, false, false, false, false, false, false, false},
79 | /*2*/ []bool{false, false, true, false, false, false, false, false, false, false, false, false},
80 | /*3*/ []bool{true, true, true, true, true, true, false, false, false, false, false, false},
81 | /*4*/ []bool{false, false, false, false, true, false, false, false, false, false, false, false},
82 | /*5*/ []bool{false, false, false, false, false, true, false, false, false, false, false, false},
83 | /*6*/ []bool{false, false, false, false, false, false, true, true, false, false, false, false},
84 | /*7*/ []bool{false, false, false, false, false, false, false, true, false, false, false, false},
85 | /*8*/ []bool{false, false, false, false, false, false, false, false, true, false, false, false},
86 | /*9*/ []bool{false, false, false, false, false, false, false, false, false, true, true, true},
87 | /*10*/ []bool{false, false, false, false, false, false, false, false, false, true, true, true},
88 | /*11*/ []bool{false, false, false, false, false, false, false, false, false, false, false, true}}
89 | timeAnswers := [][]bool{
90 | // ------------0----1-------2-------3-----4-------5------6------7------8------9-----10-----11
91 | /*0*/ []bool{true, false, false, false, false, false, false, false, false, false, false, false},
92 | /*1*/ []bool{true, true, false, false, false, false, false, false, false, false, false, false},
93 | /*2*/ []bool{true, true, true, false, false, false, false, false, false, false, false, false},
94 | /*3*/ []bool{true, true, true, true, false, false, false, false, false, false, false, false},
95 | /*4*/ []bool{true, true, true, true, true, true, true, true, true, true, true, true},
96 | /*5*/ []bool{true, true, true, true, true, true, true, true, true, true, true, true},
97 | /*6*/ []bool{true, true, true, true, false, false, true, false, false, false, false, false},
98 | /*7*/ []bool{true, true, true, true, false, false, true, true, false, false, false, false},
99 | /*8*/ []bool{true, true, true, true, false, false, true, true, true, false, false, false},
100 | /*9*/ []bool{true, true, true, true, false, false, true, true, true, true, false, false},
101 | /*10*/ []bool{true, true, true, true, false, false, true, true, true, true, true, false},
102 | /*11*/ []bool{true, true, true, true, false, false, true, true, true, true, true, true},
103 | }
104 | for x := range timeAnswers {
105 | for y := range timeAnswers[x] {
106 | if expected, got := timeAnswers[x][y], patterns[x].timeSupercedes(patterns[y]); expected != got {
107 | if expected {
108 | t.Errorf("TIME: Expected %d to supercede %d", x, y)
109 | } else {
110 | t.Errorf("TIME: Did not expect %d to supercede %d", x, y)
111 | }
112 | }
113 | if expected, got := pathAnswers[x][y], patterns[x].pathSupercedes(patterns[y]); expected != got {
114 | if expected {
115 | t.Errorf("PATH: Expected %d to supercede %d", x, y)
116 | } else {
117 | t.Errorf("PATH: Did not expect %d to supercede %d", x, y)
118 | }
119 | }
120 | }
121 | }
122 | }
123 |
124 | func TestTemplates(t *testing.T) {
125 | fmt.Println()
126 | twm, err := NewMemoryWhitelistManager("tempmem.csv")
127 | if err != nil {
128 | t.Fatalf("Error starting memory whitelist manager - %t", err)
129 | }
130 | defer func() {
131 | twm.file.Close()
132 | os.RemoveAll("tempmem.csv")
133 | }()
134 | patterns := []struct {
135 | val int
136 | e Entry
137 | }{
138 | {1, NewEntry("www.google.com", false, "", "", 0)},
139 | {-1, NewEntry("www.google.com", true, "", "", 0)},
140 | {1, NewEntry("other.google.com", true, "", "", 0)},
141 | {-2, NewEntry("google.com", true, "", "", 0)},
142 | {0, NewEntry("explicit.google.com", false, "", "", 0)},
143 | {0, NewEntry("wildcard.google.com", true, "", "", 0)},
144 | {1, NewEntry("path.com", false, "/path", "", 0)},
145 | {0, NewEntry("path.com", false, "/path/too", "", 0)},
146 | {1, NewEntry("travis-ci.org", false, "", "", 0)},
147 | {1, NewEntry("com", true, "", "", 0)}, // this in invalid input, use NewEntry to "clean" it and make it a non-wildcard entry
148 | {0, NewEntry("com", false, "", "", 0)}, // test that this is not added as it is a duplicate
149 | {0, NewEntry("com", false, "/path", "", 0)}, // test that this is not added as it is superceded by path
150 | }
151 |
152 | testingSites := []struct {
153 | URL string
154 | Check bool
155 | Referer string
156 | }{
157 | {"http://www.google.com", true, "http://referer"},
158 | {"https://www.google.com", true, "http://referer"},
159 | {"http://child.www.google.com", true, "http://referer"},
160 | {"https://child.www.google.com", true, "http://referer"},
161 | {"http://google.com", true, "http://referer"},
162 | {"http://google.com?query=true", true, "http://referer"},
163 | {"http://google.com/?query=true", true, "http://referer"},
164 | {"http://www.google.company", false, "http://referer"},
165 | {"https://www.google.company", false, "http://referer"},
166 | {"http://child.www.google.company", false, "http://referer"},
167 | {"https://child.www.google.company", false, "http://referer"},
168 | {"http://google.company", false, "http://referer"},
169 | {"http://google.company?query=true", false, "http://referer"},
170 | {"http://google.company/?query=true", false, "http://referer"},
171 | {"http://path.com/path?query=true", true, "http://referer"},
172 | {"http://path.com/path/?query=true", true, "http://referer"},
173 | {"http://www.path.com/path?query=true", false, "http://referer"},
174 | {"http://www.path.com/path/?query=true", false, "http://referer"},
175 | {"http://path.com/path/good?query=true", true, "http://referer"},
176 | {"https://path.com/path/good?query=true", true, "http://referer"},
177 | {"http://path.com/path/good/?query=true", true, "http://referer"},
178 | {"http://path.com/falsepath?query=true", false, "http://referer"},
179 | {"http://path.com/falsepath/?query=true", false, "http://referer"},
180 | {"http://path.com/falsepath/", false, "http://referer"},
181 | {"http://path.com/falsepath", false, "http://referer"},
182 | {"http://path.com/pathfalse?query=true", false, "http://referer"},
183 | {"http://path.com/pathfalse/?query=true", false, "http://referer"},
184 | {"http://path.com/pathfalse/", false, "http://referer"},
185 | {"http://path.com/pathfalse", false, "http://referer"},
186 | {"http://path.com/", false, "http://referer"},
187 | {"http://path.com", false, "http://referer"},
188 | {"http://travis-ci.org", true, "http://referer"},
189 | {"https://travis-ci.org", true, "http://referer"},
190 | {"http://www.travis-ci.org", false, "http://referer"},
191 | {"http://www.mdlottery.com", false, "http://referer"},
192 | }
193 | for _, p := range patterns {
194 | wlm.Add(dummyIP, "", p.e, false)
195 | }
196 | for j, s := range testingSites {
197 | u, _ := url.Parse(s.URL)
198 | result := wlm.Check(dummyIP, Site{URL: u, Referer: s.Referer})
199 | if result != s.Check {
200 | t.Errorf("[%d] For URL %s - expected %t, got %t", j, u, s.Check, result)
201 | }
202 | }
203 | templates := []string{
204 | "/auth",
205 | "/list",
206 | "/current",
207 | }
208 | for _, n := range templates {
209 | w := httptest.NewRecorder()
210 | req, _ := http.NewRequest("get", n, nil)
211 | req.RemoteAddr = "127.0.0.1:5000"
212 | whitelistService(req, nil)
213 | if w.Code != http.StatusOK {
214 | t.Errorf("Error displaying %s - %s", n, w.Body.String())
215 | }
216 | }
217 | }
218 |
--------------------------------------------------------------------------------
/zone.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "bufio"
5 | "encoding/json"
6 | "fmt"
7 | "io"
8 | "log"
9 | "net"
10 | "os"
11 | "strconv"
12 | "strings"
13 | )
14 |
15 | type Zone struct {
16 | User string // username to require for authentication
17 | Net net.IPNet // nil means everything
18 | Whitelist string // filename of whitelist
19 | wlm *MemoryWhitelistManager `json:"-"`
20 | }
21 |
22 | func (z *Zone) UnmarshalJSON(data []byte) error {
23 | var tmp struct {
24 | User string
25 | Network string
26 | Whitelist string
27 | }
28 | err := json.Unmarshal(data, &tmp)
29 | if err != nil {
30 | return err
31 | }
32 | z.User = tmp.User
33 | z.Whitelist = tmp.Whitelist
34 | _, tmpNet, err := net.ParseCIDR(tmp.Network)
35 | z.Net = *tmpNet
36 | return err
37 | }
38 |
39 | func (z Zone) contains(ip net.IP) bool {
40 | return z.Net.Contains(ip)
41 | }
42 |
43 | func (zm ZoneManager) find(ip net.IP) *Zone { // returns nil on no match
44 | for x := range zm {
45 | if zm[x].contains(ip) {
46 | return zm[x]
47 | }
48 | }
49 | return nil
50 | }
51 |
52 | type AuthenticationError string
53 | type AuthorizationError string
54 | type NoMatchingZone string
55 |
56 | func (nmz NoMatchingZone) Error() string {
57 | return string(nmz)
58 | }
59 |
60 | func (ae AuthenticationError) Error() string {
61 | return string(ae)
62 | }
63 |
64 | func (ae AuthorizationError) Error() string {
65 | return string(ae)
66 | }
67 |
68 | func (zm ZoneManager) Add(ip net.IP, user string, e Entry, authRequired bool) error {
69 | zone := zm.find(ip)
70 | if zone == nil {
71 | return NoMatchingZone(fmt.Sprintf("Network %s not found in any zone", ip))
72 | }
73 | if authRequired {
74 | if user == "" {
75 | return AuthenticationError(fmt.Sprintf("Authentication is required to add a site in network %s", zone.Net))
76 | }
77 | found := zone.User == ""
78 | authorizedUsers := strings.Split(zone.User, ",")
79 | for _, au := range authorizedUsers {
80 | if au == user {
81 | found = true
82 | break
83 | }
84 | }
85 | if !found {
86 | return AuthorizationError(fmt.Sprintf("User %s not authorized to add site in network %s, only one of [%s] is allowed", user, zone.Net, zone.User))
87 | }
88 | }
89 | zone.wlm.Add(ip, user, e, authRequired)
90 | return nil
91 | }
92 |
93 | func (zm ZoneManager) Check(ip net.IP, site Site) bool {
94 | zone := zm.find(ip)
95 | if zone == nil {
96 | return false // if no zones match, deny
97 | }
98 | // err can occur when no port # is found, host is empty string in that case
99 | host, port, err := net.SplitHostPort(site.URL.Host)
100 | if err == nil {
101 | site.URL.Host = host
102 | }
103 | if port != "" {
104 | portNum, err := strconv.Atoi(port)
105 | if err != nil {
106 | log.Printf("Invalid port number - %s - %v", port, err)
107 | return false
108 | }
109 | if portNum != 80 && portNum != 443 {
110 | log.Printf("This proxy only supports traffic on port 80 and 443")
111 | return false
112 | }
113 | }
114 | return zone.wlm.Check(ip, site)
115 | }
116 |
117 | func (zm ZoneManager) RecentBlocks(ip net.IP, num int) []Site {
118 | zone := zm.find(ip)
119 | if zone == nil {
120 | return []Site{}
121 | }
122 | return zone.wlm.RecentBlocks(ip, num)
123 | }
124 |
125 | func (zm ZoneManager) Current(ip net.IP) []Entry {
126 | zone := zm.find(ip)
127 | if zone == nil {
128 | return []Entry{} // if no zones match, return an empty list
129 | }
130 | return zone.wlm.Current(ip)
131 | }
132 |
133 | type ZoneManager []*Zone
134 |
135 | func NewZoneManager(filename string) (ZoneManager, error) {
136 | zm := make(ZoneManager, 0, 8) // optimize for 8 zones
137 | tmp, err := os.Open(filename)
138 | if err != nil {
139 | return zm, err
140 | }
141 | r := bufio.NewReader(tmp)
142 | for {
143 | val, err := r.ReadBytes('\n')
144 | if err == io.EOF {
145 | break
146 | }
147 | if err != nil {
148 | return zm, err
149 | }
150 | zone := Zone{}
151 | err = json.Unmarshal(val, &zone)
152 | if err != nil {
153 | log.Printf("Error reading input - %s", val)
154 | return zm, err
155 | }
156 | zone.wlm, err = NewMemoryWhitelistManager(zone.Whitelist)
157 | if err != nil {
158 | return zm, err
159 | }
160 | zm = append(zm, &zone)
161 | }
162 | return zm, nil
163 | }
164 |
--------------------------------------------------------------------------------
/zone_test.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "io/ioutil"
5 | "net"
6 | "net/url"
7 | "reflect"
8 | "testing"
9 | )
10 |
11 | func TestZones(t *testing.T) {
12 | zoneBufs := []string{
13 | "{\"User\":\"ab\",\"Network\":\"10.10.10.0/24\",\"Whitelist\":\"ab.json\"}",
14 | "{\"User\":\"cd\",\"Network\":\"10.10.0.0/16\",\"Whitelist\":\"cd.json\"}",
15 | "{\"User\":\"\",\"Network\":\"172.16.0.0/12\",\"Whitelist\":\"guest.json\"}",
16 | }
17 | zones := []Zone{
18 | {User: "ab", Net: net.IPNet{IP: []byte{10, 10, 10, 0}, Mask: []byte{255, 255, 255, 0}}, Whitelist: "ab.json"},
19 | {User: "cd", Net: net.IPNet{IP: []byte{10, 10, 0, 0}, Mask: []byte{255, 255, 0, 0}}, Whitelist: "cd.json"},
20 | {User: "", Net: net.IPNet{IP: []byte{172, 16, 0, 0}, Mask: []byte{255, 240, 0, 0}}, Whitelist: "guest.json"},
21 | }
22 | for x, buf := range zoneBufs {
23 | z := Zone{}
24 | err := (&z).UnmarshalJSON([]byte(buf))
25 | if err != nil {
26 | t.Errorf("%d - unexpected error - %v", x, err)
27 | }
28 | if want, got := zones[x], z; !reflect.DeepEqual(want, got) {
29 | t.Errorf("%d - wanted %#v, got %#v", x, want, got)
30 | }
31 | }
32 | iptests := []struct {
33 | ip net.IP
34 | isin []bool
35 | }{
36 | {net.IP{10, 10, 10, 0}, []bool{true, true, false}},
37 | {net.IP{192, 168, 1, 1}, []bool{false, false, false}},
38 | {net.IP{1, 1, 1, 1}, []bool{false, false, false}},
39 | {net.IP{10, 10, 1, 1}, []bool{false, true, false}},
40 | {net.IP{172, 16, 1, 1}, []bool{false, false, true}},
41 | }
42 | for x := range iptests {
43 | for y := range iptests[x].isin {
44 | if want, got := iptests[x].isin[y], zones[y].contains(iptests[x].ip); want != got {
45 | t.Errorf("want %t, got %t - ip %s in zone %s", want, got, iptests[x].ip, zones[y].Net)
46 | }
47 | }
48 | }
49 | }
50 |
51 | func TestZoneManager(t *testing.T) {
52 | ioutil.WriteFile("zonemanagertests/zm.json", []byte(`{"User":"ab","Network":"10.10.10.0/24","Whitelist":"zonemanagertests/ab.json"}
53 | {"User":"cd","Network":"10.10.0.0/16","Whitelist":"zonemanagertests/cd.json"}
54 | {"User":"","Network":"10.0.0.0/8","Whitelist":"zonemanagertests/guest.json"}
55 | {"User":"one,two,three","Network":"172.16.0.0/12","Whitelist":"zonemanagertests/multiple.json"}
56 | `), 0666)
57 | ioutil.WriteFile("zonemanagertests/ab.json", []byte(`{"Host":"ab.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T09:19:19.195701657-05:00","Expires":"2015-02-02T09:19:19.195701657-05:00"}
58 | `), 0666)
59 | ioutil.WriteFile("zonemanagertests/cd.json", []byte(`{"Host":"cd.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T09:19:19.195701657-05:00","Expires":"2015-02-02T09:19:19.195701657-05:00"}
60 | `), 0666)
61 | ioutil.WriteFile("zonemanagertests/guest.json", []byte(`{"Host":"guest.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T09:19:19.195701657-05:00","Expires":"2015-02-02T09:19:19.195701657-05:00"}
62 | `), 0666)
63 | ioutil.WriteFile("zonemanagertests/multiple.json", []byte(`{"Host":"multiple.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T09:19:19.195701657-05:00","Expires":"2015-02-02T09:19:19.195701657-05:00"}
64 | `), 0666)
65 |
66 | zm, err := NewZoneManager("zonemanagertests/zm.json")
67 | if err != nil {
68 | t.Fatalf("%v", err)
69 | }
70 | testingSites := []struct {
71 | ip net.IP
72 | url string
73 | check bool
74 | numBlocks int
75 | }{
76 | {net.IP{10, 10, 10, 0}, "http://ab.com", true, 0},
77 | {net.IP{10, 10, 10, 0}, "http://cd.com", false, 1},
78 | {net.IP{10, 10, 1, 0}, "http://ab.com", false, 1},
79 | {net.IP{10, 10, 1, 0}, "http://cd.com", true, 1},
80 | {net.IP{10, 168, 1, 1}, "http://guest.com", true, 0},
81 | {net.IP{10, 168, 1, 1}, "http://guest.com:80", true, 0},
82 | {net.IP{10, 168, 1, 1}, "http://guest.com:443", true, 0},
83 | {net.IP{10, 168, 1, 1}, "http://guest.com:2000", false, 0},
84 | {net.IP{10, 168, 1, 1}, "http://fail.com", false, 1},
85 | {net.IP{172, 16, 1, 1}, "http://fail.com", false, 1},
86 | }
87 |
88 | for j, s := range testingSites {
89 | u, _ := url.Parse(s.url)
90 | if want, got := s.check, zm.Check(s.ip, Site{URL: u}); want != got {
91 | t.Errorf("[%d] For URL %s - wanted %t, got %t", j, u, want, got)
92 | }
93 | if want, got := s.numBlocks, len(zm.RecentBlocks(s.ip, 50)); want != got {
94 | t.Errorf("[%d] - # of blocks wanted %v, got %v", j, want, got)
95 | }
96 | t.Logf("Current blocks are:")
97 | for _, block := range zm.RecentBlocks(s.ip, 50) {
98 | t.Log(block)
99 | }
100 | t.Logf("Current entries are:")
101 | for _, entry := range zm.Current(s.ip) {
102 | t.Log(entry)
103 | }
104 | }
105 | testingAdds := []struct {
106 | ip net.IP
107 | user string
108 | requireAuth bool
109 | err error
110 | }{
111 | {net.IP{1, 1, 1, 1}, "", true, NoMatchingZone("")},
112 | {net.IP{1, 1, 1, 1}, "", false, NoMatchingZone("")},
113 | {net.IP{10, 1, 1, 1}, "", false, nil}, // no user auth requirements
114 | {net.IP{10, 1, 1, 1}, "", true, AuthenticationError("")}, // User's required to be authenticated, but no listed users
115 | {net.IP{10, 10, 1, 1}, "", true, AuthenticationError("")},
116 | {net.IP{10, 10, 1, 1}, "wronguser", true, AuthorizationError("")},
117 | {net.IP{10, 10, 1, 1}, "cd", true, nil},
118 | {net.IP{172, 16, 1, 1}, "two", true, nil},
119 | }
120 | for x, ta := range testingAdds {
121 | err = zm.Add(ta.ip, ta.user, NewEntry("host.com", false, "", "", 0), ta.requireAuth)
122 | switch ta.err.(type) {
123 | case NoMatchingZone:
124 | if _, ok := err.(NoMatchingZone); !ok {
125 | t.Errorf("[%d] - expected NoMatchingZoneError - %v", x, err)
126 | }
127 | case AuthenticationError:
128 | if _, ok := err.(AuthenticationError); !ok {
129 | t.Errorf("[%d] - expected AuthenticationError - %v", x, err)
130 | }
131 | case AuthorizationError:
132 | if _, ok := err.(AuthorizationError); !ok {
133 | t.Errorf("[%d] - expected AuthorizationError - %v", x, err)
134 | }
135 | default:
136 | if err != nil {
137 | t.Errorf("[%d] - expected nil, got %v", x, err)
138 | }
139 | }
140 | }
141 | }
142 |
--------------------------------------------------------------------------------
/zonemanagertests/ab.json:
--------------------------------------------------------------------------------
1 | {"Host":"ab.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T09:19:19.195701657-05:00","Expires":"2015-02-02T09:19:19.195701657-05:00"}
2 |
--------------------------------------------------------------------------------
/zonemanagertests/cd.json:
--------------------------------------------------------------------------------
1 | {"Host":"cd.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T09:19:19.195701657-05:00","Expires":"2015-02-02T09:19:19.195701657-05:00"}
2 | {"Host":"host.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T14:36:21.953691575-05:00","Expires":"2015-02-02T14:36:21.953691575-05:00"}
3 |
--------------------------------------------------------------------------------
/zonemanagertests/guest.json:
--------------------------------------------------------------------------------
1 | {"Host":"guest.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T09:19:19.195701657-05:00","Expires":"2015-02-02T09:19:19.195701657-05:00"}
2 | {"Host":"host.com","MatchSubdomains":false,"Path":"","Creator":"","Created":"2015-02-02T14:36:21.95358784-05:00","Expires":"2015-02-02T14:36:21.95358784-05:00"}
3 |
--------------------------------------------------------------------------------
/zonemanagertests/zm.json:
--------------------------------------------------------------------------------
1 | {"User":"ab","Network":"10.10.10.0/24","Whitelist":"zonemanagertests/ab.json"}
2 | {"User":"cd","Network":"10.10.0.0/16","Whitelist":"zonemanagertests/cd.json"}
3 | {"User":"","Network":"10.0.0.0/8","Whitelist":"zonemanagertests/guest.json"}
4 | {"User":"one,two,three","Network":"172.16.0.0/12","Whitelist":"zonemanagertests/multiple.json"}
5 |
--------------------------------------------------------------------------------