Simple IP-ACL

README.md

@@ -172,6 +172,10 @@ socksRules:
   # redirect all to socks server
   - host: "*"
     proxy: socks
+# list of IPs who is allowed to connect. If empty - everybody is allowed
+acl:
+  - 127.0.0.1
+  - 192.168.0.1
 ```
 
 ### Help
@@ -200,6 +204,7 @@ Options:
                                  domain is automatically expanded to .EXAMPLE.COM when set from command line
                                  can also replace user in configuration file, when there is only one user defined
           --timeout TIMEOUT      automatically stop kpx after TIMEOUT seconds, when run without config file, defaults to 3600s = 1h (set to 0 to disable)
+          --acl=<ips>            list of comma-separated IPs, who is allowed to connect
       -e, --encrypt              encrypt a password, encryption key location is kpx.key
       -d, --debug                run in debug mode, displaying all headers
       -t, --trace                run in trace mode, displaying everything
@@ -361,6 +366,11 @@ domains:
   EUR: EUR.MSD.WORLD.COMPANY
   ASI: ASI.MSD.WORLD.COMPANY
   AME: AME.MSD.WORLD.COMPANY
+
+# list of IPs who is allowed to connect. If empty - everybody is allowed
+acl:
+  - 127.0.0.1
+  - 192.168.0.1
 ```
 
 ### Notes

config.go

@@ -124,6 +124,8 @@ func (c *Config) readFromConfig() error {
 		Proxy: &proxyName,
 	}
 
+	c.conf.ACL = options.ACL
+
 	return nil
 }
 
@@ -997,9 +999,10 @@ type Conf struct {
 	Update                      bool
 	Restart                     bool
 	UseEnvProxy                 bool
-	Experimental                string // space/comma separated list of features
-	experimentalConnectionPools bool   // add a connection pool for http
-	experimentalHostsCache      bool   // add a hosts cache for proxy lookup - fine grained url lookup is then disabled
+	Experimental                string   // space/comma separated list of features
+	experimentalConnectionPools bool     // add a connection pool for http
+	experimentalHostsCache      bool     // add a hosts cache for proxy lookup - fine grained url lookup is then disabled
+	ACL                         []string `yaml:"acl"` //comma-separated list of allowed IPs. If empty everybody is allowed
 }
 
 type ConfCred struct {

global.go

@@ -63,6 +63,7 @@ type Options struct {
 	Debug       bool
 	Trace       bool
 	Verbose     bool
+	ACL         []string
 
 	bindHost  string
 	bindPort  int

go.mod

@@ -1,8 +1,8 @@
 module github.com/momiji/kpx
 
-go 1.22
+go 1.22.0
 
-toolchain go1.22.2
+toolchain go1.23.4
 
 replace github.com/jcmturner/gokrb5/v8 v8.4.4 => github.com/momiji/gokrb5/v8 v8.4.4-x0
 
@@ -17,6 +17,7 @@ require (
 	github.com/palantir/stacktrace v0.0.0-20161112013806-78658fd2d177
 	github.com/txthinking/socks5 v0.0.0-20230325130024-4230056ae301
 	golang.org/x/crypto v0.27.0
+	golang.org/x/exp v0.0.0-20241204233417-43b7b7cde48d
 	golang.org/x/net v0.29.0
 	golang.org/x/text v0.18.0
 	gopkg.in/yaml.v2 v2.4.0

go.sum

@@ -71,10 +71,12 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
 golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+golang.org/x/exp v0.0.0-20241204233417-43b7b7cde48d h1:0olWaB5pg3+oychR51GUVCEsGkeCU/2JxjBgIo4f3M0=
+golang.org/x/exp v0.0.0-20241204233417-43b7b7cde48d/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
@@ -87,8 +89,8 @@ golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -115,8 +117,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
+golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

main.go

@@ -42,6 +42,7 @@ Options:
                                  ! domain is case-sensitive in Kerberos, however it is uppercased as all internet usage seems to be uppercase
                                  domain is automatically expanded to {{.AppDefaultDomain}} when set from command line
                                  can also replace user in configuration file, when there is only one user defined
+	      --acl=<ips>            list of comma-separated IPs, who is allowed to connect
           --timeout TIMEOUT      automatically stop {{.AppName}} after TIMEOUT seconds, when run without config file, defaults to 3600s = 1h (set to 0 to disable)
       -e, --encrypt              encrypt a password, encryption key location is {{.AppName}}.key  
       -d, --debug                run in debug mode, displaying all headers
@@ -206,6 +207,11 @@ domains:
   EUR: EUR.MSD.WORLD.COMPANY
   ASI: ASI.MSD.WORLD.COMPANY
   AME: AME.MSD.WORLD.COMPANY
+
+# list of IPs who is allowed to connect. If empty - everybody is allowed
+acl:
+  - 127.0.0.1
+  - 192.168.0.1
 `
 
 func Main() {
@@ -268,6 +274,9 @@ func cmd() {
 	flag.BoolVar(&options.ShowHelp, "help", false, "")
 	flag.BoolVar(&options.ShowVersion, "V", false, "")
 	flag.BoolVar(&options.ShowVersion, "version", false, "")
+	var acl string
+	flag.StringVar(&acl, "acl", "", "")
+	options.ACL = strings.Split(acl, ",")
 	flag.Parse()
 	args := flag.Args()
 

proxy.go

@@ -3,17 +3,20 @@ package kpx
 import (
 	"container/list"
 	"fmt"
-	"github.com/txthinking/socks5"
 	"math"
 	"net"
 	"os"
 	"path"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
 
+	"github.com/txthinking/socks5"
+
 	"github.com/fsnotify/fsnotify"
 	"github.com/palantir/stacktrace"
+	"golang.org/x/exp/slices"
 )
 
 type Proxy struct {
@@ -276,6 +279,12 @@ func (p *Proxy) run() error {
 				if err != nil {
 					continue
 				}
+				if config.conf.ACL != nil {
+					if !slices.Contains(config.conf.ACL, strings.Split(conn.RemoteAddr().String(), ":")[0]) {
+						conn.Close()
+						continue
+					}
+				}
 				ConfigureConn(conn)
 				if p.stopped() {
 					_ = conn.Close() // force closing client, ignore any error