Ability to dynamically control list of spying domains

diff --git a/caches/caches.go b/caches/caches.go
index f451da46a1183b9cc9ba16f2ed23c28b1da20dd8..39dfd3451d51f55e3a0d07be1de5c13ef5b5e2b6 100644 (file)
--- a/caches/caches.go
+++ b/caches/caches.go
@@ -17,4 +17,7 @@ var (
 
        TLSAuthCache  = make(map[string]*tls.Certificate)
        TLSAuthCacheM sync.RWMutex
+
+       Spies  = make([]string, 0)
+       SpiesM sync.RWMutex
 )

diff --git a/doc/usage.texi b/doc/usage.texi
index 8942839df9863b2fc6b8bd443ce15760651a5d75..eb88636dcf3e104a627df3078d3310ff1aa3bb51 100644 (file)
--- a/doc/usage.texi
+++ b/doc/usage.texi
@@ -52,6 +52,13 @@ main.go:70: listening: [::1]:8080 dns: [::1]:53 certs: ./certs ccerts: ./ccerts
 If you want to use TLS client certificates, then place them to
 @file{-ccerts} directory.
 
+@item
+Load spying domains to reject to with:
+
+@example
+$ cat spies.txt > fifos/add-spies
+@end example
+
 @item Watch logs:
 
 @example

diff --git a/fifos/ensure.do b/fifos/ensure.do
index 5e5cc7e143f3492851490584d7f3b49f003308d0..6af361f4adab2500b59e4968880855ba3cb32a32 100644 (file)
--- a/fifos/ensure.do
+++ b/fifos/ensure.do
@@ -1,7 +1,8 @@
 for f in cert dane err http-auth non-ok ok redir req tls tls-auth various ; do
     [ -p log-$f ] || mkfifo log-$f
 done
-for f in accepted http-auth rejected tls-auth ; do
+for f in accepted http-auth rejected spies tls-auth ; do
     [ -p list-$f ] || mkfifo list-$f
     [ -p del-$f ] || mkfifo del-$f
 done
+[ -p add-spies ] || mkfifo add-spies

diff --git a/fifos/spies.go b/fifos/spies.go
new file mode 100644 (file)
index 0000000..0b6aa57
--- /dev/null
+++ b/fifos/spies.go
@@ -0,0 +1,73 @@
+/*
+tofuproxy -- HTTP proxy with TLS certificates management
+Copyright (C) 2021 Sergey Matveev <stargrave@stargrave.org>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, version 3 of the License.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+package fifos
+
+import (
+       "bufio"
+       "log"
+       "os"
+
+       "go.stargrave.org/tofuproxy/caches"
+)
+
+func listSpies(p string) {
+       for {
+               fd, err := os.OpenFile(p, os.O_WRONLY|os.O_APPEND, os.FileMode(0666))
+               if err != nil {
+                       log.Fatalln(err)
+               }
+               caches.SpiesM.RLock()
+               for _, spy := range caches.Spies {
+                       if _, err = fd.WriteString(spy + "\n"); err != nil {
+                               break
+                       }
+               }
+               caches.SpiesM.RUnlock()
+               fd.Close()
+       }
+}
+
+func addSpy(p string) {
+       for {
+               fd, err := os.OpenFile(p, os.O_RDONLY, os.FileMode(0666))
+               if err != nil {
+                       log.Fatalln(err)
+               }
+               hosts := make(map[string]struct{})
+               scanner := bufio.NewScanner(fd)
+               for scanner.Scan() {
+                       t := scanner.Text()
+                       if len(t) > 0 {
+                               hosts[t] = struct{}{}
+                       }
+               }
+               fd.Close()
+               for host := range hosts {
+                       log.Printf("%s: adding host %s\n", p, host)
+               }
+               caches.SpiesM.Lock()
+               for _, spy := range caches.Spies {
+                       hosts[spy] = struct{}{}
+               }
+               caches.Spies = caches.Spies[:0]
+               for host := range hosts {
+                       caches.Spies = append(caches.Spies, host)
+               }
+               caches.SpiesM.Unlock()
+       }
+}

diff --git a/fifos/start.go b/fifos/start.go
index f37abe632cac8ababa37282c71f95105e93ae7a0..a005c640036e5503054ef7e9aa52738f5736be81 100644 (file)
--- a/fifos/start.go
+++ b/fifos/start.go
@@ -22,6 +22,7 @@ func Start(fifos string) {
        go listAccepted(filepath.Join(fifos, "list-accepted"))
        go listHTTPAuth(filepath.Join(fifos, "list-http-auth"))
        go listRejected(filepath.Join(fifos, "list-rejected"))
+       go listSpies(filepath.Join(fifos, "list-spies"))
        go listTLSAuth(filepath.Join(fifos, "list-tls-auth"))
 
        go del(
@@ -40,4 +41,18 @@ func Start(fifos string) {
                &caches.TLSAuthCacheM, func(host string) { delete(caches.TLSAuthCache, host) },
                filepath.Join(fifos, "del-tls-auth"),
        )
+
+       go addSpy(filepath.Join(fifos, "add-spies"))
+       go del(
+               &caches.SpiesM, func(host string) {
+                       for i, spy := range caches.Spies {
+                               if spy == host {
+                                       caches.Spies[i] = caches.Spies[len(caches.Spies)-1]
+                                       caches.Spies = caches.Spies[:len(caches.Spies)-1]
+                                       return
+                               }
+                       }
+               },
+               filepath.Join(fifos, "del-spies"),
+       )
 }

diff --git a/rounds/spy.go b/rounds/spy.go
index cb12480d40390be491131234a812707e5e02f99f..e830701c5bef90715c38e694a131f38fd12069dd 100644 (file)
--- a/rounds/spy.go
+++ b/rounds/spy.go
@@ -22,31 +22,14 @@ import (
        "net/http"
        "strings"
 
+       "go.stargrave.org/tofuproxy/caches"
        "go.stargrave.org/tofuproxy/fifos"
 )
 
-var spyDomains = []string{
-       "google-analytics.com",
-       "goo.gl",
-       "ads.google.com",
-       "googletagmanager.com",
-       "facebook.com",
-       "facebook.net",
-       "fbcdn.com",
-       "fbcdn.net",
-       "advertising.yandex.ru",
-       "an.yandex.ru",
-       "awaps.yandex.ru",
-       "bs.yandex.ru",
-       "informer.yandex.ru",
-       "mc.yandex.ru",
-       "metrika.yandex.ru",
-       "doubleclick.net",
-       "tns-counter.ru",
-}
-
 func IsSpy(host string) bool {
-       for _, spy := range spyDomains {
+       caches.SpiesM.RLock()
+       defer caches.SpiesM.RUnlock()
+       for _, spy := range caches.Spies {
                if strings.HasSuffix(host, spy) {
                        return true
                }

diff --git a/spies.txt b/spies.txt
new file mode 100644 (file)
index 0000000..73887a3
--- /dev/null
+++ b/spies.txt
@@ -0,0 +1,18 @@
+google-analytics.com
+goo.gl
+ads.google.com
+googletagmanager.com
+facebook.com
+facebook.net
+fbcdn.com
+fbcdn.net
+advertising.yandex.ru
+an.yandex.ru
+awaps.yandex.ru
+bs.yandex.ru
+informer.yandex.ru
+mc.yandex.ru
+metrika.yandex.ru
+doubleclick.net
+tns-counter.ru
+counter.rambler.ru