| 64 | } |
| 65 | |
| 66 | int |
| 67 | CB_Pre_Accept(TSCont, TSEvent event, void *edata) |
| 68 | { |
| 69 | TSVConn ssl_vc = reinterpret_cast<TSVConn>(edata); |
| 70 | IpAddr ip(TSNetVConnLocalAddrGet(ssl_vc)); |
| 71 | char buff[INET6_ADDRSTRLEN]; |
| 72 | IpAddr ip_client(TSNetVConnRemoteAddrGet(ssl_vc)); |
| 73 | char buff2[INET6_ADDRSTRLEN]; |
| 74 | |
| 75 | // Not the worlds most efficient address comparison. For short lists |
| 76 | // shouldn't be too bad. If the client IP is in any of the ranges, |
| 77 | // flip the tunnel to be blind tunneled instead of decrypted and proxied |
| 78 | bool proxy_tunnel = true; |
| 79 | |
| 80 | for (auto const &r : ClientBlindTunnelIp) { |
| 81 | if (r.first <= ip_client && ip_client <= r.second) { |
| 82 | proxy_tunnel = false; |
| 83 | break; |
| 84 | } |
| 85 | } |
| 86 | |
| 87 | if (!proxy_tunnel) { |
| 88 | // Push everything to blind tunnel |
| 89 | TSVConnTunnel(ssl_vc); |
| 90 | } |
| 91 | |
| 92 | Dbg(dbg_ctl, "Pre accept callback %p - event is %s, target address %s, client address %s%s", ssl_vc, |
| 93 | event == TS_EVENT_VCONN_START ? "good" : "bad", ip.toString(buff, sizeof(buff)), ip_client.toString(buff2, sizeof(buff2)), |
| 94 | proxy_tunnel ? "" : " blind tunneled"); |
| 95 | |
| 96 | // All done, reactivate things |
| 97 | TSVConnReenable(ssl_vc); |
| 98 | return TS_SUCCESS; |
| 99 | } |
| 100 | |
| 101 | } // namespace |
| 102 |
nothing calls this directly
no test coverage detected