buildFilter returns the packet filter enforcing what the server is configured to serve: new inbound TCP connections are admitted only to the server's own address (limited to ServedTCPPorts if set), plus to any destination when OnTCPForward is set (exit node mode). Everything else from the tunnel is
()
| 500 | // netstack; the OnTCP/OnTCPForward callbacks remain the |
| 501 | // per-connection gates behind it. |
| 502 | func (s *Server) buildFilter() *filter.Filter { |
| 503 | lb := s.lb |
| 504 | |
| 505 | selfPorts := []filter.PortRange{allTCPPorts} |
| 506 | if s.ServedTCPPorts != nil { |
| 507 | selfPorts = s.ServedTCPPorts |
| 508 | } |
| 509 | var selfDsts []filter.NetPortRange |
| 510 | for _, pr := range selfPorts { |
| 511 | selfDsts = append(selfDsts, filter.NetPortRange{Net: lb.addrPrefix, Ports: pr}) |
| 512 | } |
| 513 | matches := []filter.Match{{ |
| 514 | IPProto: views.SliceOf([]ipproto.Proto{ipproto.TCP}), |
| 515 | Srcs: []netip.Prefix{allIPv6}, |
| 516 | Dsts: selfDsts, |
| 517 | }} |
| 518 | |
| 519 | var localNets netipx.IPSetBuilder |
| 520 | localNets.AddPrefix(lb.addrPrefix) |
| 521 | if s.OnTCPForward != nil { |
| 522 | localNets.AddPrefix(allIPv6) |
| 523 | matches = append(matches, filter.Match{ |
| 524 | IPProto: views.SliceOf([]ipproto.Proto{ipproto.TCP}), |
| 525 | Srcs: []netip.Prefix{allIPv6}, |
| 526 | Dsts: []filter.NetPortRange{{Net: allIPv6, Ports: allTCPPorts}}, |
| 527 | }) |
| 528 | } |
| 529 | local, _ := localNets.IPSet() |
| 530 | return filter.New(matches, nil, local, nil, nil, lb.logf) |
| 531 | } |
| 532 | |
| 533 | // Addr returns the server's IPv6 address derived from its public key. |
| 534 | // It must only be called after [Server.Start]. |