Merge branch 'filter-invalid-endpoints'

1 files changed, 125 insertions, 11 deletions

diff --git a/mullvad-daemon/src/relays/mod.rs b/mullvad-daemon/src/relays/mod.rs
index 0c2aec38fe..edf941f31d 100644
--- a/mullvad-daemon/src/relays/mod.rs
+++ b/mullvad-daemon/src/relays/mod.rs
@@ -105,22 +105,14 @@ impl ParsedRelays {
                         latitude,
                         longitude,
                     });
-
-                    for wg_tunnel in &relay.tunnels.wireguard {
-                        relay_with_location
-                            .tunnels
-                            .wireguard
-                            .push(WireguardEndpointData {
-                                protocol: TransportProtocol::Tcp,
-                                port_ranges: WIREGUARD_TCP_PORTS.to_vec(),
-                                ..wg_tunnel.clone()
-                            });
-                    }
+                    Self::filter_invalid_relays(&mut relay_with_location);
+                    Self::tack_on_wireguard_tcp_relays(&mut relay_with_location.tunnels.wireguard);
 
                     relays.push(relay_with_location);
                 }
             }
         }
+
         ParsedRelays {
             last_updated,
             locations: relay_list,
@@ -128,6 +120,55 @@ impl ParsedRelays {
         }
     }
 
+    fn filter_invalid_relays(relay: &mut Relay) {
+        let total_openvpn_endpoints = relay.tunnels.openvpn.len();
+        let openvpn_endpoints = &mut relay.tunnels.openvpn;
+        openvpn_endpoints.retain(|data| data.port != 0);
+
+        if openvpn_endpoints.len() < total_openvpn_endpoints {
+            log::error!(
+                "Relay {} contained {} invalid OpenVPN endpoints out of {} endpoints",
+                relay.hostname,
+                total_openvpn_endpoints - openvpn_endpoints.len(),
+                total_openvpn_endpoints
+            );
+        }
+
+        let total_wireguard_endpoints = relay.tunnels.wireguard.len();
+        let wireguard_endpoints = &mut relay.tunnels.wireguard;
+        wireguard_endpoints.retain(|data| {
+            !data.port_ranges.is_empty() && data.port_ranges.iter().all(|(start, end)| start <= end)
+        });
+
+        if wireguard_endpoints.len() < total_wireguard_endpoints {
+            log::error!(
+                "Relay {} contained {} invalid WireGuard endpoints out of {} endpoints",
+                relay.hostname,
+                total_wireguard_endpoints - wireguard_endpoints.len(),
+                total_wireguard_endpoints
+            );
+        }
+    }
+
+    /// Add synthesized WireGuard TCP endpoints to a relay
+    fn tack_on_wireguard_tcp_relays(endpoints: &mut Vec<WireguardEndpointData>) {
+        *endpoints = endpoints
+            .iter()
+            .cloned()
+            .map(|udp_endpoint| {
+                [
+                    WireguardEndpointData {
+                        protocol: TransportProtocol::Tcp,
+                        port_ranges: WIREGUARD_TCP_PORTS.to_vec(),
+                        ..udp_endpoint.clone()
+                    },
+                    udp_endpoint,
+                ]
+            })
+            .flatten()
+            .collect();
+    }
+
     pub fn from_file(path: impl AsRef<Path>) -> Result<Self, Error> {
         log::debug!("Reading relays from {}", path.as_ref().display());
         let (last_modified, file) =
@@ -995,6 +1036,53 @@ mod test {
                                     },
                                     location: None,
                                 },
+                                Relay {
+                                    hostname: "se11-wireguard-filtered".to_string(),
+                                    ipv4_addr_in: "185.213.154.69".parse().unwrap(),
+                                    ipv6_addr_in: Some("2a03:1b20:5:f011::a10f".parse().unwrap()),
+                                    include_in_country: true,
+                                    active: true,
+                                    owned: true,
+                                    provider: "31173".to_string(),
+                                    weight: 1,
+                                    tunnels: RelayTunnels {
+                                        openvpn: vec![],
+                                        wireguard: vec![
+                                            WireguardEndpointData {
+                                                port_ranges: vec![],
+                                                ipv4_gateway: "10.64.0.1".parse().unwrap(),
+                                                ipv6_gateway: "fc00:bbbb:bbbb:bb01::1".parse().unwrap(),
+                                                public_key: PublicKey::from_base64("veGD6/aEY6sMfN3Ls7YWPmNgu3AheO7nQqsFT47YSws=").unwrap(),
+                                                protocol: TransportProtocol::Udp,
+                                            },
+                                        ],
+                                    },
+                                    bridges: RelayBridges {
+                                        shadowsocks: vec![],
+                                    },
+                                    location: None,
+                                },
+                                Relay {
+                                    hostname: "se-got-010-filtered".to_string(),
+                                    ipv4_addr_in: "185.213.154.69".parse().unwrap(),
+                                    ipv6_addr_in: Some("2a03:1b20:5:f011::a10f".parse().unwrap()),
+                                    include_in_country: true,
+                                    active: true,
+                                    owned: true,
+                                    provider: "31173".to_string(),
+                                    weight: 1,
+                                    tunnels: RelayTunnels {
+                                        openvpn: vec![OpenVpnEndpointData{
+                                            port: 0,
+                                            protocol: TransportProtocol::Udp,
+                                        }],
+                                        wireguard: vec![],
+                                    },
+                                    bridges: RelayBridges {
+                                        shadowsocks: vec![],
+                                    },
+                                    location: None,
+                                }
                             ],
                         },
                     ],
@@ -1467,4 +1555,30 @@ mod test {
             );
         }
     }
+
+    #[test]
+    fn test_filtering_invalid_endpoint_relays() {
+        let relay_selector = new_relay_selector();
+        let mut constraints = RelayConstraints {
+            location: Constraint::Only(LocationConstraint::Hostname(
+                "se".to_string(),
+                "got".to_string(),
+                "se11-wireguard-filtered".to_string(),
+            )),
+            ..RelayConstraints::default()
+        };
+        relay_selector
+            .get_tunnel_endpoint(&constraints, BridgeState::Off, 0, true)
+            .expect_err("Successfully selected a relay that should be filtered");
+
+        constraints.location = Constraint::Only(LocationConstraint::Hostname(
+            "se".to_string(),
+            "got".to_string(),
+            "se-got-010-filtered".to_string(),
+        ));
+
+        relay_selector
+            .get_tunnel_endpoint(&constraints, BridgeState::Off, 0, true)
+            .expect_err("Successfully selected a relay that should be filtered");
+    }
 }