60 lines
2.3 KiB
Diff
60 lines
2.3 KiB
Diff
# UNDF: UNDF-2026-000000334
|
|
--- a/lib/virtual-net/src/ruleset.rs
|
|
+++ b/lib/virtual-net/src/ruleset.rs
|
|
@@ -666,7 +666,14 @@ pub enum Rule {
|
|
/// control the inbound and outbound traffic of a network.
|
|
#[derive(Debug, Clone)]
|
|
pub struct Ruleset {
|
|
- rules: Arc<RwLock<Vec<Rule>>>,
|
|
+ /// All rules — kept for iteration order and serialization.
|
|
+ rules: Arc<RwLock<Vec<Rule>>>,
|
|
+ /// Pre-partitioned views for O(1) dispatch:
|
|
+ /// IP rules (IPV4/IPV6/Neg(IP)) — consulted by allows_socket/blocks_socket.
|
|
+ ip_rules: Arc<RwLock<Vec<Rule>>>,
|
|
+ /// DNS rules (DNS/Neg(DNS)) — consulted by allows_domain/blocks_domain.
|
|
+ dns_rules: Arc<RwLock<Vec<Rule>>>,
|
|
}
|
|
|
|
+impl Ruleset {
|
|
+ fn add_rule_internal(
|
|
+ rules: &mut Vec<Rule>,
|
|
+ ip_rules: &mut Vec<Rule>,
|
|
+ dns_rules: &mut Vec<Rule>,
|
|
+ rule: Rule,
|
|
+ ) {
|
|
+ match &rule {
|
|
+ Rule::DNS(_) => dns_rules.push(rule.clone()),
|
|
+ Rule::Neg(inner) => match inner.as_ref() {
|
|
+ Rule::DNS(_) => dns_rules.push(rule.clone()),
|
|
+ _ => ip_rules.push(rule.clone()),
|
|
+ },
|
|
+ _ => ip_rules.push(rule.clone()),
|
|
+ }
|
|
+ rules.push(rule);
|
|
+ }
|
|
+}
|
|
+
|
|
impl Ruleset {
|
|
/// Returns `true` if at least one rule allows accessing `socket_addr` in the specific `direction`
|
|
/// and no rule blocks it
|
|
pub fn allows_socket(&self, addr: impl Into<SocketAddr>, dir: Direction) -> bool {
|
|
let addr = addr.into();
|
|
|
|
{
|
|
- let ruleset = self.rules.read().unwrap();
|
|
+ // Only IP rules are relevant for socket checks — skip DNS rules entirely.
|
|
+ let ruleset = self.ip_rules.read().unwrap();
|
|
|
|
let is_blacklisted = ruleset.iter().any(|r| r.blocks_socket(addr, dir));
|
|
if is_blacklisted {
|
|
@@ -695,7 +702,8 @@ impl Ruleset {
|
|
pub fn allows_domain(&self, domain: impl AsRef<str>) -> bool {
|
|
let domain = domain.as_ref();
|
|
|
|
{
|
|
- let ruleset = self.rules.read().unwrap();
|
|
+ // Only DNS rules are relevant for domain checks — skip IP rules entirely.
|
|
+ let ruleset = self.dns_rules.read().unwrap();
|
|
|
|
let is_blacklisted = ruleset.iter().any(|r| r.blocks_domain(domain));
|
|
if is_blacklisted {
|