checker: Add new firewall tests

checker/checker.go

@@ -85,7 +85,7 @@ func studentChecker(std *adlin.Student, also_check_matrix bool, offline bool) {
 			}
 
 			// PingResolver
-			if tunnel_version == 3 {
+			if has_test(CheckMap[tunnel_version], PingResolver) {
 				tmp := strings.Split(stdIP, ":")
 				tmp[len(tmp)-1] = "2"
 				stdResolverIP := strings.Join(tmp, ":")
@@ -99,6 +99,23 @@ func studentChecker(std *adlin.Student, also_check_matrix bool, offline bool) {
 				})
 			}
 
+			// Firewalled
+			if has_test(CheckMap[tunnel_version], Firewalled) {
+				if err = check_firewall("tcp", stdIP); err == nil {
+					if verbose {
+						log.Printf("%s just unlocked firewalled challenge\n", std.Login)
+					}
+					if _, err := std.UnlockChallenge(CheckMap[tunnel_version][Firewalled], ""); err != nil {
+						log.Printf("Unable to register challenge for %s: %s\n", std.Login, err.Error())
+					}
+				} else {
+					std.RegisterChallengeError(CheckMap[tunnel_version][Firewalled], err)
+					if verbose {
+						log.Printf("%s and firewalled: %s\n", std.Login, err)
+					}
+				}
+			}
+
 			dnsIP := stdIP
 			var glueErr error
 			// Is GLUE defined?
@@ -197,6 +214,7 @@ func studentChecker(std *adlin.Student, also_check_matrix bool, offline bool) {
 
 					// Check Matrix (only if GLUE Ok and defer contraint)
 					if glueErr == nil && also_check_matrix {
+						if has_test(CheckMap[tunnel_version], MatrixSrv) {
 							// Check Matrix Federation first
 							if v, err := check_matrix_federation(std.MyDelegatedDomain()); err == nil {
 								if verbose {
@@ -211,8 +229,10 @@ func studentChecker(std *adlin.Student, also_check_matrix bool, offline bool) {
 									log.Printf("%s and Matrix federation: %s\n", std.Login, err)
 								}
 							}
+						}
 
 						// Check Matrix Client
+						if has_test(CheckMap[tunnel_version], MatrixClt) {
 							if v, err := check_matrix_client(std.MyDelegatedDomain()); err == nil {
 								if verbose {
 									log.Printf("%s just unlocked Matrix client challenge\n", std.Login)
@@ -227,6 +247,7 @@ func studentChecker(std *adlin.Student, also_check_matrix bool, offline bool) {
 								}
 							}
 						}
+					}
 
 					// Check DNSSEC (only if GLUE Ok)
 					if glueErr == nil {

checker/checks.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"log"
+	"math/rand"
 	"net"
 	"net/http"
 	"net/url"
@@ -21,7 +22,8 @@ import (
 type AdlinTest int
 
 const (
-	HTTPonIP AdlinTest = iota
+	Firewalled AdlinTest = iota
+	HTTPonIP
 	HTTPonAssociatedDomain
 	HTTPSonAssociatedDomain
 	DNSDelegation
@@ -44,6 +46,7 @@ const (
 
 var CheckMap = map[int]map[AdlinTest]int{
 	2: map[AdlinTest]int{
+		Firewalled:              100,
 		HTTPonIP:                101,
 		HTTPonAssociatedDomain:  102,
 		HTTPSonAssociatedDomain: 103,
@@ -53,7 +56,8 @@ var CheckMap = map[int]map[AdlinTest]int{
 		HTTPSSNI:                107,
 		DNSSEC:                  110,
 	},
-	3: map[AdlinTest]int{
+	/*2: map[AdlinTest]int{
+		Firewalled:              200,
 		HTTPonIP:                201,
 		HTTPonAssociatedDomain:  202,
 		HTTPSonAssociatedDomain: 203,
@@ -64,8 +68,8 @@ var CheckMap = map[int]map[AdlinTest]int{
 		MatrixSrv:               208,
 		MatrixClt:               209,
 		DNSSEC:                  210,
-	},
-	4: map[AdlinTest]int{
+	},*/
+	3: map[AdlinTest]int{
 		PingResolver:           300,
 		HTTPonIP:               301,
 		DNSDelegation:          303,
@@ -83,6 +87,15 @@ var CheckMap = map[int]map[AdlinTest]int{
 	},
 }
 
+func has_test(m map[AdlinTest]int, test AdlinTest) bool {
+	for k := range m {
+		if k == test {
+			return true
+		}
+	}
+	return false
+}
+
 // ICMP
 
 func check_ping(ip string, cb func(pkt *ping.Packet)) (err error) {
@@ -105,6 +118,23 @@ func check_ping(ip string, cb func(pkt *ping.Packet)) (err error) {
 	return
 }
 
+func check_firewall(network, ip string) error {
+	port := rand.Int31n(64500) + 1024
+
+	conn, err := net.DialTimeout(network, fmt.Sprintf("[%s]:%d", ip, port), 3*time.Second)
+	if err != nil {
+		if operr, ok := err.(*net.OpError); ok && operr.Timeout() {
+			// We expect a timeout here if the firewall is well setuped
+			return nil
+		}
+
+		return fmt.Errorf("Port %d is not filtered: %s", port, err.Error())
+	}
+
+	conn.Close()
+	return fmt.Errorf("Port %d is open", port)
+}
+
 // PORT 53
 
 func get_GLUE(student *adlin.Student) (aaaa net.IP, err error) {