From 9772a4d04559dc884b30d34c3213f7c9f97f614f Mon Sep 17 00:00:00 2001 From: Meo597 <197331664+Meo597@users.noreply.github.com> Date: Thu, 12 Nov 2026 12:42:47 +0800 Subject: [PATCH] firewall --- app/dns/dns_test.go | 16 ++-- app/proxyman/outbound/handler_test.go | 6 +- app/router/script_test.go | 2 +- core/functions_test.go | 6 +- infra/conf/freedom.go | 46 ++++++---- infra/conf/freedom_test.go | 4 +- proxy/freedom/config.pb.go | 61 +++++++------ proxy/freedom/config.proto | 4 +- proxy/freedom/freedom.go | 86 +++++++++---------- testing/scenarios/command_test.go | 10 +-- testing/scenarios/dokodemo_test.go | 4 +- testing/scenarios/feature_test.go | 18 ++-- testing/scenarios/http_test.go | 12 +-- testing/scenarios/masque_test.go | 2 +- testing/scenarios/metrics_test.go | 2 +- testing/scenarios/policy_test.go | 4 +- testing/scenarios/reverse_test.go | 4 +- testing/scenarios/shadowsocks_2022_test.go | 4 +- testing/scenarios/shadowsocks_test.go | 8 +- testing/scenarios/socks_test.go | 10 +-- testing/scenarios/tls_test.go | 20 ++--- testing/scenarios/transport_test.go | 2 +- testing/scenarios/vless_test.go | 16 ++-- testing/scenarios/vmess_test.go | 20 ++--- testing/scenarios/wireguard_test.go | 2 +- .../internet/finalmask/sudoku/sudoku_test.go | 8 +- 26 files changed, 192 insertions(+), 185 deletions(-) diff --git a/app/dns/dns_test.go b/app/dns/dns_test.go index 8ccfe8407..575fda271 100644 --- a/app/dns/dns_test.go +++ b/app/dns/dns_test.go @@ -148,7 +148,7 @@ func TestUDPServerSubnet(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -210,7 +210,7 @@ func TestUDPServer(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -350,7 +350,7 @@ func TestPrioritizedDomain(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -421,7 +421,7 @@ func TestUDPServerIPv6(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -490,7 +490,7 @@ func TestStaticHostDomain(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -577,7 +577,7 @@ func TestIPMatch(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -696,7 +696,7 @@ func TestLocalDomain(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -953,7 +953,7 @@ func TestMultiMatchPrioritizedDomain(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/app/proxyman/outbound/handler_test.go b/app/proxyman/outbound/handler_test.go index 702944298..b9e6ecfa1 100644 --- a/app/proxyman/outbound/handler_test.go +++ b/app/proxyman/outbound/handler_test.go @@ -48,7 +48,7 @@ func TestOutboundWithoutStatCounter(t *testing.T) { ctx = session.ContextWithOutbounds(ctx, []*session.Outbound{{}}) h, _ := NewHandler(ctx, &core.OutboundHandlerConfig{ Tag: "tag", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }) conn, _ := h.(*Handler).Dial(ctx, net.TCPDestination(net.DomainAddress("localhost"), 13146)) _, ok := conn.(*stat.CounterConnection) @@ -78,7 +78,7 @@ func TestOutboundWithStatCounter(t *testing.T) { ctx = session.ContextWithOutbounds(ctx, []*session.Outbound{{}}) h, _ := NewHandler(ctx, &core.OutboundHandlerConfig{ Tag: "tag", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }) conn, _ := h.(*Handler).Dial(ctx, net.TCPDestination(net.DomainAddress("localhost"), 13146)) _, ok := conn.(*stat.CounterConnection) @@ -117,7 +117,7 @@ func TestTagsCache(t *testing.T) { tag := fmt.Sprintf("%s%d", tags_prefix, idx) cfg := &core.OutboundHandlerConfig{ Tag: tag, - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), } if h, err := NewHandler(ctx, cfg); err == nil { if err := ohm.AddHandler(ctx, h); err == nil { diff --git a/app/router/script_test.go b/app/router/script_test.go index 599ebbf7d..1ab0b5e2b 100644 --- a/app/router/script_test.go +++ b/app/router/script_test.go @@ -399,7 +399,7 @@ end`) Outbound: []*core.OutboundHandlerConfig{ {Tag: "default", ProxySettings: serial.ToTypedMessage(&blackhole.Config{})}, {Tag: "direct", ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, })}, }, }) diff --git a/core/functions_test.go b/core/functions_test.go index e1f13894c..030785dfb 100644 --- a/core/functions_test.go +++ b/core/functions_test.go @@ -53,7 +53,7 @@ func TestXrayDial(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -105,7 +105,7 @@ func TestXrayDialUDPConn(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -174,7 +174,7 @@ func TestXrayDialUDP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/infra/conf/freedom.go b/infra/conf/freedom.go index d825e032b..8e6abe8d9 100644 --- a/infra/conf/freedom.go +++ b/infra/conf/freedom.go @@ -18,16 +18,17 @@ import ( ) type FreedomConfig struct { - TargetStrategy string `json:"targetStrategy"` - DomainStrategy string `json:"domainStrategy"` - Redirect string `json:"redirect"` - UserLevel uint32 `json:"userLevel"` - Fragment *Fragment `json:"fragment"` - Noise *Noise `json:"noise"` - Noises []*Noise `json:"noises"` - ProxyProtocol uint32 `json:"proxyProtocol"` - IPsBlocked *StringList `json:"ipsBlocked"` - FinalRules []*FreedomFinalRuleConfig `json:"finalRules"` + TargetStrategy string `json:"targetStrategy"` + DomainStrategy string `json:"domainStrategy"` + Redirect string `json:"redirect"` + UserLevel uint32 `json:"userLevel"` + Fragment *Fragment `json:"fragment"` + Noise *Noise `json:"noise"` + Noises []*Noise `json:"noises"` + ProxyProtocol uint32 `json:"proxyProtocol"` + IPsBlocked *StringList `json:"ipsBlocked"` + Firewall []*FreedomFirewallConfig `json:"firewall"` + FinalRules []*FreedomFirewallConfig `json:"finalRules"` } type Fragment struct { @@ -44,7 +45,7 @@ type Noise struct { ApplyTo string `json:"applyTo"` } -type FreedomFinalRuleConfig struct { +type FreedomFirewallConfig struct { Action string `json:"action"` Network *NetworkList `json:"network"` Port *PortList `json:"port"` @@ -58,7 +59,7 @@ type FreedomFinalRuleConfig struct { func (c *FreedomConfig) Build() (proto.Message, error) { if c.IPsBlocked != nil { // todo: remove legacy - errors.LogWarning(context.Background(), `The feature "ipsBlocked" has been removed and migrated to "finalRules". Please update your config(s) according to release note and documentation.`) + errors.LogWarning(context.Background(), `The feature "ipsBlocked" has been removed and migrated to "firewall". Please update your config(s) according to release note and documentation.`) } config := new(freedom.Config) @@ -187,12 +188,19 @@ func (c *FreedomConfig) Build() (proto.Message, error) { config.ProxyProtocol = c.ProxyProtocol } - for _, r := range c.FinalRules { + firewall := c.Firewall + if c.FinalRules != nil { + errors.PrintDeprecatedFeatureWarning("finalRules", "firewall") + if firewall == nil { + firewall = c.FinalRules + } + } + for _, r := range firewall { rule, err := r.Build() if err != nil { return nil, err } - config.FinalRules = append(config.FinalRules, rule) + config.Firewall = append(config.Firewall, rule) } return config, nil @@ -254,8 +262,8 @@ func ParseNoise(noise *Noise) (*freedom.Noise, error) { return NConfig, nil } -func (c *FreedomFinalRuleConfig) Build() (*freedom.FinalRuleConfig, error) { - rule := &freedom.FinalRuleConfig{} +func (c *FreedomFirewallConfig) Build() (*freedom.FirewallConfig, error) { + rule := &freedom.FirewallConfig{} switch strings.ToLower(c.Action) { case "allow": @@ -283,13 +291,13 @@ func (c *FreedomFinalRuleConfig) Build() (*freedom.FinalRuleConfig, error) { } if c.BlockDelay != nil { - errors.PrintDeprecatedFeatureWarning("finalRules.blockDelay", "finalRules.delay") + errors.PrintDeprecatedFeatureWarning("firewall.blockDelay", "firewall.delay") c.Delay = c.BlockDelay } if rule.Action != freedom.RuleAction_Block { if c.Delay != nil || c.LogLevel != "" { - return nil, errors.New("delay and logLevel are only supported for block finalRules") + return nil, errors.New("delay and logLevel are only supported for firewall action block") } return rule, nil } @@ -313,7 +321,7 @@ func (c *FreedomFinalRuleConfig) Build() (*freedom.FinalRuleConfig, error) { case "error": rule.LogLevel = log.Severity_Error.Enum() default: - return nil, errors.New("unknown finalRules.logLevel: ", c.LogLevel) + return nil, errors.New("unknown firewall.logLevel: ", c.LogLevel) } return rule, nil diff --git a/infra/conf/freedom_test.go b/infra/conf/freedom_test.go index 1d50fee7b..ee7cd86d8 100644 --- a/infra/conf/freedom_test.go +++ b/infra/conf/freedom_test.go @@ -42,7 +42,7 @@ func TestFreedomConfig(t *testing.T) { }, { Input: `{ - "finalRules": [{ + "firewall": [{ "action": "block", "network": "tcp,udp", "port": "53,443", @@ -56,7 +56,7 @@ func TestFreedomConfig(t *testing.T) { }`, Parser: loadJSON(creator), Output: &freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{ + Firewall: []*freedom.FirewallConfig{ { Action: freedom.RuleAction_Block, Networks: []net.Network{net.Network_TCP, net.Network_UDP}, diff --git a/proxy/freedom/config.pb.go b/proxy/freedom/config.pb.go index 4bc9c1849..8fb882b50 100644 --- a/proxy/freedom/config.pb.go +++ b/proxy/freedom/config.pb.go @@ -352,7 +352,7 @@ func (x *Range) GetMax() uint64 { return 0 } -type FinalRuleConfig struct { +type FirewallConfig struct { state protoimpl.MessageState `protogen:"open.v1"` Action RuleAction `protobuf:"varint,1,opt,name=action,proto3,enum=xray.proxy.freedom.RuleAction" json:"action,omitempty"` Networks []net.Network `protobuf:"varint,2,rep,packed,name=networks,proto3,enum=xray.common.net.Network" json:"networks,omitempty"` @@ -364,20 +364,20 @@ type FinalRuleConfig struct { sizeCache protoimpl.SizeCache } -func (x *FinalRuleConfig) Reset() { - *x = FinalRuleConfig{} +func (x *FirewallConfig) Reset() { + *x = FirewallConfig{} mi := &file_proxy_freedom_config_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *FinalRuleConfig) String() string { +func (x *FirewallConfig) String() string { return protoimpl.X.MessageStringOf(x) } -func (*FinalRuleConfig) ProtoMessage() {} +func (*FirewallConfig) ProtoMessage() {} -func (x *FinalRuleConfig) ProtoReflect() protoreflect.Message { +func (x *FirewallConfig) ProtoReflect() protoreflect.Message { mi := &file_proxy_freedom_config_proto_msgTypes[4] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) @@ -389,47 +389,47 @@ func (x *FinalRuleConfig) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use FinalRuleConfig.ProtoReflect.Descriptor instead. -func (*FinalRuleConfig) Descriptor() ([]byte, []int) { +// Deprecated: Use FirewallConfig.ProtoReflect.Descriptor instead. +func (*FirewallConfig) Descriptor() ([]byte, []int) { return file_proxy_freedom_config_proto_rawDescGZIP(), []int{4} } -func (x *FinalRuleConfig) GetAction() RuleAction { +func (x *FirewallConfig) GetAction() RuleAction { if x != nil { return x.Action } return RuleAction_Allow } -func (x *FinalRuleConfig) GetNetworks() []net.Network { +func (x *FirewallConfig) GetNetworks() []net.Network { if x != nil { return x.Networks } return nil } -func (x *FinalRuleConfig) GetPortList() *net.PortList { +func (x *FirewallConfig) GetPortList() *net.PortList { if x != nil { return x.PortList } return nil } -func (x *FinalRuleConfig) GetIp() []*geodata.IPRule { +func (x *FirewallConfig) GetIp() []*geodata.IPRule { if x != nil { return x.Ip } return nil } -func (x *FinalRuleConfig) GetDelay() *Range { +func (x *FirewallConfig) GetDelay() *Range { if x != nil { return x.Delay } return nil } -func (x *FinalRuleConfig) GetLogLevel() log.Severity { +func (x *FirewallConfig) GetLogLevel() log.Severity { if x != nil && x.LogLevel != nil { return *x.LogLevel } @@ -444,7 +444,7 @@ type Config struct { Fragment *Fragment `protobuf:"bytes,5,opt,name=fragment,proto3" json:"fragment,omitempty"` ProxyProtocol uint32 `protobuf:"varint,6,opt,name=proxy_protocol,json=proxyProtocol,proto3" json:"proxy_protocol,omitempty"` Noises []*Noise `protobuf:"bytes,7,rep,name=noises,proto3" json:"noises,omitempty"` - FinalRules []*FinalRuleConfig `protobuf:"bytes,8,rep,name=final_rules,json=finalRules,proto3" json:"final_rules,omitempty"` + Firewall []*FirewallConfig `protobuf:"bytes,8,rep,name=firewall,proto3" json:"firewall,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -521,9 +521,9 @@ func (x *Config) GetNoises() []*Noise { return nil } -func (x *Config) GetFinalRules() []*FinalRuleConfig { +func (x *Config) GetFirewall() []*FirewallConfig { if x != nil { - return x.FinalRules + return x.Firewall } return nil } @@ -558,8 +558,8 @@ const file_proxy_freedom_config_proto_rawDesc = "" + "\bapply_to\x18\x06 \x01(\tR\aapplyTo\"+\n" + "\x05Range\x12\x10\n" + "\x03min\x18\x01 \x01(\x04R\x03min\x12\x10\n" + - "\x03max\x18\x02 \x01(\x04R\x03max\"\xe0\x02\n" + - "\x0fFinalRuleConfig\x126\n" + + "\x03max\x18\x02 \x01(\x04R\x03max\"\xdf\x02\n" + + "\x0eFirewallConfig\x126\n" + "\x06action\x18\x01 \x01(\x0e2\x1e.xray.proxy.freedom.RuleActionR\x06action\x124\n" + "\bnetworks\x18\x02 \x03(\x0e2\x18.xray.common.net.NetworkR\bnetworks\x126\n" + "\tport_list\x18\x03 \x01(\v2\x19.xray.common.net.PortListR\bportList\x12+\n" + @@ -567,7 +567,7 @@ const file_proxy_freedom_config_proto_rawDesc = "" + "\x05delay\x18\x05 \x01(\v2\x19.xray.proxy.freedom.RangeR\x05delay\x12;\n" + "\tlog_level\x18\x06 \x01(\x0e2\x19.xray.common.log.SeverityH\x00R\blogLevel\x88\x01\x01B\f\n" + "\n" + - "_log_level\"\xaf\x03\n" + + "_log_level\"\xa9\x03\n" + "\x06Config\x12P\n" + "\x0fdomain_strategy\x18\x01 \x01(\x0e2'.xray.transport.internet.DomainStrategyR\x0edomainStrategy\x12Z\n" + "\x14destination_override\x18\x03 \x01(\v2'.xray.proxy.freedom.DestinationOverrideR\x13destinationOverride\x12\x1d\n" + @@ -575,9 +575,8 @@ const file_proxy_freedom_config_proto_rawDesc = "" + "user_level\x18\x04 \x01(\rR\tuserLevel\x128\n" + "\bfragment\x18\x05 \x01(\v2\x1c.xray.proxy.freedom.FragmentR\bfragment\x12%\n" + "\x0eproxy_protocol\x18\x06 \x01(\rR\rproxyProtocol\x121\n" + - "\x06noises\x18\a \x03(\v2\x19.xray.proxy.freedom.NoiseR\x06noises\x12D\n" + - "\vfinal_rules\x18\b \x03(\v2#.xray.proxy.freedom.FinalRuleConfigR\n" + - "finalRules*\"\n" + + "\x06noises\x18\a \x03(\v2\x19.xray.proxy.freedom.NoiseR\x06noises\x12>\n" + + "\bfirewall\x18\b \x03(\v2\".xray.proxy.freedom.FirewallConfigR\bfirewall*\"\n" + "\n" + "RuleAction\x12\t\n" + "\x05Allow\x10\x00\x12\t\n" + @@ -604,7 +603,7 @@ var file_proxy_freedom_config_proto_goTypes = []any{ (*Fragment)(nil), // 2: xray.proxy.freedom.Fragment (*Noise)(nil), // 3: xray.proxy.freedom.Noise (*Range)(nil), // 4: xray.proxy.freedom.Range - (*FinalRuleConfig)(nil), // 5: xray.proxy.freedom.FinalRuleConfig + (*FirewallConfig)(nil), // 5: xray.proxy.freedom.FirewallConfig (*Config)(nil), // 6: xray.proxy.freedom.Config (*protocol.ServerEndpoint)(nil), // 7: xray.common.protocol.ServerEndpoint (net.Network)(0), // 8: xray.common.net.Network @@ -615,17 +614,17 @@ var file_proxy_freedom_config_proto_goTypes = []any{ } var file_proxy_freedom_config_proto_depIdxs = []int32{ 7, // 0: xray.proxy.freedom.DestinationOverride.server:type_name -> xray.common.protocol.ServerEndpoint - 0, // 1: xray.proxy.freedom.FinalRuleConfig.action:type_name -> xray.proxy.freedom.RuleAction - 8, // 2: xray.proxy.freedom.FinalRuleConfig.networks:type_name -> xray.common.net.Network - 9, // 3: xray.proxy.freedom.FinalRuleConfig.port_list:type_name -> xray.common.net.PortList - 10, // 4: xray.proxy.freedom.FinalRuleConfig.ip:type_name -> xray.common.geodata.IPRule - 4, // 5: xray.proxy.freedom.FinalRuleConfig.delay:type_name -> xray.proxy.freedom.Range - 11, // 6: xray.proxy.freedom.FinalRuleConfig.log_level:type_name -> xray.common.log.Severity + 0, // 1: xray.proxy.freedom.FirewallConfig.action:type_name -> xray.proxy.freedom.RuleAction + 8, // 2: xray.proxy.freedom.FirewallConfig.networks:type_name -> xray.common.net.Network + 9, // 3: xray.proxy.freedom.FirewallConfig.port_list:type_name -> xray.common.net.PortList + 10, // 4: xray.proxy.freedom.FirewallConfig.ip:type_name -> xray.common.geodata.IPRule + 4, // 5: xray.proxy.freedom.FirewallConfig.delay:type_name -> xray.proxy.freedom.Range + 11, // 6: xray.proxy.freedom.FirewallConfig.log_level:type_name -> xray.common.log.Severity 12, // 7: xray.proxy.freedom.Config.domain_strategy:type_name -> xray.transport.internet.DomainStrategy 1, // 8: xray.proxy.freedom.Config.destination_override:type_name -> xray.proxy.freedom.DestinationOverride 2, // 9: xray.proxy.freedom.Config.fragment:type_name -> xray.proxy.freedom.Fragment 3, // 10: xray.proxy.freedom.Config.noises:type_name -> xray.proxy.freedom.Noise - 5, // 11: xray.proxy.freedom.Config.final_rules:type_name -> xray.proxy.freedom.FinalRuleConfig + 5, // 11: xray.proxy.freedom.Config.firewall:type_name -> xray.proxy.freedom.FirewallConfig 12, // [12:12] is the sub-list for method output_type 12, // [12:12] is the sub-list for method input_type 12, // [12:12] is the sub-list for extension type_name diff --git a/proxy/freedom/config.proto b/proxy/freedom/config.proto index 9a218877d..7770b77f2 100644 --- a/proxy/freedom/config.proto +++ b/proxy/freedom/config.proto @@ -47,7 +47,7 @@ enum RuleAction { Block = 1; } -message FinalRuleConfig { +message FirewallConfig { RuleAction action = 1; repeated xray.common.net.Network networks = 2; xray.common.net.PortList port_list = 3; @@ -63,5 +63,5 @@ message Config { Fragment fragment = 5; uint32 proxy_protocol = 6; repeated Noise noises = 7; - repeated FinalRuleConfig final_rules = 8; + repeated FirewallConfig firewall = 8; } diff --git a/proxy/freedom/freedom.go b/proxy/freedom/freedom.go index 6215647a2..bdd4670f9 100644 --- a/proxy/freedom/freedom.go +++ b/proxy/freedom/freedom.go @@ -35,8 +35,8 @@ import ( var ( useSplice atomic.Bool allNetworks [8]bool - defaultBlockPrivateRule *FinalRule - defaultBlockAllRule *FinalRule + defaultBlockPrivateRule *Firewall + defaultBlockAllRule *Firewall ) func reloadEnvSettings() error { @@ -72,21 +72,21 @@ func init() { allNetworks[i] = true } - defaultBlockPrivateRule = &FinalRule{ + defaultBlockPrivateRule = &Firewall{ action: RuleAction_Block, network: allNetworks, ip: geodata.GetPrivateIPMatcher(), logLevel: log.Severity_Warning.Enum(), } - defaultBlockAllRule = &FinalRule{ + defaultBlockAllRule = &Firewall{ action: RuleAction_Block, network: allNetworks, logLevel: log.Severity_Warning.Enum(), } } -type FinalRule struct { +type Firewall struct { action RuleAction network [8]bool port net.MemoryPortList @@ -99,13 +99,13 @@ type FinalRule struct { type Handler struct { policyManager policy.Manager config *Config - finalRules []*FinalRule + firewall []*Firewall resolveStrategy internet.DomainStrategy usesDialerProxy bool } -func buildFinalRule(config *FinalRuleConfig) (*FinalRule, error) { - rule := &FinalRule{ +func buildRule(config *FirewallConfig) (*Firewall, error) { + rule := &Firewall{ action: config.GetAction(), delay: config.GetDelay(), logLevel: config.LogLevel, @@ -134,25 +134,25 @@ func buildFinalRule(config *FinalRuleConfig) (*FinalRule, error) { return rule, nil } -func (r *FinalRule) matchNetwork(network net.Network) bool { +func (r *Firewall) matchNetwork(network net.Network) bool { return r.network[int(network)] } -func (r *FinalRule) matchPort(port net.Port) bool { +func (r *Firewall) matchPort(port net.Port) bool { if len(r.port) == 0 { return true } return r.port.Contains(port) } -func (r *FinalRule) matchIP(addr net.Address) bool { +func (r *Firewall) matchIP(addr net.Address) bool { if r.ip == nil { return true } return addr != nil && addr.Family().IsIP() && r.ip.Match(addr.IP()) } -func (r *FinalRule) Apply(network net.Network, address net.Address, port net.Port) bool { +func (r *Firewall) Apply(network net.Network, address net.Address, port net.Port) bool { if !r.matchNetwork(network) { return false } @@ -162,7 +162,7 @@ func (r *FinalRule) Apply(network net.Network, address net.Address, port net.Por return r.matchIP(address) } -func getDefaultFinalRule(inbound *session.Inbound) *FinalRule { +func getDefaultRule(inbound *session.Inbound) *Firewall { if inbound == nil { return nil } @@ -179,8 +179,8 @@ func getDefaultFinalRule(inbound *session.Inbound) *FinalRule { return nil } -func (h *Handler) matchFinalRule(network net.Network, address net.Address, port net.Port, defaultRule *FinalRule) *FinalRule { - for _, rule := range h.finalRules { +func (h *Handler) matchRule(network net.Network, address net.Address, port net.Port, defaultRule *Firewall) *Firewall { + for _, rule := range h.firewall { if rule.Apply(network, address, port) { return rule } @@ -195,19 +195,19 @@ func (h *Handler) matchFinalRule(network net.Network, address net.Address, port func (h *Handler) Init(config *Config, pm policy.Manager) error { h.config = config h.policyManager = pm - if h.usesDialerProxy { // freedom is not the final outbound, final rules do not apply - if len(config.FinalRules) > 0 { - errors.LogWarning(context.Background(), `The "finalRules" setting is ignored when "sockopt.dialerProxy" is set, since freedom is not the final outbound.`) + if h.usesDialerProxy { // freedom is not the final outbound, firewall does not apply + if len(config.Firewall) > 0 { + errors.LogWarning(context.Background(), `The "firewall" setting is ignored when "sockopt.dialerProxy" is set, since freedom is not the final outbound.`) } return nil } - h.finalRules = make([]*FinalRule, 0, len(config.FinalRules)) - for _, rc := range config.FinalRules { - rule, err := buildFinalRule(rc) + h.firewall = make([]*Firewall, 0, len(config.Firewall)) + for _, rc := range config.Firewall { + rule, err := buildRule(rc) if err != nil { - return errors.New("failed to build final rule").Base(err) + return errors.New("failed to build firewall rule").Base(err) } - h.finalRules = append(h.finalRules, rule) + h.firewall = append(h.firewall, rule) } return nil } @@ -217,7 +217,7 @@ func (h *Handler) policy() policy.Session { return p } -func (r *FinalRule) blockDuration() time.Duration { +func (r *Firewall) blockDuration() time.Duration { min := uint64(30) max := uint64(90) if r.delay != nil { @@ -231,7 +231,7 @@ func (r *FinalRule) blockDuration() time.Duration { return time.Duration(min+uint64(dice.Roll(int(span+1)))) * time.Second } -func (r *FinalRule) log(ctx context.Context, msg ...interface{}) { +func (r *Firewall) log(ctx context.Context, msg ...interface{}) { level := log.Severity_Info if r.logLevel != nil { level = *r.logLevel @@ -248,9 +248,9 @@ func (r *FinalRule) log(ctx context.Context, msg ...interface{}) { } } -func (h *Handler) blackhole(ctx context.Context, input buf.Reader, output buf.Writer, rule *FinalRule, dest *net.Destination) error { +func (h *Handler) blackhole(ctx context.Context, input buf.Reader, output buf.Writer, rule *Firewall, dest *net.Destination) error { delay := rule.blockDuration() - rule.log(ctx, "target blocked by a finalrule: ", *dest, ", blackholing connection for ", delay) + rule.log(ctx, "target blocked by a firewall rule: ", *dest, ", blackholing connection for ", delay) defer common.Close(output) done := make(chan struct{}) go func() { // a DispatchLink inbound's reader ignores Interrupt, so don't wait for this copy @@ -286,9 +286,9 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte ob.Name = "freedom" ob.CanSpliceCopy = 1 inbound := session.InboundFromContext(ctx) - var defaultRule *FinalRule - if !h.usesDialerProxy { // freedom is not the final outbound, final rules do not apply (and the domain is not resolved) - defaultRule = getDefaultFinalRule(inbound) + var defaultRule *Firewall + if !h.usesDialerProxy { // freedom is not the final outbound, firewall does not apply (and the domain is not resolved) + defaultRule = getDefaultRule(inbound) } destination := ob.Target @@ -316,10 +316,10 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte var conn stat.Connection var blockedDest *net.Destination - var blockedRule *FinalRule + var blockedRule *Firewall err := retry.ExponentialBackoff(5, 100).On(func() error { if destination.Address.Family().IsDomain() { - if defaultRule != nil || len(h.finalRules) > 0 { + if defaultRule != nil || len(h.firewall) > 0 { if strategy := h.resolveStrategy; strategy.HasStrategy() { ips, err := internet.LookupForIP(destination.Address.Domain(), strategy, outGateway) if err != nil { // non-force may still dial with system DNS @@ -330,7 +330,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte } for _, ip := range ips { if addr := net.IPAddress(ip); addr != nil { - if rule := h.matchFinalRule(destination.Network, addr, destination.Port, defaultRule); rule != nil && rule.action == RuleAction_Block { + if rule := h.matchRule(destination.Network, addr, destination.Port, defaultRule); rule != nil && rule.action == RuleAction_Block { blockedDest = &destination blockedDest.Address = addr blockedRule = rule @@ -345,7 +345,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte } for _, addr := range addrs { if ipAddr := net.IPAddress(addr.IP); ipAddr != nil { - if rule := h.matchFinalRule(destination.Network, ipAddr, destination.Port, defaultRule); rule != nil && rule.action == RuleAction_Block { + if rule := h.matchRule(destination.Network, ipAddr, destination.Port, defaultRule); rule != nil && rule.action == RuleAction_Block { blockedDest = &destination blockedDest.Address = ipAddr blockedRule = rule @@ -356,7 +356,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte } } } else { - if rule := h.matchFinalRule(destination.Network, destination.Address, destination.Port, defaultRule); rule != nil && rule.action == RuleAction_Block { + if rule := h.matchRule(destination.Network, destination.Address, destination.Port, defaultRule); rule != nil && rule.action == RuleAction_Block { blockedDest = &destination blockedRule = rule return nil @@ -377,10 +377,10 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte if blockedDest != nil { return h.blackhole(ctx, input, output, blockedRule, blockedDest) } - if destination.Address.Family().IsDomain() && (defaultRule != nil || len(h.finalRules) > 0) { + if destination.Address.Family().IsDomain() && (defaultRule != nil || len(h.firewall) > 0) { // pre-check may fail or dialer may select another IP remoteDest := net.DestinationFromAddr(conn.RemoteAddr()) - if rule := h.matchFinalRule(remoteDest.Network, remoteDest.Address, remoteDest.Port, defaultRule); rule != nil && rule.action == RuleAction_Block { + if rule := h.matchRule(remoteDest.Network, remoteDest.Address, remoteDest.Port, defaultRule); rule != nil && rule.action == RuleAction_Block { conn.Close() return h.blackhole(ctx, input, output, rule, &remoteDest) } @@ -484,7 +484,7 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte return nil } -func NewPacketReader(conn net.Conn, h *Handler, defaultRule *FinalRule, UDPOverride net.Destination, DialDest net.Destination) buf.Reader { +func NewPacketReader(conn net.Conn, h *Handler, defaultRule *Firewall, UDPOverride net.Destination, DialDest net.Destination) buf.Reader { iConn := conn statConn, ok := iConn.(*stat.CounterConnection) if ok { @@ -517,7 +517,7 @@ type PacketReader struct { *net.PacketConnWrapper stats.Counter Handler *Handler - DefaultRule *FinalRule + DefaultRule *Firewall IsOverridden bool InitUnchangedAddr net.Address InitChangedAddr net.Address @@ -534,7 +534,7 @@ func (r *PacketReader) ReadMultiBuffer() (buf.MultiBuffer, error) { } udpAddr := d.(*net.UDPAddr) sourceAddr := net.IPAddress(udpAddr.IP) - if rule := r.Handler.matchFinalRule(net.Network_UDP, sourceAddr, net.Port(udpAddr.Port), r.DefaultRule); rule != nil && rule.action == RuleAction_Block { + if rule := r.Handler.matchRule(net.Network_UDP, sourceAddr, net.Port(udpAddr.Port), r.DefaultRule); rule != nil && rule.action == RuleAction_Block { continue } b.Resize(0, int32(n)) @@ -559,7 +559,7 @@ func (r *PacketReader) ReadMultiBuffer() (buf.MultiBuffer, error) { } // DialDest means the dial target used in the dialer when creating conn -func NewPacketWriter(conn net.Conn, h *Handler, defaultRule *FinalRule, UDPOverride net.Destination, DialDest net.Destination, outGateway net.Address) buf.Writer { +func NewPacketWriter(conn net.Conn, h *Handler, defaultRule *Firewall, UDPOverride net.Destination, DialDest net.Destination, outGateway net.Address) buf.Writer { iConn := conn statConn, ok := iConn.(*stat.CounterConnection) if ok { @@ -593,7 +593,7 @@ type PacketWriter struct { *net.PacketConnWrapper stats.Counter *Handler - DefaultRule *FinalRule + DefaultRule *Firewall UDPOverride net.Destination // Dest of udp packets might be a domain, we will resolve them to IP @@ -652,7 +652,7 @@ func (w *PacketWriter) WriteMultiBuffer(mb buf.MultiBuffer) error { } } } - if rule := w.matchFinalRule(net.Network_UDP, b.UDP.Address, b.UDP.Port, w.DefaultRule); rule != nil && rule.action == RuleAction_Block { + if rule := w.matchRule(net.Network_UDP, b.UDP.Address, b.UDP.Port, w.DefaultRule); rule != nil && rule.action == RuleAction_Block { b.Release() continue } diff --git a/testing/scenarios/command_test.go b/testing/scenarios/command_test.go index 8f82bb2b4..e14344f75 100644 --- a/testing/scenarios/command_test.go +++ b/testing/scenarios/command_test.go @@ -71,7 +71,7 @@ func TestCommanderListenConfigurationItem(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { Tag: "default-outbound", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, }, } @@ -166,7 +166,7 @@ func TestCommanderRemoveHandler(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { Tag: "default-outbound", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, }, } @@ -262,7 +262,7 @@ func TestCommanderListHandlers(t *testing.T) { { Tag: "default-outbound", SenderSettings: serial.ToTypedMessage(&proxyman.SenderConfig{}), - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, }, } @@ -390,7 +390,7 @@ func TestCommanderAddRemoveUser(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -579,7 +579,7 @@ func TestCommanderStats(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/dokodemo_test.go b/testing/scenarios/dokodemo_test.go index e160ab508..225044330 100644 --- a/testing/scenarios/dokodemo_test.go +++ b/testing/scenarios/dokodemo_test.go @@ -60,7 +60,7 @@ func TestDokodemoTCP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -163,7 +163,7 @@ func TestDokodemoUDP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/feature_test.go b/testing/scenarios/feature_test.go index fa1ff3564..3036b36b3 100644 --- a/testing/scenarios/feature_test.go +++ b/testing/scenarios/feature_test.go @@ -62,7 +62,7 @@ func TestPassiveConnection(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -123,7 +123,7 @@ func TestDialerProxy(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -152,7 +152,7 @@ func TestDialerProxy(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -254,7 +254,7 @@ func TestDialerProxyOverKCP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -283,7 +283,7 @@ func TestDialerProxyOverKCP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), SenderSettings: serial.ToTypedMessage(&proxyman.SenderConfig{ StreamSettings: &internet.StreamConfig{ @@ -402,7 +402,7 @@ func TestBlackhole(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { Tag: "direct", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, { Tag: "blocked", @@ -517,7 +517,7 @@ func TestUDPConnection(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -582,7 +582,7 @@ func TestDomainSniffing(t *testing.T) { }, { Tag: "direct", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, }, App: []*serial.TypedMessage{ @@ -669,7 +669,7 @@ func TestDialXray(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/http_test.go b/testing/scenarios/http_test.go index 28d0ea4e8..8e91392da 100644 --- a/testing/scenarios/http_test.go +++ b/testing/scenarios/http_test.go @@ -50,7 +50,7 @@ func TestHttpConformance(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -113,7 +113,7 @@ func TestHttpError(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -163,7 +163,7 @@ func TestHTTPConnectMethod(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -245,7 +245,7 @@ func TestHttpPost(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -317,7 +317,7 @@ func TestHttpBasicAuth(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -405,7 +405,7 @@ func TestHTTPOutboundServerFirst(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/masque_test.go b/testing/scenarios/masque_test.go index 876ff0d2e..5d92cf4f7 100644 --- a/testing/scenarios/masque_test.go +++ b/testing/scenarios/masque_test.go @@ -499,7 +499,7 @@ func masqueServerConfig(serverPort net.Port, certificate *tls.Certificate, h2 bo Port: uint32(dest.Port), }, }, - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), } } diff --git a/testing/scenarios/metrics_test.go b/testing/scenarios/metrics_test.go index d75384770..fed9c5d05 100644 --- a/testing/scenarios/metrics_test.go +++ b/testing/scenarios/metrics_test.go @@ -63,7 +63,7 @@ func TestMetrics(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { Tag: "default-outbound", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, }, } diff --git a/testing/scenarios/policy_test.go b/testing/scenarios/policy_test.go index 588d07e5c..fea442831 100644 --- a/testing/scenarios/policy_test.go +++ b/testing/scenarios/policy_test.go @@ -85,7 +85,7 @@ func TestVMessClosing(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -193,7 +193,7 @@ func TestZeroBuffer(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/reverse_test.go b/testing/scenarios/reverse_test.go index 155386944..de74beb05 100644 --- a/testing/scenarios/reverse_test.go +++ b/testing/scenarios/reverse_test.go @@ -151,7 +151,7 @@ func TestReverseProxy(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { Tag: "freedom", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, { Tag: "reverse", @@ -340,7 +340,7 @@ func TestReverseProxyLongRunning(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { Tag: "freedom", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, { Tag: "reverse", diff --git a/testing/scenarios/shadowsocks_2022_test.go b/testing/scenarios/shadowsocks_2022_test.go index f456c5a3c..99c48f170 100644 --- a/testing/scenarios/shadowsocks_2022_test.go +++ b/testing/scenarios/shadowsocks_2022_test.go @@ -91,7 +91,7 @@ func testShadowsocks2022Tcp(t *testing.T, method string, password string) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -176,7 +176,7 @@ func testShadowsocks2022Udp(t *testing.T, method string, password string) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/shadowsocks_test.go b/testing/scenarios/shadowsocks_test.go index 2f4536993..ec46f02b1 100644 --- a/testing/scenarios/shadowsocks_test.go +++ b/testing/scenarios/shadowsocks_test.go @@ -53,7 +53,7 @@ func TestShadowsocksChaCha20Poly1305TCP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -141,7 +141,7 @@ func TestShadowsocksAES256GCMTCP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -236,7 +236,7 @@ func TestShadowsocksAES128GCMUDP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -330,7 +330,7 @@ func TestShadowsocksAES128GCMUDPMux(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/socks_test.go b/testing/scenarios/socks_test.go index e4682b80e..eeea64785 100644 --- a/testing/scenarios/socks_test.go +++ b/testing/scenarios/socks_test.go @@ -51,7 +51,7 @@ func TestSocksBridgeTCP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -128,7 +128,7 @@ func TestSocksWithHttpRequest(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -217,7 +217,7 @@ func TestSocksBridageUDP(t *testing.T) { }, Outbound: []*core.OutboundHandlerConfig{ { - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, }, } @@ -335,7 +335,7 @@ func TestSocksBridageUDPWithRouting(t *testing.T) { }, { Tag: "out", - ProxySettings: serial.ToTypedMessage(&freedom.Config{FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}}), + ProxySettings: serial.ToTypedMessage(&freedom.Config{Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}}), }, }, } @@ -435,7 +435,7 @@ func TestSocksConformanceMod(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/tls_test.go b/testing/scenarios/tls_test.go index c76ce4f60..f08144b7d 100644 --- a/testing/scenarios/tls_test.go +++ b/testing/scenarios/tls_test.go @@ -69,7 +69,7 @@ func TestSimpleTLSConnection(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -182,7 +182,7 @@ func TestAutoIssuingCertificate(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -287,7 +287,7 @@ func TestTLSOverKCP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -387,7 +387,7 @@ func TestTLSOverWebSocket(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -503,7 +503,7 @@ func TestGRPC(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -619,7 +619,7 @@ func TestGRPCMultiMode(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -728,7 +728,7 @@ func TestSimpleTLSConnectionPinned(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -827,7 +827,7 @@ func TestSimpleTLSConnectionPinnedWrongCert(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -925,7 +925,7 @@ func TestUTLSConnectionPinned(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -1025,7 +1025,7 @@ func TestUTLSConnectionPinnedWrongCert(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/transport_test.go b/testing/scenarios/transport_test.go index a0bd43f5b..584c51ccd 100644 --- a/testing/scenarios/transport_test.go +++ b/testing/scenarios/transport_test.go @@ -63,7 +63,7 @@ func TestHTTPConnectionHeader(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/vless_test.go b/testing/scenarios/vless_test.go index a624b0844..963dae8b4 100644 --- a/testing/scenarios/vless_test.go +++ b/testing/scenarios/vless_test.go @@ -70,7 +70,7 @@ func TestVless(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -175,7 +175,7 @@ func TestVlessTls(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -298,7 +298,7 @@ func TestVlessXtlsVision(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -430,7 +430,7 @@ func TestVlessXtlsVisionReality(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -569,7 +569,7 @@ func TestVlessRealityFingerprints(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -661,7 +661,7 @@ func TestVlessRealityFingerprints(t *testing.T) { wg.Wait() } -// A blocked connection must close after finalRules.delay even while the client keeps it open and sends nothing. +// A blocked connection must close after firewall.delay even while the client keeps it open and sends nothing. func TestVlessBlockDelay(t *testing.T) { tcpServer := tcp.Server{ MsgProcessor: xor, @@ -695,7 +695,7 @@ func TestVlessBlockDelay(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{ + Firewall: []*freedom.FirewallConfig{ { Action: freedom.RuleAction_Block, Delay: &freedom.Range{Min: delay, Max: delay}, @@ -734,7 +734,7 @@ func TestVlessBlockDelay(t *testing.T) { t.Fatalf("connection is still open after %v", elapsed) } if elapsed < blockDuration { - t.Fatalf("connection is closed after %v, before finalRules.delay", elapsed) + t.Fatalf("connection is closed after %v, before firewall.delay", elapsed) } }) } diff --git a/testing/scenarios/vmess_test.go b/testing/scenarios/vmess_test.go index b1d73b20c..35e416f4a 100644 --- a/testing/scenarios/vmess_test.go +++ b/testing/scenarios/vmess_test.go @@ -62,7 +62,7 @@ func TestVMessGCM(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -162,7 +162,7 @@ func TestVMessGCMReadv(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -265,7 +265,7 @@ func TestVMessGCMUDP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -362,7 +362,7 @@ func TestVMessChacha20(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -463,7 +463,7 @@ func TestVMessKCP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -568,7 +568,7 @@ func TestVMessKCPLarge(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -674,7 +674,7 @@ func TestVMessGCMMux(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -787,7 +787,7 @@ func TestVMessGCMMuxUDP(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -910,7 +910,7 @@ func TestVMessGCMLengthAuth(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, @@ -1012,7 +1012,7 @@ func TestVMessGCMLengthAuthPlusNoTerminationSignal(t *testing.T) { Outbound: []*core.OutboundHandlerConfig{ { ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), }, }, diff --git a/testing/scenarios/wireguard_test.go b/testing/scenarios/wireguard_test.go index a3014c48e..663d02f76 100644 --- a/testing/scenarios/wireguard_test.go +++ b/testing/scenarios/wireguard_test.go @@ -61,7 +61,7 @@ func TestWireguard(t *testing.T) { Port: uint32(dest.Port), }, }, - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, }), } } diff --git a/transport/internet/finalmask/sudoku/sudoku_test.go b/transport/internet/finalmask/sudoku/sudoku_test.go index 2c03a21f0..a2460f3e1 100644 --- a/transport/internet/finalmask/sudoku/sudoku_test.go +++ b/transport/internet/finalmask/sudoku/sudoku_test.go @@ -279,7 +279,7 @@ func runVLESSRealityCase(t *testing.T, bin string, mode trafficMode, payloadSize }, Outbound: []*core.OutboundHandlerConfig{ {ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, })}, }, }) @@ -398,7 +398,7 @@ func runHysteria2Case(t *testing.T, bin string, mode trafficMode, payloadSize in }, Outbound: []*core.OutboundHandlerConfig{ {ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, })}, }, }) @@ -514,7 +514,7 @@ func runVLesseEncCase(t *testing.T, bin string, mode trafficMode, payloadSize in }, Outbound: []*core.OutboundHandlerConfig{ {ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, })}, }, }) @@ -614,7 +614,7 @@ func runVLESSXHTTPCase(t *testing.T, bin string, mode trafficMode, payloadSize i }, Outbound: []*core.OutboundHandlerConfig{ {ProxySettings: serial.ToTypedMessage(&freedom.Config{ - FinalRules: []*freedom.FinalRuleConfig{{Action: freedom.RuleAction_Allow}}, + Firewall: []*freedom.FirewallConfig{{Action: freedom.RuleAction_Allow}}, })}, }, })