added basic local connection option (#80)

config.defaults.yaml

@@ -35,6 +35,8 @@ general:
   public_ipv4:
   # Public IPv6 of the server, reply address of DNS AAAA queries
   public_ipv6:
+  # allow connections from sniproxy to RFC1918 addresses. default is false.
+  allow_conn_to_local: false
   # log level for the application. choices: debug, info, warn, error
   # by default, the logs are colored so they are not suited for logging to a file.
   # in order to disable colors, set NO_COLOR=true in the environment variables

https.go

@@ -54,7 +54,7 @@ func handle443(conn net.Conn, httpslog zerolog.Logger) error {
 			return err
 		}
 		// TODO: handle timeout and context here
-		if rAddr.IsLoopback() || rAddr.IsPrivate() || rAddr.Equal(net.IPv4(0, 0, 0, 0)) || rAddr.Equal(net.IP(c.PublicIPv4)) || rAddr.Equal(net.IP(c.sourceAddr)) || rAddr.Equal(net.IP(c.PublicIPv6)) {
+		if rAddr.IsLoopback() || (rAddr.IsPrivate() && !c.AllowConnToLocal) || rAddr.Equal(net.IPv4(0, 0, 0, 0)) || rAddr.Equal(net.IP(c.PublicIPv4)) || rAddr.Equal(net.IP(c.sourceAddr)) || rAddr.Equal(net.IP(c.PublicIPv6)) {
 			httpslog.Info().Msg("connection to private IP or self ignored")
 			return nil
 		}

main.go

@@ -53,6 +53,7 @@ type runConfig struct {
 	BindHTTPS             string `yaml:"bind_https"`
 	Interface             string `yaml:"interface"`
 	BindPrometheus        string `yaml:"bind_prometheus"`
+	AllowConnToLocal      bool   `yaml:"allow_conn_to_local"`
 
 	acl []acl.ACL
 
@@ -301,6 +302,7 @@ func main() {
 		c.PublicIPv6, _ = getPublicIPv6()
 	}
 	c.BindPrometheus = generalConfig.String("prometheus")
+	c.AllowConnToLocal = generalConfig.Bool("allow_conn_to_local")
 
 	var err error
 	c.acl, err = acl.StartACLs(&logger, k)