fix: whitelist domain depth, exclude subnets from verdict

querying/src/lib.rs

@@ -32,13 +32,13 @@ pub struct Check {
     pub verdict: CheckVerdict,
     pub geo: IpInfo,
     pub ips: Vec<IpAddr>,
+    pub rkn_subnets: HashSet<IpNet>,
 }
 
 pub enum CheckVerdict {
     Clear,
     Blocked {
         rkn_domain: Option<String>,
-        rkn_subnets: HashSet<IpNet>,
         cdn_provider_subnets: HashMap<String, HashSet<NetworkRecord>>,
     },
 }
@@ -115,14 +115,14 @@ impl Checker {
             .collect();
 
         Ok(Check {
-            verdict: match (domain, cdn_provider_subnets.is_empty(), rkn_subnets.is_empty()) {
-                (None, true, true) => CheckVerdict::Clear,
-                (domain, _, _) => CheckVerdict::Blocked {
+            verdict: match (domain, cdn_provider_subnets.is_empty()) {
+                (None, true) => CheckVerdict::Clear,
+                (domain, _) => CheckVerdict::Blocked {
                     rkn_domain: domain,
-                    rkn_subnets,
                     cdn_provider_subnets,
-                }
+                },
             },
+            rkn_subnets,
             geo,
             ips
         })

website/src/db.rs

@@ -127,6 +127,9 @@ pub async fn check_whitelist(
     domain: &str,
     db: &mut Connection<Db>,
 ) -> Result<Option<WhitelistedEntry>, sqlx::Error> {
+    if domain.chars().filter(|c| *c == '.').count() > 4 {
+        return Ok(None);
+    }
     sqlx::query_as!(
         WhitelistedEntry,
         "SELECT *

website/src/main.rs

@@ -135,6 +135,7 @@ async fn check(
             verdict: CheckVerdict::Clear,
             geo,
             ips,
+            rkn_subnets,
         }) => Ok(Template::render(
             "result",
             context! {
@@ -143,6 +144,9 @@ async fn check(
                 found: false,
                 target: target.to_query(),
                 target_type: target.readable_type(),
+                blocked_subnets: rkn_subnets.iter()
+                    .map(|n| n.to_string())
+                    .collect::<Vec<_>>(),
                 whitelist,
                 ips,
                 geo,
@@ -152,10 +156,10 @@ async fn check(
             verdict:
                 CheckVerdict::Blocked {
                     rkn_domain,
-                    rkn_subnets,
                     cdn_provider_subnets,
                 },
             geo,
+            rkn_subnets,
             ips,
         }) => Ok(Template::render(
             "result",

website/templates/result.html.tera

@@ -107,8 +107,13 @@
                 <div class="detail-row">
                     <span class="row-label">Реестр РКН</span>
 
-                    {% if domain or blocked_subnets %}
+                    {% if domain %}
                         <span class="row-value alert">ОГРАНИЧЕН</span>
+                    {% elif blocked_subnets %}
+                        <span class="row-value alert hint"
+                              title="Адреса пересекаются с подсетями заблокированных доменов (не гарантирует блокировку)">
+                            IP-АДРЕСА
+                        </span>
                     {% else %}
                         <span class="row-value">Не найден</span>
                     {% endif %}