# /etc/sockd.conf -- brintOS wasm32 image.
#
# Loopback-only and numeric throughout: nothing here traverses getaddrinfo(3)'s
# dns leg, which is broken on this image (brintos/linux-in-the-browser#96) and
# would otherwise turn a proxy result into a resolver result.
#
# Neither user.privileged nor user.unprivileged is set. The credential-setter
# family is unwired here (brintos/linux#19), so a privilege drop could only
# fail; dante's default -- keep the invoking uid -- is the only reachable one.
#
# socksmethod is `none' because every method that authenticates goes through a
# dlopen'd PAM module or a system password, and this arm has no dlopen.

logoutput: stderr

internal: 127.0.0.1 port = 1080
external: 127.0.0.1

socksmethod: none
clientmethod: none

# Only a loopback client may speak to the server at all.
client pass {
	from: 127.0.0.0/8 to: 0.0.0.0/0
	log: error
}

client block {
	from: 0.0.0.0/0 to: 0.0.0.0/0
	log: connect error
}

# One destination passes -- 127.0.0.1:8099, where 88-dante stands up its socat
# origin. Everything else is refused with SOCKS reply 0x02 (connection not
# allowed by ruleset), which is the half of the criterion the block rule below
# provides a subject for.
socks pass {
	from: 127.0.0.0/8 to: 127.0.0.1/32 port = 8099
	command: connect
	protocol: tcp
	log: connect error
}

socks block {
	from: 0.0.0.0/0 to: 0.0.0.0/0
	log: connect error
}