Add destination port ACL rules

README.md

@@ -10,7 +10,7 @@ Hermes is a minimal HTTP/1.1 forward proxy written in Rust. It supports streamin
 - SOCKS5 IPv4, IPv6, and domain destinations with shared ACL enforcement
 - Streaming request and response bodies
 - Upstream connection pooling and configurable timeouts
-- Ordered allow/deny ACLs using Basic authentication, client IP networks, and destination domains
+- Ordered allow/deny ACLs using Basic authentication, client IP networks, destination domains, and destination ports
 - Fast salted SHA-256 password hashes; plaintext passwords are never stored in YAML
 - Removal of standard and `Connection`-nominated hop-by-hop headers
 - W3C Trace Context extraction and injection for plain HTTP traffic
@@ -109,6 +109,7 @@ acl:
     - name: approved-domains
       action: allow
       domains: ["docs.example.com", "example.org", "*.rust-lang.org"]
+      ports: [80, 443]
 ```
 
 | Field | Default | Description |
@@ -123,30 +124,31 @@ acl:
 | `acl.users` | empty | Usernames and salted SHA-256 password hashes |
 | `acl.rules` | empty | Ordered ACL rules |
 
-Configuration is loaded and validated at startup. Unknown fields, invalid CIDRs or domain patterns, duplicate or empty rules, references to unknown users, and unsupported password hashes prevent startup. Restart Hermes to apply configuration changes.
+Configuration is loaded and validated at startup. Unknown fields, invalid CIDRs, domain patterns, or ports, duplicate or empty rules, references to unknown users, and unsupported password hashes prevent startup. Restart Hermes to apply configuration changes.
 
 `telemetry.log_filter` controls log filtering and defaults to `info`, for example `log_filter: "hermes=debug"`. `RUST_LOG` is not read.
 
 ### ACL rules
 
 - Rules are evaluated in order; the **first match wins**.
-- Separate user, network, and domain rules provide Basic-auth, source-IP, or destination-domain authorization.
+- Separate user, network, domain, and port rules provide Basic-auth, source-IP, destination-domain, or destination-port authorization.
 - If a rule contains multiple selector types, every specified selector must match. Entries within each selector are ORed.
 - A rule must contain at least one selector; accidental match-all rules are rejected.
 - `networks` uses the actual client TCP peer address. `X-Forwarded-For` is never trusted.
 - `domains` uses the request-target authority, never the downstream `Host` header, and works for both HTTP and `CONNECT`.
+- `ports` matches the destination port. Plain HTTP defaults to port 80 when omitted; `CONNECT` and SOCKS5 provide an explicit port.
 - Requests without required credentials receive `407 Proxy Authentication Required` and a Basic `Proxy-Authenticate` challenge.
 - Invalid credentials receive 407; clients denied by policy receive 403.
 - ACLs are enforced before upstream HTTP requests or `CONNECT` connections are made.
 - `Proxy-Authorization` is consumed by Hermes and is never forwarded upstream.
 
-### Destination domains
+### Destination domains and ports
 
 Domain entries support exact names and leading-subdomain wildcards:
 
 - `example.com` matches only that name.
 - `*.example.com` matches `www.example.com` and `a.b.example.com`, but not the apex `example.com` or a lookalike such as `evil-example.com`.
-- Matching is case-insensitive, ignores ports, and normalizes one trailing DNS root dot.
+- Domain matching is case-insensitive and normalizes one trailing DNS root dot. Use `ports` when port restrictions are also required.
 - Single-label names such as `localhost` are supported. International domains must use ASCII/punycode form.
 - IP literals never match domain patterns.
 
@@ -159,6 +161,7 @@ acl:
     - name: approved-domains
       action: allow
       domains: ["example.com", "*.rust-lang.org"]
+      ports: [80, 443]
 ```
 
 A domain blacklist uses deny rules, typically with `default_action: allow`:
@@ -172,7 +175,7 @@ acl:
       domains: ["ads.example.net", "*.tracker.example"]
 ```
 
-Domain selectors can be combined with `users` and/or `networks` when client and destination restrictions must both apply. A domain-only allow rule does not implicitly require authentication.
+Domain and port selectors can be combined with `users` and/or `networks` when client and destination restrictions must both apply. A domain-only allow rule does not implicitly require authentication. Multiple ports are ORed; different selector types are ANDed. Ports must be in the range 1–65535, and omitting `ports` matches any destination port.
 
 **Domain matching is not destination-IP filtering.** A hostname blacklist can be bypassed by connecting directly to an IP address. Hermes also does not inspect resolved addresses or provide DNS-rebinding protection. A domain-only whitelist with `default_action: deny` rejects IP-literal destinations unless another rule allows them.
 
@@ -231,7 +234,7 @@ curl --socks5-hostname 127.0.0.1:1080 \
   http://example.com/
 ```
 
-SOCKS5 reuses the ACL's salted password hashes and applies `users`, `networks`, and `domains` before upstream dialing. Username/password negotiation is selected when required by the ACL; otherwise no-auth is used. Authentication is cleartext on the network, so restrict the listener to localhost or trusted networks. ACL denial returns SOCKS reply `0x02` before any upstream connection.
+SOCKS5 reuses the ACL's salted password hashes and applies `users`, `networks`, `domains`, and `ports` before upstream dialing. Username/password negotiation is selected when required by the ACL; otherwise no-auth is used. Authentication is cleartext on the network, so restrict the listener to localhost or trusted networks. ACL denial returns SOCKS reply `0x02` before any upstream connection.
 
 Only CONNECT is supported. SOCKS4, BIND, and UDP ASSOCIATE are not implemented. Docker users can publish the listener with `-p 127.0.0.1:1080:1080` when it is enabled.
 
@@ -300,7 +303,7 @@ Hermes uses standard HTTP instrument names where applicable and adds proxy-speci
 - `hermes.proxy.tunnel.bytes`
 - `hermes.proxy.acl.decisions`
 
-Metric attributes are deliberately bounded. Tunnel and ACL metrics include `proxy.protocol` to distinguish HTTP, HTTP CONNECT, and SOCKS5. Raw URLs, destination hostnames, usernames, rule names, and client addresses are not metric attributes.
+Metric attributes are deliberately bounded. Tunnel and ACL metrics include `proxy.protocol` to distinguish HTTP, HTTP CONNECT, and SOCKS5. Raw URLs, destination hostnames, destination ports, usernames, rule names, and client addresses are not metric attributes.
 
 ### Logs