Rework Communication+Link to Connection
This commit is contained in:
Daniel
@@ -2,7 +2,7 @@ package firewall
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"os"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
@@ -34,7 +34,7 @@ var (
|
||||
|
||||
// localNet4 *net.IPNet
|
||||
|
||||
// localhost4 = net.IPv4(127, 0, 0, 1)
|
||||
localhost4 = net.IPv4(127, 0, 0, 1)
|
||||
// localhost6 = net.IPv6loopback
|
||||
|
||||
// tunnelNet4 *net.IPNet
|
||||
@@ -61,6 +61,8 @@ func init() {
|
||||
DefaultValue: true,
|
||||
},
|
||||
)
|
||||
|
||||
network.SetDefaultFirewallHandler(defaultHandler)
|
||||
}
|
||||
|
||||
func prep() (err error) {
|
||||
@@ -78,16 +80,16 @@ func prep() (err error) {
|
||||
// // Yes, this would normally be 127.0.0.0/8
|
||||
// // TODO: figure out any side effects
|
||||
// if err != nil {
|
||||
// return fmt.Errorf("firewall: failed to parse cidr 127.0.0.0/24: %s", err)
|
||||
// return fmt.Errorf("filter: failed to parse cidr 127.0.0.0/24: %s", err)
|
||||
// }
|
||||
|
||||
// _, tunnelNet4, err = net.ParseCIDR("127.17.0.0/16")
|
||||
// if err != nil {
|
||||
// return fmt.Errorf("firewall: failed to parse cidr 127.17.0.0/16: %s", err)
|
||||
// return fmt.Errorf("filter: failed to parse cidr 127.17.0.0/16: %s", err)
|
||||
// }
|
||||
// _, tunnelNet6, err = net.ParseCIDR("fd17::/64")
|
||||
// if err != nil {
|
||||
// return fmt.Errorf("firewall: failed to parse cidr fd17::/64: %s", err)
|
||||
// return fmt.Errorf("filter: failed to parse cidr fd17::/64: %s", err)
|
||||
// }
|
||||
|
||||
var pA uint64
|
||||
@@ -135,7 +137,10 @@ func handlePacket(pkt packet.Packet) {
|
||||
// }
|
||||
|
||||
// allow local dns
|
||||
if (pkt.Info().DstPort == 53 || pkt.Info().SrcPort == 53) && pkt.Info().Src.Equal(pkt.Info().Dst) {
|
||||
if (pkt.Info().DstPort == 53 || pkt.Info().SrcPort == 53) &&
|
||||
(pkt.Info().Src.Equal(pkt.Info().Dst) || // Windows redirects back to same interface
|
||||
pkt.Info().Src.Equal(localhost4) || // Linux sometimes does 127.0.0.1->127.0.0.53
|
||||
pkt.Info().Dst.Equal(localhost4)) {
|
||||
log.Debugf("accepting local dns: %s", pkt)
|
||||
_ = pkt.PermanentAccept()
|
||||
return
|
||||
@@ -180,11 +185,11 @@ func handlePacket(pkt packet.Packet) {
|
||||
// TODO: Howto handle NetBios?
|
||||
}
|
||||
|
||||
// log.Debugf("firewall: pkt %s has ID %s", pkt, pkt.GetLinkID())
|
||||
// log.Debugf("filter: pkt %s has ID %s", pkt, pkt.GetLinkID())
|
||||
|
||||
// use this to time how long it takes process packet
|
||||
// timed := time.Now()
|
||||
// defer log.Tracef("firewall: took %s to process packet %s", time.Now().Sub(timed).String(), pkt)
|
||||
// defer log.Tracef("filter: took %s to process packet %s", time.Now().Sub(timed).String(), pkt)
|
||||
|
||||
// check if packet is destined for tunnel
|
||||
// switch pkt.IPVersion() {
|
||||
@@ -201,156 +206,110 @@ func handlePacket(pkt packet.Packet) {
|
||||
traceCtx, tracer := log.AddTracer(context.Background())
|
||||
if tracer != nil {
|
||||
pkt.SetCtx(traceCtx)
|
||||
tracer.Tracef("firewall: handling packet: %s", pkt)
|
||||
tracer.Tracef("filter: handling packet: %s", pkt)
|
||||
}
|
||||
|
||||
// associate packet to link and handle
|
||||
link, created := network.GetOrCreateLinkByPacket(pkt)
|
||||
if created {
|
||||
link.SetFirewallHandler(initialHandler)
|
||||
conn, ok := network.GetConnection(pkt.GetConnectionID())
|
||||
if ok {
|
||||
tracer.Tracef("filter: assigned to connection %s", conn.ID)
|
||||
} else {
|
||||
conn = network.NewConnectionFromFirstPacket(pkt)
|
||||
tracer.Tracef("filter: created new connection %s", conn.ID)
|
||||
conn.SetFirewallHandler(initialHandler)
|
||||
}
|
||||
|
||||
link.HandlePacket(pkt)
|
||||
// handle packet
|
||||
conn.HandlePacket(pkt)
|
||||
}
|
||||
|
||||
func initialHandler(pkt packet.Packet, link *network.Link) {
|
||||
defer func() {
|
||||
go link.SaveIfNeeded()
|
||||
}()
|
||||
|
||||
log.Tracer(pkt.Ctx()).Trace("firewall: [initial handler]")
|
||||
func initialHandler(conn *network.Connection, pkt packet.Packet) {
|
||||
log.Tracer(pkt.Ctx()).Trace("filter: [initial handler]")
|
||||
|
||||
// check for internal firewall bypass
|
||||
ps := getPortStatusAndMarkUsed(pkt.Info().LocalPort())
|
||||
if ps.isMe {
|
||||
// connect to comms
|
||||
comm, err := network.GetOwnComm(pkt)
|
||||
if err != nil {
|
||||
// log.Warningf("firewall: could not get own comm: %s", err)
|
||||
log.Tracer(pkt.Ctx()).Warningf("firewall: could not get own comm: %s", err)
|
||||
} else {
|
||||
comm.AddLink(link)
|
||||
}
|
||||
|
||||
// approve
|
||||
link.Accept("internally approved")
|
||||
log.Tracer(pkt.Ctx()).Tracef("firewall: internally approved link (via local port %d)", pkt.Info().LocalPort())
|
||||
|
||||
conn.Accept("internally approved")
|
||||
// finish
|
||||
link.StopFirewallHandler()
|
||||
issueVerdict(pkt, link, 0, true)
|
||||
conn.StopFirewallHandler()
|
||||
issueVerdict(conn, pkt, 0, true)
|
||||
return
|
||||
}
|
||||
|
||||
// get Communication
|
||||
comm, err := network.GetCommunicationByFirstPacket(pkt)
|
||||
if err != nil {
|
||||
log.Tracer(pkt.Ctx()).Warningf("firewall: could not get process, denying link: %s", err)
|
||||
|
||||
// get "unknown" comm
|
||||
link.Deny(fmt.Sprintf("could not get process: %s", err))
|
||||
comm, err = network.GetUnknownCommunication(pkt)
|
||||
|
||||
if err != nil {
|
||||
// all failed
|
||||
log.Tracer(pkt.Ctx()).Errorf("firewall: could not get unknown comm: %s", err)
|
||||
link.UpdateVerdict(network.VerdictDrop)
|
||||
link.StopFirewallHandler()
|
||||
issueVerdict(pkt, link, 0, true)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// add new Link to Communication (and save both)
|
||||
comm.AddLink(link)
|
||||
log.Tracer(pkt.Ctx()).Tracef("firewall: link attached to %s", comm)
|
||||
|
||||
// reroute dns requests to nameserver
|
||||
if comm.Process().Pid != os.Getpid() && pkt.IsOutbound() && pkt.Info().DstPort == 53 && !pkt.Info().Src.Equal(pkt.Info().Dst) {
|
||||
link.UpdateVerdict(network.VerdictRerouteToNameserver)
|
||||
link.StopFirewallHandler()
|
||||
issueVerdict(pkt, link, 0, true)
|
||||
if conn.Process().Pid != os.Getpid() && pkt.IsOutbound() && pkt.Info().DstPort == 53 && !pkt.Info().Src.Equal(pkt.Info().Dst) {
|
||||
conn.Verdict = network.VerdictRerouteToNameserver
|
||||
conn.StopFirewallHandler()
|
||||
issueVerdict(conn, pkt, 0, true)
|
||||
return
|
||||
}
|
||||
|
||||
log.Tracer(pkt.Ctx()).Trace("firewall: starting decision process")
|
||||
|
||||
// TODO: filter lists may have IPs in the future!
|
||||
DecideOnCommunication(comm)
|
||||
DecideOnLink(comm, link, pkt)
|
||||
|
||||
// TODO: link this to real status
|
||||
// gate17Active := mode.Client()
|
||||
log.Tracer(pkt.Ctx()).Trace("filter: starting decision process")
|
||||
DecideOnConnection(conn, pkt)
|
||||
conn.Inspecting = false // TODO: enable inspecting again
|
||||
|
||||
switch {
|
||||
// case gate17Active && link.Inspect:
|
||||
// // tunnel link, but also inspect (after reroute)
|
||||
// link.Tunneled = true
|
||||
// link.SetFirewallHandler(inspectThenVerdict)
|
||||
// verdict(pkt, link.GetVerdict())
|
||||
// case gate17Active:
|
||||
// // tunnel link, don't inspect
|
||||
// link.Tunneled = true
|
||||
// link.StopFirewallHandler()
|
||||
// permanentVerdict(pkt, network.VerdictAccept)
|
||||
case link.Inspect:
|
||||
log.Tracer(pkt.Ctx()).Trace("firewall: start inspecting")
|
||||
link.SetFirewallHandler(inspectThenVerdict)
|
||||
inspectThenVerdict(pkt, link)
|
||||
case conn.Inspecting:
|
||||
log.Tracer(pkt.Ctx()).Trace("filter: start inspecting")
|
||||
conn.SetFirewallHandler(inspectThenVerdict)
|
||||
inspectThenVerdict(conn, pkt)
|
||||
default:
|
||||
link.StopFirewallHandler()
|
||||
issueVerdict(pkt, link, 0, true)
|
||||
conn.StopFirewallHandler()
|
||||
issueVerdict(conn, pkt, 0, true)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
func inspectThenVerdict(pkt packet.Packet, link *network.Link) {
|
||||
pktVerdict, continueInspection := inspection.RunInspectors(pkt, link)
|
||||
func defaultHandler(conn *network.Connection, pkt packet.Packet) {
|
||||
issueVerdict(conn, pkt, 0, true)
|
||||
}
|
||||
|
||||
func inspectThenVerdict(conn *network.Connection, pkt packet.Packet) {
|
||||
pktVerdict, continueInspection := inspection.RunInspectors(conn, pkt)
|
||||
if continueInspection {
|
||||
issueVerdict(pkt, link, pktVerdict, false)
|
||||
issueVerdict(conn, pkt, pktVerdict, false)
|
||||
return
|
||||
}
|
||||
|
||||
// we are done with inspecting
|
||||
link.StopFirewallHandler()
|
||||
issueVerdict(pkt, link, 0, true)
|
||||
conn.StopFirewallHandler()
|
||||
issueVerdict(conn, pkt, 0, true)
|
||||
}
|
||||
|
||||
func issueVerdict(pkt packet.Packet, link *network.Link, verdict network.Verdict, allowPermanent bool) {
|
||||
link.Lock()
|
||||
|
||||
func issueVerdict(conn *network.Connection, pkt packet.Packet, verdict network.Verdict, allowPermanent bool) {
|
||||
// enable permanent verdict
|
||||
if allowPermanent && !link.VerdictPermanent {
|
||||
link.VerdictPermanent = permanentVerdicts()
|
||||
if link.VerdictPermanent {
|
||||
link.SaveWhenFinished()
|
||||
if allowPermanent && !conn.VerdictPermanent {
|
||||
conn.VerdictPermanent = permanentVerdicts()
|
||||
if conn.VerdictPermanent {
|
||||
conn.SaveWhenFinished()
|
||||
}
|
||||
}
|
||||
|
||||
// do not allow to circumvent link decision: e.g. to ACCEPT packets from a DROP-ed link
|
||||
if verdict < link.Verdict {
|
||||
verdict = link.Verdict
|
||||
// do not allow to circumvent decision: e.g. to ACCEPT packets from a DROP-ed connection
|
||||
if verdict < conn.Verdict {
|
||||
verdict = conn.Verdict
|
||||
}
|
||||
|
||||
var err error
|
||||
switch verdict {
|
||||
case network.VerdictAccept:
|
||||
atomic.AddUint64(packetsAccepted, 1)
|
||||
if link.VerdictPermanent {
|
||||
if conn.VerdictPermanent {
|
||||
err = pkt.PermanentAccept()
|
||||
} else {
|
||||
err = pkt.Accept()
|
||||
}
|
||||
case network.VerdictBlock:
|
||||
atomic.AddUint64(packetsBlocked, 1)
|
||||
if link.VerdictPermanent {
|
||||
if conn.VerdictPermanent {
|
||||
err = pkt.PermanentBlock()
|
||||
} else {
|
||||
err = pkt.Block()
|
||||
}
|
||||
case network.VerdictDrop:
|
||||
atomic.AddUint64(packetsDropped, 1)
|
||||
if link.VerdictPermanent {
|
||||
if conn.VerdictPermanent {
|
||||
err = pkt.PermanentDrop()
|
||||
} else {
|
||||
err = pkt.Drop()
|
||||
@@ -364,13 +323,9 @@ func issueVerdict(pkt packet.Packet, link *network.Link, verdict network.Verdict
|
||||
err = pkt.Drop()
|
||||
}
|
||||
|
||||
link.Unlock()
|
||||
|
||||
if err != nil {
|
||||
log.Warningf("firewall: failed to apply verdict to pkt %s: %s", pkt, err)
|
||||
log.Warningf("filter: failed to apply verdict to pkt %s: %s", pkt, err)
|
||||
}
|
||||
|
||||
log.Tracer(pkt.Ctx()).Infof("firewall: %s %s", link.Verdict, link)
|
||||
}
|
||||
|
||||
// func tunnelHandler(pkt packet.Packet) {
|
||||
@@ -381,7 +336,7 @@ func issueVerdict(pkt packet.Packet, link *network.Link, verdict network.Verdict
|
||||
// }
|
||||
//
|
||||
// entry.CreateTunnel(pkt, tunnelInfo.Domain, tunnelInfo.RRCache.ExportAllARecords())
|
||||
// log.Tracef("firewall: rerouting %s to tunnel entry point", pkt)
|
||||
// log.Tracef("filter: rerouting %s to tunnel entry point", pkt)
|
||||
// pkt.RerouteToTunnel()
|
||||
// return
|
||||
// }
|
||||
@@ -403,7 +358,7 @@ func statLogger() {
|
||||
case <-module.Stopping():
|
||||
return
|
||||
case <-time.After(10 * time.Second):
|
||||
log.Tracef("firewall: packets accepted %d, blocked %d, dropped %d", atomic.LoadUint64(packetsAccepted), atomic.LoadUint64(packetsBlocked), atomic.LoadUint64(packetsDropped))
|
||||
log.Tracef("filter: packets accepted %d, blocked %d, dropped %d", atomic.LoadUint64(packetsAccepted), atomic.LoadUint64(packetsBlocked), atomic.LoadUint64(packetsDropped))
|
||||
atomic.StoreUint64(packetsAccepted, 0)
|
||||
atomic.StoreUint64(packetsBlocked, 0)
|
||||
atomic.StoreUint64(packetsDropped, 0)
|
||||
|
||||
Reference in New Issue
Block a user