Rework Communication+Link to Connection
This commit is contained in:
Daniel
150
network/clean.go
150
network/clean.go
@@ -9,113 +9,73 @@ import (
|
||||
)
|
||||
|
||||
var (
|
||||
cleanerTickDuration = 10 * time.Second
|
||||
deleteLinksAfterEndedThreshold = 5 * time.Minute
|
||||
deleteCommsWithoutLinksThreshhold = 3 * time.Minute
|
||||
|
||||
mtSaveLink = "save network link"
|
||||
cleanerTickDuration = 5 * time.Second
|
||||
deleteConnsAfterEndedThreshold = 5 * time.Minute
|
||||
)
|
||||
|
||||
func cleaner() {
|
||||
func connectionCleaner(ctx context.Context) error {
|
||||
ticker := time.NewTicker(cleanerTickDuration)
|
||||
|
||||
for {
|
||||
time.Sleep(cleanerTickDuration)
|
||||
|
||||
activeComms := cleanLinks()
|
||||
activeProcs := cleanComms(activeComms)
|
||||
process.CleanProcessStorage(activeProcs)
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
ticker.Stop()
|
||||
return nil
|
||||
case <-ticker.C:
|
||||
activePIDs := cleanConnections()
|
||||
process.CleanProcessStorage(activePIDs)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func cleanLinks() (activeComms map[string]struct{}) {
|
||||
activeComms = make(map[string]struct{})
|
||||
activeIDs := process.GetActiveConnectionIDs()
|
||||
func cleanConnections() (activePIDs map[int]struct{}) {
|
||||
activePIDs = make(map[int]struct{})
|
||||
|
||||
now := time.Now().Unix()
|
||||
deleteOlderThan := time.Now().Add(-deleteLinksAfterEndedThreshold).Unix()
|
||||
|
||||
linksLock.RLock()
|
||||
defer linksLock.RUnlock()
|
||||
|
||||
var found bool
|
||||
for key, link := range links {
|
||||
|
||||
// delete dead links
|
||||
link.lock.Lock()
|
||||
deleteThis := link.Ended > 0 && link.Ended < deleteOlderThan
|
||||
link.lock.Unlock()
|
||||
if deleteThis {
|
||||
log.Tracef("network.clean: deleted %s (ended at %d)", link.DatabaseKey(), link.Ended)
|
||||
go link.Delete()
|
||||
continue
|
||||
name := "clean connections" // TODO: change to new fn
|
||||
module.RunMediumPriorityMicroTask(&name, func(ctx context.Context) error {
|
||||
activeIDs := make(map[string]struct{})
|
||||
for _, cID := range process.GetActiveConnectionIDs() {
|
||||
activeIDs[cID] = struct{}{}
|
||||
}
|
||||
|
||||
// not yet deleted, so its still a valid link regarding link count
|
||||
comm := link.Communication()
|
||||
comm.lock.Lock()
|
||||
markActive(activeComms, comm.DatabaseKey())
|
||||
comm.lock.Unlock()
|
||||
now := time.Now().Unix()
|
||||
deleteOlderThan := time.Now().Add(-deleteConnsAfterEndedThreshold).Unix()
|
||||
|
||||
// check if link is dead
|
||||
found = false
|
||||
for _, activeID := range activeIDs {
|
||||
if key == activeID {
|
||||
found = true
|
||||
break
|
||||
connsLock.Lock()
|
||||
defer connsLock.Unlock()
|
||||
|
||||
for key, conn := range conns {
|
||||
// get conn.Ended
|
||||
conn.Lock()
|
||||
ended := conn.Ended
|
||||
conn.Unlock()
|
||||
|
||||
// delete inactive connections
|
||||
switch {
|
||||
case ended == 0:
|
||||
// Step 1: check if still active
|
||||
_, ok := activeIDs[key]
|
||||
if ok {
|
||||
activePIDs[conn.process.Pid] = struct{}{}
|
||||
} else {
|
||||
// Step 2: mark end
|
||||
activePIDs[conn.process.Pid] = struct{}{}
|
||||
conn.Lock()
|
||||
conn.Ended = now
|
||||
conn.Unlock()
|
||||
// "save"
|
||||
dbController.PushUpdate(conn)
|
||||
}
|
||||
case ended < deleteOlderThan:
|
||||
// Step 3: delete
|
||||
log.Tracef("network.clean: deleted %s (ended at %s)", conn.DatabaseKey(), time.Unix(conn.Ended, 0))
|
||||
conn.delete()
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if !found {
|
||||
// mark end time
|
||||
link.lock.Lock()
|
||||
link.Ended = now
|
||||
link.lock.Unlock()
|
||||
log.Tracef("network.clean: marked %s as ended", link.DatabaseKey())
|
||||
// save
|
||||
linkToSave := link
|
||||
module.StartMicroTask(&mtSaveLink, func(ctx context.Context) error {
|
||||
linkToSave.saveAndLog()
|
||||
return nil
|
||||
})
|
||||
}
|
||||
return nil
|
||||
})
|
||||
|
||||
}
|
||||
|
||||
return activeComms
|
||||
}
|
||||
|
||||
func cleanComms(activeLinks map[string]struct{}) (activeComms map[string]struct{}) {
|
||||
activeComms = make(map[string]struct{})
|
||||
|
||||
commsLock.RLock()
|
||||
defer commsLock.RUnlock()
|
||||
|
||||
threshold := time.Now().Add(-deleteCommsWithoutLinksThreshhold).Unix()
|
||||
for _, comm := range comms {
|
||||
// has links?
|
||||
_, hasLinks := activeLinks[comm.DatabaseKey()]
|
||||
|
||||
// comm created
|
||||
comm.lock.Lock()
|
||||
created := comm.Meta().Created
|
||||
comm.lock.Unlock()
|
||||
|
||||
if !hasLinks && created < threshold {
|
||||
log.Tracef("network.clean: deleted %s", comm.DatabaseKey())
|
||||
go comm.Delete()
|
||||
} else {
|
||||
p := comm.Process()
|
||||
p.Lock()
|
||||
markActive(activeComms, p.DatabaseKey())
|
||||
p.Unlock()
|
||||
}
|
||||
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
func markActive(activeMap map[string]struct{}, key string) {
|
||||
_, ok := activeMap[key]
|
||||
if !ok {
|
||||
activeMap[key] = struct{}{}
|
||||
}
|
||||
return activePIDs
|
||||
}
|
||||
|
||||
@@ -1,417 +0,0 @@
|
||||
package network
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/safing/portmaster/resolver"
|
||||
|
||||
"github.com/safing/portbase/database/record"
|
||||
"github.com/safing/portbase/log"
|
||||
"github.com/safing/portmaster/intel"
|
||||
"github.com/safing/portmaster/network/netutils"
|
||||
"github.com/safing/portmaster/network/packet"
|
||||
"github.com/safing/portmaster/process"
|
||||
)
|
||||
|
||||
// Communication describes a logical connection between a process and a domain.
|
||||
//nolint:maligned // TODO: fix alignment
|
||||
type Communication struct {
|
||||
record.Base
|
||||
lock sync.Mutex
|
||||
|
||||
Scope string
|
||||
Entity *intel.Entity
|
||||
Direction bool
|
||||
|
||||
Verdict Verdict
|
||||
Reason string
|
||||
ReasonID string // format source[:id[:id]]
|
||||
Inspect bool
|
||||
process *process.Process
|
||||
profileRevisionCounter uint64
|
||||
|
||||
FirstLinkEstablished int64
|
||||
LastLinkEstablished int64
|
||||
|
||||
saveWhenFinished bool
|
||||
}
|
||||
|
||||
// Lock locks the communication and the communication's Entity.
|
||||
func (comm *Communication) Lock() {
|
||||
comm.lock.Lock()
|
||||
comm.Entity.Lock()
|
||||
}
|
||||
|
||||
// Lock unlocks the communication and the communication's Entity.
|
||||
func (comm *Communication) Unlock() {
|
||||
comm.Entity.Unlock()
|
||||
comm.lock.Unlock()
|
||||
}
|
||||
|
||||
// Process returns the process that owns the connection.
|
||||
func (comm *Communication) Process() *process.Process {
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
|
||||
return comm.process
|
||||
}
|
||||
|
||||
// ResetVerdict resets the verdict to VerdictUndecided.
|
||||
func (comm *Communication) ResetVerdict() {
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
|
||||
comm.Verdict = VerdictUndecided
|
||||
comm.Reason = ""
|
||||
comm.saveWhenFinished = true
|
||||
}
|
||||
|
||||
// GetVerdict returns the current verdict.
|
||||
func (comm *Communication) GetVerdict() Verdict {
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
|
||||
return comm.Verdict
|
||||
}
|
||||
|
||||
// Accept accepts the communication and adds the given reason.
|
||||
func (comm *Communication) Accept(reason string) {
|
||||
comm.AddReason(reason)
|
||||
comm.UpdateVerdict(VerdictAccept)
|
||||
}
|
||||
|
||||
// Deny blocks or drops the communication depending on the connection direction and adds the given reason.
|
||||
func (comm *Communication) Deny(reason string) {
|
||||
if comm.Direction {
|
||||
comm.Drop(reason)
|
||||
} else {
|
||||
comm.Block(reason)
|
||||
}
|
||||
}
|
||||
|
||||
// Block blocks the communication and adds the given reason.
|
||||
func (comm *Communication) Block(reason string) {
|
||||
comm.AddReason(reason)
|
||||
comm.UpdateVerdict(VerdictBlock)
|
||||
}
|
||||
|
||||
// Drop drops the communication and adds the given reason.
|
||||
func (comm *Communication) Drop(reason string) {
|
||||
comm.AddReason(reason)
|
||||
comm.UpdateVerdict(VerdictDrop)
|
||||
}
|
||||
|
||||
// UpdateVerdict sets a new verdict for this link, making sure it does not interfere with previous verdicts.
|
||||
func (comm *Communication) UpdateVerdict(newVerdict Verdict) {
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
|
||||
if newVerdict > comm.Verdict {
|
||||
comm.Verdict = newVerdict
|
||||
comm.saveWhenFinished = true
|
||||
}
|
||||
}
|
||||
|
||||
// SetReason sets/replaces a human readable string as to why a certain verdict was set in regard to this communication.
|
||||
func (comm *Communication) SetReason(reason string) {
|
||||
if reason == "" {
|
||||
return
|
||||
}
|
||||
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
comm.Reason = reason
|
||||
comm.saveWhenFinished = true
|
||||
}
|
||||
|
||||
// AddReason adds a human readable string as to why a certain verdict was set in regard to this communication.
|
||||
func (comm *Communication) AddReason(reason string) {
|
||||
if reason == "" {
|
||||
return
|
||||
}
|
||||
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
|
||||
if comm.Reason != "" {
|
||||
comm.Reason += " | "
|
||||
}
|
||||
comm.Reason += reason
|
||||
}
|
||||
|
||||
// UpdateAndCheck updates profiles and checks whether a reevaluation is needed.
|
||||
func (comm *Communication) UpdateAndCheck() (needsReevaluation bool) {
|
||||
revCnt := comm.Process().Profile().Update()
|
||||
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
if comm.profileRevisionCounter != revCnt {
|
||||
comm.profileRevisionCounter = revCnt
|
||||
needsReevaluation = true
|
||||
}
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
// GetCommunicationByFirstPacket returns the matching communication from the internal storage.
|
||||
func GetCommunicationByFirstPacket(pkt packet.Packet) (*Communication, error) {
|
||||
// get Process
|
||||
proc, direction, err := process.GetProcessByPacket(pkt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var scope string
|
||||
|
||||
// Incoming
|
||||
if direction {
|
||||
switch netutils.ClassifyIP(pkt.Info().Src) {
|
||||
case netutils.HostLocal:
|
||||
scope = IncomingHost
|
||||
case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
|
||||
scope = IncomingLAN
|
||||
case netutils.Global, netutils.GlobalMulticast:
|
||||
scope = IncomingInternet
|
||||
case netutils.Invalid:
|
||||
scope = IncomingInvalid
|
||||
}
|
||||
|
||||
communication, ok := GetCommunication(proc.Pid, scope)
|
||||
if !ok {
|
||||
communication = &Communication{
|
||||
Scope: scope,
|
||||
Entity: (&intel.Entity{}).Init(),
|
||||
Direction: Inbound,
|
||||
process: proc,
|
||||
Inspect: true,
|
||||
FirstLinkEstablished: time.Now().Unix(),
|
||||
saveWhenFinished: true,
|
||||
}
|
||||
}
|
||||
communication.process.AddCommunication()
|
||||
return communication, nil
|
||||
}
|
||||
|
||||
// get domain
|
||||
ipinfo, err := resolver.GetIPInfo(pkt.FmtRemoteIP())
|
||||
|
||||
// PeerToPeer
|
||||
if err != nil {
|
||||
// if no domain could be found, it must be a direct connection (ie. no DNS)
|
||||
|
||||
switch netutils.ClassifyIP(pkt.Info().Dst) {
|
||||
case netutils.HostLocal:
|
||||
scope = PeerHost
|
||||
case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
|
||||
scope = PeerLAN
|
||||
case netutils.Global, netutils.GlobalMulticast:
|
||||
scope = PeerInternet
|
||||
case netutils.Invalid:
|
||||
scope = PeerInvalid
|
||||
}
|
||||
|
||||
communication, ok := GetCommunication(proc.Pid, scope)
|
||||
if !ok {
|
||||
communication = &Communication{
|
||||
Scope: scope,
|
||||
Entity: (&intel.Entity{}).Init(),
|
||||
Direction: Outbound,
|
||||
process: proc,
|
||||
Inspect: true,
|
||||
FirstLinkEstablished: time.Now().Unix(),
|
||||
saveWhenFinished: true,
|
||||
}
|
||||
}
|
||||
communication.process.AddCommunication()
|
||||
return communication, nil
|
||||
}
|
||||
|
||||
// To Domain
|
||||
// FIXME: how to handle multiple possible domains?
|
||||
communication, ok := GetCommunication(proc.Pid, ipinfo.Domains[0])
|
||||
if !ok {
|
||||
communication = &Communication{
|
||||
Scope: ipinfo.Domains[0],
|
||||
Entity: (&intel.Entity{
|
||||
Domain: ipinfo.Domains[0],
|
||||
}).Init(),
|
||||
Direction: Outbound,
|
||||
process: proc,
|
||||
Inspect: true,
|
||||
FirstLinkEstablished: time.Now().Unix(),
|
||||
saveWhenFinished: true,
|
||||
}
|
||||
}
|
||||
communication.process.AddCommunication()
|
||||
return communication, nil
|
||||
}
|
||||
|
||||
// var localhost = net.IPv4(127, 0, 0, 1)
|
||||
|
||||
var (
|
||||
dnsAddress = net.IPv4(127, 0, 0, 1)
|
||||
dnsPort uint16 = 53
|
||||
)
|
||||
|
||||
// GetCommunicationByDNSRequest returns the matching communication from the internal storage.
|
||||
func GetCommunicationByDNSRequest(ctx context.Context, ip net.IP, port uint16, fqdn string) (*Communication, error) {
|
||||
// get Process
|
||||
proc, err := process.GetProcessByEndpoints(ctx, ip, port, dnsAddress, dnsPort, packet.UDP)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
communication, ok := GetCommunication(proc.Pid, fqdn)
|
||||
if !ok {
|
||||
communication = &Communication{
|
||||
Scope: fqdn,
|
||||
Entity: (&intel.Entity{
|
||||
Domain: fqdn,
|
||||
}).Init(),
|
||||
process: proc,
|
||||
Inspect: true,
|
||||
saveWhenFinished: true,
|
||||
}
|
||||
communication.process.AddCommunication()
|
||||
communication.saveWhenFinished = true
|
||||
}
|
||||
return communication, nil
|
||||
}
|
||||
|
||||
// GetCommunication fetches a connection object from the internal storage.
|
||||
func GetCommunication(pid int, domain string) (comm *Communication, ok bool) {
|
||||
commsLock.RLock()
|
||||
defer commsLock.RUnlock()
|
||||
comm, ok = comms[fmt.Sprintf("%d/%s", pid, domain)]
|
||||
return
|
||||
}
|
||||
|
||||
func (comm *Communication) makeKey() string {
|
||||
return fmt.Sprintf("%d/%s", comm.process.Pid, comm.Scope)
|
||||
}
|
||||
|
||||
// SaveWhenFinished marks the Connection for saving after all current actions are finished.
|
||||
func (comm *Communication) SaveWhenFinished() {
|
||||
comm.saveWhenFinished = true
|
||||
}
|
||||
|
||||
// SaveIfNeeded saves the Connection if it is marked for saving when finished.
|
||||
func (comm *Communication) SaveIfNeeded() {
|
||||
comm.lock.Lock()
|
||||
save := comm.saveWhenFinished
|
||||
if save {
|
||||
comm.saveWhenFinished = false
|
||||
}
|
||||
comm.lock.Unlock()
|
||||
|
||||
if save {
|
||||
err := comm.save()
|
||||
if err != nil {
|
||||
log.Warningf("network: failed to save comm %s: %s", comm, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Save saves the Connection object in the storage and propagates the change.
|
||||
func (comm *Communication) save() error {
|
||||
// update comm
|
||||
comm.lock.Lock()
|
||||
if comm.process == nil {
|
||||
comm.lock.Unlock()
|
||||
return errors.New("cannot save connection without process")
|
||||
}
|
||||
|
||||
if !comm.KeyIsSet() {
|
||||
comm.SetKey(fmt.Sprintf("network:tree/%d/%s", comm.process.Pid, comm.Scope))
|
||||
comm.UpdateMeta()
|
||||
}
|
||||
if comm.Meta().Deleted > 0 {
|
||||
log.Criticalf("network: revieving dead comm %s", comm)
|
||||
comm.Meta().Deleted = 0
|
||||
}
|
||||
key := comm.makeKey()
|
||||
comm.saveWhenFinished = false
|
||||
comm.lock.Unlock()
|
||||
|
||||
// save comm
|
||||
commsLock.RLock()
|
||||
_, ok := comms[key]
|
||||
commsLock.RUnlock()
|
||||
|
||||
if !ok {
|
||||
commsLock.Lock()
|
||||
comms[key] = comm
|
||||
commsLock.Unlock()
|
||||
}
|
||||
|
||||
go dbController.PushUpdate(comm)
|
||||
return nil
|
||||
}
|
||||
|
||||
// Delete deletes a connection from the storage and propagates the change.
|
||||
func (comm *Communication) Delete() {
|
||||
commsLock.Lock()
|
||||
defer commsLock.Unlock()
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
|
||||
delete(comms, comm.makeKey())
|
||||
|
||||
comm.Meta().Delete()
|
||||
go dbController.PushUpdate(comm)
|
||||
}
|
||||
|
||||
// AddLink applies the Communication to the Link and sets timestamps.
|
||||
func (comm *Communication) AddLink(link *Link) {
|
||||
comm.lock.Lock()
|
||||
defer comm.lock.Unlock()
|
||||
|
||||
// apply comm to link
|
||||
link.lock.Lock()
|
||||
link.comm = comm
|
||||
link.Verdict = comm.Verdict
|
||||
link.Inspect = comm.Inspect
|
||||
// FIXME: use new copy methods
|
||||
link.Entity.Domain = comm.Entity.Domain
|
||||
link.saveWhenFinished = true
|
||||
link.lock.Unlock()
|
||||
|
||||
// check if we should save
|
||||
if comm.LastLinkEstablished < time.Now().Add(-3*time.Second).Unix() {
|
||||
comm.saveWhenFinished = true
|
||||
}
|
||||
|
||||
// update LastLinkEstablished
|
||||
comm.LastLinkEstablished = time.Now().Unix()
|
||||
if comm.FirstLinkEstablished == 0 {
|
||||
comm.FirstLinkEstablished = comm.LastLinkEstablished
|
||||
}
|
||||
}
|
||||
|
||||
// String returns a string representation of Communication.
|
||||
func (comm *Communication) String() string {
|
||||
comm.Lock()
|
||||
defer comm.Unlock()
|
||||
|
||||
switch comm.Scope {
|
||||
case IncomingHost, IncomingLAN, IncomingInternet, IncomingInvalid:
|
||||
if comm.process == nil {
|
||||
return "? <- *"
|
||||
}
|
||||
return fmt.Sprintf("%s <- *", comm.process.String())
|
||||
case PeerHost, PeerLAN, PeerInternet, PeerInvalid:
|
||||
if comm.process == nil {
|
||||
return "? -> *"
|
||||
}
|
||||
return fmt.Sprintf("%s -> *", comm.process.String())
|
||||
default:
|
||||
if comm.process == nil {
|
||||
return fmt.Sprintf("? -> %s", comm.Scope)
|
||||
}
|
||||
return fmt.Sprintf("%s -> %s", comm.process.String(), comm.Scope)
|
||||
}
|
||||
}
|
||||
379
network/connection.go
Normal file
379
network/connection.go
Normal file
@@ -0,0 +1,379 @@
|
||||
package network
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"strconv"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/safing/portbase/database/record"
|
||||
"github.com/safing/portbase/log"
|
||||
"github.com/safing/portmaster/intel"
|
||||
"github.com/safing/portmaster/network/netutils"
|
||||
"github.com/safing/portmaster/network/packet"
|
||||
"github.com/safing/portmaster/process"
|
||||
"github.com/safing/portmaster/resolver"
|
||||
)
|
||||
|
||||
// FirewallHandler defines the function signature for a firewall handle function
|
||||
type FirewallHandler func(conn *Connection, pkt packet.Packet)
|
||||
|
||||
// Connection describes a distinct physical network connection identified by the IP/Port pair.
|
||||
type Connection struct { //nolint:maligned // TODO: fix alignment
|
||||
record.Base
|
||||
sync.Mutex
|
||||
|
||||
ID string
|
||||
Scope string
|
||||
Inbound bool
|
||||
Entity *intel.Entity // needs locking, instance is never shared
|
||||
process *process.Process
|
||||
|
||||
Verdict Verdict
|
||||
Reason string
|
||||
ReasonID string // format source[:id[:id]] // TODO
|
||||
|
||||
Started int64
|
||||
Ended int64
|
||||
Tunneled bool
|
||||
VerdictPermanent bool
|
||||
Inspecting bool
|
||||
Encrypted bool // TODO
|
||||
|
||||
pktQueue chan packet.Packet
|
||||
firewallHandler FirewallHandler
|
||||
|
||||
activeInspectors []bool
|
||||
inspectorData map[uint8]interface{}
|
||||
|
||||
saveWhenFinished bool
|
||||
profileRevisionCounter uint64
|
||||
}
|
||||
|
||||
// NewConnectionFromDNSRequest
|
||||
func NewConnectionFromDNSRequest(ctx context.Context, fqdn string, ip net.IP, port uint16) *Connection {
|
||||
// get Process
|
||||
proc, err := process.GetProcessByEndpoints(ctx, ip, port, dnsAddress, dnsPort, packet.UDP)
|
||||
if err != nil {
|
||||
log.Warningf("network: failed to find process of dns request for %s: %s", fqdn, err)
|
||||
proc = process.UnknownProcess
|
||||
}
|
||||
|
||||
timestamp := time.Now().Unix()
|
||||
dnsConn := &Connection{
|
||||
Scope: fqdn,
|
||||
Entity: (&intel.Entity{
|
||||
Domain: fqdn,
|
||||
}).Init(),
|
||||
process: proc,
|
||||
Started: timestamp,
|
||||
Ended: timestamp,
|
||||
}
|
||||
saveOpenDNSRequest(dnsConn)
|
||||
return dnsConn
|
||||
}
|
||||
|
||||
func NewConnectionFromFirstPacket(pkt packet.Packet) *Connection {
|
||||
// get Process
|
||||
proc, inbound, err := process.GetProcessByPacket(pkt)
|
||||
if err != nil {
|
||||
log.Warningf("network: failed to find process of packet %s: %s", pkt, err)
|
||||
proc = process.UnknownProcess
|
||||
}
|
||||
|
||||
var scope string
|
||||
var entity *intel.Entity
|
||||
|
||||
if inbound {
|
||||
|
||||
// inbound connection
|
||||
switch netutils.ClassifyIP(pkt.Info().Src) {
|
||||
case netutils.HostLocal:
|
||||
scope = IncomingHost
|
||||
case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
|
||||
scope = IncomingLAN
|
||||
case netutils.Global, netutils.GlobalMulticast:
|
||||
scope = IncomingInternet
|
||||
default: // netutils.Invalid
|
||||
scope = IncomingInvalid
|
||||
}
|
||||
entity = (&intel.Entity{
|
||||
IP: pkt.Info().Src,
|
||||
Protocol: uint8(pkt.Info().Protocol),
|
||||
Port: pkt.Info().SrcPort,
|
||||
}).Init()
|
||||
|
||||
} else {
|
||||
|
||||
// outbound connection
|
||||
entity = (&intel.Entity{
|
||||
IP: pkt.Info().Dst,
|
||||
Protocol: uint8(pkt.Info().Protocol),
|
||||
Port: pkt.Info().DstPort,
|
||||
}).Init()
|
||||
|
||||
// check if we can find a domain for that IP
|
||||
ipinfo, err := resolver.GetIPInfo(pkt.Info().Dst.String())
|
||||
if err == nil {
|
||||
|
||||
// outbound to domain
|
||||
scope = ipinfo.Domains[0]
|
||||
entity.Domain = scope
|
||||
removeOpenDNSRequest(proc.Pid, scope)
|
||||
|
||||
} else {
|
||||
|
||||
// outbound direct (possibly P2P) connection
|
||||
switch netutils.ClassifyIP(pkt.Info().Dst) {
|
||||
case netutils.HostLocal:
|
||||
scope = PeerHost
|
||||
case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
|
||||
scope = PeerLAN
|
||||
case netutils.Global, netutils.GlobalMulticast:
|
||||
scope = PeerInternet
|
||||
default: // netutils.Invalid
|
||||
scope = PeerInvalid
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
timestamp := time.Now().Unix()
|
||||
return &Connection{
|
||||
ID: pkt.GetConnectionID(),
|
||||
Scope: scope,
|
||||
Entity: entity,
|
||||
process: proc,
|
||||
Started: timestamp,
|
||||
}
|
||||
}
|
||||
|
||||
// GetConnection fetches a Connection from the database.
|
||||
func GetConnection(id string) (*Connection, bool) {
|
||||
connsLock.RLock()
|
||||
defer connsLock.RUnlock()
|
||||
|
||||
conn, ok := conns[id]
|
||||
return conn, ok
|
||||
}
|
||||
|
||||
// Accept accepts the connection.
|
||||
func (conn *Connection) Accept(reason string) {
|
||||
if conn.SetVerdict(VerdictAccept) {
|
||||
conn.Reason = reason
|
||||
log.Infof("filter: granting connection %s, %s", conn, conn.Reason)
|
||||
} else {
|
||||
log.Warningf("filter: tried to accept %s, but current verdict is %s", conn, conn.Verdict)
|
||||
}
|
||||
}
|
||||
|
||||
// Block blocks the connection.
|
||||
func (conn *Connection) Block(reason string) {
|
||||
if conn.SetVerdict(VerdictBlock) {
|
||||
conn.Reason = reason
|
||||
log.Infof("filter: blocking connection %s, %s", conn, conn.Reason)
|
||||
} else {
|
||||
log.Warningf("filter: tried to block %s, but current verdict is %s", conn, conn.Verdict)
|
||||
}
|
||||
}
|
||||
|
||||
// Drop drops the connection.
|
||||
func (conn *Connection) Drop(reason string) {
|
||||
if conn.SetVerdict(VerdictDrop) {
|
||||
conn.Reason = reason
|
||||
log.Infof("filter: dropping connection %s, %s", conn, conn.Reason)
|
||||
} else {
|
||||
log.Warningf("filter: tried to drop %s, but current verdict is %s", conn, conn.Verdict)
|
||||
}
|
||||
}
|
||||
|
||||
// Deny blocks or drops the link depending on the connection direction.
|
||||
func (conn *Connection) Deny(reason string) {
|
||||
if conn.Inbound {
|
||||
conn.Drop(reason)
|
||||
} else {
|
||||
conn.Block(reason)
|
||||
}
|
||||
}
|
||||
|
||||
// SetVerdict sets a new verdict for the connection, making sure it does not interfere with previous verdicts.
|
||||
func (conn *Connection) SetVerdict(newVerdict Verdict) (ok bool) {
|
||||
if newVerdict >= conn.Verdict {
|
||||
conn.Verdict = newVerdict
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// Process returns the connection's process.
|
||||
func (conn *Connection) Process() *process.Process {
|
||||
return conn.process
|
||||
}
|
||||
|
||||
// SaveWhenFinished marks the connection for saving it after the firewall handler.
|
||||
func (conn *Connection) SaveWhenFinished() {
|
||||
conn.saveWhenFinished = true
|
||||
}
|
||||
|
||||
// save saves the link object in the storage and propagates the change.
|
||||
func (conn *Connection) save() {
|
||||
if conn.ID == "" {
|
||||
|
||||
// dns request
|
||||
if !conn.KeyIsSet() {
|
||||
conn.SetKey(fmt.Sprintf("network:tree/%d/%s", conn.process.Pid, conn.Scope))
|
||||
conn.UpdateMeta()
|
||||
}
|
||||
// save to internal state
|
||||
// check if it already exists
|
||||
mapKey := strconv.Itoa(conn.process.Pid) + "/" + conn.Scope
|
||||
dnsConnsLock.RLock()
|
||||
_, ok := dnsConns[mapKey]
|
||||
dnsConnsLock.RUnlock()
|
||||
if !ok {
|
||||
dnsConnsLock.Lock()
|
||||
dnsConns[mapKey] = conn
|
||||
dnsConnsLock.Unlock()
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
// connection
|
||||
if !conn.KeyIsSet() {
|
||||
conn.SetKey(fmt.Sprintf("network:tree/%d/%s/%s", conn.process.Pid, conn.Scope, conn.ID))
|
||||
conn.UpdateMeta()
|
||||
}
|
||||
// save to internal state
|
||||
// check if it already exists
|
||||
connsLock.RLock()
|
||||
_, ok := conns[conn.ID]
|
||||
connsLock.RUnlock()
|
||||
if !ok {
|
||||
connsLock.Lock()
|
||||
conns[conn.ID] = conn
|
||||
connsLock.Unlock()
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// notify database controller
|
||||
dbController.PushUpdate(conn)
|
||||
}
|
||||
|
||||
// delete deletes a link from the storage and propagates the change. Nothing is locked - both the conns map and the connection itself require locking
|
||||
func (conn *Connection) delete() {
|
||||
delete(conns, conn.ID)
|
||||
|
||||
conn.Meta().Delete()
|
||||
dbController.PushUpdate(conn)
|
||||
}
|
||||
|
||||
// UpdateAndCheck updates profiles and checks whether a reevaluation is needed.
|
||||
func (conn *Connection) UpdateAndCheck() (needsReevaluation bool) {
|
||||
p := conn.process.Profile()
|
||||
if p == nil {
|
||||
return false
|
||||
}
|
||||
revCnt := p.Update()
|
||||
|
||||
if conn.profileRevisionCounter != revCnt {
|
||||
conn.profileRevisionCounter = revCnt
|
||||
needsReevaluation = true
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// SetFirewallHandler sets the firewall handler for this link, and starts a worker to handle the packets.
|
||||
func (conn *Connection) SetFirewallHandler(handler FirewallHandler) {
|
||||
if conn.firewallHandler == nil {
|
||||
conn.pktQueue = make(chan packet.Packet, 1000)
|
||||
|
||||
// start handling
|
||||
module.StartWorker("packet handler", func(ctx context.Context) error {
|
||||
conn.packetHandler()
|
||||
return nil
|
||||
})
|
||||
}
|
||||
conn.firewallHandler = handler
|
||||
}
|
||||
|
||||
// StopFirewallHandler unsets the firewall handler and stops the handler worker.
|
||||
func (conn *Connection) StopFirewallHandler() {
|
||||
conn.firewallHandler = nil
|
||||
conn.pktQueue <- nil
|
||||
}
|
||||
|
||||
// HandlePacket queues packet of Link for handling
|
||||
func (conn *Connection) HandlePacket(pkt packet.Packet) {
|
||||
conn.Lock()
|
||||
defer conn.Unlock()
|
||||
|
||||
// execute handler or verdict
|
||||
if conn.firewallHandler != nil {
|
||||
conn.pktQueue <- pkt
|
||||
// TODO: drop if overflowing?
|
||||
} else {
|
||||
defaultFirewallHandler(conn, pkt)
|
||||
}
|
||||
}
|
||||
|
||||
// packetHandler sequentially handles queued packets
|
||||
func (conn *Connection) packetHandler() {
|
||||
for {
|
||||
pkt := <-conn.pktQueue
|
||||
if pkt == nil {
|
||||
return
|
||||
}
|
||||
// get handler
|
||||
conn.Lock()
|
||||
// execute handler or verdict
|
||||
if conn.firewallHandler != nil {
|
||||
conn.firewallHandler(conn, pkt)
|
||||
} else {
|
||||
defaultFirewallHandler(conn, pkt)
|
||||
}
|
||||
conn.Unlock()
|
||||
// save does not touch any changing data
|
||||
// must not be locked, will deadlock with cleaner functions
|
||||
if conn.saveWhenFinished {
|
||||
conn.saveWhenFinished = false
|
||||
conn.save()
|
||||
}
|
||||
// submit trace logs
|
||||
log.Tracer(pkt.Ctx()).Submit()
|
||||
}
|
||||
}
|
||||
|
||||
// GetActiveInspectors returns the list of active inspectors.
|
||||
func (conn *Connection) GetActiveInspectors() []bool {
|
||||
return conn.activeInspectors
|
||||
}
|
||||
|
||||
// SetActiveInspectors sets the list of active inspectors.
|
||||
func (conn *Connection) SetActiveInspectors(new []bool) {
|
||||
conn.activeInspectors = new
|
||||
}
|
||||
|
||||
// GetInspectorData returns the list of inspector data.
|
||||
func (conn *Connection) GetInspectorData() map[uint8]interface{} {
|
||||
return conn.inspectorData
|
||||
}
|
||||
|
||||
// SetInspectorData set the list of inspector data.
|
||||
func (conn *Connection) SetInspectorData(new map[uint8]interface{}) {
|
||||
conn.inspectorData = new
|
||||
}
|
||||
|
||||
// String returns a string representation of conn.
|
||||
func (conn *Connection) String() string {
|
||||
switch conn.Scope {
|
||||
case IncomingHost, IncomingLAN, IncomingInternet, IncomingInvalid:
|
||||
return fmt.Sprintf("%s <- %s", conn.process, conn.Entity.IP)
|
||||
case PeerHost, PeerLAN, PeerInternet, PeerInvalid:
|
||||
return fmt.Sprintf("%s -> %s", conn.process, conn.Entity.IP)
|
||||
default:
|
||||
return fmt.Sprintf("%s to %s (%s)", conn.process, conn.Entity.Domain, conn.Entity.IP)
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,6 @@
|
||||
package network
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
@@ -15,10 +14,10 @@ import (
|
||||
)
|
||||
|
||||
var (
|
||||
links = make(map[string]*Link) // key: Link ID
|
||||
linksLock sync.RWMutex
|
||||
comms = make(map[string]*Communication) // key: PID/Domain
|
||||
commsLock sync.RWMutex
|
||||
dnsConns = make(map[string]*Connection) // key: <PID>/Scope
|
||||
dnsConnsLock sync.RWMutex
|
||||
conns = make(map[string]*Connection) // key: Connection ID
|
||||
connsLock sync.RWMutex
|
||||
|
||||
dbController *database.Controller
|
||||
)
|
||||
@@ -44,18 +43,18 @@ func (s *StorageInterface) Get(key string) (record.Record, error) {
|
||||
}
|
||||
}
|
||||
case 3:
|
||||
commsLock.RLock()
|
||||
defer commsLock.RUnlock()
|
||||
conn, ok := comms[fmt.Sprintf("%s/%s", splitted[1], splitted[2])]
|
||||
dnsConnsLock.RLock()
|
||||
defer dnsConnsLock.RUnlock()
|
||||
conn, ok := dnsConns[splitted[1]+"/"+splitted[2]]
|
||||
if ok {
|
||||
return conn, nil
|
||||
}
|
||||
case 4:
|
||||
linksLock.RLock()
|
||||
defer linksLock.RUnlock()
|
||||
link, ok := links[splitted[3]]
|
||||
connsLock.RLock()
|
||||
defer connsLock.RUnlock()
|
||||
conn, ok := conns[splitted[3]]
|
||||
if ok {
|
||||
return link, nil
|
||||
return conn, nil
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -85,25 +84,25 @@ func (s *StorageInterface) processQuery(q *query.Query, it *iterator.Iterator) {
|
||||
}
|
||||
|
||||
if slashes <= 2 {
|
||||
// comms
|
||||
commsLock.RLock()
|
||||
for _, conn := range comms {
|
||||
// dns scopes only
|
||||
dnsConnsLock.RLock()
|
||||
for _, dnsConns := range dnsConns {
|
||||
if strings.HasPrefix(dnsConns.DatabaseKey(), q.DatabaseKeyPrefix()) {
|
||||
it.Next <- dnsConns
|
||||
}
|
||||
}
|
||||
dnsConnsLock.RUnlock()
|
||||
}
|
||||
|
||||
if slashes <= 3 {
|
||||
// connections
|
||||
connsLock.RLock()
|
||||
for _, conn := range conns {
|
||||
if strings.HasPrefix(conn.DatabaseKey(), q.DatabaseKeyPrefix()) {
|
||||
it.Next <- conn
|
||||
}
|
||||
}
|
||||
commsLock.RUnlock()
|
||||
}
|
||||
|
||||
if slashes <= 3 {
|
||||
// links
|
||||
linksLock.RLock()
|
||||
for _, link := range links {
|
||||
if strings.HasPrefix(link.DatabaseKey(), q.DatabaseKeyPrefix()) {
|
||||
it.Next <- link
|
||||
}
|
||||
}
|
||||
linksLock.RUnlock()
|
||||
connsLock.RUnlock()
|
||||
}
|
||||
|
||||
it.Finish(nil)
|
||||
|
||||
73
network/dns.go
Normal file
73
network/dns.go
Normal file
@@ -0,0 +1,73 @@
|
||||
package network
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strconv"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
var (
|
||||
openDNSRequests = make(map[string]*Connection) // key: <pid>/fqdn
|
||||
openDNSRequestsLock sync.Mutex
|
||||
|
||||
// write open dns requests every
|
||||
writeOpenDNSRequestsTickDuration = 5 * time.Second
|
||||
|
||||
// duration after which DNS requests without a following connection are logged
|
||||
openDNSRequestLimit = 3 * time.Second
|
||||
)
|
||||
|
||||
func removeOpenDNSRequest(pid int, fqdn string) {
|
||||
openDNSRequestsLock.Lock()
|
||||
defer openDNSRequestsLock.Unlock()
|
||||
|
||||
key := strconv.Itoa(pid) + "/" + fqdn
|
||||
delete(openDNSRequests, key)
|
||||
}
|
||||
|
||||
func saveOpenDNSRequest(conn *Connection) {
|
||||
openDNSRequestsLock.Lock()
|
||||
defer openDNSRequestsLock.Unlock()
|
||||
|
||||
key := strconv.Itoa(conn.process.Pid) + "/" + conn.Scope
|
||||
|
||||
existingConn, ok := openDNSRequests[key]
|
||||
if ok {
|
||||
existingConn.Lock()
|
||||
defer existingConn.Unlock()
|
||||
|
||||
existingConn.Ended = conn.Started
|
||||
} else {
|
||||
openDNSRequests[key] = conn
|
||||
}
|
||||
}
|
||||
|
||||
func openDNSRequestWriter(ctx context.Context) error {
|
||||
ticker := time.NewTicker(writeOpenDNSRequestsTickDuration)
|
||||
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
ticker.Stop()
|
||||
return nil
|
||||
case <-ticker.C:
|
||||
writeOpenDNSRequestsToDB()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func writeOpenDNSRequestsToDB() {
|
||||
openDNSRequestsLock.Lock()
|
||||
defer openDNSRequestsLock.Unlock()
|
||||
|
||||
threshold := time.Now().Add(-openDNSRequestLimit).Unix()
|
||||
for id, conn := range openDNSRequests {
|
||||
conn.Lock()
|
||||
if conn.Ended < threshold {
|
||||
conn.save()
|
||||
delete(openDNSRequests, id)
|
||||
}
|
||||
conn.Unlock()
|
||||
}
|
||||
}
|
||||
428
network/link.go
428
network/link.go
@@ -1,428 +0,0 @@
|
||||
package network
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/safing/portmaster/intel"
|
||||
|
||||
"github.com/safing/portbase/database/record"
|
||||
"github.com/safing/portbase/log"
|
||||
"github.com/safing/portmaster/network/packet"
|
||||
)
|
||||
|
||||
// FirewallHandler defines the function signature for a firewall handle function
|
||||
type FirewallHandler func(pkt packet.Packet, link *Link)
|
||||
|
||||
// Link describes a distinct physical connection (e.g. TCP connection) - like an instance - of a Connection.
|
||||
type Link struct { //nolint:maligned // TODO: fix alignment
|
||||
record.Base
|
||||
lock sync.Mutex
|
||||
|
||||
ID string
|
||||
Entity *intel.Entity
|
||||
Direction bool
|
||||
|
||||
Verdict Verdict
|
||||
Reason string
|
||||
ReasonID string // format source[:id[:id]]
|
||||
Tunneled bool
|
||||
VerdictPermanent bool
|
||||
Inspect bool
|
||||
Started int64
|
||||
Ended int64
|
||||
|
||||
pktQueue chan packet.Packet
|
||||
firewallHandler FirewallHandler
|
||||
comm *Communication
|
||||
|
||||
activeInspectors []bool
|
||||
inspectorData map[uint8]interface{}
|
||||
saveWhenFinished bool
|
||||
}
|
||||
|
||||
// Lock locks the link and the link's Entity.
|
||||
func (link *Link) Lock() {
|
||||
link.lock.Lock()
|
||||
link.Entity.Lock()
|
||||
}
|
||||
|
||||
// Lock unlocks the link and the link's Entity.
|
||||
func (link *Link) Unlock() {
|
||||
link.Entity.Unlock()
|
||||
link.lock.Unlock()
|
||||
}
|
||||
|
||||
// Communication returns the Communication the Link is part of
|
||||
func (link *Link) Communication() *Communication {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
return link.comm
|
||||
}
|
||||
|
||||
// GetVerdict returns the current verdict.
|
||||
func (link *Link) GetVerdict() Verdict {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
return link.Verdict
|
||||
}
|
||||
|
||||
// FirewallHandlerIsSet returns whether a firewall handler is set or not
|
||||
func (link *Link) FirewallHandlerIsSet() bool {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
return link.firewallHandler != nil
|
||||
}
|
||||
|
||||
// SetFirewallHandler sets the firewall handler for this link
|
||||
func (link *Link) SetFirewallHandler(handler FirewallHandler) {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
if link.firewallHandler == nil {
|
||||
link.pktQueue = make(chan packet.Packet, 1000)
|
||||
|
||||
// start handling
|
||||
module.StartWorker("packet handler", func(ctx context.Context) error {
|
||||
link.packetHandler()
|
||||
return nil
|
||||
})
|
||||
}
|
||||
link.firewallHandler = handler
|
||||
}
|
||||
|
||||
// StopFirewallHandler unsets the firewall handler
|
||||
func (link *Link) StopFirewallHandler() {
|
||||
link.lock.Lock()
|
||||
link.firewallHandler = nil
|
||||
link.lock.Unlock()
|
||||
link.pktQueue <- nil
|
||||
}
|
||||
|
||||
// HandlePacket queues packet of Link for handling
|
||||
func (link *Link) HandlePacket(pkt packet.Packet) {
|
||||
// get handler
|
||||
link.lock.Lock()
|
||||
handler := link.firewallHandler
|
||||
link.lock.Unlock()
|
||||
|
||||
// send to queue
|
||||
if handler != nil {
|
||||
link.pktQueue <- pkt
|
||||
return
|
||||
}
|
||||
|
||||
// no handler!
|
||||
log.Warningf("network: link %s does not have a firewallHandler, dropping packet", link)
|
||||
err := pkt.Drop()
|
||||
if err != nil {
|
||||
log.Warningf("network: failed to drop packet %s: %s", pkt, err)
|
||||
}
|
||||
}
|
||||
|
||||
// Accept accepts the link and adds the given reason.
|
||||
func (link *Link) Accept(reason string) {
|
||||
link.AddReason(reason)
|
||||
link.UpdateVerdict(VerdictAccept)
|
||||
}
|
||||
|
||||
// Deny blocks or drops the link depending on the connection direction and adds the given reason.
|
||||
func (link *Link) Deny(reason string) {
|
||||
if link.Direction {
|
||||
link.Drop(reason)
|
||||
} else {
|
||||
link.Block(reason)
|
||||
}
|
||||
}
|
||||
|
||||
// Block blocks the link and adds the given reason.
|
||||
func (link *Link) Block(reason string) {
|
||||
link.AddReason(reason)
|
||||
link.UpdateVerdict(VerdictBlock)
|
||||
}
|
||||
|
||||
// Drop drops the link and adds the given reason.
|
||||
func (link *Link) Drop(reason string) {
|
||||
link.AddReason(reason)
|
||||
link.UpdateVerdict(VerdictDrop)
|
||||
}
|
||||
|
||||
// RerouteToNameserver reroutes the link to the portmaster nameserver.
|
||||
func (link *Link) RerouteToNameserver() {
|
||||
link.UpdateVerdict(VerdictRerouteToNameserver)
|
||||
}
|
||||
|
||||
// RerouteToTunnel reroutes the link to the tunnel entrypoint and adds the given reason for accepting the connection.
|
||||
func (link *Link) RerouteToTunnel(reason string) {
|
||||
link.AddReason(reason)
|
||||
link.UpdateVerdict(VerdictRerouteToTunnel)
|
||||
}
|
||||
|
||||
// UpdateVerdict sets a new verdict for this link, making sure it does not interfere with previous verdicts
|
||||
func (link *Link) UpdateVerdict(newVerdict Verdict) {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
if newVerdict > link.Verdict {
|
||||
link.Verdict = newVerdict
|
||||
link.saveWhenFinished = true
|
||||
}
|
||||
}
|
||||
|
||||
// AddReason adds a human readable string as to why a certain verdict was set in regard to this link
|
||||
func (link *Link) AddReason(reason string) {
|
||||
if reason == "" {
|
||||
return
|
||||
}
|
||||
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
if link.Reason != "" {
|
||||
link.Reason += " | "
|
||||
}
|
||||
link.Reason += reason
|
||||
|
||||
link.saveWhenFinished = true
|
||||
}
|
||||
|
||||
// packetHandler sequentially handles queued packets
|
||||
func (link *Link) packetHandler() {
|
||||
for {
|
||||
pkt := <-link.pktQueue
|
||||
if pkt == nil {
|
||||
return
|
||||
}
|
||||
// get handler
|
||||
link.lock.Lock()
|
||||
handler := link.firewallHandler
|
||||
link.lock.Unlock()
|
||||
// execute handler or verdict
|
||||
if handler != nil {
|
||||
handler(pkt, link)
|
||||
} else {
|
||||
link.ApplyVerdict(pkt)
|
||||
}
|
||||
// submit trace logs
|
||||
log.Tracer(pkt.Ctx()).Submit()
|
||||
}
|
||||
}
|
||||
|
||||
// ApplyVerdict appies the link verdict to a packet.
|
||||
func (link *Link) ApplyVerdict(pkt packet.Packet) {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
var err error
|
||||
|
||||
if link.VerdictPermanent {
|
||||
switch link.Verdict {
|
||||
case VerdictAccept:
|
||||
err = pkt.PermanentAccept()
|
||||
case VerdictBlock:
|
||||
err = pkt.PermanentBlock()
|
||||
case VerdictDrop:
|
||||
err = pkt.PermanentDrop()
|
||||
case VerdictRerouteToNameserver:
|
||||
err = pkt.RerouteToNameserver()
|
||||
case VerdictRerouteToTunnel:
|
||||
err = pkt.RerouteToTunnel()
|
||||
default:
|
||||
err = pkt.Drop()
|
||||
}
|
||||
} else {
|
||||
switch link.Verdict {
|
||||
case VerdictAccept:
|
||||
err = pkt.Accept()
|
||||
case VerdictBlock:
|
||||
err = pkt.Block()
|
||||
case VerdictDrop:
|
||||
err = pkt.Drop()
|
||||
case VerdictRerouteToNameserver:
|
||||
err = pkt.RerouteToNameserver()
|
||||
case VerdictRerouteToTunnel:
|
||||
err = pkt.RerouteToTunnel()
|
||||
default:
|
||||
err = pkt.Drop()
|
||||
}
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
log.Warningf("network: failed to apply link verdict to packet %s: %s", pkt, err)
|
||||
}
|
||||
}
|
||||
|
||||
// SaveWhenFinished marks the Link for saving after all current actions are finished.
|
||||
func (link *Link) SaveWhenFinished() {
|
||||
// FIXME: check if we should lock here
|
||||
link.saveWhenFinished = true
|
||||
}
|
||||
|
||||
// SaveIfNeeded saves the Link if it is marked for saving when finished.
|
||||
func (link *Link) SaveIfNeeded() {
|
||||
link.lock.Lock()
|
||||
save := link.saveWhenFinished
|
||||
if save {
|
||||
link.saveWhenFinished = false
|
||||
}
|
||||
link.lock.Unlock()
|
||||
|
||||
if save {
|
||||
link.saveAndLog()
|
||||
}
|
||||
}
|
||||
|
||||
// saveAndLog saves the link object in the storage and propagates the change. It does not return an error, but logs it.
|
||||
func (link *Link) saveAndLog() {
|
||||
err := link.save()
|
||||
if err != nil {
|
||||
log.Warningf("network: failed to save link %s: %s", link, err)
|
||||
}
|
||||
}
|
||||
|
||||
// save saves the link object in the storage and propagates the change.
|
||||
func (link *Link) save() error {
|
||||
// update link
|
||||
link.lock.Lock()
|
||||
if link.comm == nil {
|
||||
link.lock.Unlock()
|
||||
return errors.New("cannot save link without comms")
|
||||
}
|
||||
|
||||
if !link.KeyIsSet() {
|
||||
link.SetKey(fmt.Sprintf("network:tree/%d/%s/%s", link.comm.Process().Pid, link.comm.Scope, link.ID))
|
||||
link.UpdateMeta()
|
||||
}
|
||||
link.saveWhenFinished = false
|
||||
link.lock.Unlock()
|
||||
|
||||
// save link
|
||||
linksLock.RLock()
|
||||
_, ok := links[link.ID]
|
||||
linksLock.RUnlock()
|
||||
|
||||
if !ok {
|
||||
linksLock.Lock()
|
||||
links[link.ID] = link
|
||||
linksLock.Unlock()
|
||||
}
|
||||
|
||||
go dbController.PushUpdate(link)
|
||||
return nil
|
||||
}
|
||||
|
||||
// Delete deletes a link from the storage and propagates the change.
|
||||
func (link *Link) Delete() {
|
||||
linksLock.Lock()
|
||||
defer linksLock.Unlock()
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
delete(links, link.ID)
|
||||
|
||||
link.Meta().Delete()
|
||||
go dbController.PushUpdate(link)
|
||||
}
|
||||
|
||||
// GetLink fetches a Link from the database from the default namespace for this object
|
||||
func GetLink(id string) (*Link, bool) {
|
||||
linksLock.RLock()
|
||||
defer linksLock.RUnlock()
|
||||
|
||||
link, ok := links[id]
|
||||
return link, ok
|
||||
}
|
||||
|
||||
// GetOrCreateLinkByPacket returns the associated Link for a packet and a bool expressing if the Link was newly created
|
||||
func GetOrCreateLinkByPacket(pkt packet.Packet) (*Link, bool) {
|
||||
link, ok := GetLink(pkt.GetLinkID())
|
||||
if ok {
|
||||
log.Tracer(pkt.Ctx()).Tracef("network: assigned to link %s", link.ID)
|
||||
return link, false
|
||||
}
|
||||
link = CreateLinkFromPacket(pkt)
|
||||
log.Tracer(pkt.Ctx()).Tracef("network: created new link %s", link.ID)
|
||||
return link, true
|
||||
}
|
||||
|
||||
// CreateLinkFromPacket creates a new Link based on Packet.
|
||||
func CreateLinkFromPacket(pkt packet.Packet) *Link {
|
||||
link := &Link{
|
||||
ID: pkt.GetLinkID(),
|
||||
Entity: (&intel.Entity{
|
||||
IP: pkt.Info().RemoteIP(),
|
||||
Protocol: uint8(pkt.Info().Protocol),
|
||||
Port: pkt.Info().RemotePort(),
|
||||
}).Init(),
|
||||
Direction: pkt.IsInbound(),
|
||||
Verdict: VerdictUndecided,
|
||||
Started: time.Now().Unix(),
|
||||
saveWhenFinished: true,
|
||||
}
|
||||
return link
|
||||
}
|
||||
|
||||
// GetActiveInspectors returns the list of active inspectors.
|
||||
func (link *Link) GetActiveInspectors() []bool {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
return link.activeInspectors
|
||||
}
|
||||
|
||||
// SetActiveInspectors sets the list of active inspectors.
|
||||
func (link *Link) SetActiveInspectors(new []bool) {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
link.activeInspectors = new
|
||||
}
|
||||
|
||||
// GetInspectorData returns the list of inspector data.
|
||||
func (link *Link) GetInspectorData() map[uint8]interface{} {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
return link.inspectorData
|
||||
}
|
||||
|
||||
// SetInspectorData set the list of inspector data.
|
||||
func (link *Link) SetInspectorData(new map[uint8]interface{}) {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
link.inspectorData = new
|
||||
}
|
||||
|
||||
// String returns a string representation of Link.
|
||||
func (link *Link) String() string {
|
||||
link.lock.Lock()
|
||||
defer link.lock.Unlock()
|
||||
|
||||
if link.comm == nil {
|
||||
return fmt.Sprintf("? <-> %s", link.Entity.IP.String())
|
||||
}
|
||||
switch link.comm.Scope {
|
||||
case IncomingHost, IncomingLAN, IncomingInternet, IncomingInvalid:
|
||||
if link.comm.process == nil {
|
||||
return fmt.Sprintf("? <- %s", link.Entity.IP.String())
|
||||
}
|
||||
return fmt.Sprintf("%s <- %s", link.comm.process.String(), link.Entity.IP.String())
|
||||
case PeerHost, PeerLAN, PeerInternet, PeerInvalid:
|
||||
if link.comm.process == nil {
|
||||
return fmt.Sprintf("? -> %s", link.Entity.IP.String())
|
||||
}
|
||||
return fmt.Sprintf("%s -> %s", link.comm.process.String(), link.Entity.IP.String())
|
||||
default:
|
||||
if link.comm.process == nil {
|
||||
return fmt.Sprintf("? -> %s (%s)", link.comm.Scope, link.Entity.IP.String())
|
||||
}
|
||||
return fmt.Sprintf("%s to %s (%s)", link.comm.process.String(), link.comm.Scope, link.Entity.IP.String())
|
||||
}
|
||||
}
|
||||
@@ -1,24 +1,39 @@
|
||||
package network
|
||||
|
||||
import (
|
||||
"net"
|
||||
|
||||
"github.com/safing/portbase/modules"
|
||||
)
|
||||
|
||||
var (
|
||||
module *modules.Module
|
||||
|
||||
dnsAddress = net.IPv4(127, 0, 0, 1)
|
||||
dnsPort uint16 = 53
|
||||
|
||||
defaultFirewallHandler FirewallHandler
|
||||
)
|
||||
|
||||
func init() {
|
||||
module = modules.Register("network", nil, start, nil, "core", "processes")
|
||||
}
|
||||
|
||||
// SetDefaultFirewallHandler sets the default firewall handler.
|
||||
func SetDefaultFirewallHandler(handler FirewallHandler) {
|
||||
if defaultFirewallHandler == nil {
|
||||
defaultFirewallHandler = handler
|
||||
}
|
||||
}
|
||||
|
||||
func start() error {
|
||||
err := registerAsDatabase()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
go cleaner()
|
||||
module.StartServiceWorker("clean connections", 0, connectionCleaner)
|
||||
module.StartServiceWorker("write open dns requests", 0, openDNSRequestWriter)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -10,7 +10,7 @@ import (
|
||||
type Base struct {
|
||||
ctx context.Context
|
||||
info Info
|
||||
linkID string
|
||||
connID string
|
||||
Payload []byte
|
||||
}
|
||||
|
||||
@@ -70,26 +70,26 @@ func (pkt *Base) GetPayload() ([]byte, error) {
|
||||
return pkt.Payload, ErrFailedToLoadPayload
|
||||
}
|
||||
|
||||
// GetLinkID returns the link ID for this packet.
|
||||
func (pkt *Base) GetLinkID() string {
|
||||
if pkt.linkID == "" {
|
||||
pkt.createLinkID()
|
||||
// GetConnectionID returns the link ID for this packet.
|
||||
func (pkt *Base) GetConnectionID() string {
|
||||
if pkt.connID == "" {
|
||||
pkt.createConnectionID()
|
||||
}
|
||||
return pkt.linkID
|
||||
return pkt.connID
|
||||
}
|
||||
|
||||
func (pkt *Base) createLinkID() {
|
||||
func (pkt *Base) createConnectionID() {
|
||||
if pkt.info.Protocol == TCP || pkt.info.Protocol == UDP {
|
||||
if pkt.info.Direction {
|
||||
pkt.linkID = fmt.Sprintf("%d-%s-%d-%s-%d", pkt.info.Protocol, pkt.info.Dst, pkt.info.DstPort, pkt.info.Src, pkt.info.SrcPort)
|
||||
pkt.connID = fmt.Sprintf("%d-%s-%d-%s-%d", pkt.info.Protocol, pkt.info.Dst, pkt.info.DstPort, pkt.info.Src, pkt.info.SrcPort)
|
||||
} else {
|
||||
pkt.linkID = fmt.Sprintf("%d-%s-%d-%s-%d", pkt.info.Protocol, pkt.info.Src, pkt.info.SrcPort, pkt.info.Dst, pkt.info.DstPort)
|
||||
pkt.connID = fmt.Sprintf("%d-%s-%d-%s-%d", pkt.info.Protocol, pkt.info.Src, pkt.info.SrcPort, pkt.info.Dst, pkt.info.DstPort)
|
||||
}
|
||||
} else {
|
||||
if pkt.info.Direction {
|
||||
pkt.linkID = fmt.Sprintf("%d-%s-%s", pkt.info.Protocol, pkt.info.Dst, pkt.info.Src)
|
||||
pkt.connID = fmt.Sprintf("%d-%s-%s", pkt.info.Protocol, pkt.info.Dst, pkt.info.Src)
|
||||
} else {
|
||||
pkt.linkID = fmt.Sprintf("%d-%s-%s", pkt.info.Protocol, pkt.info.Src, pkt.info.Dst)
|
||||
pkt.connID = fmt.Sprintf("%d-%s-%s", pkt.info.Protocol, pkt.info.Src, pkt.info.Dst)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -215,7 +215,7 @@ type Packet interface {
|
||||
SetOutbound()
|
||||
HasPorts() bool
|
||||
GetPayload() ([]byte, error)
|
||||
GetLinkID() string
|
||||
GetConnectionID() string
|
||||
|
||||
// MATCHING
|
||||
MatchesAddress(bool, IPProtocol, *net.IPNet, uint16) bool
|
||||
|
||||
@@ -1,79 +0,0 @@
|
||||
package network
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"github.com/safing/portmaster/intel"
|
||||
"github.com/safing/portmaster/network/netutils"
|
||||
"github.com/safing/portmaster/network/packet"
|
||||
"github.com/safing/portmaster/process"
|
||||
)
|
||||
|
||||
// GetOwnComm returns the communication for the given packet, that originates from the Portmaster itself.
|
||||
func GetOwnComm(pkt packet.Packet) (*Communication, error) {
|
||||
var scope string
|
||||
|
||||
// Incoming
|
||||
if pkt.IsInbound() {
|
||||
switch netutils.ClassifyIP(pkt.Info().RemoteIP()) {
|
||||
case netutils.HostLocal:
|
||||
scope = IncomingHost
|
||||
case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
|
||||
scope = IncomingLAN
|
||||
case netutils.Global, netutils.GlobalMulticast:
|
||||
scope = IncomingInternet
|
||||
case netutils.Invalid:
|
||||
scope = IncomingInvalid
|
||||
}
|
||||
|
||||
communication, ok := GetCommunication(os.Getpid(), scope)
|
||||
if !ok {
|
||||
proc, err := process.GetOrFindProcess(pkt.Ctx(), os.Getpid())
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("could not get own process")
|
||||
}
|
||||
communication = &Communication{
|
||||
Scope: scope,
|
||||
Entity: (&intel.Entity{}).Init(),
|
||||
Direction: Inbound,
|
||||
process: proc,
|
||||
Inspect: true,
|
||||
FirstLinkEstablished: time.Now().Unix(),
|
||||
}
|
||||
}
|
||||
communication.process.AddCommunication()
|
||||
return communication, nil
|
||||
}
|
||||
|
||||
// PeerToPeer
|
||||
switch netutils.ClassifyIP(pkt.Info().RemoteIP()) {
|
||||
case netutils.HostLocal:
|
||||
scope = PeerHost
|
||||
case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
|
||||
scope = PeerLAN
|
||||
case netutils.Global, netutils.GlobalMulticast:
|
||||
scope = PeerInternet
|
||||
case netutils.Invalid:
|
||||
scope = PeerInvalid
|
||||
}
|
||||
|
||||
communication, ok := GetCommunication(os.Getpid(), scope)
|
||||
if !ok {
|
||||
proc, err := process.GetOrFindProcess(pkt.Ctx(), os.Getpid())
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("could not get own process")
|
||||
}
|
||||
communication = &Communication{
|
||||
Scope: scope,
|
||||
Entity: (&intel.Entity{}).Init(),
|
||||
Direction: Outbound,
|
||||
process: proc,
|
||||
Inspect: true,
|
||||
FirstLinkEstablished: time.Now().Unix(),
|
||||
}
|
||||
}
|
||||
communication.process.AddCommunication()
|
||||
return communication, nil
|
||||
}
|
||||
@@ -1,66 +0,0 @@
|
||||
package network
|
||||
|
||||
import (
|
||||
"time"
|
||||
|
||||
"github.com/safing/portmaster/intel"
|
||||
"github.com/safing/portmaster/network/netutils"
|
||||
"github.com/safing/portmaster/network/packet"
|
||||
"github.com/safing/portmaster/process"
|
||||
)
|
||||
|
||||
// Static reasons
|
||||
const (
|
||||
ReasonUnknownProcess = "unknown connection owner: process could not be found"
|
||||
)
|
||||
|
||||
// GetUnknownCommunication returns the connection to a packet of unknown owner.
|
||||
func GetUnknownCommunication(pkt packet.Packet) (*Communication, error) {
|
||||
if pkt.IsInbound() {
|
||||
switch netutils.ClassifyIP(pkt.Info().Src) {
|
||||
case netutils.HostLocal:
|
||||
return getOrCreateUnknownCommunication(pkt, IncomingHost)
|
||||
case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
|
||||
return getOrCreateUnknownCommunication(pkt, IncomingLAN)
|
||||
case netutils.Global, netutils.GlobalMulticast:
|
||||
return getOrCreateUnknownCommunication(pkt, IncomingInternet)
|
||||
case netutils.Invalid:
|
||||
return getOrCreateUnknownCommunication(pkt, IncomingInvalid)
|
||||
}
|
||||
}
|
||||
|
||||
switch netutils.ClassifyIP(pkt.Info().Dst) {
|
||||
case netutils.HostLocal:
|
||||
return getOrCreateUnknownCommunication(pkt, PeerHost)
|
||||
case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
|
||||
return getOrCreateUnknownCommunication(pkt, PeerLAN)
|
||||
case netutils.Global, netutils.GlobalMulticast:
|
||||
return getOrCreateUnknownCommunication(pkt, PeerInternet)
|
||||
case netutils.Invalid:
|
||||
return getOrCreateUnknownCommunication(pkt, PeerInvalid)
|
||||
}
|
||||
|
||||
// this should never happen
|
||||
return getOrCreateUnknownCommunication(pkt, PeerInvalid)
|
||||
}
|
||||
|
||||
func getOrCreateUnknownCommunication(pkt packet.Packet, connScope string) (*Communication, error) {
|
||||
connection, ok := GetCommunication(process.UnknownProcess.Pid, connScope)
|
||||
if !ok {
|
||||
connection = &Communication{
|
||||
Scope: connScope,
|
||||
Entity: (&intel.Entity{}).Init(),
|
||||
Direction: pkt.IsInbound(),
|
||||
Verdict: VerdictDrop,
|
||||
Reason: ReasonUnknownProcess,
|
||||
process: process.UnknownProcess,
|
||||
Inspect: false,
|
||||
FirstLinkEstablished: time.Now().Unix(),
|
||||
}
|
||||
if pkt.IsOutbound() {
|
||||
connection.Verdict = VerdictBlock
|
||||
}
|
||||
}
|
||||
connection.process.AddCommunication()
|
||||
return connection, nil
|
||||
}
|
||||
Reference in New Issue
Block a user