Work on portmaster restructuring

network/clean.go

@@ -5,7 +5,7 @@ package network
 import (
 	"time"
 
-	"github.com/Safing/safing-core/process"
+	"github.com/Safing/portmaster/process"
 )
 
 func init() {

network/connection.go

@@ -5,19 +5,20 @@ package network
 import (
 	"fmt"
 	"net"
+	"sync"
 	"time"
 
-	"github.com/Safing/portbase/database"
+	"github.com/Safing/portbase/database/record"
 	"github.com/Safing/portmaster/intel"
 	"github.com/Safing/portmaster/network/packet"
 	"github.com/Safing/portmaster/process"
-
-	datastore "github.com/ipfs/go-datastore"
 )
 
 // Connection describes a connection between a process and a domain
 type Connection struct {
-	database.Base
+	record.Base
+	sync.Mutex
+
 	Domain               string
 	Direction            bool
 	Intel                *intel.Intel
@@ -26,76 +27,62 @@ type Connection struct {
 	Reason               string
 	Inspect              bool
 	FirstLinkEstablished int64
+	LastLinkEstablished  int64
 }
 
-var connectionModel *Connection // only use this as parameter for database.EnsureModel-like functions
-
-func init() {
-	database.RegisterModel(connectionModel, func() database.Model { return new(Connection) })
-}
-
+// Process returns the process that owns the connection.
 func (m *Connection) Process() *process.Process {
 	return m.process
 }
 
-// Create creates a new database entry in the database in the default namespace for this object
-func (m *Connection) Create(name string) error {
-	return m.CreateObject(&database.OrphanedConnection, name, m)
-}
-
-// CreateInProcessNamespace creates a new database entry in the namespace of the connection's process
-func (m *Connection) CreateInProcessNamespace() error {
-	if m.process != nil {
-		return m.CreateObject(m.process.GetKey(), m.Domain, m)
-	}
-	return m.CreateObject(&database.OrphanedConnection, m.Domain, m)
-}
-
-// Save saves the object to the database (It must have been either already created or loaded from the database)
-func (m *Connection) Save() error {
-	return m.SaveObject(m)
-}
-
+// CantSay sets the connection verdict to "can't say", the connection will be further analysed.
 func (m *Connection) CantSay() {
 	if m.Verdict != CANTSAY {
 		m.Verdict = CANTSAY
-		m.SaveObject(m)
+		m.Save()
 	}
 	return
 }
 
+// Drop sets the connection verdict to drop.
 func (m *Connection) Drop() {
 	if m.Verdict != DROP {
 		m.Verdict = DROP
-		m.SaveObject(m)
+		m.Save()
 	}
 	return
 }
 
+// Block sets the connection verdict to block.
 func (m *Connection) Block() {
 	if m.Verdict != BLOCK {
 		m.Verdict = BLOCK
-		m.SaveObject(m)
+		m.Save()
 	}
 	return
 }
 
+// Accept sets the connection verdict to accept.
 func (m *Connection) Accept() {
 	if m.Verdict != ACCEPT {
 		m.Verdict = ACCEPT
-		m.SaveObject(m)
+		m.Save()
 	}
 	return
 }
 
 // AddReason adds a human readable string as to why a certain verdict was set in regard to this connection
 func (m *Connection) AddReason(newReason string) {
+	m.Lock()
+	defer m.Unlock()
+
 	if m.Reason != "" {
 		m.Reason += " | "
 	}
 	m.Reason += newReason
 }
 
+// GetConnectionByFirstPacket returns the matching connection from the internal storage.
 func GetConnectionByFirstPacket(pkt packet.Packet) (*Connection, error) {
 	// get Process
 	proc, direction, err := process.GetProcessByPacket(pkt)
@@ -154,6 +141,7 @@ var (
 	dnsPort    uint16 = 53
 )
 
+// GetConnectionByDNSRequest returns the matching connection from the internal storage.
 func GetConnectionByDNSRequest(ip net.IP, port uint16, fqdn string) (*Connection, error) {
 	// get Process
 	proc, err := process.GetProcessByEndpoints(ip, port, dnsAddress, dnsPort, packet.UDP)
@@ -173,38 +161,22 @@ func GetConnectionByDNSRequest(ip net.IP, port uint16, fqdn string) (*Connection
 	return connection, nil
 }
 
-// GetConnection fetches a Connection from the database from the default namespace for this object
-func GetConnection(name string) (*Connection, error) {
-	return GetConnectionFromNamespace(&database.OrphanedConnection, name)
-}
+// AddLink applies the connection to the link.
+func (conn *Connection) AddLink(link *Link) {
+	link.Lock()
+	defer link.Unlock()
+	link.connection = conn
+	link.Verdict = conn.Verdict
+	link.Inspect = conn.Inspect
+	link.Save()
 
-// GetConnectionFromProcessNamespace fetches a Connection from the namespace of its process
-func GetConnectionFromProcessNamespace(process *process.Process, domain string) (*Connection, error) {
-	return GetConnectionFromNamespace(process.GetKey(), domain)
-}
-
-// GetConnectionFromNamespace fetches a Connection form the database, but from a custom namespace
-func GetConnectionFromNamespace(namespace *datastore.Key, name string) (*Connection, error) {
-	object, err := database.GetAndEnsureModel(namespace, name, connectionModel)
-	if err != nil {
-		return nil, err
+	conn.Lock()
+	defer conn.Unlock()
+	conn.LastLinkEstablished = time.Now().Unix()
+	if conn.FirstLinkEstablished == 0 {
+		conn.FirstLinkEstablished = conn.FirstLinkEstablished
 	}
-	model, ok := object.(*Connection)
-	if !ok {
-		return nil, database.NewMismatchError(object, connectionModel)
-	}
-	return model, nil
-}
-
-func (m *Connection) AddLink(link *Link, pkt packet.Packet) {
-	link.connection = m
-	link.Verdict = m.Verdict
-	link.Inspect = m.Inspect
-	if m.FirstLinkEstablished == 0 {
-		m.FirstLinkEstablished = time.Now().Unix()
-		m.Save()
-	}
-	link.CreateInConnectionNamespace(pkt.GetConnectionID())
+	conn.Save()
 }
 
 // FORMATTING

network/database.go

@@ -0,0 +1,116 @@
+package network
+
+import (
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/Safing/portbase/database"
+	"github.com/Safing/portbase/database/iterator"
+	"github.com/Safing/portbase/database/query"
+	"github.com/Safing/portbase/database/record"
+	"github.com/Safing/portbase/database/storage"
+	"github.com/Safing/portmaster/process"
+)
+
+var (
+	links       map[string]*Link
+	connections map[string]*Connection
+	dataLock    sync.RWMutex
+
+	dbController *database.Controller
+)
+
+// StorageInterface provices a storage.Interface to the configuration manager.
+type StorageInterface struct {
+	storage.InjectBase
+}
+
+// Get returns a database record.
+func (s *StorageInterface) Get(key string) (record.Record, error) {
+
+	dataLock.RLock()
+	defer dataLock.RUnlock()
+
+	splitted := strings.Split(key, "/")
+	switch splitted[0] {
+	case "tree":
+		switch len(splitted) {
+		case 2:
+			pid, err := strconv.Atoi(splitted[1])
+			if err != nil {
+				return process.GetProcessByPID(pid)
+			}
+		case 3:
+			conn, ok := connections[splitted[2]]
+			if ok {
+				return conn, nil
+			}
+		case 4:
+			link, ok := links[splitted[3]]
+			if ok {
+				return link, nil
+			}
+		}
+	}
+
+	return nil, storage.ErrNotFound
+}
+
+// Query returns a an iterator for the supplied query.
+func (s *StorageInterface) Query(q *query.Query, local, internal bool) (*iterator.Iterator, error) {
+	it := iterator.New()
+	go s.processQuery(q, it)
+	// TODO: check local and internal
+
+	return it, nil
+}
+
+func (s *StorageInterface) processQuery(q *query.Query, it *iterator.Iterator) {
+	// processes
+	for _, proc := range process.All() {
+		if strings.HasPrefix(proc.Meta().DatabaseKey, q.DatabaseKeyPrefix()) {
+			it.Next <- proc
+		}
+	}
+
+	dataLock.RLock()
+	defer dataLock.RUnlock()
+
+	// connections
+	for _, conn := range connections {
+		if strings.HasPrefix(conn.Meta().DatabaseKey, q.DatabaseKeyPrefix()) {
+			it.Next <- conn
+		}
+	}
+
+	// links
+	for _, link := range links {
+		if strings.HasPrefix(opt.Meta().DatabaseKey, q.DatabaseKeyPrefix()) {
+			it.Next <- link
+		}
+	}
+
+	it.Finish(nil)
+}
+
+func registerAsDatabase() error {
+	_, err := database.Register(&database.Database{
+		Name:        "network",
+		Description: "Network and Firewall Data",
+		StorageType: "injected",
+		PrimaryAPI:  "",
+	})
+	if err != nil {
+		return err
+	}
+
+	controller, err := database.InjectDatabase("network", &ConfigStorageInterface{})
+	if err != nil {
+		return err
+	}
+
+	dbController = controller
+	process.SetDBController(dbController)
+	return nil
+}

network/environment/environment_darwin.go

@@ -0,0 +1,27 @@
+package environment
+
+import "net"
+
+func Nameservers() []Nameserver {
+	return nil
+}
+
+func Gateways() []*net.IP {
+	return nil
+}
+
+// TODO: implement using
+// ifconfig
+// scutil --nwi
+// scutil --proxy
+// networksetup -listallnetworkservices
+// networksetup -listnetworkserviceorder
+// networksetup -getdnsservers "Wi-Fi"
+// networksetup -getsearchdomains <networkservice>
+// networksetup -getftpproxy <networkservice>
+// networksetup -getwebproxy <networkservice>
+// networksetup -getsecurewebproxy <networkservice>
+// networksetup -getstreamingproxy <networkservice>
+// networksetup -getgopherproxy <networkservice>
+// networksetup -getsocksfirewallproxy <networkservice>
+// route -n get default

network/environment/environment_test.go

@@ -1,4 +1,4 @@
-// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.
+// +build linux
 
 package environment
 

network/link.go

@@ -3,17 +3,17 @@
 package network
 
 import (
+	"errors"
 	"fmt"
 	"sync"
 	"time"
 
-	datastore "github.com/ipfs/go-datastore"
-
-	"github.com/Safing/portbase/database"
+	"github.com/Safing/portbase/database/record"
 	"github.com/Safing/portbase/log"
 	"github.com/Safing/portmaster/network/packet"
 )
 
+// FirewallHandler defines the function signature for a firewall handle function
 type FirewallHandler func(pkt packet.Packet, link *Link)
 
 var (
@@ -22,9 +22,13 @@ var (
 	allLinksLock sync.RWMutex
 )
 
-// Link describes an distinct physical connection (e.g. TCP connection) - like an instance - of a Connection
+// Link describes a distinct physical connection (e.g. TCP connection) - like an instance - of a Connection.
 type Link struct {
-	database.Base
+	record.Record
+	sync.Mutex
+
+	ID string
+
 	Verdict          Verdict
 	Reason           string
 	Tunneled         bool
@@ -32,180 +36,167 @@ type Link struct {
 	Inspect          bool
 	Started          int64
 	Ended            int64
-	connection       *Connection
 	RemoteAddress    string
-	ActiveInspectors []bool                `json:"-" bson:"-"`
-	InspectorData    map[uint8]interface{} `json:"-" bson:"-"`
 
 	pktQueue        chan packet.Packet
 	firewallHandler FirewallHandler
-}
+	connection      *Connection
 
-var linkModel *Link // only use this as parameter for database.EnsureModel-like functions
-
-func init() {
-	database.RegisterModel(linkModel, func() database.Model { return new(Link) })
+	activeInspectors []bool
+	inspectorData    map[uint8]interface{}
 }
 
 // Connection returns the Connection the Link is part of
-func (m *Link) Connection() *Connection {
-	return m.connection
+func (link *Link) Connection() *Connection {
+	return link.connection
 }
 
 // FirewallHandlerIsSet returns whether a firewall handler is set or not
-func (m *Link) FirewallHandlerIsSet() bool {
-	return m.firewallHandler != nil
+func (link *Link) FirewallHandlerIsSet() bool {
+	return link.firewallHandler != nil
 }
 
 // SetFirewallHandler sets the firewall handler for this link
-func (m *Link) SetFirewallHandler(handler FirewallHandler) {
-	if m.firewallHandler == nil {
-		m.firewallHandler = handler
-		m.pktQueue = make(chan packet.Packet, 1000)
-		go m.packetHandler()
+func (link *Link) SetFirewallHandler(handler FirewallHandler) {
+	if link.firewallHandler == nil {
+		link.firewallHandler = handler
+		link.pktQueue = make(chan packet.Packet, 1000)
+		go link.packetHandler()
 		return
 	}
-	m.firewallHandler = handler
+	link.firewallHandler = handler
 }
 
 // StopFirewallHandler unsets the firewall handler
-func (m *Link) StopFirewallHandler() {
-	m.pktQueue <- nil
+func (link *Link) StopFirewallHandler() {
+	link.pktQueue <- nil
 }
 
 // HandlePacket queues packet of Link for handling
-func (m *Link) HandlePacket(pkt packet.Packet) {
-	if m.firewallHandler != nil {
-		m.pktQueue <- pkt
+func (link *Link) HandlePacket(pkt packet.Packet) {
+	if link.firewallHandler != nil {
+		link.pktQueue <- pkt
 		return
 	}
-	log.Criticalf("network: link %s does not have a firewallHandler, maybe its a copy, dropping packet", m)
+	log.Criticalf("network: link %s does not have a firewallHandler (maybe it's a copy), dropping packet", link)
 	pkt.Drop()
 }
 
 // UpdateVerdict sets a new verdict for this link, making sure it does not interfere with previous verdicts
-func (m *Link) UpdateVerdict(newVerdict Verdict) {
-	if newVerdict > m.Verdict {
-		m.Verdict = newVerdict
-		m.Save()
+func (link *Link) UpdateVerdict(newVerdict Verdict) {
+	if newVerdict > link.Verdict {
+		link.Verdict = newVerdict
+		link.Save()
 	}
 }
 
 // AddReason adds a human readable string as to why a certain verdict was set in regard to this link
-func (m *Link) AddReason(newReason string) {
-	if m.Reason != "" {
-		m.Reason += " | "
+func (link *Link) AddReason(newReason string) {
+	link.Lock()
+	defer link.Unlock()
+
+	if link.Reason != "" {
+		link.Reason += " | "
 	}
-	m.Reason += newReason
+	link.Reason += newReason
 }
 
 // packetHandler sequentially handles queued packets
-func (m *Link) packetHandler() {
+func (link *Link) packetHandler() {
 	for {
-		pkt := <-m.pktQueue
+		pkt := <-link.pktQueue
 		if pkt == nil {
 			break
 		}
-		m.firewallHandler(pkt, m)
+		link.firewallHandler(pkt, link)
 	}
-	m.firewallHandler = nil
+	link.firewallHandler = nil
 }
 
-// Create creates a new database entry in the database in the default namespace for this object
-func (m *Link) Create(name string) error {
-	m.CreateShallow(name)
-	return m.CreateObject(&database.OrphanedLink, name, m)
-}
-
-// Create creates a new database entry in the database in the default namespace for this object
-func (m *Link) CreateShallow(name string) {
-	allLinksLock.Lock()
-	allLinks[name] = m
-	allLinksLock.Unlock()
-}
-
-// CreateWithDefaultKey creates a new database entry in the database in the default namespace for this object using the default key
-func (m *Link) CreateInConnectionNamespace(name string) error {
-	if m.connection != nil {
-		return m.CreateObject(m.connection.GetKey(), name, m)
+// Save saves the link object in the storage and propagates the change.
+func (link *Link) Save() error {
+	if link.connection == nil {
+		return errors.New("cannot save link without connection")
 	}
-	return m.CreateObject(&database.OrphanedLink, name, m)
+
+	if link.DatabaseKey() == "" {
+
+		link.SetKey(fmt.Sprintf("network:tree/%d/%s/%s", link.connection.Process().Pid, link.connection.Domain, link.ID))
+		link.CreateMeta()
+
+		dataLock.Lock()
+		defer dataLock.Unlock()
+
+		links[link.ID] = link
+	}
+
+	if link.orphaned && link.connection != nil {
+		p.SetKey()
+	}
+
+	dbController.PushUpdate(link)
 }
 
-// Save saves the object to the database (It must have been either already created or loaded from the database)
-func (m *Link) Save() error {
-	return m.SaveObject(m)
+// Delete deletes a link from the storage and propagates the change.
+func (link *Link) Delete() {
+	dataLock.Lock()
+	defer dataLock.Unlock()
+	delete(links, link.ID)
+	link.Lock()
+	defer link.Lock()
+	link.Meta().Delete()
+	dbController.PushUpdate(link)
 }
 
 // GetLink fetches a Link from the database from the default namespace for this object
-func GetLink(name string) (*Link, error) {
-	allLinksLock.RLock()
-	link, ok := allLinks[name]
-	allLinksLock.RUnlock()
-	if !ok {
-		return nil, database.ErrNotFound
-	}
-	return link, nil
-	// return GetLinkFromNamespace(&database.RunningLink, name)
-}
+func GetLink(id string) (*Link, bool) {
+	dataLock.RLock()
+	defer dataLock.RUnlock()
 
-func SaveInCache(link *Link) {
-
-}
-
-// GetLinkFromNamespace fetches a Link form the database, but from a custom namespace
-func GetLinkFromNamespace(namespace *datastore.Key, name string) (*Link, error) {
-	object, err := database.GetAndEnsureModel(namespace, name, linkModel)
-	if err != nil {
-		return nil, err
-	}
-	model, ok := object.(*Link)
-	if !ok {
-		return nil, database.NewMismatchError(object, linkModel)
-	}
-	return model, nil
+	link, ok := links[id]
+	return link, ok
 }
 
 // GetOrCreateLinkByPacket returns the associated Link for a packet and a bool expressing if the Link was newly created
 func GetOrCreateLinkByPacket(pkt packet.Packet) (*Link, bool) {
-	link, err := GetLink(pkt.GetConnectionID())
-	if err != nil {
-		return CreateLinkFromPacket(pkt), true
+	link, ok := GetLink(pkt.GetConnectionID())
+	if ok {
+		return link, false
 	}
-	return link, false
+	return CreateLinkFromPacket(pkt), true
 }
 
-// CreateLinkFromPacket creates a new Link based on Packet. The Link is shallowly saved and SHOULD be saved to the database as soon more information is available
+// CreateLinkFromPacket creates a new Link based on Packet.
 func CreateLinkFromPacket(pkt packet.Packet) *Link {
 	link := &Link{
+		ID:            pkt.GetConnectionID(),
 		Verdict:       UNDECIDED,
 		Started:       time.Now().Unix(),
 		RemoteAddress: pkt.FmtRemoteAddress(),
 	}
-	link.CreateShallow(pkt.GetConnectionID())
 	return link
 }
 
-// FORMATTING
-func (m *Link) String() string {
-	if m.connection == nil {
-		return fmt.Sprintf("? <-> %s", m.RemoteAddress)
+// String returns a string representation of Link.
+func (link *Link) String() string {
+	if link.connection == nil {
+		return fmt.Sprintf("? <-> %s", link.RemoteAddress)
 	}
-	switch m.connection.Domain {
+	switch link.connection.Domain {
 	case "I":
-		if m.connection.process == nil {
-			return fmt.Sprintf("? <- %s", m.RemoteAddress)
+		if link.connection.process == nil {
+			return fmt.Sprintf("? <- %s", link.RemoteAddress)
 		}
-		return fmt.Sprintf("%s <- %s", m.connection.process.String(), m.RemoteAddress)
+		return fmt.Sprintf("%s <- %s", link.connection.process.String(), link.RemoteAddress)
 	case "D":
-		if m.connection.process == nil {
-			return fmt.Sprintf("? -> %s", m.RemoteAddress)
+		if link.connection.process == nil {
+			return fmt.Sprintf("? -> %s", link.RemoteAddress)
 		}
-		return fmt.Sprintf("%s -> %s", m.connection.process.String(), m.RemoteAddress)
+		return fmt.Sprintf("%s -> %s", link.connection.process.String(), link.RemoteAddress)
 	default:
-		if m.connection.process == nil {
-			return fmt.Sprintf("? -> %s (%s)", m.connection.Domain, m.RemoteAddress)
+		if link.connection.process == nil {
+			return fmt.Sprintf("? -> %s (%s)", link.connection.Domain, link.RemoteAddress)
 		}
-		return fmt.Sprintf("%s to %s (%s)", m.connection.process.String(), m.connection.Domain, m.RemoteAddress)
+		return fmt.Sprintf("%s to %s (%s)", link.connection.process.String(), link.connection.Domain, link.RemoteAddress)
 	}
 }

network/module.go

@@ -0,0 +1,13 @@
+package network
+
+import (
+	"github.com/Safing/portbase/modules"
+)
+
+func init() {
+	modules.Register("network", prep, start, nil, "database")
+}
+
+func start() error {
+	return registerAsDatabase()
+}

network/status.go

@@ -2,7 +2,7 @@
 
 package network
 
-// Status describes the status of a connection.
+// Verdict describes the decision made about a connection or link.
 type Verdict uint8
 
 // List of values a Status can have
@@ -15,6 +15,7 @@ const (
 	DROP
 )
 
+// Packer Directions
 const (
 	Inbound  = true
 	Outbound = false

network/unknown.go

@@ -0,0 +1,31 @@
+package network
+
+import "github.com/Safing/portmaster/process"
+
+// Static reasons
+const (
+	ReasonUnknownProcess = "unknown connection owner: process could not be found"
+)
+
+var (
+	UnknownDirectConnection = &Connection{
+		Domain:    "D",
+		Direction: Outbound,
+		Verdict:   DROP,
+		Reason:    ReasonUnknownProcess,
+		process:   process.UnknownProcess,
+	}
+
+	UnknownIncomingConnection = &Connection{
+		Domain:    "I",
+		Direction: Inbound,
+		Verdict:   DROP,
+		Reason:    ReasonUnknownProcess,
+		process:   process.UnknownProcess,
+	}
+)
+
+func init() {
+	UnknownDirectConnection.Save()
+	UnknownIncomingConnection.Save()
+}