github/portmaster
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #875 from safing/feature/change-incoming-behavior

Browse Source 
incoming: force block by default, apply default action and allow LAN per rules
This commit is contained in:
Daniel Hovie
2022-09-21 15:47:55 +02:00
committed by GitHub
parent c56faf5f08 0c787a917a
commit 80bfdcf299
2 changed files with 12 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
firewall/master.go
View File

@@ -54,7 +54,6 @@ var defaultDeciders = []deciderFn{
checkBypassPrevention, checkBypassPrevention,
checkFilterLists, checkFilterLists,
checkCustomFilterList, checkCustomFilterList,
dropInbound,
checkDomainHeuristics, checkDomainHeuristics,
checkAutoPermitRelated, checkAutoPermitRelated,
} }
@@ -539,15 +538,6 @@ func checkDomainHeuristics(ctx context.Context, conn *network.Connection, p *pro
return false return false
} }
func dropInbound(_ context.Context, conn *network.Connection, _ *profile.LayeredProfile, _ packet.Packet) bool {
// implicit default=block for inbound
if conn.Inbound {
conn.Drop("incoming connection blocked by default", profile.CfgOptionServiceEndpointsKey)
return true
}
return false
}
func checkAutoPermitRelated(_ context.Context, conn *network.Connection, p *profile.LayeredProfile, _ packet.Packet) bool { func checkAutoPermitRelated(_ context.Context, conn *network.Connection, p *profile.LayeredProfile, _ packet.Packet) bool {
// Auto permit is disabled for default action permit. // Auto permit is disabled for default action permit.
if p.DefaultAction() == profile.DefaultActionPermit { if p.DefaultAction() == profile.DefaultActionPermit {

20
profile/config.go
View File

@@ -292,15 +292,14 @@ Important: DNS Requests are only matched against domain and filter list rules, a
cfgStringArrayOptions[CfgOptionEndpointsKey] = cfgOptionEndpoints cfgStringArrayOptions[CfgOptionEndpointsKey] = cfgOptionEndpoints
// Service Endpoint Filter List // Service Endpoint Filter List
defaultIncomingRulesValue := []string{"+ Localhost"}
err = config.Register(&config.Option{ err = config.Register(&config.Option{
Name: "Incoming Rules", Name: "Incoming Rules",
Key: CfgOptionServiceEndpointsKey, Key: CfgOptionServiceEndpointsKey,
Description: "Rules that apply to incoming network connections. Cannot overrule Network Scopes and Connection Types (see above). Also note that the default action for incoming connections is to always block.", Description: "Rules that apply to incoming network connections. Cannot overrule Network Scopes and Connection Types (see above).",
Help: rulesHelp, Help: rulesHelp,
Sensitive: true, Sensitive: true,
OptType: config.OptTypeStringArray, OptType: config.OptTypeStringArray,
DefaultValue: defaultIncomingRulesValue, DefaultValue: []string{},
ExpertiseLevel: config.ExpertiseLevelExpert, ExpertiseLevel: config.ExpertiseLevelExpert,
Annotations: config.Annotations{ Annotations: config.Annotations{
config.StackableAnnotation: true, config.StackableAnnotation: true,
@@ -310,17 +309,17 @@ Important: DNS Requests are only matched against domain and filter list rules, a
endpoints.EndpointListVerdictNamesAnnotation: rulesVerdictNames, endpoints.EndpointListVerdictNamesAnnotation: rulesVerdictNames,
config.QuickSettingsAnnotation: []config.QuickSetting{ config.QuickSettingsAnnotation: []config.QuickSetting{
{ {
Name: "SSH", Name: "Allow SSH",
Action: config.QuickMergeTop, Action: config.QuickMergeTop,
Value: []string{"+ * tcp/22"}, Value: []string{"+ * tcp/22"},
}, },
{ {
Name: "HTTP/s", Name: "Allow HTTP/s",
Action: config.QuickMergeTop, Action: config.QuickMergeTop,
Value: []string{"+ * tcp/80", "+ * tcp/443"}, Value: []string{"+ * tcp/80", "+ * tcp/443"},
}, },
{ {
Name: "RDP", Name: "Allow RDP",
Action: config.QuickMergeTop, Action: config.QuickMergeTop,
Value: []string{"+ * */3389"}, Value: []string{"+ * */3389"},
}, },
@@ -334,6 +333,11 @@ Important: DNS Requests are only matched against domain and filter list rules, a
Action: config.QuickMergeTop, Action: config.QuickMergeTop,
Value: []string{"+ Internet"}, Value: []string{"+ Internet"},
}, },
{
Name: "Block everything else",
Action: config.QuickMergeBottom,
Value: []string{"- *"},
},
}, },
}, },
ValidationRegex: endpoints.ListEntryValidationRegex, ValidationRegex: endpoints.ListEntryValidationRegex,
@@ -342,7 +346,7 @@ Important: DNS Requests are only matched against domain and filter list rules, a
if err != nil { if err != nil {
return err return err
} }
cfgOptionServiceEndpoints = config.Concurrent.GetAsStringArray(CfgOptionServiceEndpointsKey, defaultIncomingRulesValue) cfgOptionServiceEndpoints = config.Concurrent.GetAsStringArray(CfgOptionServiceEndpointsKey, []string{})
cfgStringArrayOptions[CfgOptionServiceEndpointsKey] = cfgOptionServiceEndpoints cfgStringArrayOptions[CfgOptionServiceEndpointsKey] = cfgOptionServiceEndpoints
// Filter list IDs // Filter list IDs
@@ -494,7 +498,7 @@ Important: DNS Requests are only matched against domain and filter list rules, a
Key: CfgOptionBlockInboundKey, Key: CfgOptionBlockInboundKey,
Description: "Connections initiated towards your device from the LAN or Internet. This will usually only be the case if you are running a network service or are using peer to peer software. Is stronger than Rules (see below).", Description: "Connections initiated towards your device from the LAN or Internet. This will usually only be the case if you are running a network service or are using peer to peer software. Is stronger than Rules (see below).",
OptType: config.OptTypeInt, OptType: config.OptTypeInt,
DefaultValue: status.SecurityLevelOff, DefaultValue: status.SecurityLevelsAll,
PossibleValues: status.AllSecurityLevelValues, PossibleValues: status.AllSecurityLevelValues,
Annotations: config.Annotations{ Annotations: config.Annotations{
config.DisplayHintAnnotation: status.DisplayHintSecurityLevel, config.DisplayHintAnnotation: status.DisplayHintSecurityLevel,