github/portmaster
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Work on portmaster restructuring

Browse Source
This commit is contained in:
Daniel
2018-11-28 16:17:46 +01:00
parent 5bdb021c88
commit be8a1d1739
13 changed files with 301 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
network/clean.go
View File

@@ -8,6 +8,11 @@ import (
"github.com/Safing/portmaster/process"
)
var (
deadLinksTimeout = 5 * time.Minute
thresholdDuration = 1 * time.Minute
)
func init() {
go cleaner()
}
@@ -21,18 +26,21 @@ func cleaner() {
}
}
func markDeadLinks() {
func cleanLinks() {
activeIDs := process.GetActiveConnectionIDs()
allLinksLock.RLock()
defer allLinksLock.RUnlock()
dataLock.Lock()
defer dataLock.Lock()
now := time.Now().Unix()
var found bool
for key, link := range allLinks {
deleteOlderThan := time.Now().Add(-deadLinksTimeout).Unix()
// skip dead links
if link.Ended > 0 {
var found bool
for key, link := range links {
// delete dead links
if link.Ended > 0 && link.Ended < deleteOlderThan {
link.Delete()
continue
}
@@ -54,50 +62,18 @@ func markDeadLinks() {
}
}
func purgeDeadFor(age time.Duration) {
connections := make(map[*Connection]bool)
processes := make(map[*process.Process]bool)
func cleanConnections() {
dataLock.Lock()
defer dataLock.Lock()
allLinksLock.Lock()
defer allLinksLock.Unlock()
// delete old dead links
// make a list of connections without links
ageAgo := time.Now().Add(-1 * age).Unix()
for key, link := range allLinks {
if link.Ended != 0 && link.Ended < ageAgo {
link.Delete()
delete(allLinks, key)
_, ok := connections[link.Connection()]
if !ok {
connections[link.Connection()] = false
}
} else {
connections[link.Connection()] = true
threshold := time.Now().Add(-thresholdDuration).Unix()
for _, conn := range connections {
if conn.FirstLinkEstablished < threshold && conn.LinkCount == 0 {
conn.Delete()
}
}
// delete connections without links
// make a list of processes without connections
for conn, active := range connections {
if conn != nil {
if !active {
conn.Delete()
_, ok := processes[conn.Process()]
if !ok {
processes[conn.Process()] = false
}
} else {
processes[conn.Process()] = true
}
}
}
// delete processes without connections
for proc, active := range processes {
if proc != nil && !active {
proc.Delete()
}
}
}
func cleanProcesses() {
process.CleanProcessStorage(thresholdDuration)
}

190
network/connection.go
View File

@@ -3,6 +3,7 @@
package network
import (
"errors"
"fmt"
"net"
"sync"
@@ -19,67 +20,69 @@ type Connection struct {
record.Base
sync.Mutex
Domain string
Direction bool
Intel *intel.Intel
process *process.Process
Verdict Verdict
Reason string
Inspect bool
Domain string
Direction bool
Intel *intel.Intel
process *process.Process
Verdict Verdict
Reason string
Inspect bool
FirstLinkEstablished int64
LastLinkEstablished int64
LinkCount uint
}
// Process returns the process that owns the connection.
func (m *Connection) Process() *process.Process {
return m.process
func (conn *Connection) Process() *process.Process {
return conn.process
}
// CantSay sets the connection verdict to "can't say", the connection will be further analysed.
func (m *Connection) CantSay() {
if m.Verdict != CANTSAY {
m.Verdict = CANTSAY
m.Save()
func (conn *Connection) CantSay() {
if conn.Verdict != CANTSAY {
conn.Verdict = CANTSAY
conn.Save()
}
return
}
// Drop sets the connection verdict to drop.
func (m *Connection) Drop() {
if m.Verdict != DROP {
m.Verdict = DROP
m.Save()
func (conn *Connection) Drop() {
if conn.Verdict != DROP {
conn.Verdict = DROP
conn.Save()
}
return
}
// Block sets the connection verdict to block.
func (m *Connection) Block() {
if m.Verdict != BLOCK {
m.Verdict = BLOCK
m.Save()
func (conn *Connection) Block() {
if conn.Verdict != BLOCK {
conn.Verdict = BLOCK
conn.Save()
}
return
}
// Accept sets the connection verdict to accept.
func (m *Connection) Accept() {
if m.Verdict != ACCEPT {
m.Verdict = ACCEPT
m.Save()
func (conn *Connection) Accept() {
if conn.Verdict != ACCEPT {
conn.Verdict = ACCEPT
conn.Save()
}
return
}
// AddReason adds a human readable string as to why a certain verdict was set in regard to this connection
func (m *Connection) AddReason(newReason string) {
m.Lock()
defer m.Unlock()
func (conn *Connection) AddReason(newReason string) {
conn.Lock()
defer conn.Unlock()
if m.Reason != "" {
m.Reason += " | "
if conn.Reason != "" {
conn.Reason += " | "
}
m.Reason += newReason
conn.Reason += newReason
}
// GetConnectionByFirstPacket returns the matching connection from the internal storage.
@@ -92,16 +95,17 @@ func GetConnectionByFirstPacket(pkt packet.Packet) (*Connection, error) {
// if INBOUND
if direction {
connection, err := GetConnectionFromProcessNamespace(proc, "I")
if err != nil {
connection, ok := GetConnection(proc.Pid, "I")
if !ok {
connection = &Connection{
Domain: "I",
Direction: true,
Direction: Inbound,
process: proc,
Inspect: true,
FirstLinkEstablished: time.Now().Unix(),
}
}
connection.process.AddConnection()
return connection, nil
}
@@ -109,28 +113,32 @@ func GetConnectionByFirstPacket(pkt packet.Packet) (*Connection, error) {
ipinfo, err := intel.GetIPInfo(pkt.FmtRemoteIP())
if err != nil {
// if no domain could be found, it must be a direct connection
connection, err := GetConnectionFromProcessNamespace(proc, "D")
if err != nil {
connection, ok := GetConnection(proc.Pid, "D")
if !ok {
connection = &Connection{
Domain: "D",
Direction: Outbound,
process: proc,
Inspect: true,
FirstLinkEstablished: time.Now().Unix(),
}
}
connection.process.AddConnection()
return connection, nil
}
// FIXME: how to handle multiple possible domains?
connection, err := GetConnectionFromProcessNamespace(proc, ipinfo.Domains[0])
if err != nil {
connection, ok := GetConnection(proc.Pid, ipinfo.Domains[0])
if !ok {
connection = &Connection{
Domain: ipinfo.Domains[0],
Direction: Outbound,
process: proc,
Inspect: true,
FirstLinkEstablished: time.Now().Unix(),
}
}
connection.process.AddConnection()
return connection, nil
}
@@ -149,19 +157,70 @@ func GetConnectionByDNSRequest(ip net.IP, port uint16, fqdn string) (*Connection
return nil, err
}
connection, err := GetConnectionFromProcessNamespace(proc, fqdn)
if err != nil {
connection, ok := GetConnection(proc.Pid, fqdn)
if !ok {
connection = &Connection{
Domain: fqdn,
process: proc,
Inspect: true,
}
connection.CreateInProcessNamespace()
connection.process.AddConnection()
connection.Save()
}
return connection, nil
}
// AddLink applies the connection to the link.
// GetConnection fetches a connection object from the internal storage.
func GetConnection(pid int, domain string) (conn *Connection, ok bool) {
dataLock.RLock()
defer dataLock.RUnlock()
conn, ok = connections[fmt.Sprintf("%d/%s", pid, domain)]
return
}
func (conn *Connection) makeKey() string {
return fmt.Sprintf("%d/%s", conn.process.Pid, conn.Domain)
}
// Save saves the connection object in the storage and propagates the change.
func (conn *Connection) Save() error {
if conn.process == nil {
return errors.New("cannot save connection without process")
}
if conn.DatabaseKey() == "" {
conn.SetKey(fmt.Sprintf("network:tree/%d/%s", conn.process.Pid, conn.Domain))
conn.CreateMeta()
}
key := conn.makeKey()
dataLock.RLock()
_, ok := connections[key]
dataLock.RUnlock()
if !ok {
dataLock.Lock()
connections[key] = conn
dataLock.Unlock()
}
dbController.PushUpdate(conn)
return nil
}
// Delete deletes a connection from the storage and propagates the change.
func (conn *Connection) Delete() {
dataLock.Lock()
defer dataLock.Unlock()
delete(connections, conn.makeKey())
conn.Lock()
defer conn.Lock()
conn.Meta().Delete()
dbController.PushUpdate(conn)
conn.process.RemoveConnection()
}
// AddLink applies the connection to the link and increases sets counter and timestamps.
func (conn *Connection) AddLink(link *Link) {
link.Lock()
defer link.Unlock()
@@ -172,6 +231,7 @@ func (conn *Connection) AddLink(link *Link) {
conn.Lock()
defer conn.Unlock()
conn.LinkCount++
conn.LastLinkEstablished = time.Now().Unix()
if conn.FirstLinkEstablished == 0 {
conn.FirstLinkEstablished = conn.FirstLinkEstablished
@@ -179,24 +239,32 @@ func (conn *Connection) AddLink(link *Link) {
conn.Save()
}
// FORMATTING
func (m *Connection) String() string {
switch m.Domain {
case "I":
if m.process == nil {
return "? <- *"
}
return fmt.Sprintf("%s <- *", m.process.String())
case "D":
if m.process == nil {
return "? -> *"
}
return fmt.Sprintf("%s -> *", m.process.String())
default:
if m.process == nil {
return fmt.Sprintf("? -> %s", m.Domain)
}
return fmt.Sprintf("%s -> %s", m.process.String(), m.Domain)
// RemoveLink lowers the link counter by one.
func (conn *Connection) RemoveLink() {
conn.Lock()
defer conn.Unlock()
if conn.LinkCount > 0 {
conn.LinkCount--
}
}
// String returns a string representation of Connection.
func (conn *Connection) String() string {
switch conn.Domain {
case "I":
if conn.process == nil {
return "? <- *"
}
return fmt.Sprintf("%s <- *", conn.process.String())
case "D":
if conn.process == nil {
return "? -> *"
}
return fmt.Sprintf("%s -> *", conn.process.String())
default:
if conn.process == nil {
return fmt.Sprintf("? -> %s", conn.Domain)
}
return fmt.Sprintf("%s -> %s", conn.process.String(), conn.Domain)
}
}

28
network/link.go
View File

@@ -17,14 +17,12 @@ import (
type FirewallHandler func(pkt packet.Packet, link *Link)
var (
linkTimeout = 10 * time.Minute
allLinks = make(map[string]*Link)
allLinksLock sync.RWMutex
linkTimeout = 10 * time.Minute
)
// Link describes a distinct physical connection (e.g. TCP connection) - like an instance - of a Connection.
type Link struct {
record.Record
record.Base
sync.Mutex
ID string
@@ -120,21 +118,22 @@ func (link *Link) Save() error {
}
if link.DatabaseKey() == "" {
link.SetKey(fmt.Sprintf("network:tree/%d/%s/%s", link.connection.Process().Pid, link.connection.Domain, link.ID))
link.CreateMeta()
dataLock.Lock()
defer dataLock.Unlock()
links[link.ID] = link
}
if link.orphaned && link.connection != nil {
p.SetKey()
dataLock.RLock()
_, ok := links[link.ID]
dataLock.RUnlock()
if !ok {
dataLock.Lock()
links[link.ID] = link
dataLock.Unlock()
}
dbController.PushUpdate(link)
return nil
}
// Delete deletes a link from the storage and propagates the change.
@@ -146,6 +145,7 @@ func (link *Link) Delete() {
defer link.Lock()
link.Meta().Delete()
dbController.PushUpdate(link)
link.connection.RemoveLink()
}
// GetLink fetches a Link from the database from the default namespace for this object
@@ -159,7 +159,7 @@ func GetLink(id string) (*Link, bool) {
// GetOrCreateLinkByPacket returns the associated Link for a packet and a bool expressing if the Link was newly created
func GetOrCreateLinkByPacket(pkt packet.Packet) (*Link, bool) {
link, ok := GetLink(pkt.GetConnectionID())
link, ok := GetLink(pkt.GetLinkID())
if ok {
return link, false
}
@@ -169,7 +169,7 @@ func GetOrCreateLinkByPacket(pkt packet.Packet) (*Link, bool) {
// CreateLinkFromPacket creates a new Link based on Packet.
func CreateLinkFromPacket(pkt packet.Packet) *Link {
link := &Link{
ID: pkt.GetConnectionID(),
ID: pkt.GetLinkID(),
Verdict: UNDECIDED,
Started: time.Now().Unix(),
RemoteAddress: pkt.FmtRemoteAddress(),

28
network/packet/packet.go
View File

@@ -106,10 +106,10 @@ type TCPUDPHeader struct {
}
type PacketBase struct {
connectionID string
Direction bool
InTunnel bool
Payload []byte
linkID string
Direction bool
InTunnel bool
Payload []byte
*IPHeader
*TCPUDPHeader
}
@@ -146,25 +146,25 @@ func (pkt *PacketBase) IPVersion() IPVersion {
return pkt.Version
}
func (pkt *PacketBase) GetConnectionID() string {
if pkt.connectionID == "" {
pkt.createConnectionID()
func (pkt *PacketBase) GetLinkID() string {
if pkt.linkID == "" {
pkt.createLinkID()
}
return pkt.connectionID
return pkt.linkID
}
func (pkt *PacketBase) createConnectionID() {
func (pkt *PacketBase) createLinkID() {
if pkt.IPHeader.Protocol == TCP || pkt.IPHeader.Protocol == UDP {
if pkt.Direction {
pkt.connectionID = fmt.Sprintf("%d-%s-%d-%s-%d", pkt.Protocol, pkt.Dst, pkt.DstPort, pkt.Src, pkt.SrcPort)
pkt.linkID = fmt.Sprintf("%d-%s-%d-%s-%d", pkt.Protocol, pkt.Dst, pkt.DstPort, pkt.Src, pkt.SrcPort)
} else {
pkt.connectionID = fmt.Sprintf("%d-%s-%d-%s-%d", pkt.Protocol, pkt.Src, pkt.SrcPort, pkt.Dst, pkt.DstPort)
pkt.linkID = fmt.Sprintf("%d-%s-%d-%s-%d", pkt.Protocol, pkt.Src, pkt.SrcPort, pkt.Dst, pkt.DstPort)
}
} else {
if pkt.Direction {
pkt.connectionID = fmt.Sprintf("%d-%s-%s", pkt.Protocol, pkt.Dst, pkt.Src)
pkt.linkID = fmt.Sprintf("%d-%s-%s", pkt.Protocol, pkt.Dst, pkt.Src)
} else {
pkt.connectionID = fmt.Sprintf("%d-%s-%s", pkt.Protocol, pkt.Src, pkt.Dst)
pkt.linkID = fmt.Sprintf("%d-%s-%s", pkt.Protocol, pkt.Src, pkt.Dst)
}
}
}
@@ -299,7 +299,7 @@ type Packet interface {
IsOutbound() bool
SetInbound()
SetOutbound()
GetConnectionID() string
GetLinkID() string
IPVersion() IPVersion
// MATCHING