Reevaluate and update firewall core logic

network/clean.go

@@ -20,7 +20,7 @@ func cleaner() {
 
 		cleanLinks()
 		time.Sleep(2 * time.Second)
-		cleanConnections()
+		cleanComms()
 		time.Sleep(2 * time.Second)
 		cleanProcesses()
 	}
@@ -73,18 +73,18 @@ func cleanLinks() {
 	}
 }
 
-func cleanConnections() {
-	connectionsLock.RLock()
-	defer connectionsLock.RUnlock()
+func cleanComms() {
+	commsLock.RLock()
+	defer commsLock.RUnlock()
 
 	threshold := time.Now().Add(-thresholdDuration).Unix()
-	for _, conn := range connections {
-		conn.Lock()
-		if conn.FirstLinkEstablished < threshold && conn.LinkCount == 0 {
-			// log.Tracef("network.clean: deleted %s", conn.DatabaseKey())
-			go conn.Delete()
+	for _, comm := range comms {
+		comm.Lock()
+		if comm.FirstLinkEstablished < threshold && comm.LinkCount == 0 {
+			// log.Tracef("network.clean: deleted %s", comm.DatabaseKey())
+			go comm.Delete()
 		}
-		conn.Unlock()
+		comm.Unlock()
 	}
 }
 

network/communication.go

@@ -0,0 +1,349 @@
+// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.
+
+package network
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/Safing/portbase/database/record"
+	"github.com/Safing/portmaster/intel"
+	"github.com/Safing/portmaster/network/netutils"
+	"github.com/Safing/portmaster/network/packet"
+	"github.com/Safing/portmaster/process"
+	"github.com/Safing/portmaster/profile"
+)
+
+// Communication describes a logical connection between a process and a domain.
+type Communication struct {
+	record.Base
+	sync.Mutex
+
+	Domain    string
+	Direction bool
+	Intel     *intel.Intel
+	process   *process.Process
+	Verdict   Verdict
+	Reason    string
+	Inspect   bool
+
+	FirstLinkEstablished int64
+	LastLinkEstablished  int64
+	LinkCount            uint
+
+	profileUpdateVersion uint32
+}
+
+// Process returns the process that owns the connection.
+func (comm *Communication) Process() *process.Process {
+	comm.Lock()
+	defer comm.Unlock()
+
+	return comm.process
+}
+
+// ResetVerdict resets the verdict to VerdictUndecided.
+func (comm *Communication) ResetVerdict() {
+	comm.Lock()
+	defer comm.Unlock()
+
+	comm.Verdict = VerdictUndecided
+}
+
+// GetVerdict returns the current verdict.
+func (comm *Communication) GetVerdict() Verdict {
+	comm.Lock()
+	defer comm.Unlock()
+
+	return comm.Verdict
+}
+
+// Accept accepts the communication and adds the given reason.
+func (comm *Communication) Accept(reason string) {
+	comm.AddReason(reason)
+	comm.UpdateVerdict(VerdictAccept)
+}
+
+// Deny blocks or drops the communication depending on the connection direction and adds the given reason.
+func (comm *Communication) Deny(reason string) {
+	if comm.Direction {
+		comm.Drop(reason)
+	} else {
+		comm.Block(reason)
+	}
+}
+
+// Block blocks the communication and adds the given reason.
+func (comm *Communication) Block(reason string) {
+	comm.AddReason(reason)
+	comm.UpdateVerdict(VerdictBlock)
+}
+
+// Drop drops the communication and adds the given reason.
+func (comm *Communication) Drop(reason string) {
+	comm.AddReason(reason)
+	comm.UpdateVerdict(VerdictDrop)
+}
+
+// UpdateVerdict sets a new verdict for this link, making sure it does not interfere with previous verdicts.
+func (comm *Communication) UpdateVerdict(newVerdict Verdict) {
+	comm.Lock()
+	defer comm.Unlock()
+
+	if newVerdict > comm.Verdict {
+		comm.Verdict = newVerdict
+		go comm.Save()
+	}
+}
+
+// AddReason adds a human readable string as to why a certain verdict was set in regard to this communication.
+func (comm *Communication) AddReason(reason string) {
+	if reason == "" {
+		return
+	}
+
+	comm.Lock()
+	defer comm.Unlock()
+
+	if comm.Reason != "" {
+		comm.Reason += " | "
+	}
+	comm.Reason += reason
+}
+
+// NeedsReevaluation returns whether the decision on this communication should be re-evaluated.
+func (comm *Communication) NeedsReevaluation() bool {
+	comm.Lock()
+	defer comm.Unlock()
+
+	updateVersion := profile.GetUpdateVersion()
+	if comm.profileUpdateVersion != updateVersion {
+		comm.profileUpdateVersion = updateVersion
+		return true
+	}
+	return false
+}
+
+// GetCommunicationByFirstPacket returns the matching communication from the internal storage.
+func GetCommunicationByFirstPacket(pkt packet.Packet) (*Communication, error) {
+	// get Process
+	proc, direction, err := process.GetProcessByPacket(pkt)
+	if err != nil {
+		return nil, err
+	}
+	var domain string
+
+	// Incoming
+	if direction {
+		switch netutils.ClassifyIP(pkt.GetIPHeader().Src) {
+		case netutils.HostLocal:
+			domain = IncomingHost
+		case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
+			domain = IncomingLAN
+		case netutils.Global, netutils.GlobalMulticast:
+			domain = IncomingInternet
+		case netutils.Invalid:
+			domain = IncomingInvalid
+		}
+
+		communication, ok := GetCommunication(proc.Pid, domain)
+		if !ok {
+			communication = &Communication{
+				Domain:               domain,
+				Direction:            Inbound,
+				process:              proc,
+				Inspect:              true,
+				FirstLinkEstablished: time.Now().Unix(),
+			}
+		}
+		communication.process.AddCommunication()
+		return communication, nil
+	}
+
+	// get domain
+	ipinfo, err := intel.GetIPInfo(pkt.FmtRemoteIP())
+
+	// PeerToPeer
+	if err != nil {
+		// if no domain could be found, it must be a direct connection (ie. no DNS)
+
+		switch netutils.ClassifyIP(pkt.GetIPHeader().Dst) {
+		case netutils.HostLocal:
+			domain = PeerHost
+		case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
+			domain = PeerLAN
+		case netutils.Global, netutils.GlobalMulticast:
+			domain = PeerInternet
+		case netutils.Invalid:
+			domain = PeerInvalid
+		}
+
+		communication, ok := GetCommunication(proc.Pid, domain)
+		if !ok {
+			communication = &Communication{
+				Domain:               domain,
+				Direction:            Outbound,
+				process:              proc,
+				Inspect:              true,
+				FirstLinkEstablished: time.Now().Unix(),
+			}
+		}
+		communication.process.AddCommunication()
+		return communication, nil
+	}
+
+	// To Domain
+	// FIXME: how to handle multiple possible domains?
+	communication, ok := GetCommunication(proc.Pid, ipinfo.Domains[0])
+	if !ok {
+		communication = &Communication{
+			Domain:               ipinfo.Domains[0],
+			Direction:            Outbound,
+			process:              proc,
+			Inspect:              true,
+			FirstLinkEstablished: time.Now().Unix(),
+		}
+	}
+	communication.process.AddCommunication()
+	return communication, nil
+}
+
+// var localhost = net.IPv4(127, 0, 0, 1)
+
+var (
+	dnsAddress        = net.IPv4(127, 0, 0, 1)
+	dnsPort    uint16 = 53
+)
+
+// GetCommunicationByDNSRequest returns the matching communication from the internal storage.
+func GetCommunicationByDNSRequest(ip net.IP, port uint16, fqdn string) (*Communication, error) {
+	// get Process
+	proc, err := process.GetProcessByEndpoints(ip, port, dnsAddress, dnsPort, packet.UDP)
+	if err != nil {
+		return nil, err
+	}
+
+	communication, ok := GetCommunication(proc.Pid, fqdn)
+	if !ok {
+		communication = &Communication{
+			Domain:  fqdn,
+			process: proc,
+			Inspect: true,
+		}
+		communication.process.AddCommunication()
+		communication.Save()
+	}
+	return communication, nil
+}
+
+// GetCommunication fetches a connection object from the internal storage.
+func GetCommunication(pid int, domain string) (comm *Communication, ok bool) {
+	commsLock.RLock()
+	defer commsLock.RUnlock()
+	comm, ok = comms[fmt.Sprintf("%d/%s", pid, domain)]
+	return
+}
+
+func (comm *Communication) makeKey() string {
+	return fmt.Sprintf("%d/%s", comm.process.Pid, comm.Domain)
+}
+
+// Save saves the connection object in the storage and propagates the change.
+func (comm *Communication) Save() error {
+	comm.Lock()
+	defer comm.Unlock()
+
+	if comm.process == nil {
+		return errors.New("cannot save connection without process")
+	}
+
+	if !comm.KeyIsSet() {
+		comm.SetKey(fmt.Sprintf("network:tree/%d/%s", comm.process.Pid, comm.Domain))
+		comm.CreateMeta()
+	}
+
+	key := comm.makeKey()
+	commsLock.RLock()
+	_, ok := comms[key]
+	commsLock.RUnlock()
+
+	if !ok {
+		commsLock.Lock()
+		comms[key] = comm
+		commsLock.Unlock()
+	}
+
+	go dbController.PushUpdate(comm)
+	return nil
+}
+
+// Delete deletes a connection from the storage and propagates the change.
+func (comm *Communication) Delete() {
+	comm.Lock()
+	defer comm.Unlock()
+
+	commsLock.Lock()
+	delete(comms, comm.makeKey())
+	commsLock.Unlock()
+
+	comm.Meta().Delete()
+	go dbController.PushUpdate(comm)
+	comm.process.RemoveCommunication()
+	go comm.process.Save()
+}
+
+// AddLink applies the Communication to the Link and increases sets counter and timestamps.
+func (comm *Communication) AddLink(link *Link) {
+	link.Lock()
+	link.comm = comm
+	link.Verdict = comm.Verdict
+	link.Inspect = comm.Inspect
+	link.Unlock()
+	link.Save()
+
+	comm.Lock()
+	comm.LinkCount++
+	comm.LastLinkEstablished = time.Now().Unix()
+	if comm.FirstLinkEstablished == 0 {
+		comm.FirstLinkEstablished = comm.LastLinkEstablished
+	}
+	comm.Unlock()
+	comm.Save()
+}
+
+// RemoveLink lowers the link counter by one.
+func (comm *Communication) RemoveLink() {
+	comm.Lock()
+	defer comm.Unlock()
+
+	if comm.LinkCount > 0 {
+		comm.LinkCount--
+	}
+}
+
+// String returns a string representation of Communication.
+func (comm *Communication) String() string {
+	comm.Lock()
+	defer comm.Unlock()
+
+	switch comm.Domain {
+	case IncomingHost, IncomingLAN, IncomingInternet, IncomingInvalid:
+		if comm.process == nil {
+			return "? <- *"
+		}
+		return fmt.Sprintf("%s <- *", comm.process.String())
+	case PeerHost, PeerLAN, PeerInternet, PeerInvalid:
+		if comm.process == nil {
+			return "? -> *"
+		}
+		return fmt.Sprintf("%s -> *", comm.process.String())
+	default:
+		if comm.process == nil {
+			return fmt.Sprintf("? -> %s", comm.Domain)
+		}
+		return fmt.Sprintf("%s -> %s", comm.process.String(), comm.Domain)
+	}
+}

network/connection.go

@@ -1,325 +0,0 @@
-// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.
-
-package network
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/Safing/portbase/database/record"
-	"github.com/Safing/portmaster/intel"
-	"github.com/Safing/portmaster/network/netutils"
-	"github.com/Safing/portmaster/network/packet"
-	"github.com/Safing/portmaster/process"
-)
-
-// Connection describes a connection between a process and a domain
-type Connection struct {
-	record.Base
-	sync.Mutex
-
-	Domain    string
-	Direction bool
-	Intel     *intel.Intel
-	process   *process.Process
-	Verdict   Verdict
-	Reason    string
-	Inspect   bool
-
-	FirstLinkEstablished int64
-	LastLinkEstablished  int64
-	LinkCount            uint
-}
-
-// Process returns the process that owns the connection.
-func (conn *Connection) Process() *process.Process {
-	conn.Lock()
-	defer conn.Unlock()
-
-	return conn.process
-}
-
-// GetVerdict returns the current verdict.
-func (conn *Connection) GetVerdict() Verdict {
-	conn.Lock()
-	defer conn.Unlock()
-
-	return conn.Verdict
-}
-
-// Accept accepts the connection and adds the given reason.
-func (conn *Connection) Accept(reason string) {
-	conn.AddReason(reason)
-	conn.UpdateVerdict(ACCEPT)
-}
-
-// Deny blocks or drops the connection depending on the connection direction and adds the given reason.
-func (conn *Connection) Deny(reason string) {
-	if conn.Direction {
-		conn.Drop(reason)
-	} else {
-		conn.Block(reason)
-	}
-}
-
-// Block blocks the connection and adds the given reason.
-func (conn *Connection) Block(reason string) {
-	conn.AddReason(reason)
-	conn.UpdateVerdict(BLOCK)
-}
-
-// Drop drops the connection and adds the given reason.
-func (conn *Connection) Drop(reason string) {
-	conn.AddReason(reason)
-	conn.UpdateVerdict(DROP)
-}
-
-// UpdateVerdict sets a new verdict for this link, making sure it does not interfere with previous verdicts
-func (conn *Connection) UpdateVerdict(newVerdict Verdict) {
-	conn.Lock()
-	defer conn.Unlock()
-
-	if newVerdict > conn.Verdict {
-		conn.Verdict = newVerdict
-		go conn.Save()
-	}
-}
-
-// AddReason adds a human readable string as to why a certain verdict was set in regard to this connection
-func (conn *Connection) AddReason(reason string) {
-	if reason == "" {
-		return
-	}
-
-	conn.Lock()
-	defer conn.Unlock()
-
-	if conn.Reason != "" {
-		conn.Reason += " | "
-	}
-	conn.Reason += reason
-}
-
-// GetConnectionByFirstPacket returns the matching connection from the internal storage.
-func GetConnectionByFirstPacket(pkt packet.Packet) (*Connection, error) {
-	// get Process
-	proc, direction, err := process.GetProcessByPacket(pkt)
-	if err != nil {
-		return nil, err
-	}
-	var domain string
-
-	// Incoming
-	if direction {
-		switch netutils.ClassifyIP(pkt.GetIPHeader().Src) {
-		case netutils.HostLocal:
-			domain = IncomingHost
-		case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
-			domain = IncomingLAN
-		case netutils.Global, netutils.GlobalMulticast:
-			domain = IncomingInternet
-		case netutils.Invalid:
-			domain = IncomingInvalid
-		}
-
-		connection, ok := GetConnection(proc.Pid, domain)
-		if !ok {
-			connection = &Connection{
-				Domain:               domain,
-				Direction:            Inbound,
-				process:              proc,
-				Inspect:              true,
-				FirstLinkEstablished: time.Now().Unix(),
-			}
-		}
-		connection.process.AddConnection()
-		return connection, nil
-	}
-
-	// get domain
-	ipinfo, err := intel.GetIPInfo(pkt.FmtRemoteIP())
-
-	// PeerToPeer
-	if err != nil {
-		// if no domain could be found, it must be a direct connection
-
-		switch netutils.ClassifyIP(pkt.GetIPHeader().Dst) {
-		case netutils.HostLocal:
-			domain = PeerHost
-		case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
-			domain = PeerLAN
-		case netutils.Global, netutils.GlobalMulticast:
-			domain = PeerInternet
-		case netutils.Invalid:
-			domain = PeerInvalid
-		}
-
-		connection, ok := GetConnection(proc.Pid, domain)
-		if !ok {
-			connection = &Connection{
-				Domain:               domain,
-				Direction:            Outbound,
-				process:              proc,
-				Inspect:              true,
-				FirstLinkEstablished: time.Now().Unix(),
-			}
-		}
-		connection.process.AddConnection()
-		return connection, nil
-	}
-
-	// To Domain
-	// FIXME: how to handle multiple possible domains?
-	connection, ok := GetConnection(proc.Pid, ipinfo.Domains[0])
-	if !ok {
-		connection = &Connection{
-			Domain:               ipinfo.Domains[0],
-			Direction:            Outbound,
-			process:              proc,
-			Inspect:              true,
-			FirstLinkEstablished: time.Now().Unix(),
-		}
-	}
-	connection.process.AddConnection()
-	return connection, nil
-}
-
-// var localhost = net.IPv4(127, 0, 0, 1)
-
-var (
-	dnsAddress        = net.IPv4(127, 0, 0, 1)
-	dnsPort    uint16 = 53
-)
-
-// GetConnectionByDNSRequest returns the matching connection from the internal storage.
-func GetConnectionByDNSRequest(ip net.IP, port uint16, fqdn string) (*Connection, error) {
-	// get Process
-	proc, err := process.GetProcessByEndpoints(ip, port, dnsAddress, dnsPort, packet.UDP)
-	if err != nil {
-		return nil, err
-	}
-
-	connection, ok := GetConnection(proc.Pid, fqdn)
-	if !ok {
-		connection = &Connection{
-			Domain:  fqdn,
-			process: proc,
-			Inspect: true,
-		}
-		connection.process.AddConnection()
-		connection.Save()
-	}
-	return connection, nil
-}
-
-// GetConnection fetches a connection object from the internal storage.
-func GetConnection(pid int, domain string) (conn *Connection, ok bool) {
-	connectionsLock.RLock()
-	defer connectionsLock.RUnlock()
-	conn, ok = connections[fmt.Sprintf("%d/%s", pid, domain)]
-	return
-}
-
-func (conn *Connection) makeKey() string {
-	return fmt.Sprintf("%d/%s", conn.process.Pid, conn.Domain)
-}
-
-// Save saves the connection object in the storage and propagates the change.
-func (conn *Connection) Save() error {
-	conn.Lock()
-	defer conn.Unlock()
-
-	if conn.process == nil {
-		return errors.New("cannot save connection without process")
-	}
-
-	if !conn.KeyIsSet() {
-		conn.SetKey(fmt.Sprintf("network:tree/%d/%s", conn.process.Pid, conn.Domain))
-		conn.CreateMeta()
-	}
-
-	key := conn.makeKey()
-	connectionsLock.RLock()
-	_, ok := connections[key]
-	connectionsLock.RUnlock()
-
-	if !ok {
-		connectionsLock.Lock()
-		connections[key] = conn
-		connectionsLock.Unlock()
-	}
-
-	go dbController.PushUpdate(conn)
-	return nil
-}
-
-// Delete deletes a connection from the storage and propagates the change.
-func (conn *Connection) Delete() {
-	conn.Lock()
-	defer conn.Unlock()
-
-	connectionsLock.Lock()
-	delete(connections, conn.makeKey())
-	connectionsLock.Unlock()
-
-	conn.Meta().Delete()
-	go dbController.PushUpdate(conn)
-	conn.process.RemoveConnection()
-	go conn.process.Save()
-}
-
-// AddLink applies the connection to the link and increases sets counter and timestamps.
-func (conn *Connection) AddLink(link *Link) {
-	link.Lock()
-	link.connection = conn
-	link.Verdict = conn.Verdict
-	link.Inspect = conn.Inspect
-	link.Unlock()
-	link.Save()
-
-	conn.Lock()
-	conn.LinkCount++
-	conn.LastLinkEstablished = time.Now().Unix()
-	if conn.FirstLinkEstablished == 0 {
-		conn.FirstLinkEstablished = conn.LastLinkEstablished
-	}
-	conn.Unlock()
-	conn.Save()
-}
-
-// RemoveLink lowers the link counter by one.
-func (conn *Connection) RemoveLink() {
-	conn.Lock()
-	defer conn.Unlock()
-
-	if conn.LinkCount > 0 {
-		conn.LinkCount--
-	}
-}
-
-// String returns a string representation of Connection.
-func (conn *Connection) String() string {
-	conn.Lock()
-	defer conn.Unlock()
-
-	switch conn.Domain {
-	case IncomingHost, IncomingLAN, IncomingInternet, IncomingInvalid:
-		if conn.process == nil {
-			return "? <- *"
-		}
-		return fmt.Sprintf("%s <- *", conn.process.String())
-	case PeerHost, PeerLAN, PeerInternet, PeerInvalid:
-		if conn.process == nil {
-			return "? -> *"
-		}
-		return fmt.Sprintf("%s -> *", conn.process.String())
-	default:
-		if conn.process == nil {
-			return fmt.Sprintf("? -> %s", conn.Domain)
-		}
-		return fmt.Sprintf("%s -> %s", conn.process.String(), conn.Domain)
-	}
-}

network/database.go

@@ -14,10 +14,10 @@ import (
 )
 
 var (
-	links           = make(map[string]*Link)
-	linksLock       sync.RWMutex
-	connections     = make(map[string]*Connection)
-	connectionsLock sync.RWMutex
+	links     = make(map[string]*Link)
+	linksLock sync.RWMutex
+	comms     = make(map[string]*Communication)
+	commsLock sync.RWMutex
 
 	dbController *database.Controller
 )
@@ -43,9 +43,9 @@ func (s *StorageInterface) Get(key string) (record.Record, error) {
 				}
 			}
 		case 3:
-			connectionsLock.RLock()
-			defer connectionsLock.RUnlock()
-			conn, ok := connections[splitted[2]]
+			commsLock.RLock()
+			defer commsLock.RUnlock()
+			conn, ok := comms[splitted[2]]
 			if ok {
 				return conn, nil
 			}
@@ -79,14 +79,14 @@ func (s *StorageInterface) processQuery(q *query.Query, it *iterator.Iterator) {
 		}
 	}
 
-	// connections
-	connectionsLock.RLock()
-	for _, conn := range connections {
+	// comms
+	commsLock.RLock()
+	for _, conn := range comms {
 		if strings.HasPrefix(conn.DatabaseKey(), q.DatabaseKeyPrefix()) {
 			it.Next <- conn
 		}
 	}
-	connectionsLock.RUnlock()
+	commsLock.RUnlock()
 
 	// links
 	linksLock.RLock()

network/link.go

@@ -38,18 +38,18 @@ type Link struct {
 
 	pktQueue        chan packet.Packet
 	firewallHandler FirewallHandler
-	connection      *Connection
+	comm            *Communication
 
 	activeInspectors []bool
 	inspectorData    map[uint8]interface{}
 }
 
-// Connection returns the Connection the Link is part of
-func (link *Link) Connection() *Connection {
+// Communication returns the Communication the Link is part of
+func (link *Link) Communication() *Communication {
 	link.Lock()
 	defer link.Unlock()
 
-	return link.connection
+	return link.comm
 }
 
 // GetVerdict returns the current verdict.
@@ -106,12 +106,12 @@ func (link *Link) HandlePacket(pkt packet.Packet) {
 // Accept accepts the link and adds the given reason.
 func (link *Link) Accept(reason string) {
 	link.AddReason(reason)
-	link.UpdateVerdict(ACCEPT)
+	link.UpdateVerdict(VerdictAccept)
 }
 
 // Deny blocks or drops the link depending on the connection direction and adds the given reason.
 func (link *Link) Deny(reason string) {
-	if link.connection != nil && link.connection.Direction {
+	if link.comm != nil && link.comm.Direction {
 		link.Drop(reason)
 	} else {
 		link.Block(reason)
@@ -121,24 +121,24 @@ func (link *Link) Deny(reason string) {
 // Block blocks the link and adds the given reason.
 func (link *Link) Block(reason string) {
 	link.AddReason(reason)
-	link.UpdateVerdict(BLOCK)
+	link.UpdateVerdict(VerdictBlock)
 }
 
 // Drop drops the link and adds the given reason.
 func (link *Link) Drop(reason string) {
 	link.AddReason(reason)
-	link.UpdateVerdict(DROP)
+	link.UpdateVerdict(VerdictDrop)
 }
 
 // RerouteToNameserver reroutes the link to the portmaster nameserver.
 func (link *Link) RerouteToNameserver() {
-	link.UpdateVerdict(RerouteToNameserver)
+	link.UpdateVerdict(VerdictRerouteToNameserver)
 }
 
 // RerouteToTunnel reroutes the link to the tunnel entrypoint and adds the given reason for accepting the connection.
 func (link *Link) RerouteToTunnel(reason string) {
 	link.AddReason(reason)
-	link.UpdateVerdict(RerouteToTunnel)
+	link.UpdateVerdict(VerdictRerouteToTunnel)
 }
 
 // UpdateVerdict sets a new verdict for this link, making sure it does not interfere with previous verdicts
@@ -192,30 +192,30 @@ func (link *Link) ApplyVerdict(pkt packet.Packet) {
 
 	if link.VerdictPermanent {
 		switch link.Verdict {
-		case ACCEPT:
+		case VerdictAccept:
 			pkt.PermanentAccept()
-		case BLOCK:
+		case VerdictBlock:
 			pkt.PermanentBlock()
-		case DROP:
+		case VerdictDrop:
 			pkt.PermanentDrop()
-		case RerouteToNameserver:
+		case VerdictRerouteToNameserver:
 			pkt.RerouteToNameserver()
-		case RerouteToTunnel:
+		case VerdictRerouteToTunnel:
 			pkt.RerouteToTunnel()
 		default:
 			pkt.Drop()
 		}
 	} else {
 		switch link.Verdict {
-		case ACCEPT:
+		case VerdictAccept:
 			pkt.Accept()
-		case BLOCK:
+		case VerdictBlock:
 			pkt.Block()
-		case DROP:
+		case VerdictDrop:
 			pkt.Drop()
-		case RerouteToNameserver:
+		case VerdictRerouteToNameserver:
 			pkt.RerouteToNameserver()
-		case RerouteToTunnel:
+		case VerdictRerouteToTunnel:
 			pkt.RerouteToTunnel()
 		default:
 			pkt.Drop()
@@ -228,12 +228,12 @@ func (link *Link) Save() error {
 	link.Lock()
 	defer link.Unlock()
 
-	if link.connection == nil {
-		return errors.New("cannot save link without connection")
+	if link.comm == nil {
+		return errors.New("cannot save link without comms")
 	}
 
 	if !link.KeyIsSet() {
-		link.SetKey(fmt.Sprintf("network:tree/%d/%s/%s", link.connection.Process().Pid, link.connection.Domain, link.ID))
+		link.SetKey(fmt.Sprintf("network:tree/%d/%s/%s", link.comm.Process().Pid, link.comm.Domain, link.ID))
 		link.CreateMeta()
 	}
 
@@ -262,8 +262,8 @@ func (link *Link) Delete() {
 
 	link.Meta().Delete()
 	go dbController.PushUpdate(link)
-	link.connection.RemoveLink()
-	go link.connection.Save()
+	link.comm.RemoveLink()
+	go link.comm.Save()
 }
 
 // GetLink fetches a Link from the database from the default namespace for this object
@@ -288,7 +288,7 @@ func GetOrCreateLinkByPacket(pkt packet.Packet) (*Link, bool) {
 func CreateLinkFromPacket(pkt packet.Packet) *Link {
 	link := &Link{
 		ID:            pkt.GetLinkID(),
-		Verdict:       UNDECIDED,
+		Verdict:       VerdictUndecided,
 		Started:       time.Now().Unix(),
 		RemoteAddress: pkt.FmtRemoteAddress(),
 	}
@@ -332,24 +332,24 @@ func (link *Link) String() string {
 	link.Lock()
 	defer link.Unlock()
 
-	if link.connection == nil {
+	if link.comm == nil {
 		return fmt.Sprintf("? <-> %s", link.RemoteAddress)
 	}
-	switch link.connection.Domain {
+	switch link.comm.Domain {
 	case "I":
-		if link.connection.process == nil {
+		if link.comm.process == nil {
 			return fmt.Sprintf("? <- %s", link.RemoteAddress)
 		}
-		return fmt.Sprintf("%s <- %s", link.connection.process.String(), link.RemoteAddress)
+		return fmt.Sprintf("%s <- %s", link.comm.process.String(), link.RemoteAddress)
 	case "D":
-		if link.connection.process == nil {
+		if link.comm.process == nil {
 			return fmt.Sprintf("? -> %s", link.RemoteAddress)
 		}
-		return fmt.Sprintf("%s -> %s", link.connection.process.String(), link.RemoteAddress)
+		return fmt.Sprintf("%s -> %s", link.comm.process.String(), link.RemoteAddress)
 	default:
-		if link.connection.process == nil {
-			return fmt.Sprintf("? -> %s (%s)", link.connection.Domain, link.RemoteAddress)
+		if link.comm.process == nil {
+			return fmt.Sprintf("? -> %s (%s)", link.comm.Domain, link.RemoteAddress)
 		}
-		return fmt.Sprintf("%s to %s (%s)", link.connection.process.String(), link.connection.Domain, link.RemoteAddress)
+		return fmt.Sprintf("%s to %s (%s)", link.comm.process.String(), link.comm.Domain, link.RemoteAddress)
 	}
 }

network/status.go

@@ -8,12 +8,13 @@ type Verdict uint8
 // List of values a Status can have
 const (
 	// UNDECIDED is the default status of new connections
-	UNDECIDED Verdict = iota
-	ACCEPT
-	BLOCK
-	DROP
-	RerouteToNameserver
-	RerouteToTunnel
+	VerdictUndecided           Verdict = 0
+	VerdictUndeterminable      Verdict = 1
+	VerdictAccept              Verdict = 2
+	VerdictBlock               Verdict = 3
+	VerdictDrop                Verdict = 4
+	VerdictRerouteToNameserver Verdict = 5
+	VerdictRerouteToTunnel     Verdict = 6
 )
 
 // Packer Directions

network/unknown.go

@@ -13,52 +13,52 @@ const (
 	ReasonUnknownProcess = "unknown connection owner: process could not be found"
 )
 
-// GetUnknownConnection returns the connection to a packet of unknown owner.
-func GetUnknownConnection(pkt packet.Packet) (*Connection, error) {
+// GetUnknownCommunication returns the connection to a packet of unknown owner.
+func GetUnknownCommunication(pkt packet.Packet) (*Communication, error) {
 	if pkt.IsInbound() {
 		switch netutils.ClassifyIP(pkt.GetIPHeader().Src) {
 		case netutils.HostLocal:
-			return getOrCreateUnknownConnection(pkt, IncomingHost)
+			return getOrCreateUnknownCommunication(pkt, IncomingHost)
 		case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
-			return getOrCreateUnknownConnection(pkt, IncomingLAN)
+			return getOrCreateUnknownCommunication(pkt, IncomingLAN)
 		case netutils.Global, netutils.GlobalMulticast:
-			return getOrCreateUnknownConnection(pkt, IncomingInternet)
+			return getOrCreateUnknownCommunication(pkt, IncomingInternet)
 		case netutils.Invalid:
-			return getOrCreateUnknownConnection(pkt, IncomingInvalid)
+			return getOrCreateUnknownCommunication(pkt, IncomingInvalid)
 		}
 	}
 
 	switch netutils.ClassifyIP(pkt.GetIPHeader().Dst) {
 	case netutils.HostLocal:
-		return getOrCreateUnknownConnection(pkt, PeerHost)
+		return getOrCreateUnknownCommunication(pkt, PeerHost)
 	case netutils.LinkLocal, netutils.SiteLocal, netutils.LocalMulticast:
-		return getOrCreateUnknownConnection(pkt, PeerLAN)
+		return getOrCreateUnknownCommunication(pkt, PeerLAN)
 	case netutils.Global, netutils.GlobalMulticast:
-		return getOrCreateUnknownConnection(pkt, PeerInternet)
+		return getOrCreateUnknownCommunication(pkt, PeerInternet)
 	case netutils.Invalid:
-		return getOrCreateUnknownConnection(pkt, PeerInvalid)
+		return getOrCreateUnknownCommunication(pkt, PeerInvalid)
 	}
 
 	// this should never happen
-	return getOrCreateUnknownConnection(pkt, PeerInvalid)
+	return getOrCreateUnknownCommunication(pkt, PeerInvalid)
 }
 
-func getOrCreateUnknownConnection(pkt packet.Packet, connClass string) (*Connection, error) {
-	connection, ok := GetConnection(process.UnknownProcess.Pid, connClass)
+func getOrCreateUnknownCommunication(pkt packet.Packet, connClass string) (*Communication, error) {
+	connection, ok := GetCommunication(process.UnknownProcess.Pid, connClass)
 	if !ok {
-		connection = &Connection{
+		connection = &Communication{
 			Domain:               connClass,
 			Direction:            pkt.IsInbound(),
-			Verdict:              DROP,
+			Verdict:              VerdictDrop,
 			Reason:               ReasonUnknownProcess,
 			process:              process.UnknownProcess,
 			Inspect:              true,
 			FirstLinkEstablished: time.Now().Unix(),
 		}
 		if pkt.IsOutbound() {
-			connection.Verdict = BLOCK
+			connection.Verdict = VerdictBlock
 		}
 	}
-	connection.process.AddConnection()
+	connection.process.AddCommunication()
 	return connection, nil
 }