mirror of https://github.com/subgraph/fw-daemon
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
214 lines
5.0 KiB
214 lines
5.0 KiB
9 years ago
|
package main
|
||
|
|
||
|
import (
|
||
|
"errors"
|
||
9 years ago
|
"path"
|
||
9 years ago
|
|
||
8 years ago
|
"github.com/godbus/dbus"
|
||
|
"github.com/godbus/dbus/introspect"
|
||
9 years ago
|
"github.com/op/go-logging"
|
||
9 years ago
|
)
|
||
|
|
||
|
const introspectXml = `
|
||
|
<node>
|
||
|
<interface name="com.subgraph.Firewall">
|
||
|
<method name="SetEnabled">
|
||
|
<arg name="enabled" direction="in" type="b" />
|
||
|
</method>
|
||
9 years ago
|
|
||
9 years ago
|
<method name="IsEnabled">
|
||
|
<arg name="enabled" direction="out" type="b" />
|
||
|
</method>
|
||
9 years ago
|
|
||
|
<method name="ListRules">
|
||
|
<arg name="rules" direction="out" type="a(ussus)" />
|
||
|
</method>
|
||
|
|
||
|
<method name="DeleteRule">
|
||
|
<arg name="id" direction="in" type="u" />
|
||
|
</method>
|
||
|
|
||
|
<method name="UpdateRule">
|
||
|
<arg name="rule" direction="in" type="(ussus)" />
|
||
|
</method>
|
||
|
|
||
|
<method name="GetConfig">
|
||
|
<arg name="config" direction="out" type="a{sv}" />
|
||
|
</method>
|
||
|
|
||
|
<method name="SetConfig">
|
||
|
<arg name="key" direction="in" type="s" />
|
||
|
<arg name="val" direction="in" type="v" />
|
||
|
</method>
|
||
9 years ago
|
</interface>` +
|
||
|
introspect.IntrospectDataString +
|
||
|
`</node>`
|
||
|
|
||
|
const busName = "com.subgraph.Firewall"
|
||
|
const objectPath = "/com/subgraph/Firewall"
|
||
|
const interfaceName = "com.subgraph.Firewall"
|
||
|
|
||
|
type dbusServer struct {
|
||
9 years ago
|
fw *Firewall
|
||
9 years ago
|
conn *dbus.Conn
|
||
|
prompter *prompter
|
||
|
}
|
||
|
|
||
9 years ago
|
type DbusRule struct {
|
||
|
Id uint32
|
||
|
App string
|
||
|
Path string
|
||
|
Verb uint32
|
||
|
Target string
|
||
8 years ago
|
Mode uint16
|
||
9 years ago
|
}
|
||
|
|
||
9 years ago
|
func newDbusServer() (*dbusServer, error) {
|
||
|
conn, err := dbus.SystemBus()
|
||
9 years ago
|
if err != nil {
|
||
|
return nil, err
|
||
|
}
|
||
|
|
||
|
reply, err := conn.RequestName(busName, dbus.NameFlagDoNotQueue)
|
||
|
if err != nil {
|
||
|
return nil, err
|
||
|
}
|
||
|
if reply != dbus.RequestNameReplyPrimaryOwner {
|
||
|
return nil, errors.New("Bus name is already owned")
|
||
|
}
|
||
|
ds := &dbusServer{}
|
||
|
|
||
|
if err := conn.Export(ds, objectPath, interfaceName); err != nil {
|
||
|
return nil, err
|
||
|
}
|
||
8 years ago
|
if err := conn.Export(introspect.Introspectable(introspectXml), objectPath, "org.freedesktop.DBus.Introspectable"); err != nil {
|
||
|
return nil, err
|
||
9 years ago
|
}
|
||
8 years ago
|
|
||
9 years ago
|
ds.conn = conn
|
||
|
ds.prompter = newPrompter(conn)
|
||
|
return ds, nil
|
||
|
}
|
||
|
|
||
|
func (ds *dbusServer) SetEnabled(flag bool) *dbus.Error {
|
||
8 years ago
|
log.Debugf("SetEnabled(%v) called", flag)
|
||
9 years ago
|
ds.fw.setEnabled(flag)
|
||
9 years ago
|
return nil
|
||
|
}
|
||
|
|
||
9 years ago
|
func (ds *dbusServer) IsEnabled() (bool, *dbus.Error) {
|
||
9 years ago
|
log.Debug("IsEnabled() called")
|
||
|
return ds.fw.isEnabled(), nil
|
||
|
}
|
||
|
|
||
|
func createDbusRule(r *Rule) DbusRule {
|
||
|
return DbusRule{
|
||
|
Id: uint32(r.id),
|
||
|
App: path.Base(r.policy.path),
|
||
|
Path: r.policy.path,
|
||
|
Verb: uint32(r.rtype),
|
||
9 years ago
|
Target: r.AddrString(false),
|
||
8 years ago
|
Mode: uint16(r.mode),
|
||
9 years ago
|
}
|
||
|
}
|
||
|
|
||
|
func (ds *dbusServer) ListRules() ([]DbusRule, *dbus.Error) {
|
||
|
ds.fw.lock.Lock()
|
||
|
defer ds.fw.lock.Unlock()
|
||
|
var result []DbusRule
|
||
|
for _, p := range ds.fw.policies {
|
||
|
for _, r := range p.rules {
|
||
|
result = append(result, createDbusRule(r))
|
||
|
}
|
||
|
}
|
||
|
return result, nil
|
||
|
}
|
||
|
|
||
|
func (ds *dbusServer) DeleteRule(id uint32) *dbus.Error {
|
||
|
ds.fw.lock.Lock()
|
||
|
r := ds.fw.rulesById[uint(id)]
|
||
|
ds.fw.lock.Unlock()
|
||
8 years ago
|
if r.mode == RULE_MODE_SYSTEM {
|
||
|
log.Warningf("Cannot delete system rule: %s", r.String())
|
||
|
return nil
|
||
|
}
|
||
9 years ago
|
if r != nil {
|
||
|
r.policy.removeRule(r)
|
||
|
}
|
||
8 years ago
|
if r.mode != RULE_MODE_SESSION {
|
||
9 years ago
|
ds.fw.saveRules()
|
||
|
}
|
||
|
return nil
|
||
|
}
|
||
|
|
||
|
func (ds *dbusServer) UpdateRule(rule DbusRule) *dbus.Error {
|
||
8 years ago
|
log.Debugf("UpdateRule %v", rule)
|
||
9 years ago
|
ds.fw.lock.Lock()
|
||
|
r := ds.fw.rulesById[uint(rule.Id)]
|
||
|
ds.fw.lock.Unlock()
|
||
|
if r != nil {
|
||
8 years ago
|
if r.mode == RULE_MODE_SYSTEM {
|
||
|
log.Warningf("Cannot modify system rule: %s", r.String())
|
||
|
return nil
|
||
|
}
|
||
9 years ago
|
tmp := new(Rule)
|
||
|
tmp.addr = noAddress
|
||
|
if !tmp.parseTarget(rule.Target) {
|
||
8 years ago
|
log.Warningf("Unable to parse target: %s", rule.Target)
|
||
9 years ago
|
return nil
|
||
|
}
|
||
|
r.policy.lock.Lock()
|
||
|
if rule.Verb == RULE_ALLOW || rule.Verb == RULE_DENY {
|
||
|
r.rtype = int(rule.Verb)
|
||
|
}
|
||
|
r.hostname = tmp.hostname
|
||
|
r.addr = tmp.addr
|
||
|
r.port = tmp.port
|
||
8 years ago
|
r.mode = RuleMode(rule.Mode)
|
||
9 years ago
|
r.policy.lock.Unlock()
|
||
8 years ago
|
if r.mode != RULE_MODE_SESSION {
|
||
9 years ago
|
ds.fw.saveRules()
|
||
|
}
|
||
|
}
|
||
|
return nil
|
||
|
}
|
||
|
|
||
|
func (ds *dbusServer) GetConfig() (map[string]dbus.Variant, *dbus.Error) {
|
||
|
conf := make(map[string]dbus.Variant)
|
||
8 years ago
|
conf["log_level"] = dbus.MakeVariant(int32(ds.fw.logBackend.GetLevel("sgfw")))
|
||
|
conf["log_redact"] = dbus.MakeVariant(FirewallConfig.LogRedact)
|
||
|
conf["prompt_expanded"] = dbus.MakeVariant(FirewallConfig.PromptExpanded)
|
||
|
conf["prompt_expert"] = dbus.MakeVariant(FirewallConfig.PromptExpert)
|
||
|
conf["default_action"] = dbus.MakeVariant(int32(FirewallConfig.DefaultActionId))
|
||
9 years ago
|
return conf, nil
|
||
|
}
|
||
|
|
||
|
func (ds *dbusServer) SetConfig(key string, val dbus.Variant) *dbus.Error {
|
||
|
switch key {
|
||
8 years ago
|
case "log_level":
|
||
9 years ago
|
l := val.Value().(int32)
|
||
|
lvl := logging.Level(l)
|
||
|
ds.fw.logBackend.SetLevel(lvl, "sgfw")
|
||
8 years ago
|
FirewallConfig.LoggingLevel = lvl
|
||
|
case "log_redact":
|
||
9 years ago
|
flag := val.Value().(bool)
|
||
8 years ago
|
FirewallConfig.LogRedact = flag
|
||
|
case "prompt_expanded":
|
||
|
flag := val.Value().(bool)
|
||
|
FirewallConfig.PromptExpanded = flag
|
||
|
case "prompt_expert":
|
||
|
flag := val.Value().(bool)
|
||
|
FirewallConfig.PromptExpert = flag
|
||
|
case "default_action":
|
||
|
l := val.Value().(int32)
|
||
|
FirewallConfig.DefaultActionId = l
|
||
9 years ago
|
}
|
||
8 years ago
|
writeConfig()
|
||
9 years ago
|
return nil
|
||
9 years ago
|
}
|
||
|
|
||
9 years ago
|
func (ds *dbusServer) prompt(p *Policy) {
|
||
|
log.Info("prompting...")
|
||
|
ds.prompter.prompt(p)
|
||
|
}
|