mirror of https://github.com/subgraph/fw-daemon
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
305 lines
6.2 KiB
305 lines
6.2 KiB
9 years ago
|
package main
|
||
|
|
||
|
import (
|
||
|
"fmt"
|
||
8 years ago
|
"strings"
|
||
9 years ago
|
"sync"
|
||
|
|
||
|
"github.com/subgraph/fw-daemon/nfqueue"
|
||
9 years ago
|
"github.com/subgraph/go-procsnitch"
|
||
8 years ago
|
"net"
|
||
9 years ago
|
)
|
||
|
|
||
8 years ago
|
var _interpreters = []string{
|
||
|
"python",
|
||
|
"ruby",
|
||
|
"bash",
|
||
|
}
|
||
|
|
||
8 years ago
|
type pendingConnection interface {
|
||
|
policy() *Policy
|
||
|
procInfo() *procsnitch.Info
|
||
|
hostname() string
|
||
|
dst() net.IP
|
||
|
dstPort() uint16
|
||
|
accept()
|
||
|
drop()
|
||
|
print() string
|
||
|
}
|
||
|
|
||
9 years ago
|
type pendingPkt struct {
|
||
8 years ago
|
pol *Policy
|
||
|
name string
|
||
|
pkt *nfqueue.Packet
|
||
|
pinfo *procsnitch.Info
|
||
|
}
|
||
|
|
||
|
func (pp *pendingPkt) policy() *Policy {
|
||
|
return pp.pol
|
||
|
}
|
||
|
|
||
|
func (pp *pendingPkt) procInfo() *procsnitch.Info {
|
||
|
return pp.pinfo
|
||
|
}
|
||
|
|
||
|
func (pp *pendingPkt) hostname() string {
|
||
|
return pp.name
|
||
|
}
|
||
|
func (pp *pendingPkt) dst() net.IP {
|
||
|
return pp.pkt.Dst
|
||
|
}
|
||
|
|
||
|
func (pp *pendingPkt) dstPort() uint16 {
|
||
|
return pp.pkt.DstPort
|
||
|
}
|
||
|
|
||
|
func (pp *pendingPkt) accept() {
|
||
|
pp.pkt.Accept()
|
||
|
}
|
||
|
|
||
|
func (pp *pendingPkt) drop() {
|
||
|
pp.pkt.Mark = 1
|
||
|
pp.pkt.Accept()
|
||
|
}
|
||
|
|
||
|
func (pp *pendingPkt) print() string {
|
||
8 years ago
|
return printPacket(pp.pkt, pp.name, pp.pinfo)
|
||
9 years ago
|
}
|
||
|
|
||
|
type Policy struct {
|
||
|
fw *Firewall
|
||
|
path string
|
||
|
application string
|
||
|
icon string
|
||
|
rules RuleList
|
||
8 years ago
|
pendingQueue []pendingConnection
|
||
9 years ago
|
promptInProgress bool
|
||
|
lock sync.Mutex
|
||
|
}
|
||
|
|
||
8 years ago
|
func (fw *Firewall) PolicyForPath(path string) *Policy {
|
||
|
fw.lock.Lock()
|
||
|
defer fw.lock.Unlock()
|
||
|
|
||
|
return fw.policyForPath(path)
|
||
|
}
|
||
|
|
||
9 years ago
|
func (fw *Firewall) policyForPath(path string) *Policy {
|
||
|
if _, ok := fw.policyMap[path]; !ok {
|
||
|
p := new(Policy)
|
||
|
p.fw = fw
|
||
|
p.path = path
|
||
|
p.application = path
|
||
|
entry := entryForPath(path)
|
||
|
if entry != nil {
|
||
|
p.application = entry.name
|
||
|
p.icon = entry.icon
|
||
|
}
|
||
|
fw.policyMap[path] = p
|
||
|
fw.policies = append(fw.policies, p)
|
||
|
}
|
||
|
return fw.policyMap[path]
|
||
|
}
|
||
|
|
||
9 years ago
|
func (p *Policy) processPacket(pkt *nfqueue.Packet, pinfo *procsnitch.Info) {
|
||
9 years ago
|
p.lock.Lock()
|
||
|
defer p.lock.Unlock()
|
||
|
name := p.fw.dns.Lookup(pkt.Dst)
|
||
8 years ago
|
if !FirewallConfig.LogRedact {
|
||
8 years ago
|
log.Infof("Lookup(%s): %s", pkt.Dst.String(), name)
|
||
9 years ago
|
}
|
||
8 years ago
|
result := p.rules.filterPacket(pkt, pinfo, name)
|
||
9 years ago
|
switch result {
|
||
|
case FILTER_DENY:
|
||
9 years ago
|
pkt.Mark = 1
|
||
|
pkt.Accept()
|
||
9 years ago
|
case FILTER_ALLOW:
|
||
|
pkt.Accept()
|
||
|
case FILTER_PROMPT:
|
||
8 years ago
|
p.processPromptResult(&pendingPkt{pol: p, name: name, pkt: pkt, pinfo: pinfo})
|
||
9 years ago
|
default:
|
||
8 years ago
|
log.Warningf("Unexpected filter result: %d", result)
|
||
9 years ago
|
}
|
||
|
}
|
||
|
|
||
8 years ago
|
func (p *Policy) processPromptResult(pc pendingConnection) {
|
||
|
p.pendingQueue = append(p.pendingQueue, pc)
|
||
9 years ago
|
if !p.promptInProgress {
|
||
|
p.promptInProgress = true
|
||
|
go p.fw.dbus.prompt(p)
|
||
|
}
|
||
|
}
|
||
|
|
||
8 years ago
|
func (p *Policy) nextPending() pendingConnection {
|
||
9 years ago
|
p.lock.Lock()
|
||
|
defer p.lock.Unlock()
|
||
|
if len(p.pendingQueue) == 0 {
|
||
|
return nil
|
||
|
}
|
||
|
return p.pendingQueue[0]
|
||
|
}
|
||
|
|
||
8 years ago
|
func (p *Policy) removePending(pc pendingConnection) {
|
||
9 years ago
|
p.lock.Lock()
|
||
|
defer p.lock.Unlock()
|
||
|
|
||
8 years ago
|
remaining := []pendingConnection{}
|
||
|
for _, c := range p.pendingQueue {
|
||
|
if c != pc {
|
||
|
remaining = append(remaining, c)
|
||
9 years ago
|
}
|
||
|
}
|
||
|
if len(remaining) != len(p.pendingQueue) {
|
||
|
p.pendingQueue = remaining
|
||
|
}
|
||
|
}
|
||
|
|
||
|
func (p *Policy) processNewRule(r *Rule, scope int32) bool {
|
||
|
p.lock.Lock()
|
||
|
defer p.lock.Unlock()
|
||
|
|
||
|
if scope != APPLY_ONCE {
|
||
|
p.rules = append(p.rules, r)
|
||
|
}
|
||
|
|
||
|
p.filterPending(r)
|
||
|
if len(p.pendingQueue) == 0 {
|
||
|
p.promptInProgress = false
|
||
|
}
|
||
|
|
||
|
return p.promptInProgress
|
||
|
}
|
||
|
|
||
9 years ago
|
func (p *Policy) parseRule(s string, add bool) (*Rule, error) {
|
||
|
r := new(Rule)
|
||
8 years ago
|
r.mode = RULE_MODE_PERMANENT
|
||
9 years ago
|
r.policy = p
|
||
|
if !r.parse(s) {
|
||
|
return nil, parseError(s)
|
||
|
}
|
||
|
if add {
|
||
|
p.lock.Lock()
|
||
|
defer p.lock.Unlock()
|
||
|
p.rules = append(p.rules, r)
|
||
|
}
|
||
|
p.fw.addRule(r)
|
||
|
return r, nil
|
||
|
}
|
||
|
|
||
|
func (p *Policy) removeRule(r *Rule) {
|
||
|
p.lock.Lock()
|
||
|
defer p.lock.Unlock()
|
||
|
|
||
|
var newRules RuleList
|
||
|
for _, rr := range p.rules {
|
||
|
if rr.id != r.id {
|
||
|
newRules = append(newRules, rr)
|
||
|
}
|
||
|
}
|
||
|
p.rules = newRules
|
||
|
}
|
||
|
|
||
9 years ago
|
func (p *Policy) filterPending(rule *Rule) {
|
||
8 years ago
|
remaining := []pendingConnection{}
|
||
|
for _, pc := range p.pendingQueue {
|
||
|
if rule.match(pc.dst(), pc.dstPort(), pc.hostname()) {
|
||
8 years ago
|
log.Infof("Adding rule for: %s", rule.getString(FirewallConfig.LogRedact))
|
||
|
log.Noticef("%s > %s", rule.getString(FirewallConfig.LogRedact), pc.print())
|
||
9 years ago
|
if rule.rtype == RULE_ALLOW {
|
||
8 years ago
|
pc.accept()
|
||
9 years ago
|
} else {
|
||
8 years ago
|
pc.drop()
|
||
9 years ago
|
}
|
||
|
} else {
|
||
8 years ago
|
remaining = append(remaining, pc)
|
||
9 years ago
|
}
|
||
|
}
|
||
|
if len(remaining) != len(p.pendingQueue) {
|
||
|
p.pendingQueue = remaining
|
||
|
}
|
||
|
}
|
||
|
|
||
|
func (p *Policy) hasPersistentRules() bool {
|
||
|
for _, r := range p.rules {
|
||
8 years ago
|
if r.mode != RULE_MODE_SESSION {
|
||
9 years ago
|
return true
|
||
|
}
|
||
|
}
|
||
|
return false
|
||
|
}
|
||
|
|
||
8 years ago
|
func printPacket(pkt *nfqueue.Packet, hostname string, pinfo *procsnitch.Info) string {
|
||
9 years ago
|
proto := func() string {
|
||
|
switch pkt.Protocol {
|
||
|
case nfqueue.TCP:
|
||
|
return "TCP"
|
||
|
case nfqueue.UDP:
|
||
|
return "UDP"
|
||
|
default:
|
||
|
return "???"
|
||
|
}
|
||
|
}()
|
||
9 years ago
|
|
||
8 years ago
|
if FirewallConfig.LogRedact {
|
||
9 years ago
|
hostname = "[redacted]"
|
||
|
}
|
||
9 years ago
|
name := hostname
|
||
|
if name == "" {
|
||
|
name = pkt.Dst.String()
|
||
|
}
|
||
8 years ago
|
if (pinfo == nil) {
|
||
|
return fmt.Sprintf("(%s %s:%d -> %s:%d)", proto, pkt.Src, pkt.SrcPort, name, pkt.DstPort)
|
||
|
} else {
|
||
|
return fmt.Sprintf("%s %s %s:%d -> %s:%d", pinfo.ExePath, proto, pkt.Src, pkt.SrcPort, name, pkt.DstPort)
|
||
|
}
|
||
9 years ago
|
}
|
||
|
|
||
|
func (fw *Firewall) filterPacket(pkt *nfqueue.Packet) {
|
||
|
if pkt.Protocol == nfqueue.UDP && pkt.SrcPort == 53 {
|
||
|
pkt.Accept()
|
||
|
fw.dns.processDNS(pkt)
|
||
|
return
|
||
|
}
|
||
9 years ago
|
pinfo := findProcessForPacket(pkt)
|
||
9 years ago
|
if pinfo == nil {
|
||
8 years ago
|
log.Warningf("No proc found for %s", printPacket(pkt, fw.dns.Lookup(pkt.Dst), nil))
|
||
9 years ago
|
pkt.Accept()
|
||
|
return
|
||
|
}
|
||
8 years ago
|
ppath := pinfo.ExePath
|
||
|
cf := strings.Fields(pinfo.CmdLine)
|
||
|
if len(cf) > 1 && strings.HasPrefix(cf[1], "/") {
|
||
|
for _, intp := range _interpreters {
|
||
|
if strings.Contains(pinfo.ExePath, intp) {
|
||
|
ppath = cf[1]
|
||
|
break
|
||
|
}
|
||
|
}
|
||
|
}
|
||
8 years ago
|
log.Debugf("filterPacket [%s] %s", ppath, printPacket(pkt, fw.dns.Lookup(pkt.Dst), nil))
|
||
9 years ago
|
if basicAllowPacket(pkt) {
|
||
9 years ago
|
pkt.Accept()
|
||
|
return
|
||
|
}
|
||
8 years ago
|
policy := fw.PolicyForPath(ppath)
|
||
9 years ago
|
policy.processPacket(pkt, pinfo)
|
||
9 years ago
|
}
|
||
|
|
||
9 years ago
|
func findProcessForPacket(pkt *nfqueue.Packet) *procsnitch.Info {
|
||
9 years ago
|
switch pkt.Protocol {
|
||
|
case nfqueue.TCP:
|
||
9 years ago
|
return procsnitch.LookupTCPSocketProcess(pkt.SrcPort, pkt.Dst, pkt.DstPort)
|
||
9 years ago
|
case nfqueue.UDP:
|
||
9 years ago
|
return procsnitch.LookupUDPSocketProcess(pkt.SrcPort)
|
||
9 years ago
|
default:
|
||
8 years ago
|
log.Warningf("Packet has unknown protocol: %d", pkt.Protocol)
|
||
9 years ago
|
return nil
|
||
|
}
|
||
|
}
|
||
|
|
||
9 years ago
|
func basicAllowPacket(pkt *nfqueue.Packet) bool {
|
||
|
return pkt.Dst.IsLoopback() ||
|
||
|
pkt.Dst.IsLinkLocalMulticast() ||
|
||
|
pkt.Protocol != nfqueue.TCP
|
||
|
}
|