Settings: adding sandbox and allow tls to rule edit...

fw-settings/definitions/RuleEdit.ui

@@ -98,6 +98,7 @@
                     <property name="active">0</property>
                     <items>
                       <item id="allow" translatable="yes">Allow</item>
+                      <item id="allow_tls" translatable="yes">Allow TLS Only</item>
                       <item id="deny" translatable="yes">Deny</item>
                     </items>
                   </object>
@@ -162,7 +163,7 @@
               </object>
               <packing>
                 <property name="left_attach">0</property>
-                <property name="top_attach">2</property>
+                <property name="top_attach">3</property>
                 <property name="width">2</property>
               </packing>
             </child>
@@ -184,6 +185,34 @@
                 <property name="top_attach">1</property>
               </packing>
             </child>
+            <child>
+              <object class="GtkLabel" id="sandbox_title">
+                <property name="visible">True</property>
+                <property name="can_focus">False</property>
+                <property name="halign">start</property>
+                <property name="hexpand">False</property>
+                <property name="label" translatable="yes">Sandbox:</property>
+                <attributes>
+                  <attribute name="weight" value="bold"/>
+                </attributes>
+              </object>
+              <packing>
+                <property name="left_attach">0</property>
+                <property name="top_attach">2</property>
+              </packing>
+            </child>
+            <child>
+              <object class="GtkLabel" id="sandbox_label">
+                <property name="visible">True</property>
+                <property name="can_focus">False</property>
+                <property name="halign">start</property>
+                <property name="hexpand">True</property>
+              </object>
+              <packing>
+                <property name="left_attach">1</property>
+                <property name="top_attach">2</property>
+              </packing>
+            </child>
           </object>
           <packing>
             <property name="expand">False</property>

fw-settings/definitions/rule_edit.go

@@ -108,6 +108,7 @@ func (*defRuleEdit) String() string {
                     <property name="active">0</property>
                     <items>
                       <item id="allow" translatable="yes">Allow</item>
+                      <item id="allow_tls" translatable="yes">Allow TLS Only</item>
                       <item id="deny" translatable="yes">Deny</item>
                     </items>
                   </object>
@@ -172,7 +173,7 @@ func (*defRuleEdit) String() string {
               </object>
               <packing>
                 <property name="left_attach">0</property>
-                <property name="top_attach">2</property>
+                <property name="top_attach">3</property>
                 <property name="width">2</property>
               </packing>
             </child>
@@ -194,6 +195,34 @@ func (*defRuleEdit) String() string {
                 <property name="top_attach">1</property>
               </packing>
             </child>
+            <child>
+              <object class="GtkLabel" id="sandbox_title">
+                <property name="visible">True</property>
+                <property name="can_focus">False</property>
+                <property name="halign">start</property>
+                <property name="hexpand">False</property>
+                <property name="label" translatable="yes">Sandbox:</property>
+                <attributes>
+                  <attribute name="weight" value="bold"/>
+                </attributes>
+              </object>
+              <packing>
+                <property name="left_attach">0</property>
+                <property name="top_attach">2</property>
+              </packing>
+            </child>
+            <child>
+              <object class="GtkLabel" id="sandbox_label">
+                <property name="visible">True</property>
+                <property name="can_focus">False</property>
+                <property name="halign">start</property>
+                <property name="hexpand">True</property>
+              </object>
+              <packing>
+                <property name="left_attach">1</property>
+                <property name="top_attach">2</property>
+              </packing>
+            </child>
           </object>
           <packing>
             <property name="expand">False</property>

fw-settings/rule_edit.go

@@ -21,6 +21,8 @@ type ruleEdit struct {
 	row          *ruleRow
 	dialog       *gtk.Dialog
 	pathLabel    *gtk.Label
+	sandboxLabel *gtk.Label
+	sandboxTitle *gtk.Label
 	verbCombo    *gtk.ComboBoxText
 	hostEntry    *gtk.Entry
 	portEntry    *gtk.Entry
@@ -33,6 +35,8 @@ func newRuleEdit(rr *ruleRow, saveasnew bool) *ruleEdit {
 	b.getItems(
 		"dialog", &redit.dialog,
 		"path_label", &redit.pathLabel,
+		"sandbox_label", &redit.sandboxLabel,
+		"sandbox_title", &redit.sandboxTitle,
 		"verb_combo", &redit.verbCombo,
 		"host_entry", &redit.hostEntry,
 		"port_entry", &redit.portEntry,
@@ -54,9 +58,17 @@ func (re *ruleEdit) updateDialogFields() {
 	re.pathLabel.SetText(r.Path)
 	if sgfw.RuleAction(r.Verb) == sgfw.RULE_ACTION_ALLOW {
 		re.verbCombo.SetActiveID("allow")
+	} else if sgfw.RuleAction(r.Verb) == sgfw.RULE_ACTION_ALLOW_TLSONLY {
+		re.verbCombo.SetActiveID("allow_tls")
 	} else {
 		re.verbCombo.SetActiveID("deny")
 	}
+	if r.Sandbox != "" {
+		re.sandboxLabel.SetText(r.Sandbox)
+	} else {
+		re.sandboxLabel.SetVisible(false)
+		re.sandboxTitle.SetVisible(false)
+	}
 	target := strings.Split(r.Target, ":")
 	if len(target) != 2 {
 		return
@@ -67,7 +79,7 @@ func (re *ruleEdit) updateDialogFields() {
 
 func (re *ruleEdit) validateFields() bool {
 	id := re.verbCombo.GetActiveID()
-	if id != "allow" && id != "deny" {
+	if id != "allow" && id != "allow_tls" && id != "deny" {
 		return false
 	}
 	host, _ := re.hostEntry.GetText()
@@ -121,6 +133,8 @@ func (re *ruleEdit) updateRow() {
 	switch re.verbCombo.GetActiveID() {
 	case "allow":
 		r.Verb = uint16(sgfw.RULE_ACTION_ALLOW)
+	case "allow_tls":
+		r.Verb = uint16(sgfw.RULE_ACTION_ALLOW_TLSONLY)
 	case "deny":
 		r.Verb = uint16(sgfw.RULE_ACTION_DENY)
 	}

fw-settings/rules.go

@@ -135,6 +135,9 @@ func getVerbText(rule *sgfw.DbusRule) string {
 	if sgfw.RuleAction(rule.Verb) == sgfw.RULE_ACTION_ALLOW {
 		return sgfw.RuleActionString[sgfw.RULE_ACTION_ALLOW] + ":"
 	}
+	if sgfw.RuleAction(rule.Verb) == sgfw.RULE_ACTION_ALLOW_TLSONLY {
+		return sgfw.RuleActionString[sgfw.RULE_ACTION_ALLOW_TLSONLY] + ":"
+	}
 	return sgfw.RuleActionString[sgfw.RULE_ACTION_DENY] + ":"
 }
 
@@ -180,11 +183,24 @@ func (rr *ruleRow) onEdit() {
 }
 
 func (rr *ruleRow) onDelete() {
-	body := fmt.Sprintf(`Are you sure you want to delete this rule:
+	var body string
+	if rr.rule.Sandbox != "" {
+		ss := `Are you sure you want to delete this rule:
 
 	<b>Path:</b>   %s
 
-	<b>Rule:</b>   %s %s`, rr.rule.Path, getVerbText(rr.rule), getTargetText(rr.rule))
+	<b>Sandbox:</b>   %s
+
+	<b>Rule:</b>   %s %s`
+		body = fmt.Sprintf(ss, rr.rule.Path, rr.rule.Sandbox, getVerbText(rr.rule), getTargetText(rr.rule))
+	} else {
+		ss := `Are you sure you want to delete this rule:
+
+	<b>Path:</b>   %s
+
+	<b>Rule:</b>   %s %s`
+		body = fmt.Sprintf(ss, rr.rule.Path, getVerbText(rr.rule), getTargetText(rr.rule))
+	}
 	d := gtk.MessageDialogNewWithMarkup(
 		rr.rl.win,
 		gtk.DIALOG_DESTROY_WITH_PARENT,

sgfw/const.go

@@ -141,6 +141,7 @@ type DbusRule struct {
 	Verb    uint16
 	Target  string
 	Mode    uint16
+	Sandbox string
 }
 
 /*const (

sgfw/dbus.go

@@ -153,6 +153,7 @@ func createDbusRule(r *Rule) DbusRule {
 	} else if r.gid >= 0 {
 		pstr += ":" + strconv.Itoa(r.gid)
 	}
+	log.Debugf("SANDBOX SANDBOX SANDBOX: %s", r.sandbox)
 	return DbusRule{
 		ID:      uint32(r.id),
 		Net:     netstr,
@@ -165,6 +166,7 @@ func createDbusRule(r *Rule) DbusRule {
 		Verb:    uint16(r.rtype),
 		Target:  r.AddrString(false),
 		Mode:    uint16(r.mode),
+		Sandbox: r.sandbox,
 	}
 }
 
@@ -223,6 +225,7 @@ func (ds *dbusServer) UpdateRule(rule DbusRule) *dbus.Error {
 		r.addr = tmp.addr
 		r.port = tmp.port
 		r.mode = RuleMode(rule.Mode)
+		r.sandbox = rule.Sandbox
 		r.policy.lock.Unlock()
 		if r.mode != RULE_MODE_SESSION {
 			ds.fw.saveRules()

sgfw/rules.go

@@ -188,7 +188,7 @@ func (rl *RuleList) filter(pkt *nfqueue.NFQPacket, src, dst net.IP, dstPort uint
 				nfqproto = getNFQProto(pkt)
 			} else {
 				log.Noticef("Weird state: %v %v %v %v", r.port, dstPort, hostname, r.hostname)
-				if (r.saddr == nil && src == nil && sandboxed == false && (r.port == dstPort || r.port == matchAny) && (r.addr.Equal(anyAddress) || r.hostname == "" || r.hostname == hostname)) {
+				if r.saddr == nil && src == nil && sandboxed == false && (r.port == dstPort || r.port == matchAny) && (r.addr.Equal(anyAddress) || r.hostname == "" || r.hostname == hostname) {
 					log.Notice("+ Socks5 MATCH SUCCEEDED")
 					if r.rtype == RULE_ACTION_DENY {
 						return FILTER_DENY