41 Commits (master)

Author	SHA1	Message	Date
dma	139c4a08b8	Fixes https://github.com/subgraph/fw-daemon/issues/52 + redacts logs per config	7 years ago
dma	38fabc3327	Apply rules contextually by policy defined sandbox	7 years ago
dma	c395ad85f8	Fix dumb bug where sgfw accepting DNS packet before passing to DNS processor	7 years ago
xSmurf	c01894f35c	fmt..	7 years ago
dma	92276eed47	fmt	7 years ago
dma	5f454f2c6b	Remove debug output	7 years ago
dma	af1a925b11	Fix bug where sometimes not all of /proc/net/tcp is read	7 years ago
dma	ed8c254404	Add TLSGuard to SOCKS5 filter clients not coming from oz-daemon	7 years ago
xSmurf	755e0088c5	typo and fmt...	7 years ago
xSmurf	6e6e265fae	Fmt..	7 years ago
dma	68e6d57c9b	Remove bad deps, fix exec erroneous path truncation for processes outside of oz	7 years ago
dma	dafec55bc7	Fixed bug with prompt rule / saved rule mismatch on SOCKS connects	7 years ago
dma	7b5a0ed980	Bug fixes, cleanup, improvement	7 years ago
dma	f3f5414fd4	Support for TLSGuard in prompter	7 years ago
User	14e1f99b03	Loosen match on UDP socket lookup (still WIP)	7 years ago
shw	27d0a4809d	Updated SOCKS5 connection lookup code now correctly identifies originating process. ... Includes code to read internal proxy state information from (updated) oz-daemon.	8 years ago
shw	acf62b63d1	Changed SOCKS/Tor credential randomization so it only occurs if username and password are empty.	8 years ago
shw	515c4eb3ee	Squashed (some) noisy debug output.	8 years ago
shw	0f2b2413ea	Added per-process (ephemeral) rule support. ... (proc coroner now has support for multiple callbacks)	8 years ago
shw	8546f6c416	Working (but not intensively tested) IPv6 support!	8 years ago
shw	5f5042fed4	Very noisy, experimental support for asynchronous multi-rule firewall prompting. ... Fixed prompted rule removal bug in fw-prompt.	8 years ago
shw	c3635093fa	Introduced per-process DNS cache segregation for all A records not returned by local resolver. ... Cached DNS name lookups now failover to global cache only populated by local resolver. Added proc-coroner module for detecting process deaths. procsnitch updated to handle multiple levels of "strictness" (necessary to lookup processes generating certain UDP data).	8 years ago
shw	51c181a881	Full support for multiple protocol types (UDP, ICMP). ... Cleared up awkward fw-settings/fwprompt GUI language caused by introduction of UDP/ICMP ("connection"-less) rules. fw-daemon automatically passes through all ICMP traffic sent to same address. Added (temporary) rule for passing through all UDP-based DNS server traffic. Updated developers' README documentation.	8 years ago
shw	f47e23e706	Support for firewall rule matching by uid/gid and/or user/group name value. ... fw-daemon prompt GUI and fw-settings now include user/uid and group/gid info. sgfw prompt GUI now displays username instead of real name. Fixed bug in parsing IP addresses as CIDR values. sgfw_rules entries can now be commented out. Upgraded bundled go-procsnitch API.	8 years ago
shw	0708f9127c	Proper logging of all connections denied by firewall. ... fw-daemon now also forces logging to syslog if launched from a terminal.	8 years ago
shw	e895f204a7	Fixed bug so that system-wide firewall settings match all traffic except sandboxed traffic.	8 years ago
shw	b567e5ce54	oz-init pid mappings are now properly destroyed as these processes exit.	8 years ago
shw	a930fbbce0	Sandboxed process entries in GUI now include sandbox name/ID in display. ... Removed fatal error when a connection to oz-control socket cannot be established.	8 years ago
shw	ba35abfb46	Name of sandboxed exe returned by procsnitch is now resolved to absolute pathname.	8 years ago
shw	b4ed11261f	Added extra display info for "Sandboxed application" in fw-prompt gnome shell GUI. ... fw-prompt GUI gracefully displays unknown PIDs and UIDs. Fixed stupid syntax error bug in oz-init PID management code.	8 years ago
shw	7a1851419c	Added support for using fw-daemon on all processes system-wide. ... Added changes for fw-daemon to check sandboxed processes' oz-init /proc/[pid]/net/tcp with procsnitch. fw-daemon IPC accepts "register-init" command to register new oz-init process instance alerts. fw-daemon also checks for existing oz-init processes on startup. Updated vendor-bundled go-procsnitch to latest dev version that includes findTCPSocketAll().	8 years ago
shw	9069c91606	Garbage dump commit of current progress.	8 years ago
shw	08266cca76	Support for handling network traffic that can't be uncovered with procsnitch.	8 years ago
shw	cadb859dce	Added ephemeral oz sandbox/fw-daemon rules that can be updated via IPC connection. ... fw-daemon prompter is now updated with source address of originating packet. Fixed bug in decoding DNS data. Packets are dropped properly (by marking and then calling Accept()).	8 years ago
shw	942b0a0c01	Bug fix.	8 years ago
shw	8fe02202de	Very dirty/experimental replacement of nfqueue with native github.com/subgraph/go-nfnetlink package.	8 years ago
xSmurf	02155c44ed	Golint...	8 years ago
xSmurf	2e6f98e410	FMT...	8 years ago
xSmurf	5d4b38c5b4	Refactor...	8 years ago
xSmurf	4b632fb6f2	Moved fw-daemon to command/lib	8 years ago
xSmurf	9c8f5895ca	Moved all to sgfw	8 years ago