35 Commits (0d13c7bb9c5a8665327c1fac30999c6a829fcd83)

Author	SHA1	Message	Date
Stephen Watt	0d13c7bb9c	*WORK IN PROGRESS*: New file descriptor monitor thread removes prompt requests if associated socket closes/dies before user reacts. ... fw-prompt request entries are now properly tethered to their default rule scope included by SGFW. pendingConnection now operates on prompter instead of raw DBus object. Fixed prompter bug in cycling through pending connections. Fixed inadequacies in SGFW rules parsing/error handling. go fmt.	7 years ago
Stephen Watt	2eac4c7dc5	*Very experimental*/under-dev release of new fully asynchronous multi-prompter. ... New Dbus method "RequestPromptAsync" to handle "return-less" prompter invocations in fw-prompt. Proper GUI locking in fw-prompt eliminates old race/crash conditions. New DBus method "GetPendingRequests" in SGFW allows prompter to retrieve pending connections. Policies now maintain rulesPending list of unapplied asynchronously submitted FW rules from the prompter. Fixed reentrance/crash bug in UID and GID to name lookups.	7 years ago
Stephen Watt	2f5e10d53d	Merge newest branch changes with latest changes to master.	7 years ago
Stephen Watt	2fc7525cc7	Added new RemovePrompt DBus call to complement RequestPrompt (GUID-based prompt removal). ... The addition of a rule matching multiple pending connections in fw-prompt now removes all of them. fw-prompter now increments ref# column for identical prompt requests. Fixed/cleaned up/updated TLSGuard code. Added TLSGuard toggle option to fw-prompt GUI (default for SOCKS connections). fw-prompt now displays icon of filtered application. DBus RequestPrompt() now "works" asynchronously. TLSGuard fixed under certain conditions but still very buggy. Fixed some fw-prompt crash conditions with treeview mutex locking. Fixed SOCKS connection panic condition linked to closed channel. Cleanup of unused data structures/values.	7 years ago
Stephen Watt	a8f61a2d4e	Re-sync to master.	7 years ago
dma	dafec55bc7	Fixed bug with prompt rule / saved rule mismatch on SOCKS connects	7 years ago
dma	7b5a0ed980	Bug fixes, cleanup, improvement	7 years ago
dma	f3f5414fd4	Support for TLSGuard in prompter	7 years ago
User	14e1f99b03	Loosen match on UDP socket lookup (still WIP)	7 years ago
shw	27d0a4809d	Updated SOCKS5 connection lookup code now correctly identifies originating process. ... Includes code to read internal proxy state information from (updated) oz-daemon.	8 years ago
shw	acf62b63d1	Changed SOCKS/Tor credential randomization so it only occurs if username and password are empty.	8 years ago
shw	515c4eb3ee	Squashed (some) noisy debug output.	8 years ago
shw	0f2b2413ea	Added per-process (ephemeral) rule support. ... (proc coroner now has support for multiple callbacks)	8 years ago
shw	8546f6c416	Working (but not intensively tested) IPv6 support!	8 years ago
shw	5f5042fed4	Very noisy, experimental support for asynchronous multi-rule firewall prompting. ... Fixed prompted rule removal bug in fw-prompt.	8 years ago
shw	c3635093fa	Introduced per-process DNS cache segregation for all A records not returned by local resolver. ... Cached DNS name lookups now failover to global cache only populated by local resolver. Added proc-coroner module for detecting process deaths. procsnitch updated to handle multiple levels of "strictness" (necessary to lookup processes generating certain UDP data).	8 years ago
shw	51c181a881	Full support for multiple protocol types (UDP, ICMP). ... Cleared up awkward fw-settings/fwprompt GUI language caused by introduction of UDP/ICMP ("connection"-less) rules. fw-daemon automatically passes through all ICMP traffic sent to same address. Added (temporary) rule for passing through all UDP-based DNS server traffic. Updated developers' README documentation.	8 years ago
shw	f47e23e706	Support for firewall rule matching by uid/gid and/or user/group name value. ... fw-daemon prompt GUI and fw-settings now include user/uid and group/gid info. sgfw prompt GUI now displays username instead of real name. Fixed bug in parsing IP addresses as CIDR values. sgfw_rules entries can now be commented out. Upgraded bundled go-procsnitch API.	8 years ago
shw	0708f9127c	Proper logging of all connections denied by firewall. ... fw-daemon now also forces logging to syslog if launched from a terminal.	8 years ago
shw	e895f204a7	Fixed bug so that system-wide firewall settings match all traffic except sandboxed traffic.	8 years ago
shw	b567e5ce54	oz-init pid mappings are now properly destroyed as these processes exit.	8 years ago
shw	a930fbbce0	Sandboxed process entries in GUI now include sandbox name/ID in display. ... Removed fatal error when a connection to oz-control socket cannot be established.	8 years ago
shw	ba35abfb46	Name of sandboxed exe returned by procsnitch is now resolved to absolute pathname.	8 years ago
shw	b4ed11261f	Added extra display info for "Sandboxed application" in fw-prompt gnome shell GUI. ... fw-prompt GUI gracefully displays unknown PIDs and UIDs. Fixed stupid syntax error bug in oz-init PID management code.	8 years ago
shw	7a1851419c	Added support for using fw-daemon on all processes system-wide. ... Added changes for fw-daemon to check sandboxed processes' oz-init /proc/[pid]/net/tcp with procsnitch. fw-daemon IPC accepts "register-init" command to register new oz-init process instance alerts. fw-daemon also checks for existing oz-init processes on startup. Updated vendor-bundled go-procsnitch to latest dev version that includes findTCPSocketAll().	8 years ago
shw	9069c91606	Garbage dump commit of current progress.	8 years ago
shw	08266cca76	Support for handling network traffic that can't be uncovered with procsnitch.	8 years ago
shw	cadb859dce	Added ephemeral oz sandbox/fw-daemon rules that can be updated via IPC connection. ... fw-daemon prompter is now updated with source address of originating packet. Fixed bug in decoding DNS data. Packets are dropped properly (by marking and then calling Accept()).	8 years ago
shw	942b0a0c01	Bug fix.	8 years ago
shw	8fe02202de	Very dirty/experimental replacement of nfqueue with native github.com/subgraph/go-nfnetlink package.	8 years ago
xSmurf	02155c44ed	Golint...	8 years ago
xSmurf	2e6f98e410	FMT...	8 years ago
xSmurf	5d4b38c5b4	Refactor...	8 years ago
xSmurf	4b632fb6f2	Moved fw-daemon to command/lib	8 years ago
xSmurf	9c8f5895ca	Moved all to sgfw	8 years ago