package sgfw import ( "fmt" "os/user" "strconv" "strings" "sync" "time" "github.com/godbus/dbus" "github.com/subgraph/fw-daemon/proc-coroner" ) var DoMultiPrompt = true const MAX_PROMPTS = 3 var outstandingPrompts = 0 var promptLock = &sync.Mutex{} func newPrompter(conn *dbus.Conn) *prompter { p := new(prompter) p.cond = sync.NewCond(&p.lock) p.dbusObj = conn.Object("com.subgraph.FirewallPrompt", "/com/subgraph/FirewallPrompt") p.policyMap = make(map[string]*Policy) go p.promptLoop() return p } type prompter struct { dbusObj dbus.BusObject lock sync.Mutex cond *sync.Cond policyMap map[string]*Policy policyQueue []*Policy } func (p *prompter) prompt(policy *Policy) { p.lock.Lock() defer p.lock.Unlock() _, ok := p.policyMap[policy.path] if ok { return } p.policyMap[policy.path] = policy p.policyQueue = append(p.policyQueue, policy) p.cond.Signal() } func (p *prompter) promptLoop() { p.lock.Lock() for { fmt.Println("promptLoop() outer") for p.processNextPacket() { fmt.Println("promptLoop() inner") } fmt.Println("promptLoop() wait") p.cond.Wait() } } func (p *prompter) processNextPacket() bool { var pc pendingConnection = nil if !DoMultiPrompt { pc, _ = p.nextConnection() if pc == nil { return false } p.lock.Unlock() defer p.lock.Lock() p.processConnection(pc) return true } empty := true for { pc, empty = p.nextConnection() fmt.Println("processNextPacket() loop; empty = ", empty, " / pc = ", pc) if pc == nil && empty { return false } else if pc == nil { continue } else if pc != nil { break } } p.lock.Unlock() defer p.lock.Lock() fmt.Println("Waiting for prompt lock go...") for { promptLock.Lock() if outstandingPrompts >= MAX_PROMPTS { promptLock.Unlock() continue } if pc.getPrompting() { fmt.Println("Skipping over already prompted connection") promptLock.Unlock() continue } break } fmt.Println("Passed prompt lock!") outstandingPrompts++ fmt.Println("Incremented outstanding to ", outstandingPrompts) promptLock.Unlock() // if !pc.getPrompting() { pc.setPrompting(true) go p.processConnection(pc) // } return true } func processReturn (pc pendingConnection) { promptLock.Lock() outstandingPrompts-- fmt.Println("Return decremented outstanding to ", outstandingPrompts) promptLock.Unlock() pc.setPrompting(false) } func (p *prompter) processConnection(pc pendingConnection) { var scope int32 var rule string if DoMultiPrompt { defer processReturn(pc) } addr := pc.hostname() if addr == "" { addr = pc.dst().String() } policy := pc.policy() call := p.dbusObj.Call("com.subgraph.FirewallPrompt.RequestPrompt", 0, policy.application, policy.icon, policy.path, addr, int32(pc.dstPort()), pc.dst().String(), pc.src().String(), pc.proto(), int32(pc.procInfo().UID), int32(pc.procInfo().GID), uidToUser(pc.procInfo().UID), gidToGroup(pc.procInfo().GID), int32(pc.procInfo().Pid), pc.getOptString(), FirewallConfig.PromptExpanded, FirewallConfig.PromptExpert, int32(FirewallConfig.DefaultActionID)) err := call.Store(&scope, &rule) if err != nil { log.Warningf("Error sending dbus RequestPrompt message: %v", err) policy.removePending(pc) pc.drop() return } if pc.src() != nil { if !strings.HasSuffix(rule, "SYSTEM") && !strings.HasSuffix(rule, "||") { rule += "|" } rule += "||" + pc.src().String() } r, err := policy.parseRule(rule, false) if err != nil { log.Warningf("Error parsing rule string returned from dbus RequestPrompt: %v", err) policy.removePending(pc) pc.drop() return } fscope := FilterScope(scope) if fscope == APPLY_SESSION { r.mode = RULE_MODE_SESSION } else if fscope == APPLY_PROCESS { r.mode = RULE_MODE_PROCESS r.pid = pc.procInfo().Pid pcoroner.MonitorProcess(r.pid) } if !policy.processNewRule(r, fscope) { p.lock.Lock() defer p.lock.Unlock() p.removePolicy(pc.policy()) } if fscope == APPLY_FOREVER { policy.fw.saveRules() } dbusp.alertRule("sgfw prompt added new rule") } func (p *prompter) nextConnection() (pendingConnection, bool) { for { if len(p.policyQueue) == 0 { return nil, true } policy := p.policyQueue[0] pc, qempty := policy.nextPending() if pc == nil && qempty { p.removePolicy(policy) } else { if pc == nil && !qempty { fmt.Println("FIX ME: I NEED TO SLEEP ON A WAKEABLE CONDITION PROPERLY!!") time.Sleep(time.Millisecond * 300) } return pc, qempty } } } func (p *prompter) removePolicy(policy *Policy) { var newQueue []*Policy = nil if DoMultiPrompt { if len(p.policyQueue) == 0 { fmt.Println("Skipping over zero length policy queue") newQueue = make([]*Policy, 0, 0) } } if !DoMultiPrompt || newQueue == nil { newQueue = make([]*Policy, 0, len(p.policyQueue)-1) } for _, pol := range p.policyQueue { if pol != policy { newQueue = append(newQueue, pol) } } p.policyQueue = newQueue delete(p.policyMap, policy.path) } var userMap = make(map[int]string) var groupMap = make(map[int]string) func lookupUser(uid int) string { if uid == -1 { return "[unknown]" } u, err := user.LookupId(strconv.Itoa(uid)) if err != nil { return fmt.Sprintf("%d", uid) } return u.Username } func lookupGroup(gid int) string { if gid == -1 { return "[unknown]" } g, err := user.LookupGroupId(strconv.Itoa(gid)) if err != nil { return fmt.Sprintf("%d", gid) } return g.Name } func uidToUser(uid int) string { uname, ok := userMap[uid] if ok { return uname } uname = lookupUser(uid) userMap[uid] = uname return uname } func gidToGroup(gid int) string { gname, ok := groupMap[gid] if ok { return gname } gname = lookupGroup(gid) groupMap[gid] = gname return gname }