You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
fw-daemon/sgfw/sgfw.go

285 lines
5.5 KiB

package sgfw
import (
"os"
"os/signal"
"regexp"
"sync"
"syscall"
// "time"
"bufio"
"encoding/json"
"fmt"
"strings"
"github.com/op/go-logging"
nfqueue "github.com/subgraph/go-nfnetlink/nfqueue"
// "github.com/subgraph/go-nfnetlink"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"github.com/subgraph/fw-daemon/proc-coroner"
"github.com/subgraph/go-procsnitch"
)
var dbusp *dbusObjectP = nil
type Firewall struct {
dbus *dbusServer
dns *dnsCache
enabled bool
logBackend logging.LeveledBackend
lock sync.Mutex
policyMap map[string]*Policy
policies []*Policy
ruleLock sync.Mutex
rulesByID map[uint]*Rule
nextRuleID uint
reloadRulesChan chan bool
stopChan chan bool
}
func (fw *Firewall) setEnabled(flag bool) {
fw.lock.Lock()
defer fw.lock.Unlock()
fw.enabled = flag
}
func (fw *Firewall) isEnabled() bool {
fw.lock.Lock()
defer fw.lock.Unlock()
return fw.enabled
}
func (fw *Firewall) clearRules() {
fw.ruleLock.Lock()
defer fw.ruleLock.Unlock()
fw.rulesByID = nil
fw.nextRuleID = 0
}
func (fw *Firewall) addRule(r *Rule) {
fw.ruleLock.Lock()
defer fw.ruleLock.Unlock()
r.id = fw.nextRuleID
fw.nextRuleID++
if fw.rulesByID == nil {
fw.rulesByID = make(map[uint]*Rule)
}
fw.rulesByID[r.id] = r
}
func (fw *Firewall) getRuleByID(id uint) *Rule {
fw.ruleLock.Lock()
defer fw.ruleLock.Unlock()
if fw.rulesByID == nil {
return nil
}
return fw.rulesByID[id]
}
func (fw *Firewall) stop() {
fw.stopChan <- true
}
func (fw *Firewall) reloadRules() {
fw.reloadRulesChan <- true
}
func (fw *Firewall) runFilter() {
q := nfqueue.NewNFQueue(0)
// XXX: need to implement this
// q.DefaultVerdict = nfqueue.DROP
// XXX: need this as well
// q.Timeout = 5 * time.Minute
ps, err := q.Open()
if err != nil {
log.Fatal("Error opening NFQueue:", err)
}
q.EnableHWTrace()
defer q.Close()
go func() {
for p := range ps {
if fw.isEnabled() {
ipLayer := p.Packet.Layer(layers.LayerTypeIPv4)
if ipLayer == nil {
continue
}
ip, _ := ipLayer.(*layers.IPv4)
if ip == nil {
continue
}
if ip.Version == 6 {
ip6p := gopacket.NewPacket(ip.LayerContents(), layers.LayerTypeIPv6, gopacket.Default)
p.Packet = ip6p
}
fw.filterPacket(p)
} else {
p.Accept()
}
}
}()
for {
select {
case <-fw.reloadRulesChan:
fw.loadRules()
case <-fw.stopChan:
return
}
}
}
type SocksJsonConfig struct {
Name string
SocksListener string
TorSocks string
}
var commentRegexp = regexp.MustCompile("^[ \t]*#")
const defaultSocksCfgPath = "/etc/sgfw/fw-daemon-socks.json"
func loadSocksConfiguration(configFilePath string) (*SocksJsonConfig, error) {
config := SocksJsonConfig{}
file, err := os.Open(configFilePath)
if err != nil {
return nil, err
}
scanner := bufio.NewScanner(file)
bs := ""
for scanner.Scan() {
line := scanner.Text()
if !commentRegexp.MatchString(line) {
bs += line + "\n"
}
}
if err := json.Unmarshal([]byte(bs), &config); err != nil {
return nil, err
}
return &config, nil
}
func getSocksChainConfig(config *SocksJsonConfig) *socksChainConfig {
// TODO: fix this to support multiple named proxy forwarders of different types
fields := strings.Split(config.TorSocks, "|")
torSocksNet := fields[0]
torSocksAddr := fields[1]
fields = strings.Split(config.SocksListener, "|")
socksListenNet := fields[0]
socksListenAddr := fields[1]
socksConfig := socksChainConfig{
Name: config.Name,
TargetSocksNet: torSocksNet,
TargetSocksAddr: torSocksAddr,
ListenSocksNet: socksListenNet,
ListenSocksAddr: socksListenAddr,
}
log.Notice("Loaded Socks chain config:")
log.Notice(socksConfig)
return &socksConfig
}
func Main() {
readConfig()
logBackend, logBackend2 := setupLoggerBackend(FirewallConfig.LoggingLevel)
if logBackend2 == nil {
logging.SetBackend(logBackend)
} else {
logging.SetBackend(logBackend, logBackend2)
}
procsnitch.SetLogger(log)
if os.Geteuid() != 0 {
log.Error("Must be run as root")
os.Exit(1)
}
setupIPTables()
ds, err := newDbusServer()
if err != nil {
log.Error(err.Error())
os.Exit(1)
}
fw := &Firewall{
dbus: ds,
dns: newDNSCache(),
enabled: true,
logBackend: logBackend,
policyMap: make(map[string]*Policy),
reloadRulesChan: make(chan bool, 0),
stopChan: make(chan bool, 0),
}
ds.fw = fw
go pcoroner.MonitorThread(procDeathCallbackDNS, fw.dns)
fw.loadRules()
/*
go func() {
http.ListenAndServe("localhost:6060", nil)
}()
*/
wg := sync.WaitGroup{}
config, err := loadSocksConfiguration(defaultSocksCfgPath)
if err != nil && !os.IsNotExist(err) {
panic(err)
}
if config != nil {
socksConfig := getSocksChainConfig(config)
chain := NewSocksChain(socksConfig, &wg, fw)
chain.start()
} else {
log.Notice("Did not find SOCKS5 configuration file at", defaultSocksCfgPath, "; ignoring subsystem...")
}
dbusp, err = newDbusObjectPrompt()
if err != nil {
panic(fmt.Sprintf("Failed to connect to dbus system bus for sgfw prompt events: %v", err))
}
dbusp.alertRule("fw-daemon initialization")
go OzReceiver(fw)
fw.runFilter()
// observe process signals and either
// reload rules or shutdown firewall service
sigKillChan := make(chan os.Signal, 1)
signal.Notify(sigKillChan, os.Interrupt, os.Kill)
sigHupChan := make(chan os.Signal, 1)
signal.Notify(sigHupChan, syscall.SIGHUP)
for {
select {
case <-sigHupChan:
fw.reloadRules()
case <-sigKillChan:
fw.stop()
return
}
}
}