vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-09-04 11:39:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Further improve logging and messages

Browse source
This commit is contained in:
Daniel 2020-05-20 16:43:54 +02:00
parent 26fd447700
commit 46411951f6
4 changed files with 27 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
firewall/interception.go
View file

@ -230,7 +230,7 @@ func initialHandler(conn *network.Connection, pkt packet.Packet) {
} }
log.Tracer(pkt.Ctx()).Trace("filter: starting decision process") log.Tracer(pkt.Ctx()).Trace("filter: starting decision process")
DecideOnConnection(conn, pkt) DecideOnConnection(pkt.Ctx(), conn, pkt)
conn.Inspecting = false // TODO: enable inspecting again conn.Inspecting = false // TODO: enable inspecting again
switch { switch {

43
firewall/master.go
View file

@ -1,6 +1,7 @@
package firewall package firewall
import ( import (
"context"
"fmt" "fmt"
"os" "os"
"path/filepath" "path/filepath"
@ -33,10 +34,10 @@ import (
// DecideOnConnection makes a decision about a connection. // DecideOnConnection makes a decision about a connection.
// When called, the connection and profile is already locked. // When called, the connection and profile is already locked.
func DecideOnConnection(conn *network.Connection, pkt packet.Packet) { func DecideOnConnection(ctx context.Context, conn *network.Connection, pkt packet.Packet) {
// update profiles and check if communication needs reevaluation // update profiles and check if communication needs reevaluation
if conn.UpdateAndCheck() { if conn.UpdateAndCheck() {
log.Tracer(pkt.Ctx()).Infof("filter: re-evaluating verdict on %s", conn) log.Tracer(ctx).Infof("filter: re-evaluating verdict on %s", conn)
conn.Verdict = network.VerdictUndecided conn.Verdict = network.VerdictUndecided
if conn.Entity != nil { if conn.Entity != nil {
@ -44,7 +45,7 @@ func DecideOnConnection(conn *network.Connection, pkt packet.Packet) {
} }
} }
var deciders = []func(*network.Connection, packet.Packet) bool{ var deciders = []func(context.Context, *network.Connection, packet.Packet) bool{
checkPortmasterConnection, checkPortmasterConnection,
checkSelfCommunication, checkSelfCommunication,
checkProfileExists, checkProfileExists,
@ -60,7 +61,7 @@ func DecideOnConnection(conn *network.Connection, pkt packet.Packet) {
} }
for _, decider := range deciders { for _, decider := range deciders {
if decider(conn, pkt) { if decider(ctx, conn, pkt) {
return return
} }
} }
@ -71,10 +72,10 @@ func DecideOnConnection(conn *network.Connection, pkt packet.Packet) {
// checkPortmasterConnection allows all connection that originate from // checkPortmasterConnection allows all connection that originate from
// portmaster itself. // portmaster itself.
func checkPortmasterConnection(conn *network.Connection, pkt packet.Packet) bool { func checkPortmasterConnection(ctx context.Context, conn *network.Connection, pkt packet.Packet) bool {
// grant self // grant self
if conn.Process().Pid == os.Getpid() { if conn.Process().Pid == os.Getpid() {
log.Tracer(pkt.Ctx()).Infof("filter: granting own connection %s", conn) log.Tracer(ctx).Infof("filter: granting own connection %s", conn)
conn.Verdict = network.VerdictAccept conn.Verdict = network.VerdictAccept
conn.Internal = true conn.Internal = true
return true return true
@ -84,7 +85,7 @@ func checkPortmasterConnection(conn *network.Connection, pkt packet.Packet) bool
} }
// checkSelfCommunication checks if the process is communicating with itself. // checkSelfCommunication checks if the process is communicating with itself.
func checkSelfCommunication(conn *network.Connection, pkt packet.Packet) bool { func checkSelfCommunication(ctx context.Context, conn *network.Connection, pkt packet.Packet) bool {
// check if process is communicating with itself // check if process is communicating with itself
if pkt != nil { if pkt != nil {
// TODO: evaluate the case where different IPs in the 127/8 net are used. // TODO: evaluate the case where different IPs in the 127/8 net are used.
@ -101,12 +102,12 @@ func checkSelfCommunication(conn *network.Connection, pkt packet.Packet) bool {
DstPort: pktInfo.DstPort, DstPort: pktInfo.DstPort,
}) })
if err != nil { if err != nil {
log.Tracer(pkt.Ctx()).Warningf("filter: failed to find local peer process PID: %s", err) log.Tracer(ctx).Warningf("filter: failed to find local peer process PID: %s", err)
} else { } else {
// get primary process // get primary process
otherProcess, err := process.GetOrFindPrimaryProcess(pkt.Ctx(), otherPid) otherProcess, err := process.GetOrFindPrimaryProcess(ctx, otherPid)
if err != nil { if err != nil {
log.Tracer(pkt.Ctx()).Warningf("filter: failed to find load local peer process with PID %d: %s", otherPid, err) log.Tracer(ctx).Warningf("filter: failed to find load local peer process with PID %d: %s", otherPid, err)
} else if otherProcess.Pid == conn.Process().Pid { } else if otherProcess.Pid == conn.Process().Pid {
conn.Accept("connection to self") conn.Accept("connection to self")
conn.Internal = true conn.Internal = true
@ -119,7 +120,7 @@ func checkSelfCommunication(conn *network.Connection, pkt packet.Packet) bool {
return false return false
} }
func checkProfileExists(conn *network.Connection, _ packet.Packet) bool { func checkProfileExists(_ context.Context, conn *network.Connection, _ packet.Packet) bool {
if conn.Process().Profile() == nil { if conn.Process().Profile() == nil {
conn.Block("unknown process or profile") conn.Block("unknown process or profile")
return true return true
@ -127,7 +128,7 @@ func checkProfileExists(conn *network.Connection, _ packet.Packet) bool {
return false return false
} }
func checkEndpointLists(conn *network.Connection, _ packet.Packet) bool { func checkEndpointLists(_ context.Context, conn *network.Connection, _ packet.Packet) bool {
var result endpoints.EPResult var result endpoints.EPResult
var reason endpoints.Reason var reason endpoints.Reason
@ -152,7 +153,7 @@ func checkEndpointLists(conn *network.Connection, _ packet.Packet) bool {
return false return false
} }
func checkConnectionType(conn *network.Connection, _ packet.Packet) bool { func checkConnectionType(ctx context.Context, conn *network.Connection, _ packet.Packet) bool {
p := conn.Process().Profile() p := conn.Process().Profile()
// check conn type // check conn type
@ -177,7 +178,7 @@ func checkConnectionType(conn *network.Connection, _ packet.Packet) bool {
return false return false
} }
func checkConnectionScope(conn *network.Connection, _ packet.Packet) bool { func checkConnectionScope(_ context.Context, conn *network.Connection, _ packet.Packet) bool {
p := conn.Process().Profile() p := conn.Process().Profile()
// check scopes // check scopes
@ -216,7 +217,7 @@ func checkConnectionScope(conn *network.Connection, _ packet.Packet) bool {
return false return false
} }
func checkBypassPrevention(conn *network.Connection, _ packet.Packet) bool { func checkBypassPrevention(_ context.Context, conn *network.Connection, _ packet.Packet) bool {
if conn.Process().Profile().PreventBypassing() { if conn.Process().Profile().PreventBypassing() {
// check for bypass protection // check for bypass protection
result, reason, reasonCtx := PreventBypassing(conn) result, reason, reasonCtx := PreventBypassing(conn)
@ -233,7 +234,7 @@ func checkBypassPrevention(conn *network.Connection, _ packet.Packet) bool {
return false return false
} }
func checkFilterLists(conn *network.Connection, pkt packet.Packet) bool { func checkFilterLists(ctx context.Context, conn *network.Connection, pkt packet.Packet) bool {
// apply privacy filter lists // apply privacy filter lists
p := conn.Process().Profile() p := conn.Process().Profile()
@ -245,12 +246,12 @@ func checkFilterLists(conn *network.Connection, pkt packet.Packet) bool {
case endpoints.NoMatch: case endpoints.NoMatch:
// nothing to do // nothing to do
default: default:
log.Tracer(pkt.Ctx()).Debugf("filter: filter lists returned unsupported verdict: %s", result) log.Tracer(ctx).Debugf("filter: filter lists returned unsupported verdict: %s", result)
} }
return false return false
} }
func checkInbound(conn *network.Connection, _ packet.Packet) bool { func checkInbound(_ context.Context, conn *network.Connection, _ packet.Packet) bool {
// implicit default=block for inbound // implicit default=block for inbound
if conn.Inbound { if conn.Inbound {
conn.Drop("endpoint is not whitelisted (incoming is always default=block)") conn.Drop("endpoint is not whitelisted (incoming is always default=block)")
@ -259,7 +260,7 @@ func checkInbound(conn *network.Connection, _ packet.Packet) bool {
return false return false
} }
func checkDefaultPermit(conn *network.Connection, _ packet.Packet) bool { func checkDefaultPermit(_ context.Context, conn *network.Connection, _ packet.Packet) bool {
// check default action // check default action
p := conn.Process().Profile() p := conn.Process().Profile()
if p.DefaultAction() == profile.DefaultActionPermit { if p.DefaultAction() == profile.DefaultActionPermit {
@ -269,7 +270,7 @@ func checkDefaultPermit(conn *network.Connection, _ packet.Packet) bool {
return false return false
} }
func checkAutoPermitRelated(conn *network.Connection, _ packet.Packet) bool { func checkAutoPermitRelated(_ context.Context, conn *network.Connection, _ packet.Packet) bool {
p := conn.Process().Profile() p := conn.Process().Profile()
if !p.DisableAutoPermit() { if !p.DisableAutoPermit() {
related, reason := checkRelation(conn) related, reason := checkRelation(conn)
@ -281,7 +282,7 @@ func checkAutoPermitRelated(conn *network.Connection, _ packet.Packet) bool {
return false return false
} }
func checkDefaultAction(conn *network.Connection, pkt packet.Packet) bool { func checkDefaultAction(_ context.Context, conn *network.Connection, pkt packet.Packet) bool {
p := conn.Process().Profile() p := conn.Process().Profile()
if p.DefaultAction() == profile.DefaultActionAsk { if p.DefaultAction() == profile.DefaultActionAsk {
prompt(conn, pkt) prompt(conn, pkt)

6
intel/block_reason.go
View file

@ -71,9 +71,9 @@ func (br ListBlockReason) GetExtraRR(_ *dns.Msg, _ string, _ interface{}) []dns.
for _, lm := range br { for _, lm := range br {
blockedBy, err := dns.NewRR(fmt.Sprintf( blockedBy, err := dns.NewRR(fmt.Sprintf(
`%s 0 IN TXT "was blocked by filter lists %s"`, `%s 0 IN TXT "blocked by filter lists %s"`,
lm.Entity, lm.Entity,
strings.Join(lm.ActiveLists, ","), strings.Join(lm.ActiveLists, ", "),
)) ))
if err == nil { if err == nil {
rrs = append(rrs, blockedBy) rrs = append(rrs, blockedBy)
@ -85,7 +85,7 @@ func (br ListBlockReason) GetExtraRR(_ *dns.Msg, _ string, _ interface{}) []dns.
wouldBeBlockedBy, err := dns.NewRR(fmt.Sprintf( wouldBeBlockedBy, err := dns.NewRR(fmt.Sprintf(
`%s 0 IN TXT "would be blocked by filter lists %s"`, `%s 0 IN TXT "would be blocked by filter lists %s"`,
lm.Entity, lm.Entity,
strings.Join(lm.InactiveLists, ","), strings.Join(lm.InactiveLists, ", "),
)) ))
if err == nil { if err == nil {
rrs = append(rrs, wouldBeBlockedBy) rrs = append(rrs, wouldBeBlockedBy)

2
nameserver/nameserver.go
View file

@ -222,7 +222,7 @@ func handleRequest(ctx context.Context, w dns.ResponseWriter, query *dns.Msg) er
} }
// check profile before we even get intel and rr // check profile before we even get intel and rr
firewall.DecideOnConnection(conn, nil) firewall.DecideOnConnection(ctx, conn, nil)
switch conn.Verdict { switch conn.Verdict {
case network.VerdictBlock: case network.VerdictBlock: