vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-09-03 19:19:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Merge pull request #373 from safing/fix/intel-locking

Browse source 
Improve locking in intel/filterlists and intel/geoip
This commit is contained in:
Daniel 2021-08-18 09:25:17 +02:00 • committed by GitHub
commit f2bc518e2f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 15 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
firewall/bypassing.go
View file

@ -1,6 +1,7 @@
package firewall package firewall
import ( import (
"context"
"strings" "strings"
"github.com/safing/portmaster/nameserver/nsutil" "github.com/safing/portmaster/nameserver/nsutil"
@ -14,7 +15,7 @@ var (
// PreventBypassing checks if the connection should be denied or permitted // PreventBypassing checks if the connection should be denied or permitted
// based on some bypass protection checks. // based on some bypass protection checks.
func PreventBypassing(conn *network.Connection) (endpoints.EPResult, string, nsutil.Responder) { func PreventBypassing(ctx context.Context, conn *network.Connection) (endpoints.EPResult, string, nsutil.Responder) {
// Block firefox canary domain to disable DoH // Block firefox canary domain to disable DoH
if strings.ToLower(conn.Entity.Domain) == "use-application-dns.net." { if strings.ToLower(conn.Entity.Domain) == "use-application-dns.net." {
return endpoints.Denied, return endpoints.Denied,
@ -22,6 +23,10 @@ func PreventBypassing(conn *network.Connection) (endpoints.EPResult, string, nsu
nsutil.NxDomain() nsutil.NxDomain()
} }
if !conn.Entity.LoadLists(ctx) {
return endpoints.Undeterminable, "", nil
}
if conn.Entity.MatchLists(resolverFilterLists) { if conn.Entity.MatchLists(resolverFilterLists) {
return endpoints.Denied, return endpoints.Denied,
"blocked rogue connection to DNS resolver", "blocked rogue connection to DNS resolver",

4
firewall/master.go
View file

@ -335,10 +335,10 @@ func checkConnectionScope(_ context.Context, conn *network.Connection, p *profil
return false return false
} }
func checkBypassPrevention(_ context.Context, conn *network.Connection, p *profile.LayeredProfile, _ packet.Packet) bool { func checkBypassPrevention(ctx context.Context, conn *network.Connection, p *profile.LayeredProfile, _ packet.Packet) bool {
if p.PreventBypassing() { if p.PreventBypassing() {
// check for bypass protection // check for bypass protection
result, reason, reasonCtx := PreventBypassing(conn) result, reason, reasonCtx := PreventBypassing(ctx, conn)
switch result { switch result {
case endpoints.Denied: case endpoints.Denied:
conn.BlockWithContext("bypass prevention: "+reason, profile.CfgOptionPreventBypassingKey, reasonCtx) conn.BlockWithContext("bypass prevention: "+reason, profile.CfgOptionPreventBypassingKey, reasonCtx)

6
intel/filterlists/bloom.go
View file

@ -6,9 +6,9 @@ import (
"strings" "strings"
"sync" "sync"
"github.com/tannerryan/ring"
"github.com/safing/portbase/database/record" "github.com/safing/portbase/database/record"
"github.com/safing/portbase/log" "github.com/safing/portbase/log"
"github.com/tannerryan/ring"
) )
var defaultFilter = newScopedBloom() var defaultFilter = newScopedBloom()
@ -66,8 +66,8 @@ func (bf *scopedBloom) getBloomForType(entityType string) (*ring.Ring, error) {
} }
func (bf *scopedBloom) add(scope, value string) { func (bf *scopedBloom) add(scope, value string) {
bf.rw.RLock() bf.rw.Lock()
defer bf.rw.RUnlock() defer bf.rw.Unlock()
r, err := bf.getBloomForType(scope) r, err := bf.getBloomForType(scope)
if err != nil { if err != nil {

3
intel/geoip/database.go
View file

@ -20,7 +20,7 @@ var (
geoDBv4Reader *maxminddb.Reader geoDBv4Reader *maxminddb.Reader
geoDBv6Reader *maxminddb.Reader geoDBv6Reader *maxminddb.Reader
dbLock sync.Mutex dbLock sync.RWMutex
dbInUse = abool.NewBool(false) // only activate if used for first time dbInUse = abool.NewBool(false) // only activate if used for first time
dbDoReload = abool.NewBool(true) // if database should be reloaded dbDoReload = abool.NewBool(true) // if database should be reloaded
@ -35,6 +35,7 @@ func ReloadDatabases() error {
dbFileLock.Lock() dbFileLock.Lock()
defer dbFileLock.Unlock() defer dbFileLock.Unlock()
dbLock.Lock() dbLock.Lock()
defer dbLock.Unlock() defer dbLock.Unlock()

4
intel/geoip/lookup.go
View file

@ -15,8 +15,8 @@ func getReader(ip net.IP) *maxminddb.Reader {
// GetLocation returns Location data of an IP address // GetLocation returns Location data of an IP address
func GetLocation(ip net.IP) (record *Location, err error) { func GetLocation(ip net.IP) (record *Location, err error) {
dbLock.Lock() dbLock.RLock()
defer dbLock.Unlock() defer dbLock.RUnlock()
err = prepDatabaseForUse() err = prepDatabaseForUse()
if err != nil { if err != nil {