safing-portmaster/compat/notify.go

package compat

import (
	"context"
	"fmt"
	"strings"
	"sync"
	"time"

	"github.com/safing/portbase/log"
	"github.com/safing/portbase/modules"
	"github.com/safing/portbase/notifications"
	"github.com/safing/portmaster/process"
	"github.com/safing/portmaster/profile"
)

type baseIssue struct {
	id      string             //nolint:structcheck // Inherited.
	title   string             //nolint:structcheck // Inherited.
	message string             //nolint:structcheck // Inherited.
	level   notifications.Type //nolint:structcheck // Inherited.
}

type systemIssue baseIssue

type appIssue baseIssue

var (
	systemIssueNotification     *notifications.Notification
	systemIssueNotificationLock sync.Mutex

	systemIntegrationIssue = &systemIssue{
		id:      "compat:system-integration-issue",
		title:   "Detected System Integration Issue",
		message: "Portmaster detected a problem with its system integration. You can try to restart or reinstall the Portmaster. If that does not help, please report the issue via [GitHub](https://github.com/safing/portmaster/issues) or send a mail to [support@safing.io](mailto:support@safing.io) so we can help you out.",
		level:   notifications.Error,
	}
	systemCompatibilityIssue = &systemIssue{
		id:      "compat:compatibility-issue",
		title:   "Detected Compatibility Issue",
		message: "Portmaster detected that something is interfering with its operation. This could be a VPN, an Anti-Virus or another network protection software. Please check if you are running an incompatible [VPN client](https://docs.safing.io/portmaster/install/status/vpn-compatibility) or [software](https://docs.safing.io/portmaster/install/status/software-compatibility). Otherwise, please report the issue via [GitHub](https://github.com/safing/portmaster/issues) or send a mail to [support@safing.io](mailto:support@safing.io) so we can help you out.",
		level:   notifications.Error,
	}

	secureDNSBypassIssue = &appIssue{
		id:      "compat:secure-dns-bypass-%s",
		title:   "Blocked Bypass Attempt by %s",
		message: `[APPNAME] is using its own Secure DNS resolver, which would bypass Portmaster's firewall protections. If [APPNAME] experiences problems, disable Secure DNS within [APPNAME] to restore functionality. Rest assured that Portmaster handles Secure DNS for your whole device, including [APPNAME].`,
		// TODO: Add this when the new docs page is finished:
		// , or [find out about other options](link to new docs page)
		level: notifications.Warning,
	}
	multiPeerUDPTunnelIssue = &appIssue{
		id:      "compat:multi-peer-udp-tunnel-%s",
		title:   "Detected SPN Incompatibility in %s",
		message: "Portmaster detected that [APPNAME] is trying to connect to multiple servers via the SPN using a single UDP connection. This is common for technologies such as torrents. Unfortunately, the SPN does not support this feature currently. You can try to change this behavior within the affected app or you could exempt it from using the SPN.",
		level:   notifications.Warning,
	}
)

func (issue *systemIssue) notify(err error) {
	systemIssueNotificationLock.Lock()
	defer systemIssueNotificationLock.Unlock()

	if systemIssueNotification != nil {
		// Ignore duplicate notification.
		if issue.id == systemIssueNotification.EventID {
			return
		}

		// Remove old notification.
		systemIssueNotification.Delete()
	}

	// Create new notification.
	n := &notifications.Notification{
		EventID:      issue.id,
		Type:         issue.level,
		Title:        issue.title,
		Message:      issue.message,
		ShowOnSystem: true,
	}
	notifications.Notify(n)

	systemIssueNotification = n
	n.AttachToModule(module)

	// Report the raw error as module error.
	module.NewErrorMessage("selfcheck", err).Report()
}

func resetSystemIssue() {
	systemIssueNotificationLock.Lock()
	defer systemIssueNotificationLock.Unlock()

	if systemIssueNotification != nil {
		systemIssueNotification.Delete()
	}
	systemIssueNotification = nil
}

func (issue *appIssue) notify(proc *process.Process) {
	// Get profile from process.
	p := proc.Profile().LocalProfile()
	if p == nil {
		return
	}

	// Ignore notifications for unidentified processes.
	if p.ID == profile.UnidentifiedProfileID {
		return
	}

	// Log warning.
	log.Warningf(
		"compat: detected %s issue with %s",
		strings.ReplaceAll(
			strings.TrimPrefix(
				strings.TrimSuffix(issue.id, "-%s"),
				"compat:",
			),
			"-", " ",
		),
		proc.Path,
	)

	// Check if we already have this notification.
	eventID := fmt.Sprintf(issue.id, p.ID)
	n := notifications.Get(eventID)
	if n != nil {
		return
	}

	// Check if we reach the threshold to actually send a notification.
	if !isOverThreshold(eventID) {
		return
	}

	// Build message.
	message := strings.ReplaceAll(issue.message, "[APPNAME]", p.Name)

	// Create a new notification.
	n = &notifications.Notification{
		EventID:      eventID,
		Type:         issue.level,
		Title:        fmt.Sprintf(issue.title, p.Name),
		Message:      message,
		ShowOnSystem: true,
		AvailableActions: []*notifications.Action{
			{
				ID:   "ack",
				Text: "OK",
			},
		},
	}
	notifications.Notify(n)

	// Set warning on profile.
	module.StartWorker("set app compat warning", func(ctx context.Context) error {
		var changed bool

		func() {
			p.Lock()
			defer p.Unlock()

			if p.Warning != message || time.Now().Add(-1*time.Hour).After(p.WarningLastUpdated) {
				p.Warning = message
				p.WarningLastUpdated = time.Now()
				changed = true
			}
		}()

		if changed {
			return p.Save()
		}
		return nil
	})
}

const (
	notifyThresholdMinIncidents = 11
	notifyThresholdResetAfter   = 2 * time.Minute
)

var (
	notifyThresholds     = make(map[string]*notifyThreshold)
	notifyThresholdsLock sync.Mutex
)

type notifyThreshold struct {
	FirstSeen time.Time
	Incidents uint
}

func (nt *notifyThreshold) expired() bool {
	return time.Now().Add(-notifyThresholdResetAfter).After(nt.FirstSeen)
}

func isOverThreshold(id string) bool {
	notifyThresholdsLock.Lock()
	defer notifyThresholdsLock.Unlock()

	// Get notify threshold and check if we reach the minimum incidents.
	nt, ok := notifyThresholds[id]
	if ok && !nt.expired() {
		nt.Incidents++
		return nt.Incidents >= notifyThresholdMinIncidents
	}

	// Add new entry.
	notifyThresholds[id] = &notifyThreshold{
		FirstSeen: time.Now(),
		Incidents: 1,
	}
	return false
}

func cleanNotifyThreshold(ctx context.Context, task *modules.Task) error {
	notifyThresholdsLock.Lock()
	defer notifyThresholdsLock.Unlock()

	for id, nt := range notifyThresholds {
		if nt.expired() {
			delete(notifyThresholds, id)
		}
	}

	return nil
}