Reevaluate and update firewall core logic

global/databases.go → core/databases.go

@@ -1,4 +1,4 @@
-package global
+package core
 
 import (
 	"github.com/Safing/portbase/database"
@@ -7,11 +7,10 @@ import (
 	// module dependencies
 	_ "github.com/Safing/portbase/database/dbmodule"
 	_ "github.com/Safing/portbase/database/storage/badger"
-	_ "github.com/Safing/portmaster/status"
 )
 
 func init() {
-	modules.Register("global", nil, start, nil, "database", "status")
+	modules.Register("core", nil, start, nil, "database")
 }
 
 func start() error {

firewall/config.go

@@ -2,10 +2,13 @@ package firewall
 
 import (
 	"github.com/Safing/portbase/config"
+	"github.com/Safing/portmaster/status"
 )
 
 var (
-	permanentVerdicts config.BoolOption
+	permanentVerdicts  config.BoolOption
+	filterDNSByScope   status.SecurityLevelOption
+	filterDNSByProfile status.SecurityLevelOption
 )
 
 func registerConfig() error {
@@ -22,5 +25,35 @@ func registerConfig() error {
 	}
 	permanentVerdicts = config.Concurrent.GetAsBool("firewall/permanentVerdicts", true)
 
+	err = config.Register(&config.Option{
+		Name:            "Filter DNS Responses by Server Scope",
+		Key:             "firewall/filterDNSByScope",
+		Description:     "This option will filter out DNS answers that are outside of the scope of the server. A server on the public Internet may not respond with a private LAN address.",
+		ExpertiseLevel:  config.ExpertiseLevelExpert,
+		OptType:         config.OptTypeInt,
+		ExternalOptType: "security level",
+		DefaultValue:    7,
+		ValidationRegex: "^(7|6|4)$",
+	})
+	if err != nil {
+		return err
+	}
+	filterDNSByScope = status.ConfigIsActiveConcurrent("firewall/filterDNSByScope")
+
+	err = config.Register(&config.Option{
+		Name:            "Filter DNS Responses by Application Profile",
+		Key:             "firewall/filterDNSByProfile",
+		Description:     "This option will filter out DNS answers that an application would not be allowed to connect, based on its profile.",
+		ExpertiseLevel:  config.ExpertiseLevelExpert,
+		OptType:         config.OptTypeInt,
+		ExternalOptType: "security level",
+		DefaultValue:    7,
+		ValidationRegex: "^(7|6|4)$",
+	})
+	if err != nil {
+		return err
+	}
+	filterDNSByProfile = status.ConfigIsActiveConcurrent("firewall/filterDNSByProfile")
+
 	return nil
 }

firewall/firewall.go

@@ -13,6 +13,10 @@ import (
 	"github.com/Safing/portmaster/firewall/interception"
 	"github.com/Safing/portmaster/network"
 	"github.com/Safing/portmaster/network/packet"
+
+	// module dependencies
+	_ "github.com/Safing/portmaster/core"
+	_ "github.com/Safing/portmaster/profile"
 )
 
 var (
@@ -37,7 +41,7 @@ var (
 )
 
 func init() {
-	modules.Register("firewall", prep, start, stop, "global", "network", "nameserver", "profile")
+	modules.Register("firewall", prep, start, stop, "core", "network", "nameserver", "profile")
 }
 
 func prep() (err error) {
@@ -111,7 +115,7 @@ func handlePacket(pkt packet.Packet) {
 		return
 	}
 
-	// log.Debugf("firewall: pkt %s has ID %s", pkt, pkt.GetConnectionID())
+	// log.Debugf("firewall: pkt %s has ID %s", pkt, pkt.GetLinkID())
 
 	// use this to time how long it takes process packet
 	// timed := time.Now()
@@ -146,43 +150,51 @@ func handlePacket(pkt packet.Packet) {
 
 func initialHandler(pkt packet.Packet, link *network.Link) {
 
-	// get Connection
-	connection, err := network.GetConnectionByFirstPacket(pkt)
+	// get Communication
+	comm, err := network.GetCommunicationByFirstPacket(pkt)
 	if err != nil {
-		// get "unknown" connection
+		// get "unknown" comm
 		link.Deny(fmt.Sprintf("could not get process: %s", err))
-		connection, err = network.GetUnknownConnection(pkt)
+		comm, err = network.GetUnknownCommunication(pkt)
 
 		if err != nil {
 			// all failed
-			log.Errorf("firewall: could not get unknown connection (dropping %s): %s", pkt.String(), err)
-			link.UpdateVerdict(network.DROP)
-			verdict(pkt, network.DROP)
+			log.Errorf("firewall: could not get unknown comm (dropping %s): %s", pkt.String(), err)
+			link.UpdateVerdict(network.VerdictDrop)
+			verdict(pkt, network.VerdictDrop)
 			link.StopFirewallHandler()
 			return
 		}
 
 	}
 
-	// add new Link to Connection (and save both)
-	connection.AddLink(link)
+	// add new Link to Communication (and save both)
+	comm.AddLink(link)
 
 	// reroute dns requests to nameserver
-	if connection.Process().Pid != os.Getpid() && pkt.IsOutbound() && pkt.GetTCPUDPHeader() != nil && !pkt.GetIPHeader().Dst.Equal(localhost) && pkt.GetTCPUDPHeader().DstPort == 53 {
+	if comm.Process().Pid != os.Getpid() && pkt.IsOutbound() && pkt.GetTCPUDPHeader() != nil && !pkt.GetIPHeader().Dst.Equal(localhost) && pkt.GetTCPUDPHeader().DstPort == 53 {
 		link.RerouteToNameserver()
 		verdict(pkt, link.GetVerdict())
 		link.StopFirewallHandler()
 		return
 	}
 
+	// check if communication needs reevaluation
+	if comm.NeedsReevaluation() {
+		comm.ResetVerdict()
+	}
+
 	// make a decision if not made already
-	if connection.GetVerdict() == network.UNDECIDED {
-		DecideOnConnection(connection, pkt)
+	switch comm.GetVerdict() {
+	case network.VerdictUndecided, network.VerdictUndeterminable:
+		DecideOnCommunication(comm, pkt)
 	}
-	if connection.GetVerdict() == network.ACCEPT {
-		DecideOnLink(connection, link, pkt)
-	} else {
-		link.UpdateVerdict(connection.GetVerdict())
+
+	switch comm.GetVerdict() {
+	case network.VerdictUndecided, network.VerdictUndeterminable, network.VerdictAccept:
+		DecideOnLink(comm, link, pkt)
+	default:
+		link.UpdateVerdict(comm.GetVerdict())
 	}
 
 	// log decision
@@ -201,7 +213,7 @@ func initialHandler(pkt packet.Packet, link *network.Link) {
 	// 	// tunnel link, don't inspect
 	// 	link.Tunneled = true
 	// 	link.StopFirewallHandler()
-	// 	permanentVerdict(pkt, network.ACCEPT)
+	// 	permanentVerdict(pkt, network.VerdictAccept)
 	case link.Inspect:
 		link.SetFirewallHandler(inspectThenVerdict)
 		inspectThenVerdict(pkt, link)
@@ -241,22 +253,22 @@ func inspectThenVerdict(pkt packet.Packet, link *network.Link) {
 
 func permanentVerdict(pkt packet.Packet, action network.Verdict) {
 	switch action {
-	case network.ACCEPT:
+	case network.VerdictAccept:
 		atomic.AddUint64(packetsAccepted, 1)
 		pkt.PermanentAccept()
 		return
-	case network.BLOCK:
+	case network.VerdictBlock:
 		atomic.AddUint64(packetsBlocked, 1)
 		pkt.PermanentBlock()
 		return
-	case network.DROP:
+	case network.VerdictDrop:
 		atomic.AddUint64(packetsDropped, 1)
 		pkt.PermanentDrop()
 		return
-	case network.RerouteToNameserver:
+	case network.VerdictRerouteToNameserver:
 		pkt.RerouteToNameserver()
 		return
-	case network.RerouteToTunnel:
+	case network.VerdictRerouteToTunnel:
 		pkt.RerouteToTunnel()
 		return
 	}
@@ -265,22 +277,22 @@ func permanentVerdict(pkt packet.Packet, action network.Verdict) {
 
 func verdict(pkt packet.Packet, action network.Verdict) {
 	switch action {
-	case network.ACCEPT:
+	case network.VerdictAccept:
 		atomic.AddUint64(packetsAccepted, 1)
 		pkt.Accept()
 		return
-	case network.BLOCK:
+	case network.VerdictBlock:
 		atomic.AddUint64(packetsBlocked, 1)
 		pkt.Block()
 		return
-	case network.DROP:
+	case network.VerdictDrop:
 		atomic.AddUint64(packetsDropped, 1)
 		pkt.Drop()
 		return
-	case network.RerouteToNameserver:
+	case network.VerdictRerouteToNameserver:
 		pkt.RerouteToNameserver()
 		return
-	case network.RerouteToTunnel:
+	case network.VerdictRerouteToTunnel:
 		pkt.RerouteToTunnel()
 		return
 	}
@@ -302,26 +314,26 @@ func verdict(pkt packet.Packet, action network.Verdict) {
 
 func logInitialVerdict(link *network.Link) {
 	// switch link.GetVerdict() {
-	// case network.ACCEPT:
+	// case network.VerdictAccept:
 	// 	log.Infof("firewall: accepting new link: %s", link.String())
-	// case network.BLOCK:
+	// case network.VerdictBlock:
 	// 	log.Infof("firewall: blocking new link: %s", link.String())
-	// case network.DROP:
+	// case network.VerdictDrop:
 	// 	log.Infof("firewall: dropping new link: %s", link.String())
-	// case network.RerouteToNameserver:
+	// case network.VerdictRerouteToNameserver:
 	// 	log.Infof("firewall: rerouting new link to nameserver: %s", link.String())
-	// case network.RerouteToTunnel:
+	// case network.VerdictRerouteToTunnel:
 	// 	log.Infof("firewall: rerouting new link to tunnel: %s", link.String())
 	// }
 }
 
 func logChangedVerdict(link *network.Link) {
 	// switch link.GetVerdict() {
-	// case network.ACCEPT:
+	// case network.VerdictAccept:
 	// 	log.Infof("firewall: change! - now accepting link: %s", link.String())
-	// case network.BLOCK:
+	// case network.VerdictBlock:
 	// 	log.Infof("firewall: change! - now blocking link: %s", link.String())
-	// case network.DROP:
+	// case network.VerdictDrop:
 	// 	log.Infof("firewall: change! - now dropping link: %s", link.String())
 	// }
 }

firewall/inspection/inspection.go

@@ -54,7 +54,7 @@ func RunInspectors(pkt packet.Packet, link *network.Link) (network.Verdict, bool
 	}
 
 	continueInspection := false
-	verdict := network.UNDECIDED
+	verdict := network.VerdictUndecided
 
 	for key, skip := range activeInspectors {
 
@@ -69,28 +69,28 @@ func RunInspectors(pkt packet.Packet, link *network.Link) (network.Verdict, bool
 		action := inspectors[key](pkt, link)
 		switch action {
 		case DO_NOTHING:
-			if verdict < network.ACCEPT {
-				verdict = network.ACCEPT
+			if verdict < network.VerdictAccept {
+				verdict = network.VerdictAccept
 			}
 			continueInspection = true
 		case BLOCK_PACKET:
-			if verdict < network.BLOCK {
-				verdict = network.BLOCK
+			if verdict < network.VerdictBlock {
+				verdict = network.VerdictBlock
 			}
 			continueInspection = true
 		case DROP_PACKET:
-			verdict = network.DROP
+			verdict = network.VerdictDrop
 			continueInspection = true
 		case BLOCK_LINK:
-			link.UpdateVerdict(network.BLOCK)
+			link.UpdateVerdict(network.VerdictBlock)
 			activeInspectors[key] = true
-			if verdict < network.BLOCK {
-				verdict = network.BLOCK
+			if verdict < network.VerdictBlock {
+				verdict = network.VerdictBlock
 			}
 		case DROP_LINK:
-			link.UpdateVerdict(network.DROP)
+			link.UpdateVerdict(network.VerdictDrop)
 			activeInspectors[key] = true
-			verdict = network.DROP
+			verdict = network.VerdictDrop
 		case STOP_INSPECTING:
 			activeInspectors[key] = true
 		}