Add fileshare process monitoring

cli/cli.go

@@ -969,7 +969,8 @@ type LoaderInterceptor struct {
 }
 
 func (i *LoaderInterceptor) UnaryInterceptor(ctx context.Context, method string, req interface{}, reply interface{}, cc *grpc.ClientConn,
-	invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+	invoker grpc.UnaryInvoker, opts ...grpc.CallOption,
+) error {
 	if i.enabled {
 		loader := NewLoader()
 		loader.Start()
@@ -981,7 +982,8 @@ func (i *LoaderInterceptor) UnaryInterceptor(ctx context.Context, method string,
 }
 
 func (i *LoaderInterceptor) StreamInterceptor(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string,
-	streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
+	streamer grpc.Streamer, opts ...grpc.CallOption,
+) (grpc.ClientStream, error) {
 	stream, err := streamer(ctx, desc, cc, method, opts...)
 	return loaderStream{ClientStream: stream, loaderEnabled: i.enabled}, err
 }
@@ -1137,6 +1139,8 @@ func serviceErrorCodeToError(code meshpb.ServiceErrorCode) error {
 	switch code {
 	case meshpb.ServiceErrorCode_NOT_LOGGED_IN:
 		return internal.ErrNotLoggedIn
+	case meshpb.ServiceErrorCode_MONITOR_FAILURE:
+		return internal.ErrMonitorFailed
 	case meshpb.ServiceErrorCode_API_FAILURE, meshpb.ServiceErrorCode_CONFIG_FAILURE:
 		fallthrough
 	default:

cmd/daemon/main.go

@@ -65,6 +65,7 @@ import (
 	"github.com/NordSecurity/nordvpn-linux/request"
 	"github.com/NordSecurity/nordvpn-linux/sharedctx"
 	"github.com/NordSecurity/nordvpn-linux/snapconf"
+	"github.com/vishvananda/netlink"
 
 	"google.golang.org/grpc"
 )
@@ -129,7 +130,7 @@ func main() {
 
 	// Config
 	configEvents := daemonevents.NewConfigEvents()
-	fsystem := config.NewFilesystemConfigManager(
+	cfgMgr := config.NewFilesystemConfigManager(
 		config.SettingsDataFilePath,
 		config.InstallFilePath,
 		Salt,
@@ -138,9 +139,9 @@ func main() {
 		configEvents.Config,
 	)
 	var cfg config.Config
-	if err := fsystem.Load(&cfg); err != nil {
+	if err := cfgMgr.Load(&cfg); err != nil {
 		log.Println(err)
-		if err := fsystem.Reset(); err != nil {
+		if err := cfgMgr.Reset(); err != nil {
 			log.Fatalln(err)
 		}
 	}
@@ -236,7 +237,7 @@ func main() {
 		httpClientWithRotator,
 		validator,
 	)
-	meshAPIex := registry.NewRegistry(
+	meshRegistry := registry.NewRegistry(
 		defaultAPI,
 		meshnetEvents.SelfRemoved,
 	)
@@ -286,17 +287,17 @@ func main() {
 	// obfuscated machineID and add the mask to identify how the ID was generated
 	deviceID := fmt.Sprintf("%x_%d", sha256.Sum256([]byte(machineID.String()+Salt)), machineIdGenerator.GetUsedInformationMask())
 
-	analytics := newAnalytics(eventsDbPath, fsystem, defaultAPI, Version, Environment, deviceID)
+	analytics := newAnalytics(eventsDbPath, cfgMgr, defaultAPI, Version, Environment, deviceID)
 	heartBeatSubject.Subscribe(analytics.NotifyHeartBeat)
 	daemonEvents.Subscribe(analytics)
 	daemonEvents.Service.Connect.Subscribe(loggerSubscriber.NotifyConnect)
 	daemonEvents.Settings.Publish(cfg)
 
-	if fsystem.NewInstallation {
+	if cfgMgr.NewInstallation {
 		daemonEvents.Service.UiItemsClick.Publish(events.UiItemsAction{ItemName: "first_open", ItemType: "button", ItemValue: "first_open", FormReference: "daemon"})
 	}
 
-	vpnLibConfigGetter := vpnLibConfigGetterImplementation(fsystem)
+	vpnLibConfigGetter := vpnLibConfigGetterImplementation(cfgMgr)
 
 	internalVpnEvents := vpn.NewInternalVPNEvents()
 
@@ -398,17 +399,17 @@ func main() {
 	norduserClient := norduserservice.NewNorduserGRPCClient()
 
 	meshnetChecker := meshnet.NewRegisteringChecker(
-		fsystem,
+		cfgMgr,
 		keygen,
-		meshAPIex,
+		meshRegistry,
 	)
 
 	meshnetEvents.PeerUpdate.Subscribe(refresher.NewMeshnet(
-		meshAPIex, meshnetChecker, fsystem, netw,
+		meshRegistry, meshnetChecker, cfgMgr, netw,
 	).NotifyPeerUpdate)
 
 	meshUnsetter := meshunsetter.NewMeshnet(
-		fsystem,
+		cfgMgr,
 		netw,
 		errSubject,
 		norduserClient,
@@ -418,7 +419,7 @@ func main() {
 	accountUpdateEvents := daemonevents.NewAccountUpdateEvents()
 	accountUpdateEvents.Subscribe(statePublisher)
 	authChecker := auth.NewRenewingChecker(
-		fsystem,
+		cfgMgr,
 		defaultAPI,
 		daemonEvents.User.MFA,
 		daemonEvents.User.Logout,
@@ -431,7 +432,7 @@ func main() {
 		infoSubject,
 		errSubject,
 		meshnetEvents.PeerUpdate,
-		nc.NewCredsFetcher(defaultAPI, fsystem))
+		nc.NewCredsFetcher(defaultAPI, cfgMgr))
 
 	dataUpdateEvents := daemonevents.NewDataUpdateEvents()
 	dataUpdateEvents.Subscribe(statePublisher)
@@ -447,7 +448,7 @@ func main() {
 	rpc := daemon.NewRPC(
 		internal.Environment(Environment),
 		authChecker,
-		fsystem,
+		cfgMgr,
 		dm,
 		defaultAPI,
 		defaultAPI,
@@ -465,22 +466,33 @@ func main() {
 		notificationClient,
 		analytics,
 		norduserService,
-		meshAPIex,
+		meshRegistry,
 		statePublisher,
 		sharedContext,
 	)
+
+	filesharePortController := meshnet.NewPortAccessController(
+		netw,
+		meshnet.NewProcessChecker(),
+	)
+	fileshareProcMonitor := meshnet.NewProcMonitor(
+		filesharePortController,
+		netlinkMonitorSetupFn,
+	)
+
 	meshService := meshnet.NewServer(
 		authChecker,
-		fsystem,
+		cfgMgr,
 		meshnetChecker,
 		defaultAPI,
 		netw,
-		meshAPIex,
+		meshRegistry,
 		threatProtectionLiteServers,
 		errSubject,
 		meshnetEvents.PeerUpdate,
 		daemonEvents,
 		norduserClient,
+		fileshareProcMonitor,
 		sharedContext,
 	)
 
@@ -578,11 +590,11 @@ func main() {
 		go rpc.StartAutoConnect(network.ExponentialBackoff)
 	}
 
-	monitor, err := netstate.NewNetlinkMonitor([]string{openvpn.InterfaceName, nordlynx.InterfaceName})
+	netMonitor, err := netstate.NewNetlinkMonitor([]string{openvpn.InterfaceName, nordlynx.InterfaceName})
 	if err != nil {
 		log.Fatalln(err)
 	}
-	monitor.Start(netw)
+	netMonitor.Start(netw)
 
 	if authChecker.IsLoggedIn() {
 		go daemon.StartNC("[startup]", notificationClient)
@@ -611,3 +623,19 @@ func main() {
 		log.Println(internal.ErrorPrefix, "stopping KillSwitch:", err)
 	}
 }
+
+func netlinkMonitorSetupFn() (meshnet.MonitorChannels, error) {
+	// NOTE: It receives events from the kernel, needs to be big enough
+	// and also user-space processing needs to be fast enough.
+	eventCh := make(chan netlink.ProcEvent, 256)
+	doneCh := make(chan struct{})
+	errCh := make(chan error)
+	if err := netlink.ProcEventMonitor(eventCh, doneCh, errCh); err != nil {
+		return meshnet.MonitorChannels{}, err
+	}
+	return meshnet.MonitorChannels{
+		EventCh: eventCh,
+		DoneCh:  doneCh,
+		ErrCh:   errCh,
+	}, nil
+}

daemon/jobs_test.go

@@ -36,6 +36,7 @@ func (failingLoginChecker) IsMFAEnabled() (bool, error) { return false, nil }
 func (failingLoginChecker) IsVPNExpired() (bool, error) {
 	return true, errors.New("IsVPNExpired error")
 }
+
 func (failingLoginChecker) GetDedicatedIPServices() ([]auth.DedicatedIPService, error) {
 	return nil, fmt.Errorf("Not implemented")
 }
@@ -128,6 +129,10 @@ func (n *meshNetworker) AllowFileshare(address meshnet.UniqueAddress) error {
 	return nil
 }
 
+func (n *meshNetworker) PermitFileshare() error {
+	return nil
+}
+
 func (n *meshNetworker) AllowIncoming(address meshnet.UniqueAddress, lanAllowed bool) error {
 	n.allowedIncoming = append(n.allowedIncoming, address)
 	return nil
@@ -143,6 +148,10 @@ func (n *meshNetworker) BlockFileshare(address meshnet.UniqueAddress) error {
 	return nil
 }
 
+func (n *meshNetworker) ForbidFileshare() error {
+	return nil
+}
+
 func (*meshNetworker) ResetRouting(mesh.MachinePeer, mesh.MachinePeers) error { return nil }
 func (*meshNetworker) BlockRouting(meshnet.UniqueAddress) error               { return nil }
 func (*meshNetworker) Refresh(mesh.MachineMap) error                          { return nil }
@@ -154,6 +163,15 @@ func (*meshNetworker) GetConnectionParameters() (vpn.ServerData, bool) {
 	return vpn.ServerData{}, false
 }
 
+type handlerDummy struct{}
+
+func (handlerDummy) OnProcessStarted(meshnet.ProcEvent) {}
+func (handlerDummy) OnProcessStopped(meshnet.ProcEvent) {}
+
+func monitorSetupDummy() (meshnet.MonitorChannels, error) {
+	return meshnet.MonitorChannels{}, nil
+}
+
 func TestStartAutoMeshnet(t *testing.T) {
 	category.Set(t, category.Unit)
 
@@ -215,6 +233,7 @@ func TestStartAutoMeshnet(t *testing.T) {
 				nil,
 				&daemonevents.Events{},
 				&testnorduser.MockNorduserClient{},
+				meshnet.NewProcMonitor(handlerDummy{}, monitorSetupDummy),
 				sharedctx.New(),
 			)
 

daemon/routes/iprule/iprule.go

@@ -469,7 +469,7 @@ func fwmarkRule(prioID int, fwmark uint32, tableID int, ipv6 bool) *netlink.Rule
 	rule := netlink.NewRule()
 	rule.Priority = prioID
 	rule.Invert = true
-	rule.Mark = int(fwmark)
+	rule.Mark = fwmark
 	rule.Table = tableID
 	rule.Family = toNetlinkFamily(ipv6)
 	return rule

daemon/routes/netlink/retriever.go

@@ -131,7 +131,7 @@ func ruleAppliesForRoute(rule netlink.Rule, route netlink.Route, ifgroup uint32)
 		routeDstPrefixLen, _ = route.Dst.Mask.Size()
 	}
 	// Cannot make any assumptions about fwmarks as route has no information about them
-	return rule.Invert != (rule.Mark < 0 &&
+	return rule.Invert != (rule.Mark == 0 &&
 		rule.Table == route.Table &&
 		isSubnet(rule.Src, route.Dst) &&
 		(rule.SuppressPrefixlen < 0 || rule.SuppressPrefixlen < routeDstPrefixLen) &&
@@ -163,7 +163,7 @@ func routeCmp(a netlink.Route, b netlink.Route) int {
 // isSubnet returns true if network contains whole range of subnet. Otherwise, returns false.
 func isSubnet(network, subnet *net.IPNet) bool {
 	// nil is treated as an IP with 0 prefix
-	if network == nil {
+	if network == nil || network.IP.Equal(net.IPv4zero) || network.IP.Equal(net.IPv6zero) {
 		return true
 	}
 	if subnet == nil {

daemon/routes/netlink/retriever_test.go

@@ -230,6 +230,8 @@ func TestIsSubnet(t *testing.T) {
 		{"IPv6 subnet outside network", "2001:db8::/32", "2001:db9::/48", false},
 		{"IPv6 subnet larger than network", "2001:db8::/48", "2001:db8::/32", false},
 		{"nil network (default route)", "", "192.168.1.0/24", true},
+		{"zero IPv4 network", "0.0.0.0/0", "192.168.1.0/24", true},
+		{"zero IPv6 network", "::/0", "192.168.1.0/24", true},
 		{"nil subnet", "192.168.1.0/24", "", false},
 	}
 

go.mod

@@ -5,7 +5,7 @@ go 1.22
 toolchain go1.22.2
 
 // Bindings
-// NOTE: If you are chaning the binding versions here, keep in mind that you
+// NOTE: If you are changing the binding versions here, keep in mind that you
 // may also need to update versions in `./lib-versions.env` file.
 require (
 	github.com/NordSecurity/libdrop-go/v8 v8.0.0-20241017064027-670787595588
@@ -36,7 +36,7 @@ require (
 	github.com/quic-go/quic-go v0.48.2
 	github.com/stretchr/testify v1.9.0
 	github.com/urfave/cli/v2 v2.25.0
-	github.com/vishvananda/netlink v1.1.0
+	github.com/vishvananda/netlink v1.3.0
 	golang.org/x/crypto v0.31.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
 	golang.org/x/mod v0.17.0
@@ -89,7 +89,7 @@ require (
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 // indirect
+	github.com/vishvananda/netns v0.0.4 // indirect
 	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect

go.sum

@@ -188,11 +188,10 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/urfave/cli/v2 v2.25.0 h1:ykdZKuQey2zq0yin/l7JOm9Mh+pg72ngYMeB0ABn6q8=
 github.com/urfave/cli/v2 v2.25.0/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
-github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=
-github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
-github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
-github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 h1:gga7acRE695APm9hlsSMoOoE65U4/TcqNj90mc69Rlg=
-github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
+github.com/vishvananda/netlink v1.3.0 h1:X7l42GfcV4S6E4vHTsw48qbrV+9PVojNfIhZcwQdrZk=
+github.com/vishvananda/netlink v1.3.0/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
+github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
+github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -267,9 +266,7 @@ golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -279,6 +276,8 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

internal/errors.go

@@ -21,4 +21,5 @@ var (
 	// but is not
 	ErrNotLoggedIn           = errors.New("you are not logged in")
 	ErrVirtualServerSelected = errors.New(SpecifiedServerIsVirtualLocation)
+	ErrMonitorFailed         = errors.New(MonitorFailed)
 )