What are the roles of the RPC methods, defined in proto file?

[Prateeknandle]

I found there are five RPC calls defined in proto, but there is no mention of which RPC provides what kind of service in the documentation.

I was building a service which wants to connect with the daemon (ui is not present), and it seems out of 5 RPC calls only Notifications is the one which streams data, but I do not find daemon is sending any data to it. I need an alerts/events stream where any deny action or allowed action takes place, defined by the rules, the service will get the alerts/events.

Is this even possible with current codebase?

[gustavo-iniguez-goya]

Hi @Prateeknandle !

The Notifications channel is mainly used to send "Actions" from the server (UI) to the daemon, and receive the result of the action:
Apply/Change/delete application or firewall rules, change configuration, etc.

opensnitch/daemon/ui/notifications.go

Line 270 in 1984fb9

func (c *Client) handleNotification(stream protocol.UI_NotificationsClient, notification *protocol.Notification) {

daemon -> (daemon/ui/client) Subscribe() -> server (UI).

UI -> Apply rule -> Notifications() <<(grpc channel)>> -> daemon -> handleNotification() -> protocol.Action_CHANGE_RULE -> result Ok/Error

I need an alerts/events stream where any deny action or allowed action takes place, defined by the rules, the service will get the alerts/events.

Those events are sent via the Ping() gRPC method. The daemon collects statistics about the monitored events (connections blocked/allowed), and send them to the server (UI) every second.

new connection -> (daemon/statistics/) OnConnectionEvent -> add to circular buffer

opensnitch/daemon/statistics/stats.go

Line 119 in 1984fb9

func (s *Statistics) OnConnectionEvent(con *conman.Connection, match *rule.Rule, wasMissed bool) {

opensnitch/daemon/statistics/stats.go

Line 192 in 1984fb9

func (s *Statistics) onConnection(con *conman.Connection, match *rule.Rule, wasMissed bool) {

at the same time, the collected stats are sent to the server (UI): (daemon/ui/client.go) Client.ping() -> stats.Serialize()

opensnitch/daemon/ui/client.go

Line 300 in 1984fb9

func (c *Client) ping(ts time.Time) (err error) {

opensnitch/daemon/statistics/stats.go

Line 255 in 1984fb9

func (s *Statistics) Serialize() *protocol.Statistics {

and every time the collected stats are sent, they're deleted from the daemon.

[gustavo-iniguez-goya]

Alternatively, you can send the network events to a remote server, by using Loggers:

https://github.com/evilsocket/opensnitch/wiki/SIEM-integration

[Prateeknandle]

Hey thanks @gustavo-iniguez-goya for detailed explanation, much appreciate your help.