Can't figure out why a rule is being ignored.

[ERLindeman]

I have two rules:
(converted from JSON to txt for GitHub)
000-allowlist.txt
001-blocklist.txt

allowlist points to a folder containing:
(converted from binary to txt for GitHub)
allow.txt

and blocklist points to a folder containing:
(also converted from binary to txt for GitHub)
block.txt

the contents of block.txt probably aren't needed for this problem.

The blocklist rule is working fine and doing its job, but even after setting its name to be after allowlist, setting only allowlist to be a priority rule, and messing with RegEx for waaaaay too long to see if that might be the problem, I've yet to see anything allowed by allowlist.

Any help or advice would be greatly appreciated.

[gustavo-iniguez-goya]

The regexps of the allow.list file seems to work fine:

(^|[./])gateway.discord.gg([./]|$)

[2022-03-31 12:14:46]  DBG  new connection udp => 38457:127.0.0.1 -> 127.0.2.1:53 uid: 1000
[2022-03-31 12:14:46]  DBG  Regexp list match: gateway.discord.gg, (^|[./])gateway\.discord\.gg([./]|$)
[2022-03-31 12:14:46]  DBG  ✔ /usr/lib/firefox-esr/firefox-esr -> gateway.discord.gg:53 (000-allow-AAA-regexp)

(^|[./])messenger([./]|$)

[2022-03-31 12:26:01]  DBG  new connection udp => 32771:127.0.0.1 -> 127.0.2.1:53 uid: 1000
[2022-03-31 12:26:01]  DBG  Regexp list match: www.messenger.com, (^|[./])messenger([./]|$)
[2022-03-31 12:26:01]  DBG  ✔ /usr/lib/chromium/chromium -> www.messenger.com:53 (000-allow-AAA-regexp)

You could add a simple regexp to the allow list to see if the rule is working: .*\.com and visit any .com domain.

Also if you set log level to DEBUG (Preferences -> nodes), monitor /var/log/opensnitchd.log, you should see logs like this one:

[2022-03-31 12:06:16]  DBG  new connection udp => 52565:127.0.0.1 -> 127.0.2.1:53 uid: 1000
[2022-03-31 12:06:16]  DBG  Regexp list match: play.golang.com, .*\.com
[2022-03-31 12:06:16]  DBG  ✔ /usr/lib/chromium/chromium -> play.golang.com:53 (000-allow-AAA-regexp)

$ tail -f /var/log/opensnitchd.log | grep "Regexp list"

[ERLindeman]

I set the settings for the log, restarted opensnitch, and checked the log, and I saw this:
�[2m[2022-03-31 17:23:15]�[0m �[97m�[104m IMP �[0m Start writing logs to /var/log/opensnitchd.log
�[2m[2022-03-31 17:23:15]�[0m �[97m�[41m ERR �[0m eBPF Failed to load /etc/opensnitchd/opensnitch.o: open /etc/opensnitchd/opensnitch.o: no such file or directory
�[2m[2022-03-31 17:23:15]�[0m �[97m�[43m WAR �[0m error starting ebpf monitor method: open /etc/opensnitchd/opensnitch.o: no such file or directory
�[2m[2022-03-31 17:23:15]�[0m �[97m�[43m WAR �[0m Unable to set new process monitor method from disk: open /etc/opensnitchd/opensnitch.o: no such file or directory

and it's right, /etc/opensnitchd/opensnitch.o doesn't exist, but I was confused, because it claims it's having trouble with eBPF, but I've had it set to proc for a long while... but /etc/opensnitchd/default-config.json begs to differ:
default-config.txt
"ProcMonitorMethod": "ebpf",
Should I just manually modify this to say "proc"?
Any idea why this wouldn't update, when my settings look like this:

...and have for some time?

I'm a bit baffled at this point.

Update:
Uploaded full default-config file, and after messing with things for a bit, I've found that my settings always report that "proc" is the "process monitor method", but that other settings like "default duration" reset in the GUI to report the (incorrect) value from default-config.json.

Still very confused. Any and all help would be greatly appreciated. Sorry if I'm being stupid, and thank you for all your help thus far.

Update 2:
I realized that the AUR Git version of the eBPF module was compatible with the mainline opensnitch release, so I reinstalled eBPF and changed the settings in the GUI to match (not that it seems that should've mattered). I also added .*\.com as the third line in the allowlist, but still got this:

Back under the "Events" tab, which tells me the rule is somehow not working correctly.
If you have any ideas as to why that might be, I'd also greatly appreciate it.

Here are the log lines I got after switching back to eBPF:
�[2m[2022-03-31 18:04:25]�[0m �[97m�[104m IMP �[0m Got signal: terminated
�[2m[2022-03-31 18:04:31]�[0m �[97m�[43m WAR �[0m queue stuck, closing by timeout
�[2m[2022-03-31 18:04:31]�[0m �[97m�[43m WAR �[0m Queue.destroy(), nfq_close() not closed: -1
I couldn't make much of them, but I'm betting you can, and hoping that the termination they refer to is perhaps the reason for the rule not working properly.

Also, after reinstalling the eBPF module, the default-config file updated itself so that "DefaultAction" and "DefaultDuration" matched what I set in the GUI. I think whatever was causing it to think that the eBPF module was still installed was preventing those settings (including "ProcMonitorMethod") from updating correctly, but at this point, that's a separate issue from the one preventing my allowlist rule from running properly.

Sorry for bombarding you with information, I'd just really like to get this solved after weeks of trying (and failing) to sort it out myself, and I know you are most likely of anyone to have the answers I need.

[gustavo-iniguez-goya]

Also, after reinstalling the eBPF module, the default-config file updated itself so that "DefaultAction" and "DefaultDuration" matched what I set in the GUI. I think whatever was causing it to think that the eBPF module was still installed was preventing those settings (including "ProcMonitorMethod") from updating correctly, but at this point, that's a separate issue from the one preventing my allowlist rule from running properly

mmh, I'll try to reproduce that problem 👍

I also added .*.com as the third line in the allowlist, but still got this:

When you modified the allowlist file, was the list reloaded? you can monitor the log, and see if this log appears:

[2022-03-31 23:58:19]  INF  clearing domains lists: 2 - /etc/opensnitchd/allowlists/regexp
[2022-03-31 23:58:19]  DBG  Loading regexp list: /etc/opensnitchd/allowlists/regexp/allow-re.txt, size: 72
[2022-03-31 23:58:19]  INF  2 regexps loaded, /etc/opensnitchd/allowlists/regexp/allow-re.txt
[2022-03-31 23:58:19]  INF  2 lists loaded, 2 domains, 0 duplicated

if you add a new regexp to allowlist, it should log "3 regexps loaded", "4 regexp..", etc. If it seems to load fine the list, a telnet/curl to www.github.com should be logged: DBG Regexp list match: www.github.com, .*\.com

Sorry for bombarding you with information, I'd just really like to get this solved after weeks of trying (and failing) to sort it out myself, and I know you are most likely of anyone to have the answers I need.

No problem at all! Ask all you want and I'll try to help :)

[gustavo-iniguez-goya]

mmh, I'm also experiencing a weird behaviour with the allowlists. I'll take a look.

ah, nevermind, it's a different issue.

[ERLindeman]

I managed to solve the problem. In the end, my having the allowlist being a binary file named "allow" was the problem. Changing the name to "allow.list" fixed it.

[gustavo-iniguez-goya]

Great! I've updated the wiki page to include a note about extensions, and a troubleshooting section: https://github.com/evilsocket/opensnitch/wiki/block-lists

Change it if you think that it can be improved.