Incorrect popups #694
Comments
|
hi @Pheidologeton , you need to regenerate the protobuffer, there has been a change recently that requires it: ~ $ git clone https:..../opensnitch
~ $ cd opensnitch
opensnitch $ make protocol
opensnitch $ cd ui
opensnitch/ui $ sed -i 's/^import ui_pb2/from . import ui_pb2/' opensnitch/ui_pb2*
opensnitch/ui $ sudo cp opensnitch/ui_pb2* /usr/lib/python3/dist-packages/opensnitch/ |
|
Closing as regenerating the protobuffer should fix this problem. If it still fails drop a comment to further analyze it. |
|
@gustavo-iniguez-goya I have the same problem with the opensnitch git version. Your instructions above didn't solve the issue, unfortunately. I had to compile the ebpf programs against linux kernel 5.18.9 because compiling them against 5.8 now results in an error. In latest opensnitch git version, Almost every program that tries to connect to the internet keeps popping up requests and If I allow them it won't work unless I allow the "command line" instead of the executable. I had to revert to the Opensnitch stable RPMs for now. |
|
@pizzadude could you post the error compiling the modules? Does the module opensnitch-procs load correctly? take a look a the logs please, there should be an error if it failed. Also be sure that you don't have the above errors "Invalid rule received, applying default action". |
|
Simply rebuilding the program and the ebpf module from scratch did not solve the problem, nor did the method described above. |
|
Sorry. Latest git code works fine for me. I just cloned the repo -> Let's see if we can figure out what's going on:
|
|
I would also like to add. Some programs are recognized and rules are created correctly. Others have an unknown executable and an error. |
|
I noticed this in the logs. |
|
Also, this is the output of /sys/kernel/debug/tracing/kprobe_events This is /var/log/opensnitchd.log These are the popups I get Clicking "allow" does nothing. |
|
Also, the above errors is with the EBPF programs compiled with Linux 5.18 sources. If I try to compile with 5.8 (like the instructions said), I get this error: This is on Fedora 36. |
|
As a test, I compiled the opensnitch EBPF programs against Linux kernel 5.8 in an ubuntu 20.04 podman/docker container using distrobox. Then I copied the EBPF .o files into /etc/opensnitchd. Same issue. |
|
thank you @pizzadude ! The real problem here is the error deserializing the rule. That's usually cause by differences between the GUI and daemon's protobuffer. My recommendation is to delete the files /usr/lib/python3/dist-packages/opensnitch/ui_pb*. I assume that your GUI files under /usr/lib/python3/dist-packages/opensnitch/ are the latest from git. Otherwise you'll need also to update them. The generated files, opensnitch/daemon/ui/protocol/ui* and opensnitch/ui/opensnitch/ui_pb*, should have references to the latest field added nolog: $ grep nolog opensnitch/ui/opensnitch/ui_pb2*
opensnitch/ui/opensnitch/ui_pb2.py: name='nolog', full_name='protocol.Rule.nolog', index=4,
$ grep -i nolog opensnitch/daemon/ui/protocol/ui.pb.go
Nolog bool `protobuf:"varint,5,opt,name=nolog,proto3" json:"nolog,omitempty"`
func (m *Rule) GetNolog() bool {
return m.NologShall I generate new rpms to test? |
|
Regarding the new module: move it out from the /etc/opensnitchd/ directory , to your home for example. |
|
I did both of those things multiple times, still same problem. Here is my generated ui_pb2.py if that helps. |
|
Thank you @pizzadude , something is wrong with your protobuf file, there's a lot of code missing: Could you replace these files with yours? ui_pb2-694.zip What grpcio-tools do you have installed btw? |
I will try replacing the file and report back. |
|
I tried downgrading grpcio and grpcio-tools to both versions 1.40.0 and 1.42.0, rebuilding twice, and it didn't solve the issue. I tried replacing the files with the ones you attached and it didn't solve it either. :( |
|
ok , I'll build new packages against latest sources. On the other hand, I just upgraded an old v1.5.0 installation on Arch to latest sources and works fine, so I think it must be something related with the protobuffers. Anyway, check also that the running opensnitchd binary (pgrep -a opensnitchd) is using latest protobuf definitions: $ pgrep -a opensnitchd
12345 /usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules
$ strings /usr/bin/opensnitchd | grep -i nolog
(...)
github.com/evilsocket/opensnitch/daemon/ui/protocol.(*Rule).GetNolog
Nolog@protobuf:"varint,5,opt,name=nolog,proto3" json:"nolog,omitempty"
(...)And see if the pop-ups works as expected with the protobuf I posted with new rules (like ping github.com, and see if the rule is created and applied), or if it fails with any application or one application in particular (like the one you posted, net.downloaded.coapp). I'll download also that app to see if I can reproduce it with it. |
One program it always fails with is aria2c when downloading a video with yt-dlp. |
|
ok @pizzadude , I've tested the procs module on opensuse 15, kernel 5.9, and it's not getting the path of the processes, so that can lead to these errors. Could you replace this opensnitch-procs.o with yours, stop the daemon, and launch the daemon of the zip as: You should see traces in the log like: |
Weird... Those aren't the actual paths of aria2c. The actual path is /usr/bin/aria2c. Regardless, the download worked when I allowed it...but the path is wrong? It did get some other paths correctly: |
|
good news then! Yes, I expect that kind of behaviour. There'll be some rules that you'll have to update. Without this module we were not able to detect connections initiated by short-lived processes like fwknop, it's more accurate now. Anyway, I'll also check if the path is empty, to avoid these errors. |
|
I've pushed a change to solve these issues. @pizzadude could you compile the daemon + modules against latest sources? |
|
I compiled the ebpf modules against kernel 5.18 (and I downgraded grpcio and grpcio-tools to version 1.42.0 via pip or else I get an incorrect "ui_pb2.py")... Latest git, so far so good! Thank you for the help. :)
^That process path is incorrect, but it still works. |
|
Unfortunately I spoke too soon... Every electron application is detected as /proc/self/exe |
Sometimes the path of a path has " (deleted)" added or the path is reported as "/proc/self/exe" which is a link and needs to be resolved. -> #694
|
yeah, sorry. I added a workaround for that problem but I removed it on the last commit. Readded now. What should be the correct path of that npm package? What was the path reported before these changes? |
|
The correct path is /usr/bin/aria2c, it's not actually an npm package, idk why it picks it up as one. |
|
but does that path exist? ~/.npm-packages/bin/aria2c . See if any of both is a symlink: ls -l ~/.npm-packages/bin/aria2c /usr/bin/aria2c |
|
Nope, there is no file at ~/.npm-packages/bin/aria2c or ~/.local/bin/aria2c. Only /usr/bin/aria2c. And it's a program written in C++. BTW the /proc/self/exe fix seems to work. |
|
great! please, if you see more quirks report them because it's really useful, thank you very much! sorry if I already asked this, but is the aria2c binary launched by another app? or do you launch it directly? Would be interesting to strace it if it's launched by another app. |
|
It is launched by another app, yt-dlp (youtube downloader). When run manually it seems to have the correct path. |
|
despite all new quirks, as far as I can tell now:
Of course this is in its infancy and there's plenty of room for improvements. We'll see how it works out on others environments. @Pheidologeton how about you? did you compile latest sources? |
|
I built opensnitch and ebpf module. So far everything is working fine. I will be testing more. opensnitchd uses 0.025-0.05% CPU. I have hundreds of connections per second. If there are any problems I will contact you. |
|
thank you @Pheidologeton :) |
|
time to break master branch again! sorry, just kidding. I've added the ability to get cmdline arguments directly from kernel. Tested on kernels 5.18, 5.13, 5.11, 5.10, 5.9 and 5.6.6. But please, if you can test it and report any problem it'd very useful. Thank you! |
|
I did some light testing and the latest changes seem to work ok so far. |
Please, check the FAQ and Known Problems pages before creating the bug report:
https://github.com/evilsocket/opensnitch/wiki/FAQs
https://github.com/evilsocket/opensnitch/wiki/Known-problems
Describe the bug
A process added to the whitelist still triggers in some cases. In this case, it is snowflake-pt-client, which is necessary for tor to work. According to the rule, it is allowed access to the network. But after some time, these popups appear. When I try to allow it, it just appears again.
Include the following information:
To Reproduce
Describe in detail as much as you can what happened.
This error occurs randomly and not with all processes
Steps to reproduce the behavior:
Post error logs:
/var/log/opensnitchd.logExpected behavior (optional)
Processes added to the whitelist are not triggering
Screenshots
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: