v1.4.0-rc.2

[gustavo-iniguez-goya]

New features

• 9497cf8 Thanks to @themighty1 we have a new processes monitor method eBPF

Improvements

UI

• 4332469 - better remote nodes handling
• c7411a4 - improved windows layouts, particularly for librem5 devices.
• 042b04e , dc56be4 , 80c9519 , 49d1261 , f288078 - events window fixes and improvements

Misc

• 0f7e93a - fixed /proc/$pid/stat starttime field parsing
• 2c1c3b0 - more options to handle rules in batch
  some translations updated, 2 new added.

---

Packages:

Install them from a terminal, see how

daemon

• deb x86_64
• deb i386
• deb armhf (for raspberry pi, and others, if not, report it please)
• deb arm64 (for raspberry pi, Librem5, and others)
• rpm x86_64

GUI

• rpm
• deb

(If the above packages complain about dependencies, use these ones)

• deb - for old distributions (Ubuntu <= 18.04)
• rpm - for old distributions (Fedora < 29)

---

This discussion was created from the release v1.4.0-rc.2.

[Danny3]

I have deleted all my rules and uninstalled the previous version (RC1) and then installed this version.
On Kubuntu 21.04 + KDE Plasma 5.22 Beta.

And it's not starting by default !
Status is : -
Version is: -
Clicking on the "Play" button (that triangle) does nothing.
restarting the computer also does nothing.

LE:
Uninstalled the RC2 to install the RC1 gain and now I have the same problems with that one too !
I don't get it what's going on.
Could it be that KDE Plasma 5.22 Beta has broken it in some way ?

[gustavo-iniguez-goya]

That's really weird. You don't need to uninstall previous version unless we post a note to do so, packages are expected to be upgradable.

But anyway, first verify that the daemon is not running:

• $ pgrep -a opensnitchd

If it doesn't output the pid, launch the daemon as root:

• # /usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules/ -debug

and see if it exits with error or runs as expected. If it exits with an error post it here.

Verify anyway that the files default-config.json, system-fw.json and the directory /etc/opensnitchd/rules/ exist under /etc/opensnitchd/

[Danny3]

It says:
pgrep -a opensnitchd
816 /usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules

Then I killed it and ran the daemon as root:
/usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules/ -debug
[2021-05-21 07:32:08] IMP Starting opensnitch-daemon v1.4.0rc1
[2021-05-21 07:32:08] INF Loading rules from /etc/opensnitchd/rules ...
[2021-05-21 07:32:08] DBG Rules watcher started on path /etc/opensnitchd/rules ...
[2021-05-21 07:32:08] DBG Starting 16 workers ...
[2021-05-21 07:32:08] DBG Worker #6 started.
OK: libnetfiler_queue supports nfq_get_uid
[2021-05-21 07:32:08] DBG Worker #10 started.
[2021-05-21 07:32:08] DBG Worker #3 started.
[2021-05-21 07:32:08] DBG Stats worker #3 started.
[2021-05-21 07:32:08] DBG Worker #4 started.
[2021-05-21 07:32:08] DBG Stats worker #0 started.
[2021-05-21 07:32:08] DBG Stats worker #1 started.
[2021-05-21 07:32:08] DBG Stats worker #2 started.
[2021-05-21 07:32:08] DBG Worker #0 started.
[2021-05-21 07:32:08] DBG Worker #1 started.
[2021-05-21 07:32:08] DBG Worker #2 started.
[2021-05-21 07:32:08] DBG Worker #7 started.
[2021-05-21 07:32:08] DBG Worker #8 started.
[2021-05-21 07:32:08] DBG Worker #5 started.
OK: libnetfiler_queue supports nfq_get_uid
[2021-05-21 07:32:08] DBG Worker #9 started.
[2021-05-21 07:32:08] DBG Worker #14 started.
[2021-05-21 07:32:08] DBG Worker #12 started.
[2021-05-21 07:32:08] DBG Worker #11 started.
[2021-05-21 07:32:08] DBG Worker #15 started.
[2021-05-21 07:32:08] DBG Worker #13 started.
[2021-05-21 07:32:08] ERR Error parsing configuration /etc/opensnitchd/default-config.json: unexpected end of JSON input
[2021-05-21 07:32:08] INF Process monitor method /proc
[2021-05-21 07:32:08] DBG UI service poller started for socket
[2021-05-21 07:32:08] ERR Error parsing firewall configuration /etc/opensnitchd/system-fw.json: unexpected end of JSON input
[2021-05-21 07:32:08] INF Running on netfilter queue #0 ...
[2021-05-21 07:32:10] DBG client.disconnect()
[2021-05-21 07:32:11] DBG client.disconnect()
[2021-05-21 07:32:12] DBG client.disconnect()
[2021-05-21 07:32:13] DBG client.disconnect()
[2021-05-21 07:32:14] DBG client.disconnect()
[2021-05-21 07:32:15] DBG client.disconnect()
[2021-05-21 07:32:16] DBG client.disconnect()
[2021-05-21 07:32:17] DBG client.disconnect()
[2021-05-21 07:32:18] DBG client.disconnect()
[2021-05-21 07:32:19] DBG client.disconnect()
[2021-05-21 07:32:21] DBG client.disconnect()
[2021-05-21 07:32:22] DBG client.disconnect()
^C
[2021-05-21 07:32:23] IMP Got signal: interrupt
[2021-05-21 07:32:23] INF Cleaning up ...
[2021-05-21 07:32:23] DBG worker channel closed 10
[2021-05-21 07:32:23] DBG worker #10 exit
[2021-05-21 07:32:23] DBG worker channel closed 5
[2021-05-21 07:32:23] DBG worker channel closed 6
[2021-05-21 07:32:23] DBG worker #6 exit
[2021-05-21 07:32:23] INF exit checking fw rules
[2021-05-21 07:32:23] DBG worker #5 exit
[2021-05-21 07:32:23] DBG worker channel closed 7
[2021-05-21 07:32:23] DBG worker #7 exit
[2021-05-21 07:32:23] DBG worker channel closed 2
[2021-05-21 07:32:23] DBG worker #2 exit
[2021-05-21 07:32:23] DBG worker channel closed 1
[2021-05-21 07:32:23] DBG worker #1 exit
[2021-05-21 07:32:23] DBG worker channel closed 0
[2021-05-21 07:32:23] DBG worker #0 exit
[2021-05-21 07:32:23] DBG worker channel closed 4
[2021-05-21 07:32:23] DBG worker #4 exit
[2021-05-21 07:32:23] DBG worker channel closed 3
[2021-05-21 07:32:23] DBG worker #3 exit
[2021-05-21 07:32:23] DBG worker channel closed 13
[2021-05-21 07:32:23] DBG worker #13 exit
[2021-05-21 07:32:23] DBG worker channel closed 8
[2021-05-21 07:32:23] DBG worker #8 exit
[2021-05-21 07:32:23] DBG worker channel closed 12
[2021-05-21 07:32:23] DBG worker #12 exit
[2021-05-21 07:32:23] DBG worker channel closed 14
[2021-05-21 07:32:23] DBG worker #14 exit
[2021-05-21 07:32:23] DBG worker channel closed 11
[2021-05-21 07:32:23] DBG worker #11 exit
[2021-05-21 07:32:23] DBG worker channel closed 9
[2021-05-21 07:32:23] DBG worker #9 exit
[2021-05-21 07:32:23] DBG worker channel closed 15
[2021-05-21 07:32:23] DBG worker #15 exit
..................................................................
I pressed CTRL + C

The "/etc/opensnitchd/rules/" exists and it's empty !

[Danny3]

Tried to run the same command again thinking that I stopped it before looking at the GUI if it has started this time or not and since I stopped it with CTRL + C is should've been stopped, but the output might say otherwise, I'm not sure:

/usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules/ -debug
[2021-05-21 07:36:31] IMP Starting opensnitch-daemon v1.4.0rc1
[2021-05-21 07:36:31] INF Loading rules from /etc/opensnitchd/rules ...
[2021-05-21 07:36:31] DBG Starting 16 workers ...
[2021-05-21 07:36:31] DBG Worker #3 started.
[2021-05-21 07:36:31] DBG Rules watcher started on path /etc/opensnitchd/rules ...
ERROR: nfq_create_queue() queue not created
[2021-05-21 07:36:31] DBG Stats worker #0 started.
[2021-05-21 07:36:31] DBG Worker #15 started.
[2021-05-21 07:36:31] WAR Is opensnitchd already running?
[2021-05-21 07:36:31] !!! Error while creating queue #0: Error binding to queue: operation not permitted

[gustavo-iniguez-goya]

Do /etc/opensnitchd/default-config.json and /etc/opensnitchd/system-fw.json exist? It seems that they're either missing or empty.

[Danny3]

Do /etc/opensnitchd/default-config.json and /etc/opensnitchd/system-fw.json exist? It seems that they're either missing or empty.

No. In the "/etc/opensnitchd/" only "rules" directory exits, neither of those files are there.
Could it be because before I uninstalled the previous version I selected and deleted all the rules in the interface thinking that I should start with a clean slate with the new version ?

I though I will just recreate the rules.

[gustavo-iniguez-goya]

uh, that's really weird, I've tried to replicate the problem but in my case it has kept the files after uninstalling and installing again.
apt only removes configuration files if you purge the package (remove --purge).

But in any case, re-installing the package should install the config files.

You can extract the files of the deb and copy the files, just in case dpkg doesn't install them:

$ dpkg -x opensnitch_1.4.0.rc2-1_amd64.deb /tmp/v1.4.0rc2
$ sudo cp /tmp/v1.4.0rc2/etc/opensnitchd/* /etc/opensnitchd/

[Danny3]

I closed the program form the systray.
Then I uninstalled it completely with:
sudo apt-get remove --purge opensnitch
The I installed it again.
It complained about some packages like: python3-opensnitch-ui (--install)
And asked me to say yes to download some packaages which I did and it works gain ! :-)
Status says that it's running, version is displayed correctly in the bottom-right corner and the permission pop-up is appearing again.
Really happy that it works now !

The problems with not opening or coming to front when clicking on the systray icon or taskbar icon on KDE are still there, but that's a really minor thing which doesn't bother me much.

Thank you very much!

I'm sorry for wasting your time with this.

[gustavo-iniguez-goya]

no problem @Danny3 !

[evilsocket]

wow kudos for the eBPF port 👏🏻 @themighty1

[Danny3]

Is eBPF monitoring method better than the default one, should we switch to it or alt least test it ?
Does it have disadvantages ?
Does it work with any kernel or it needs something specific ?

I tried to look online at what is it, but I don't understand how it fits in this specific case with the firewall.

[gustavo-iniguez-goya]

yes @Danny3 , it's more accurate (in the sense that it's way harder to hide a process from the system), faster (because we receive the PID of a process directly from the kernel) and we need to test it. I've already seen that there're a few race condition bugs, I'll commit a fix soon.

Does it have disadvantages ?

No AFAIK.

Does it work with any kernel or it needs something specific ?

It works from kernel >= 4.4. It was introduced some years ago: https://ebpf.io/

[Danny3]

Wow, that's really great !
No wonder Microsoft is trying to bring it to Windows too.
Thank you very much for the explanation !

BTW, I switched to it for testing and I thought I should start clean with the rules, so I tried to delete them all like before, but I noticed a little bug.
I selected all the rules, right-clicked and chose Delete, but it didn't work, at least not as before by cleaning the list immediately.
It seems that it still works to delete them all, but to see the list empty you have to close the GUI and open it again.

[gustavo-iniguez-goya]

Yeah, that's a little bit annoying. You don't have to close the GUI, just clicking on another tab or if a new event arrives the list will refreshed.

[Danny3]

Oh, ok, that's even better, thanks !

[evilsocket]

Regarding eBPF:

#426
#427