RETEX OpenSnitch v1.6.0rc1

[NRGLine4Sec]

Hi @gustavo-iniguez-goya

I don't know if this is normal at the moment, but there are no events for incoming connections in the GUI.

[gustavo-iniguez-goya]

[edited]
lol, I didn't understand you. Inbound connections are not intercepted like we do with outbound connections, interactively.

Sorry for the confusion @NRGLine4Sec . What have been added is the ability to deny/accept/reject/redirect inbound connections, but only statically (we won't display a pop-up asking you to allow/deny it).

[NRGLine4Sec]

pgrep -a opensnitchd output :
186733 /usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules

sudo nft list table inet mangle output :

table inet mangle {
	chain output {
		type filter hook output priority mangle; policy accept;
		icmp type { echo-reply, echo-request } accept
		ct state related,new queue num 0 bypass
	}

	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
	}

	chain postrouting {
		type filter hook postrouting priority mangle; policy accept;
	}

	chain forward {
		type filter hook forward priority mangle; policy accept;
	}
}

cat /sys/kernel/debug/tracing/kprobe_events output :

r32:kprobes/rtcp_v6_connect tcp_v6_connect
p:kprobes/pudp_sendmsg udp_sendmsg
p:kprobes/pudpv6_sendmsg udpv6_sendmsg
p:kprobes/piptunnel_xmit iptunnel_xmit
p:kprobes/ptcp_v4_connect tcp_v4_connect
r32:kprobes/rtcp_v4_connect tcp_v4_connect
p:kprobes/ptcp_v6_connect tcp_v6_connect

After settings logs to debug (revelant logs only) :

[DBG  new connection tcp => 58520:192.168.1.179 -> 192.168.1.179:12345 uid: 1000                                                                                                             
[DBG  ✔ /usr/bin/ssh -> 192.168.1.179:12345 (allow-ssh)

So there is an event for the outgoing connection (I'm trying SSH on myself) but nothing for incoming connection.

[NRGLine4Sec]

[edited] lol, I didn't understand you. Inbound connections are not intercepted like we do with outbound connections, interactively.

Sorry for the confusion @NRGLine4Sec . What have been added is the ability to deny/accept/reject/redirect inbound connections, but only statically (we won't display a pop-up asking you to allow/deny it).

Oh OK, so this could be a feature request to add incoming stuff in the events viewer, right ?

[gustavo-iniguez-goya]

Yes. But only add incoming connections to the viewer or also prompt the user to allow/deny them?

[NRGLine4Sec]

Personally, I don't want to be bothered by incoming connections on ports that I haven't authorized. So only the events corresponding to the rules I have set up are of interest to me in the event viewer.
So I would say no prompt the user to allow or deny incoming connections.

[gustavo-iniguez-goya]

Ok, that will be easier with the last changes I'm finishing, I hope.