.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,17 +1,26 @@
 ---
-name: Bug report
+name: 🐞 Bug report
 about: Create a report to help us improve
 title: ''
 labels: ''
 assignees: ''
 
 ---
 
-Present yourself (or at least say "Hello" or "Hi") and be kind && respectful.
+Please, check the FAQ and Known Problems pages before creating the bug report:
+https://github.com/evilsocket/opensnitch/wiki/FAQs
+https://github.com/evilsocket/opensnitch/wiki/Known-problems
 
 **Describe the bug**
 A clear and concise description of what the bug is.
 
+Include the following information:
+ - OpenSnitch version.
+ - OS: [e.g. Debian GNU/Linux, ArchLinux, Slackware, ...]
+ - Version [e.g. Buster, 10.3, 20.04]
+ - Window Manager: [e.g. GNOME Shell, KDE, enlightenment, i3wm, ...]
+ - Kernel version: echo $(uname -a)
+
 **To Reproduce**
 Describe in detail as much as you can what happened.
 
@@ -28,22 +37,16 @@ If it's a crash of the GUI:
 
 If the daemon doesn't start:
  - Post last 15 lines of the log file `/var/log/opensnitchd.log`
- - Or launch it from a terminal (`/usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules`) and post the errors logged to the terminal.
+ - Or launch it from a terminal as root (`# /usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules`) and post the errors logged to the terminal.
 
 If the deb or rpm packages fail to install:
- - Install them from a terminal (`dpkg -i opensnitch*` / `yum install opensnitch*`), and post the errors logged to stdout.
+ - Install them from a terminal (`$ sudo dpkg -i opensnitch*` / `$ sudo yum install opensnitch*`), and post the errors logged to stdout.
 
 **Expected behavior (optional)**
 A clear and concise description of what you expected to happen.
 
 **Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**OS (please complete the following information):**
- - OS: [e.g. Debian GNU/Linux, ArchLinux, Slackware, ...]
- - Window Manager: [e.g. GNOME shell, KDE, enlightenment, ...]
- - Kernel version: echo $(uname -a)
- - Version [e.g. Buster, 10.3, 20.04]
+If applicable, add screenshots to help explain your problem. It may help to understand the issue much better.
 
 **Additional context**
 Add any other context about the problem here.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,4 @@
+contact_links:
+  - name: 🙋 Question
+    url: https://github.com/evilsocket/opensnitch/discussions/new
+    about: Ask your question here

.github/ISSUE_TEMPLATE/feature-request.md

@@ -0,0 +1,15 @@
+---
+name: 💡 Feature request
+about: Suggest an idea 
+title: '[Feature Request] <title>'
+labels: feature
+assignees: ''
+
+---
+
+<!--
+Note: Please, use the search box to see if this feature has already been requested.
+-->
+
+### Summary:
+<!-- A concise description of the new feature. -->

.github/workflows/go.yml

@@ -22,6 +22,8 @@ jobs:
         export GOPATH=~/go
         export PATH=$PATH:$GOPATH/bin
         go get github.com/golang/protobuf/protoc-gen-go
+        go install google.golang.org/protobuf/cmd/protoc-gen-go
+        go get google.golang.org/grpc/cmd/protoc-gen-go-grpc
         cd proto
         make ../daemon/ui/protocol/ui.pb.go
         go get -v -t -d ./...

daemon/Makefile

@@ -12,6 +12,7 @@ install:
 	@systemctl daemon-reload
 
 opensnitchd: $(SRC)
+	@go get
 	@go build -o opensnitchd . 
 
 clean:

daemon/conman/connection.go

@@ -83,7 +83,7 @@ func newConnectionImpl(nfp *netfilter.Packet, c *Connection, protoType string) (
 	}
 
 	pid := -1
-	var uid int
+	uid := -1
 	if procmon.MethodIsEbpf() {
 		pid, uid, err = ebpf.GetPid(c.Protocol, c.SrcPort, c.SrcIP, c.DstIP, c.DstPort)
 		if err != nil {
@@ -118,17 +118,17 @@ func newConnectionImpl(nfp *netfilter.Packet, c *Connection, protoType string) (
 		for n, inode := range inodeList {
 			pid = procmon.GetPIDFromINode(inode, fmt.Sprint(inode, c.SrcIP, c.SrcPort, c.DstIP, c.DstPort))
 			if pid != -1 {
-				log.Debug("[%d] PID found %d", n, pid)
+				log.Debug("[%d] PID found %d [%d]", n, pid, inode)
 				c.Entry.INode = inode
 				break
 			}
 		}
 	}
 
-	if uid != -1 {
-		c.Entry.UserId = uid
-	} else if c.Entry.UserId == -1 && nfp.UID != 0xffffffff {
+	if nfp.UID != 0xffffffff {
 		c.Entry.UserId = int(nfp.UID)
+	} else {
+		c.Entry.UserId = uid
 	}
 
 	if pid == os.Getpid() {

daemon/core/version.go

@@ -3,7 +3,7 @@ package core
 // version related consts
 const (
 	Name    = "opensnitch-daemon"
-	Version = "1.4.0"
+	Version = "1.5.0rc1"
 	Author  = "Simone 'evilsocket' Margaritelli"
 	Website = "https://github.com/evilsocket/opensnitch"
 )

daemon/go.mod

@@ -5,17 +5,15 @@ go 1.14
 require (
 	github.com/evilsocket/ftrace v1.2.0
 	github.com/fsnotify/fsnotify v1.4.7
-	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
-	github.com/golang/protobuf v1.5.0
 	github.com/google/gopacket v1.1.14
 	github.com/google/nftables v0.0.0-20210514154851-a285acebcad3
 	github.com/iovisor/gobpf v0.2.0
-	github.com/vishvananda/netlink v1.1.0
-	github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df // indirect
-	golang.org/x/net v0.0.0-20190311183353-d8887717615a
+	github.com/vishvananda/netlink v0.0.0-20210811191823-e1a867c6b452
+	github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae // indirect
+	golang.org/x/net v0.0.0-20191028085509-fe3aa8a45271
 	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 // indirect
-	golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444 // indirect
+	golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1
 	golang.org/x/text v0.3.0 // indirect
-	google.golang.org/grpc v1.27.0
-	google.golang.org/protobuf v1.26.0
+	google.golang.org/grpc v1.32.0
+	google.golang.org/protobuf v1.26.0 // indirect
 )

daemon/main.go

@@ -20,6 +20,7 @@ import (
 	"github.com/evilsocket/opensnitch/daemon/firewall"
 	"github.com/evilsocket/opensnitch/daemon/log"
 	"github.com/evilsocket/opensnitch/daemon/netfilter"
+	"github.com/evilsocket/opensnitch/daemon/netlink"
 	"github.com/evilsocket/opensnitch/daemon/procmon/monitor"
 	"github.com/evilsocket/opensnitch/daemon/rule"
 	"github.com/evilsocket/opensnitch/daemon/statistics"
@@ -295,25 +296,28 @@ func acceptOrDeny(packet *netfilter.Packet, con *conman.Connection) *rule.Rule {
 		}
 
 	}
+	if packet == nil {
+		log.Debug("Packet nil after processing rules")
+		return r
+	}
 
 	if r.Enabled == false {
 		applyDefaultAction(packet)
 		ruleName := log.Green(r.Name)
 		log.Info("DISABLED (%s) %s %s -> %s:%d (%s)", uiClient.DefaultAction(), log.Bold(log.Green("✔")), log.Bold(con.Process.Path), log.Bold(con.To()), con.DstPort, ruleName)
 
 	} else if r.Action == rule.Allow {
-		if packet != nil {
-			packet.SetVerdictAndMark(netfilter.NF_ACCEPT, packet.Mark)
-		}
+		packet.SetVerdictAndMark(netfilter.NF_ACCEPT, packet.Mark)
 		ruleName := log.Green(r.Name)
 		if r.Operator.Operand == rule.OpTrue {
 			ruleName = log.Dim(r.Name)
 		}
 		log.Debug("%s %s -> %s:%d (%s)", log.Bold(log.Green("✔")), log.Bold(con.Process.Path), log.Bold(con.To()), con.DstPort, ruleName)
 	} else {
-		if packet != nil {
-			packet.SetVerdict(netfilter.NF_DROP)
+		if r.Action == rule.Reject {
+			netlink.KillSocket(con.Protocol, con.SrcIP, con.SrcPort, con.DstIP, con.DstPort)
 		}
+		packet.SetVerdict(netfilter.NF_DROP)
 
 		log.Debug("%s %s -> %s:%d (%s)", log.Bold(log.Red("✘")), log.Bold(con.Process.Path), log.Bold(con.To()), con.DstPort, log.Red(r.Name))
 	}

daemon/netlink/socket.go

@@ -44,8 +44,9 @@ func GetSocketInfo(proto string, srcIP net.IP, srcPort uint, dstIP net.IP, dstPo
 			if sock.UID != 0xffffffff {
 				uid = int(sock.UID)
 			}
-			log.Debug("[%d/%d] outgoing connection: %d:%v -> %v:%d || netlink response: %d:%v -> %v:%d inode: %d - loopback: %v multicast: %v unspecified: %v linklocalunicast: %v ifaceLocalMulticast: %v GlobalUni: %v ",
+			log.Debug("[%d/%d] outgoing connection uid: %d, %d:%v -> %v:%d || netlink response: %d:%v -> %v:%d inode: %d - loopback: %v multicast: %v unspecified: %v linklocalunicast: %v ifaceLocalMulticast: %v GlobalUni: %v ",
 				n, len(sockList),
+				int(sock.UID),
 				srcPort, srcIP, dstIP, dstPort,
 				sock.ID.SourcePort, sock.ID.Source,
 				sock.ID.Destination, sock.ID.DestinationPort, sock.INode,
@@ -62,14 +63,11 @@ func GetSocketInfo(proto string, srcIP net.IP, srcPort uint, dstIP net.IP, dstPo
 				((sock.ID.Destination.IsGlobalUnicast() || sock.ID.Destination.IsLoopback()) && sock.ID.Destination.Equal(dstIP)) {
 				inodes = append([]int{int(sock.INode)}, inodes...)
 				continue
-			} else if sock.ID.SourcePort == uint16(srcPort) && sock.ID.Source.Equal(srcIP) &&
-				(sock.ID.DestinationPort == uint16(dstPort)) {
-				inodes = append([]int{int(sock.INode)}, inodes...)
-				continue
 			}
 			log.Debug("GetSocketInfo() invalid: %d:%v -> %v:%d", sock.ID.SourcePort, sock.ID.Source, sock.ID.Destination, sock.ID.DestinationPort)
 		}
 
+		// handle special cases (see function description): ntp queries (123), broadcasts, incomming connections.
 		if len(inodes) == 0 && len(sockList) > 0 {
 			for n, sock := range sockList {
 				if sockList[n].ID.Destination.Equal(net.IPv4zero) || sockList[n].ID.Destination.Equal(net.IPv6zero) {
@@ -79,6 +77,10 @@ func GetSocketInfo(proto string, srcIP net.IP, srcPort uint, dstIP net.IP, dstPo
 						sockList[n].ID.SourcePort, sockList[n].ID.Source,
 						sockList[n].ID.Destination, sockList[n].ID.DestinationPort,
 						sockList[n].INode, TCPStatesMap[sock.State])
+				} else if sock.ID.SourcePort == uint16(srcPort) && sock.ID.Source.Equal(srcIP) &&
+					(sock.ID.DestinationPort == uint16(dstPort)) {
+					inodes = append([]int{int(sock.INode)}, inodes...)
+					continue
 				} else {
 					log.Debug("netlink socket not found, EXCLUDING entry:  %d:%v -> %v:%d || %d:%v -> %v:%d inode: %d state: %s",
 						srcPort, srcIP, dstIP, dstPort,
@@ -124,3 +126,28 @@ func GetSocketInfoByInode(inodeStr string) (*Socket, error) {
 	}
 	return nil, fmt.Errorf("Inode not found")
 }
+
+// KillSocket kills a socket given the properties of a connection.
+func KillSocket(proto string, srcIP net.IP, srcPort uint, dstIP net.IP, dstPort uint) {
+	family := uint8(syscall.AF_INET)
+	ipproto := uint8(syscall.IPPROTO_TCP)
+	protoLen := len(proto)
+	if proto[protoLen-1:protoLen] == "6" {
+		family = syscall.AF_INET6
+	}
+
+	if proto[:3] == "udp" {
+		ipproto = syscall.IPPROTO_UDP
+		if protoLen >= 7 && proto[:7] == "udplite" {
+			ipproto = syscall.IPPROTO_UDPLITE
+		}
+	}
+
+	if sockList, err := SocketGet(family, ipproto, uint16(srcPort), uint16(dstPort), srcIP, dstIP); err == nil {
+		for _, s := range sockList {
+			if err := socketKill(family, ipproto, s.ID); err != nil {
+				log.Debug("Unable to kill socket:", srcPort, dstPort, err)
+			}
+		}
+	}
+}

daemon/netlink/socket_linux.go

@@ -15,6 +15,7 @@ import (
 // which adds support for query UDP, UDPLITE and IPv6 sockets to SocketGet()
 
 const (
+	SOCK_DESTROY        = 21
 	sizeofSocketID      = 0x30
 	sizeofSocketRequest = sizeofSocketID + 0x8
 	sizeofSocket        = sizeofSocketID + 0x18
@@ -186,6 +187,24 @@ func (s *Socket) deserialize(b []byte) error {
 	return nil
 }
 
+// SocketKill kills a connection
+func socketKill(family, proto uint8, sockID SocketID) error {
+
+	sockReq := &SocketRequest{
+		Family:   family,
+		Protocol: proto,
+		ID:       sockID,
+	}
+
+	req := nl.NewNetlinkRequest(SOCK_DESTROY, syscall.NLM_F_REQUEST|syscall.NLM_F_ACK)
+	req.AddData(sockReq)
+	_, err := req.Execute(syscall.NETLINK_INET_DIAG, 0)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 // SocketGet returns the list of active connections in the kernel
 // filtered by several fields. Currently it returns connections
 // filtered by source port and protocol.

daemon/opensnitch.spec

@@ -1,5 +1,5 @@
 Name:           opensnitch
-Version:        1.4.0
+Version:        1.5.0rc1
 Release:        1%{?dist}
 Summary:        OpenSnitch is a GNU/Linux application firewall
 

daemon/procmon/details.go

@@ -36,6 +36,15 @@ func (p *Process) setCwd(cwd string) {
 	p.CWD = cwd
 }
 
+func (p *Process) readComm() error {
+	data, err := ioutil.ReadFile(fmt.Sprintf("/proc/%d/comm", p.ID))
+	if err != nil {
+		return err
+	}
+	p.Comm = core.Trim(string(data))
+	return nil
+}
+
 func (p *Process) readCwd() error {
 	link, err := os.Readlink(fmt.Sprintf("/proc/%d/cwd", p.ID))
 	if err != nil {
@@ -74,6 +83,9 @@ func (p *Process) readPath() error {
 
 func (p *Process) readCmdline() {
 	if data, err := ioutil.ReadFile(fmt.Sprintf("/proc/%d/cmdline", p.ID)); err == nil {
+		if len(data) == 0 {
+			return
+		}
 		for i, b := range data {
 			if b == 0x00 {
 				data[i] = byte(' ')

daemon/procmon/parse.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"time"
 
+	"github.com/evilsocket/opensnitch/daemon/core"
 	"github.com/evilsocket/opensnitch/daemon/log"
 	"github.com/evilsocket/opensnitch/daemon/procmon/audit"
 )
@@ -86,9 +87,6 @@ func GetPIDFromINode(inode int, inodeKey string) int {
 // If it exists in /proc, a new Process{} object is returned with  the details
 // to identify a process (cmdline, name, environment variables, etc).
 func FindProcess(pid int, interceptUnknown bool) *Process {
-	if interceptUnknown && pid == -100 {
-		return NewProcess(-100, "Linux kernel")
-	}
 	if interceptUnknown && pid < 0 {
 		return NewProcess(0, "")
 	}
@@ -115,22 +113,32 @@ func FindProcess(pid int, interceptUnknown bool) *Process {
 			return proc
 		}
 	}
-
-	linkName := fmt.Sprint("/proc/", pid, "/exe")
-	if _, err := os.Lstat(linkName); err != nil {
+	// if the PID dir doesn't exist, the process may have exited or be a kernel connection
+	// XXX: can a kernel connection exist without an entry in ProcFS?
+	if core.Exists(fmt.Sprint("/proc/", pid)) == false {
+		log.Debug("PID can't be read /proc/", pid)
 		return nil
 	}
 
-	if link, err := os.Readlink(linkName); err == nil {
-		proc := NewProcess(pid, link)
-
-		proc.readCmdline()
-		proc.readCwd()
-		proc.readEnv()
-		proc.cleanPath()
+	linkName := fmt.Sprint("/proc/", pid, "/exe")
+	link, err := os.Readlink(linkName)
+	proc := NewProcess(pid, link)
+	proc.readCmdline()
+	proc.readCwd()
+	proc.readEnv()
+	proc.cleanPath()
+
+	if len(proc.Args) == 0 {
+		proc.readComm()
+		proc.Args = make([]string, 0)
+		proc.Args = append(proc.Args, proc.Comm)
+	}
 
-		addToActivePidsCache(uint64(pid), proc)
-		return proc
+	// If the link to the binary can't be read, the PID may be of a kernel task
+	if err != nil || proc.Path == "" {
+		proc.Path = "Kernel connection"
 	}
-	return nil
+
+	addToActivePidsCache(uint64(pid), proc)
+	return proc
 }