There are still unidentified/wrongly identified processes, when using ebpf

[planetoryd]

title

[gustavo-iniguez-goya]

hey @planetoryd , I'll need a little bit more information to analyze this problem.

• Provide debug logs (Preferences -> Nodes) when you reproduce this issue.
• Do you usually suspend your computer?
• Do you have any containerized application? like something running under docker.
• Post the connection details of the unidentified process (src port + src ip + dst ip + dst port + uid). Do you have any idea of what one can be? (transmission downloader maybe?)
• Is the process "unidentified" OR "wrongly identified"? It's not the same, 2 different problems.

Also take a look at this issue where we've been analyzing a similar case: #834

[planetoryd]

1. The log file is only 127 lines long. Do I need to enable verbose mode somewhere.
2. I don't. I don't even have a swap file.
3. I create a few NetNSes for daily use. Some applications run under firejail. Some are run by flatpak. I have apparmor
4. For privacy I don't want to post it publicly. It's some really random domains with REDACTED FOR PRIVACY shown in whois page. It looks like a CDN domain, like abc-cd-ef-3.efg.io, with port 80, and 443. My guess is that it could be the domain fronting censor-resistant bootstrapping process of my VPN. I don't enable its TUN however, so it only provides a socks proxy, and shouldn't do anything fancy. Sometimes it's really random IPs. I have qbittorrent, lokinet, i2p clients running.
5. Both. Sometimes it's unknown. Sometimes it's wrong.

Also, it's confusing to show DNS requests as example.com -> 53. What if I am actually connecting to example.com:53, no way to distinguish them

[gustavo-iniguez-goya]

By the way. what opensnitch are you using?

I create a few NetNSes for daily use. Some applications run under firejail. Some are run by flatpak. I have apparmor

You'll probably need to intercept forwarded packets.

If you are using v1.5.x + iptables (/etc/opensnitch/default-config.json -> Firewall: iptables):
https://github.com/evilsocket/opensnitch/wiki/System-rules-legacy#intercepting-connections-from-containers

If your opensnitch is using nftables, enable this rule in your /etc/opensnitchd/system-fw.json (it should exist, otherwise just copy the rule from this .json):

opensnitch/daemon/system-fw.json

Lines 237 to 240 in 57739cc

	"UUID": "7d7394e1-100d-4b87-a90a-cd68c46edb0b",
	"Enabled": false,
	"Position": "0",
	"Description": "Intercept forwarded connections (docker, etc)",

If you're using latest sources from git, you can enable/add it from the GUI:

Also, it's confusing to show DNS requests as example.com -> 53. What if I am actually connecting to example.com:53, no way to distinguish them

Agree 100%. But many other people didn't agree, so we changed it: gustavo-iniguez-goya#6

[planetoryd]

I don't have the sacred knowledge of linux network system administration, so I'd avoid touching iptables/nftables for the moment (unlikely that I will configure it 100% correct). Can I / Maybe I should just skip the netns part, ignore them and only monitor the default namespace.

Package: opensnitch
Version: 1.5.8-2
Built-Using: golang-1.20 (= 1.20.1-1), golang-fsnotify (= 1.6.0-2), golang-github-golang-protobuf-1-3 (= 1.3.5-4), golang-github-google-nftables (= 0.1.0-3), golang-github-iovisor-gobpf (= 0.2.0-5), golang-github-josharian-native (= 1.1.0-1), golang-github-mdlayher-netlink (= 1.7.1-1), golang-github-mdlayher-socket (= 0.4.0-1), golang-github-vishvananda-netlink (= 1.1.0.125.gf243826-4), golang-github-vishvananda-netns (= 0.0~git20211101.5004558-1), golang-golang-x-net (= 1:0.7.0+dfsg-1), golang-golang-x-sync (= 0.1.0-1), golang-golang-x-sys (= 0.3.0-1), golang-golang-x-text (= 0.5.0-1), golang-google-genproto (= 0.0~git20200413.b5235f6-3), golang-google-grpc (= 1.33.3-2), gopacket (= 1.1.19-3)
Priority: optional
Section: universe/net
Origin: Ubuntu
Maintainer: Ubuntu Developers <[email protected]>
Original-Maintainer: Debian Go Packaging Team <[email protected]>
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Installed-Size: 10.3 MB
Depends: libc6 (>= 2.34), libnetfilter-queue1 (>= 1.0.3), libnfnetlink0 (>= 1.0.2)
Recommends: python3-opensnitch-ui
Homepage: https://github.com/evilsocket/opensnitch
Download-Size: 3,390 kB
APT-Manual-Installed: yes

or, do you mean this is related to the unidentified connections.

the NetNSes have a pair of veths, and a small utility creates TUN inside each of them, connecting to the veth on the host.

I will try the latest build.

But many other people didn't agree

Downvote casted

I wouldn't be surprised if my VPN is resolving DNS through some random servers on random domains too.

and

my script for setting up NetNSes. https://github.com/planetoryd/netns-proxy

[gustavo-iniguez-goya]

Don't worry about iptables/nftables, it's only that opensnitch uses either one or the other.

Add this rule to your /etc/opensnitchd/system-fw.json: https://github.com/evilsocket/opensnitch/wiki/System-rules-legacy#intercepting-connections-from-containers

For example:

{
    "SystemRules": [
        {
            "Rule": {
                "Description": "Allow icmp",
                "Table": "mangle",
                "Chain": "OUTPUT",
                "Parameters": "-p icmp",
                "Target": "ACCEPT",
                "TargetParameters": ""
            }
        },
        {
            "Rule": {
                "Enabled": true,
                "Description": "",
                "Table": "mangle",
                "Chain": "FORWARD",
                "Parameters": "-m conntrack --ctstate NEW",
                "Target": "NFQUEUE",
                "TargetParameters": "--queue-num 0 --queue-bypass"
            }
        }
    ]
}

By the way, it looks like you installed opensnitch from the ubuntu repos, correct? I guess you didn't downloaded the eBPF modules, right?
If you didn't, download them now and copy the *.o files to /etc/opensnitchd/ :

(the modules are automatically compiled)
https://github.com/evilsocket/opensnitch/actions/runs/5790107082

Once copied, verify that Process monitor method is set to ebpf in Preferences -> Nodes

[TriMoon]

@gustavo-iniguez-goya the link you provided to the eBPF modules points to this thread (same as this reply)...

Maybe you meant: https://github.com/evilsocket/opensnitch/wiki/monitor-method-ebpf 🤔

[gustavo-iniguez-goya]

it seems that the link to download the modules has expired. The latest modules are avilable here: https://github.com/evilsocket/opensnitch/actions/runs/5790107082