evilsocket / evilsocket/opensnitch

[Feature Request] regex lib update to allow negative lookaheads

Open
#1,311 1 comment 0 reactions 0 assignees View on GitHub
feature
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

### Summary:

The current Go-style regular expressions, based on [RE2 syntax](https://github.com/google/re2/wiki/Syntax), do not support lookaheads like (?!), not allowing for important use cases such as:

Detection and automatic creation of DENY outbound ip rules for later processing by scripts/ai to do research. (The event log could also be used for this but it is transient in nature and a more explicit and stateful approach is desired.)

My thoughts:

1. create one negative lookahead regex to ALLOW ALL trusted (with host name) dns queries: the ones NOT matching `^(?!.*-in-addr\.arpa$).*`
2. alerts should still be thrown when direct ip traffic is caught, resulting in automatic creation of these rules.
3. Now we have an explicit list of rules clearly showing the culprits, which can then be processed by a script to put the ips into a blacklist (I use this script like that now):

```py
#!/usr/bin/env python3
import os
import re

# Directory to scan
rules_dir = "/etc/opensnitchd/rules/"

# Output TXT file
output_txt = "/etc/opensnitchd/blacklists/outbound-ips.txt"

# Regex pattern to extract IP-like structure from filenames
ip_pattern = re.compile(
r"(\d{1,3})-(\d{1,3})-(\d{1,3})-(\d{1,3})-in-addr-arpa-53\.json$"
)

# List to store found IP addresses
ip_addresses = []

# Scan directory
for filename in os.listdir(rules_dir):
match = ip_pattern.search(filename)
if match:
# Convert dash-separated to dot-separated IP address
ip = ".".join(match.groups())
ip_addresses.append(ip)

# Write to TXT
with open(output_txt, mode="w") as txtfile:
for ip in ip_addresses:
txtfile.write(f"{ip}\n")

print(f"Extracted {len(ip_addresses)} IPs to {output_txt}")
```

And with this one rule those get blocked:

```json
{
"created": "2025-04-07T11:06:38+02:00",
"updated": "2025-04-07T11:06:39+02:00",
"name": "0-blacklist",
"description": "",
"action": "deny",
"duration": "always",
"operator": {
"operand": "lists.ips",
"data": "/etc/opensnitchd/blacklists",
"type": "lists",
"list": [],
"sensitive": false
},
"enabled": true,
"precedence": true,
"nolog": false
}
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.