evilsocket / evilsocket/opensnitch
opensnitch's nft backend touches the iptables-nft table (cgproxy + v2ray)
- Dominant language
- Python
- Stars
- 14.1k
- Forks
- 665
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
When opensnitch's firewall backend is nft, the table used by nft for xt compatibility is changed, which causes applications using xt to behave abnormally......at least they don't work as expected due to missing xt rules.iptables will pass a prompt that nft should be used instead of the iptables management table.
Include the following information:
- OpenSnitch version: `1.5.8`
- OS: `ArchLinux`
- Version `N/A`
- Kernel version: `Linux arch 6.2.7-zen1-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Sat, 18 Mar 2023 01:06:38 +0000 x86_64 GNU/Linux`
**To Reproduce**
Steps to reproduce the behavior:
1. Set the Firewall to nftables in /etc/opensnitchd/default-config.json.
2. Run `systemctl enable --now opensnitsh`
3. Start GUI
4. iptables prompts for rules that should be managed using the nft utility when displaying the filter and mangle tables.
**Expected behavior (optional)**
opensnitch uses its own tables instead of the default five tables.
**Additional context**
I'm still trying to avoid xtables, but there are a lot of things that still rely on xt. some of the more well-known examples I can come up with include cni-plugins, docker, libvirt, k8s, and a lot of tools I don't recognize.
Adding chains unknown to xt to the default table may cause unpredictable behavior in tools that rely on xt.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with /etc/opensnitchd/default-config.json and reproduce the issue by selecting the nftables backend, starting opensnitchd, and inspecting the filter and mangle tables with iptables. Trace the nft backend entry point to identify where the default tables are changed; done means OpenSnitch uses its own tables without causing iptables-managed xt rules to be altered or prompting for nft management.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- networking, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100