evilsocket / evilsocket/opensnitch

opensnitch's nft backend touches the iptables-nft table (cgproxy + v2ray)

Open
#885 10 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
When opensnitch's firewall backend is nft, the table used by nft for xt compatibility is changed, which causes applications using xt to behave abnormally......at least they don't work as expected due to missing xt rules.iptables will pass a prompt that nft should be used instead of the iptables management table.

Include the following information:
- OpenSnitch version: `1.5.8`
- OS: `ArchLinux`
- Version `N/A`
- Kernel version: `Linux arch 6.2.7-zen1-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Sat, 18 Mar 2023 01:06:38 +0000 x86_64 GNU/Linux`

**To Reproduce**

Steps to reproduce the behavior:
1. Set the Firewall to nftables in /etc/opensnitchd/default-config.json.
2. Run `systemctl enable --now opensnitsh`
3. Start GUI
4. iptables prompts for rules that should be managed using the nft utility when displaying the filter and mangle tables.

**Expected behavior (optional)**
opensnitch uses its own tables instead of the default five tables.

**Additional context**
I'm still trying to avoid xtables, but there are a lot of things that still rely on xt. some of the more well-known examples I can come up with include cni-plugins, docker, libvirt, k8s, and a lot of tools I don't recognize.
Adding chains unknown to xt to the default table may cause unpredictable behavior in tools that rely on xt.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with /etc/opensnitchd/default-config.json and reproduce the issue by selecting the nftables backend, starting opensnitchd, and inspecting the filter and mangle tables with iptables. Trace the nft backend entry point to identify where the default tables are changed; done means OpenSnitch uses its own tables without causing iptables-managed xt rules to be altered or prompting for nft management.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
networking, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.