search

evilsocket / opensnitch

OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
GNU General Public License v3.0
10.91k stars 509 forks source link

UI prompts stop appearing after an hour or so (may be related to "Could not find process id") #248

Closed Ryujinra closed 3 years ago

Ryujinra commented 5 years ago

Opensnitch-ui/opensnitchd work as expected after starting the service or after a reboot. However, after an indeterminate amount of time I stop receiving UI prompts for unauthorized connections.

I included logs from issuing the command wget google.com before and after it stops working. The difference seems to be that at some point opensnitchd fails to find the process id of wget or any other software requesting a connection (may be related to #171). This is strange because it appears to work normally at first, but loses that ability after some time has passed.

Daemon '-debug' log on start:

[2019-02-24 00:48:07]  IMP  Starting opensnitch-daemon v1.0.0b
[2019-02-24 00:48:07]  INF  Loading rules from /etc/opensnitchd/rules ...
[2019-02-24 00:48:07]  DBG  Starting 16 workers ...
[2019-02-24 00:48:07]  DBG  Worker #4 started.
[2019-02-24 00:48:07]  DBG  Rules watcher started on path /etc/opensnitchd/rules ...
[2019-02-24 00:48:07]  DBG  Worker #11 started.
[2019-02-24 00:48:07]  DBG  Worker #1 started.
[2019-02-24 00:48:07]  DBG  Worker #2 started.
[2019-02-24 00:48:07]  DBG  Worker #3 started.
[2019-02-24 00:48:07]  DBG  Stats worker #3 started.
[2019-02-24 00:48:07]  DBG  Worker #10 started.
[2019-02-24 00:48:07]  DBG  Stats worker #1 started.
[2019-02-24 00:48:07]  DBG  Worker #5 started.
[2019-02-24 00:48:07]  DBG  Stats worker #2 started.
[2019-02-24 00:48:07]  DBG  Worker #13 started.
[2019-02-24 00:48:07]  DBG  Worker #6 started.
[2019-02-24 00:48:07]  DBG  Worker #8 started.
[2019-02-24 00:48:07]  DBG  Worker #0 started.
[2019-02-24 00:48:07]  DBG  Worker #9 started.
[2019-02-24 00:48:07]  DBG  Worker #7 started.
[2019-02-24 00:48:07]  DBG  Worker #14 started.
[2019-02-24 00:48:07]  DBG  Worker #12 started.
[2019-02-24 00:48:07]  DBG  Worker #15 started.
[2019-02-24 00:48:07]  DBG  Stats worker #0 started.
[2019-02-24 00:48:07]  INF  Running on netfilter queue #0 ...
[2019-02-24 00:48:07]  DBG  UI service poller started for socket /tmp/osui.sock
[2019-02-24 00:48:08]  INF  Connected to the UI service on /tmp/osui.sock

Daemon systemctl log:

systemd[1]: Starting OpenSnitch is a GNU/Linux port of the Little Snitch application firewall....
systemd[1]: Started OpenSnitch is a GNU/Linux port of the Little Snitch application firewall..

cat /var/log/opensnitchd.log (when prompts appear normally; snippet after 'wget google.com'):

[2019-02-24 00:49:50]  DBG  ✔ /usr/bin/wget -> {DNSIP}:53 (allow-simple-usrbinwget)
[2019-02-24 00:50:09]  DBG  ✔ /usr/bin/wget -> {DNSIP}:53 (allow-simple-usrbinwget)
[2019-02-24 00:50:09]  DBG  New DNS record: 172.217.12.142 -> google.com
[2019-02-24 00:50:09]  DBG  New DNS record: 172.217.12.142 -> google.com
[2019-02-24 00:50:09]  DBG  New DNS record: 2607:f8b0:4006:819::200e -> google.com
[2019-02-24 00:50:09]  DBG  Could not find netstat entry for: {LOCALIP} ->(udp)-> {DNSIP}:53
[2019-02-24 00:50:09]  DBG  Could not find netstat entry for: {LOCALIP} ->(udp)-> {DNSIP}:53
[2019-02-24 00:50:09]  DBG  Could not find netstat entry for: {LOCALIP} ->(udp)-> {DNSIP}:53
[2019-02-24 00:50:09]  DBG  Could not find netstat entry for: {LOCALIP} ->(udp)-> {DNSIP}:53
[2019-02-24 00:50:09]  DBG  New DNS record: 2607:f8b0:4006:819::200e -> google.com

cat /var/log/opensnitchd.log (after the prompts stop appearing; snipper after 'wget google.com'):

[2019-02-24 00:47:01]  DBG  Could not find process id for: {LOCALIP} (uid:1000) ->(udp)-> {DNSIP}:53
[2019-02-24 00:47:01]  DBG  Could not find process id for: {LOCALIP} (uid:1000) ->(udp)-> {DNSIP}:53
[2019-02-24 00:47:01]  DBG  New DNS record: 2607:f8b0:4006:819::200e -> google.com
[2019-02-24 00:47:01]  DBG  New DNS record: 172.217.12.142 -> google.com
[2019-02-24 00:47:01]  DBG  Could not find process id for: {LOCALIP} (uid:1000) ->(tcp)-> google.com:80

I substituted the local IP and DNS server but everything else is the same.

Appreciate any help.

gustavo-iniguez-goya commented 3 years ago

Try latest packages, this should be fixed. https://github.com/evilsocket/opensnitch/releases