search

ukanth / afwall

AFWall+ (Android Firewall +) - iptables based firewall for Android
GNU General Public License v3.0
2.71k stars 446 forks source link

[ISSUE] IPv6 support missing in nflog utility #1232

Open pedro042 opened 2 years ago

pedro042 commented 2 years ago

Describe the bug nflog binary (probably) doesn't support IPv6. See line 179 in external/nflog/nflog.c Hardcoded IPv4 format. IPv6 netlink messages are interpreted as IPv4 messages.

Firewall Logs See investigation https://forum.xda-developers.com/t/5-0-root-3-5-2-afwall-iptables-firewall-16-may-2021.1957231/page-314#post-85484565 and messages bellow

Smartphone (please complete the following information):

Additional context Consider update the nflog utility

bsdice commented 2 years ago

Compare https://github.com/WireGuard/wg-dynamic/blob/master/lease.c#L432 for an example of switching between IPv4 and IPv6. Bit of a task to get log_cb() to parse IPv6 correctly.

Update: Reason why NFLOG works and LOG doesn't, on my phone, appears to be a kernel configuration issue. On my Pixel 5 with stock LineageOS 18.1 kernel LOG does not work. Later today I flashed the "Proton Kernel" from https://github.com/kdrag0n/proton_kernel_redbull/releases and LOG suddenly sprung to life. Its curator @kdrag0n really really knows what he is doing: https://github.com/kdrag0n/proton_kernel_redbull/commit/4b577a681411c86baca441aaa94e9f790c0e7f42

So solution here seems to be to find a better kernel. MiPa kernel on Xiaomi Mi is good, and this one for Pixel series. Or file a bug report with LineageOS developers.

Maybe Afwall could dig into /proc or sysctl and determine if LOG is available, and if not, warn user. Also warn that NFLOG is not IPv6 capable and will produce erroneous log entries with things like "protocol 128".

pedro042 commented 2 years ago

Interesting. But on my phone LOG target works. Example: 08-29 16:42:20.356 0 0 W : [20210829_16:42:20.355699]@1 {AFL}IN= OUT=tun1 SRC=192.168.90.202 DST=192.168.90.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=55779 DF PROTO=TCP SPT=47368 DPT=8118 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B40402080A3D84D7AA0000000001030309) UID=10218 GID=10218 MARK=0x1a6 but Afwall probably can't parse it. I use "stock" LOS kernel.

selurvedu commented 2 months ago

Is this fixed by #1375?