v1.7.0

[gustavo-iniguez-goya]

New features

• Obtain and display process tree: 0556dc1 , be87bc5 , 01edd36

Connections filtering:

• Allow to filter connections by:
  • md5: 7a9bb17 ([Feature Request] Calculate a checksum for each whitelisted executable #413). Note: Not enabled by default. Configurable from the GUI and file configuration.
  • parent(s) path: 2509d21 (Does the program understand processes hierarchy ? #406). Note: Not configurable from the GUI yet.
  • username: ff3ac66 ([Feature Request] Introduce user.name operand #1236). Note: Not configurable from the GUI yet.
  • list of md5 checksums (ced8410). Note: Not configurable from the GUI yet.
• Lan access control by @nolancarougepro in Lan access control #1237

Scheduled tasks

• tasks: 9e0f3a4.
• tasks: added sockets monitor task (netstat / ss similar feature) (83fad69 , List of apps with open connections #1112).
• tasks: new task nodemonitor (5861354). WIP: the GUI part not totally finished yet.

Configuration

• Allow to configure default outbound policy: 7fd436a (Traffic not blocked if service not running #1183, [Bug] Not blocking internet access if opensnitch isn't running #884, Using opensnitch and nftables. #1201).
• Allow to configure rules directory (211c864, How to change the installation path of the binary and lib when building / compiling a package? #449).
• Allow to configure eBPF modules path (ffb7668).
• Allow to configure system firewall configuration file (bb95a77, 54ac5a3).
• Allow to configure internal options:
  • Golang GC percentage (dc43d59).
  • Flush connections on start (8e9c1d2).
  • Max Stats and events to keep in memory when the daemon is not connected to the GUI (server).
  • Interception queue number (efc0566).
  • nfqueue bypass flag (6622df9).
  • eBPF options (eede54c).
  • Interception rules monitoring interval (54ac5a3).
• New log level Trace (only configurable via default-config.json, LogLevel: -1)

GUI

• plugins (WIP) (2a233c1 , cba52cf)
  (functional, but not configurable from the GUI yet).

  • Highlight: colorize cells or rows based on patterns.
  • Downloader: a simple downloader which downloads files to local directories, for example to download blocklists.
  • Virustotal: a plugin to analyze IPs, domains and checksums with the API of virustotal when a new popup is fired.

• netstat view: List of apps with open connections #1112

What's Changed

GUI

• Added dark icons theme for qt-material (9009eef).
• Popups redesigned to add more context on the process and the connection.
• Improved popups layout (Long command line not visible even if resizing connection pop-up window #1274, 58cb954).
• Improved rows selection ([Bug Report] Dragging to select table rows loses selection when scrolling #1291 , fe73008, b113ed0, 0fbbbcc, f2eb3fa, 320ec18, 9d5d53d).
• New Czech, Hindi, Italian, Indonesian, Ukranian and Swedish translations.
• Introduce new 12 hour duration option. by @petterreinholdtsen in Introduce new 12 hour duration option. #1324

Configuration

• Apply configuration changes without restarting the daemon (bde5d34, 0b67c1a)

eBPF

• Replaced eBPF lib gobpf by Cilium (feafe87, Next steps (2025): migrating to cilium/ebpf, port to Qt6 #1222).
• Added support for IPv6 tunnels (56b2d28, Mullvad VPN cannot connect (IPv6) #1250).
• Better interception of some (UDP) connections (63a3b4e, Blocks Parsec STUN with zero logging #1246).
• Clean DNS ebpf hooks on exit (785500c).
• Performance improvement for opensnitch-procs (7442bec).
• Fixed DNS uprobes (1518cb3).

(eBPF on i386 is pretty much broken since v1.7.0.0).

Other changes

• Improved integration with 3rd party software (SIEM, loggers, ...) (64a698f).
• Remove duplicate regex in system.go for -check-requirements by @redanaheim in Remove duplicate regex in system.go for -check-requirements #1139
• ebpf_prog/Makefile: several improvements by @ariel-anieli (ebpf_prog/Makefile: removed useless LLVM_STRIP #1187, ebpf_prog/Makefile: temp files are now handled by a pattern rule #1185, Clear out warnings about unused variables #1229)
• Make example explanation consistent with regex - take Lot's of tracebacks #2 by @atriwidada in Make example explanation consistent with regex - take #2 #1209
• fix UI: deleting rules deletes the wrong rules #1245 UI rule deletion by @e3dio in fix #1245 UI rule deletion #1252
• ui: make sure 'service' variable is set by @staticssleever668 in ui: make sure 'service' variable is set #1255
• ui: dialogs: stats: optimize string format by @MEschenbacher in ui: dialogs: stats: optimize string format #1266
• Indonesian translation by @atriwidada in Add Indonesian translation #1195
• Fixed typo in translatable string (Your are->You are). by @petterreinholdtsen in Fixed typo in translatable string (Your are->You are). #1039
• fix(sec): upgrade golang.org/x/sys to 0.1.0 by @chncaption in fix(sec): upgrade golang.org/x/sys to 0.1.0 #992
• fix(sec): upgrade golang.org/x/net to 0.7.0 by @Huoxi-any in fix(sec): upgrade golang.org/x/net to 0.7.0 #1036
• i18n: updated Brazilian Portuguese translation by @tioguda in i18n: updated Brazilian Portuguese translation #1126
• Improve wording in Top menu by @ponychicken in Improve wording in Top menu #1135
• Remove duplicate regex in system.go for -check-requirements by @redanaheim in Remove duplicate regex in system.go for -check-requirements #1139
• ebpf_prog/Makefile: temp files are now handled by a pattern rule by @ariel-anieli in ebpf_prog/Makefile: temp files are now handled by a pattern rule #1185
• remove lagacy cname_trackers.txt reference from update_adlists.sh by @abuturabofficial in remove lagacy cname_trackers.txt reference from update_adlists.sh #1179
• ebpf_prog/Makefile: removed useless LLVM_STRIP by @ariel-anieli in ebpf_prog/Makefile: removed useless LLVM_STRIP #1187
• Add Indonesian translation by @atriwidada in Add Indonesian translation #1195
• Update README.md - Fix Discord link nesting by @C0rn3j in Update README.md - Fix Discord link nesting #1198
• Make example explanation consistent with regex - take Lot's of tracebacks #2 by @atriwidada in Make example explanation consistent with regex - take #2 #1209
• Clear out warnings about unused variables by @ariel-anieli in Clear out warnings about unused variables #1229
• fix UI: deleting rules deletes the wrong rules #1245 UI rule deletion by @e3dio in fix #1245 UI rule deletion #1252
• ui: make sure 'service' variable is set by @staticssleever668 in ui: make sure 'service' variable is set #1255
• direct link to sponsoring page by @jermanuts in direct link to sponsoring page #1265
• ui: dialogs: stats: optimize string format by @MEschenbacher in ui: dialogs: stats: optimize string format #1266
• Update bug_report.md by @NormPlum in Update bug_report.md #1282
• fix Weblate widget by @jermanuts in fix Weblate widget #1289
• Update Indonesian translation by @atriwidada in Update Indonesian translation #1298
• Update i18n ru_RU by @deenle in Update i18n ru_RU #1306
• feat: Add script to automatically update ipasn and asnames databases in feat: Add script to automatically update ipasn and asnames databases #1313
• ui,stats: handle dict-wrapped notifs in callback in ui,stats: handle dict-wrapped notifs in callback #1320
• Added ebpf build rule mapping for armv8l to work with more armhf machines. by @petterreinholdtsen in Added ebpf build rule mapping for armv8l to work with more armhf machines. #1326
• Changed how ebpf build find kernel headers from running to installed version. by @petterreinholdtsen in Changed how ebpf build find kernel headers from running to installed version. #1327
• refactor: Update localhost rules and add IPv6 in refactor: Update localhost rules and add IPv6 #1332
• feat: Add bash script to sync OpenSnitch ASN data in feat: Add bash script to sync OpenSnitch ASN data #1331
• Added ebpf build rule mapping for s390x to s390. by @petterreinholdtsen in Added ebpf build rule mapping for s390x to s390. #1333
• Added ebpf build rule mapping for loongarch64 to loongarch. by @petterreinholdtsen in Added ebpf build rule mapping for loongarch64 to loongarch. #1335
• Added ebpf build rule mapping for riscv64 to riscv. by @petterreinholdtsen in Added ebpf build rule mapping for riscv64 to riscv. #1336
• Add loongarch64 support by @Dandan336 in Add loongarch64 support #1339
• ui: remove unused imports by @ddogfoodd in ui: remove unused imports #1344

New Contributors

• @chncaption made their first contribution in fix(sec): upgrade golang.org/x/sys to 0.1.0 #992
• @Huoxi-any made their first contribution in fix(sec): upgrade golang.org/x/net to 0.7.0 #1036
• @ponychicken made their first contribution in Improve wording in Top menu #1135
• @redanaheim made their first contribution in Remove duplicate regex in system.go for -check-requirements #1139
• @ariel-anieli made their first contribution in ebpf_prog/Makefile: temp files are now handled by a pattern rule #1185
• @abuturabofficial made their first contribution in remove lagacy cname_trackers.txt reference from update_adlists.sh #1179
• @atriwidada made their first contribution in Add Indonesian translation #1195
• @C0rn3j made their first contribution in Update README.md - Fix Discord link nesting #1198
• @nolancarougepro made their first contribution in Lan access control #1237
• @e3dio made their first contribution in fix #1245 UI rule deletion #1252
• @jermanuts made their first contribution in direct link to sponsoring page #1265
• @MEschenbacher made their first contribution in ui: dialogs: stats: optimize string format #1266
• @NormPlum made their first contribution in Update bug_report.md #1282
• @deenle made their first contribution in Update i18n ru_RU #1306
• @Dandan336 made their first contribution in Add loongarch64 support #1339
• @ddogfoodd made their first contribution in ui: remove unused imports #1344

Full Changelog: v1.6.9...v1.7.0-rc.1

---

This discussion was created from the release v1.7.0-rc.1.

[gustavo-iniguez-goya]

Thanks everyone for reporting bugs, fixes and new features! I cannot stress enough how important reporting bugs and ideas is.

Some of the changes mentioned and not mentioned above:

Popups

• The popups have been redesigned to include more information about the process opening outbound connections:

This way we can keep adding more information as we need it (containers -> host, mount, namespaces, etc).

For now the popups can not be resized, but we'll make it possible.

GUI plugins

The GUI now has a way to modify the GUI behaviour via plugins. It's experimental, and the idea is to keep improving it.

There're 3 plugins: highlight, downloader and virustotal. It's still not possible to configure them from the GUI.

• Highlight: allows you to highlight rows based on patterns.

  • There're by default 4 actions defined in /usr/lib/python3/site-packages/opensnitch/actions/default_configs.py
  • These rules can be overwritten by creating a json file under $HOME/.config/opensnitch/actions/ (one per action defined in default_configs.py, commonActionsDelegate.json, rulesActionsDelegate.json, etc).

• Downloader: download remote files periodically (to update blocklists for example). This probably will be moved to the daemon, to make it independent of the GUI.

• Virustotal:

  • Analyze IPs, domains or hashes via the Virustotal API. It can be integrated easily with other services like *.abuse.ch services.
  • Right now it modifies the popups, to display the analysis results of new outbound connections, but it could be added to the Hosts and Adresses tabs, to passively analyze domains or IPs for example.

Main window

Nodes tab

The Nodes tab has a new right panel to monitor the state of the nodes (daemons). It's a WIP, we'll keep improving it, but the idea is to have a place where you can inspect the state of the nodes, to debug any possible problem (memory and cpu use, filesystem space, etc). Useful mainly when you have remote nodes connected.

It works only when you select a node.

Netstat view

• There's a new view to list the listening or opened sockets, like what you can see with ss or netstat. In general we'll try to dump the list from the kernel, and in some cases we'll rely on /proc/net/.

  • All the columns are clickable, to easily analyze what is what.

System firewall

• You can now configure the outbound policy of the system firewall (i.e.: regular nftables / iptables rules).

There were some requests to block outbound traffic if the daemon unexpectedly died. Now it's possible by enabling this option, or by enabling [x] Block outbound network traffic if the daemon unexpectedly dies from the Preferences -> Nodes tab -> Internal.

qt-material dark themes improvement

When using a dark qt-material theme, due to some icon themes design, our icons were practically invisible:

So when using one of the predefined dark qt-material theme, now we'll use our own icons (which are just the icons of the HighContrast icons theme):

[e3dio]

Good job thanks for updates, I made some notes that I saw:

1. The Netstat tab is very nice for active connections, with color-coded state, and sorting columns is nice feature. I think sorting by Port, UserID, and PID columns should sort numerically rather than by string, so numbers are sorted in correct order. Sorting by State seems to not group Listen together correctly, connections listening on SrcPort = 0 are grouped apart from non-zero port

2. The popups information is very helpful, would be nice to display this info by default without needing to click the small info button and only hide the "Environment variables" info, but if space is limited maybe this is not an option

3. Nodes tab side panel started minimized for me, even after clicking node, I had to find the bar and drag it open, then it stayed open including after restarting UI. Nice informative panel for each node, for RAM I think it should display "available" ram rather than "free" ram

[gustavo-iniguez-goya]

1. • Sorting by numbers is an old issue that needs to be fixed 📝
   • Regarding the Listen state issue, could you explain it to me like if I'm 5yo? O:) A screenshot would be helpful. There's some "magic" in some cases.

2. Yeah, unfortunately there's too much information to show. Allowing to resize the popups could be useful.
   The idea is to save this information to the DB, and allow to display it later in a new dialog, probably the ProcessDialog.

3. That was intentional. It still needs work.

Similar to that panel, I was thinking if it would be useful to have an Info panel for connections (events in general) in the Events tab.
Pressing SPACE to show or hide it, and as you keep selecting rows, display the information about the event interactively. Without having to right-click on a row and select Details.

Thanks for the feedback @e3dio !!

[e3dio]

A screenshot would be helpful. There's some "magic" in some cases

Above shows rows sorted by State column, it groups LISTEN on port 0 as above Established which is above LISTEN on non-zero port, so the LISTEN rows are separated when they are supposed to be together, because it's sorted by State

[e3dio]

Or I guess the better question is why is it showing listening on port 0, it should show some non-zero port

[gustavo-iniguez-goya]

aah I see. The problem is that the states are ordered by State constants instead of alphabetically: https://github.com/vishvananda/netlink/blob/0e7078ed04c84cea47daea45be061544e565ec49/tcp.go#L4

Regarding the port 0, that's because some sockets don't open a port really, so the default value is 0. For example when sockets are opened to "listen" to network packets (AF_PACKET family), netlink sockets or unix sockets.

ss dumps the sockes in a similar manner:

netlink (sometimes local address == 0, port ==0):

~ # ss -A netlink -pnl|grep ":0"
State  Recv-Q Send-Q Local Address:Port        Peer Address:PortProcess                                                            
UNCONN 0      0                  0:0                       *           
UNCONN 896    0                  4:0                       * 

AF_PACKET sockets show address and port as *, which means "any":

~ # ss -A packet -pnl
Netid State  Recv-Q Send-Q Local Address:Port   Peer Address:PortProcess                                      
p_raw UNCONN 0      0                  *:wlp3s0             *     users:(("arpalert",pid=3130148,fd=4))       
p_dgr UNCONN 0      0            [35085]:wlp3s0             *     users:(("wpa_supplicant",pid=1256,fd=13))

The ss manual explains how they interpret it: https://man.archlinux.org/man/ss.8#HOST_SYNTAX

We could simply not show the 0 value for certain protocols and families combinations, or leave it as it's now. In any case, I think we should document it because there'll be doubts in the future for sure.

[gustavo-iniguez-goya]

Second Prerelease https://github.com/evilsocket/opensnitch/releases/tag/v1.7.0-rc.2

I'll continue working on improving the GUI, trying to fix the issues you @e3dio and @tredondo have reported. At least for now. When porting the GUI to PyQt6 it'll be worth try to rewrite it.

And it's about time to migrate to Cilium (#1222).