mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

run tests on every change, fixed fw options

Browse source 
- Run unit tests on every push/pr.
- Silence gcc warnings, it doesn't seem to work and causes unit tests to
  fail:
  https://github.com/golang/go/issues/6883#issuecomment-383800123
- Improved firewall configuration contraints, to meet with this table:
  https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks#Hooks_by_family_and_chain_type
This commit is contained in:
Gustavo Iñiguez Goia 2022-05-18 17:47:39 +02:00
parent 5453a49692
commit 0ba5fc44c9
3 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.github/workflows/go.yml vendored
View file

@ -36,3 +36,7 @@ jobs:
run: |
cd daemon
go build -v .
- name: Test
run: |
cd daemon
go test ./...

4
daemon/firewall/nftables/utils.go
View file

@ -73,11 +73,11 @@ func getChainPriority(family, cType, hook string) (*nftables.ChainPriority, nfta
log.Warning("[nftables] invalid nat combination of tables and hooks. chain: %s, hook: %s", cType, hook)
return nil, chainType
}
if family == exprs.NFT_FAMILY_NETDEV && (cType != exprs.NFT_CHAIN_FILTER || (hook != exprs.NFT_HOOK_EGRESS || hook != exprs.NFT_HOOK_INGRESS)) {
if family == exprs.NFT_FAMILY_NETDEV && (cType != exprs.NFT_CHAIN_FILTER || hook != exprs.NFT_HOOK_INGRESS) {
log.Warning("[nftables] invalid netdev combination of tables and hooks. chain: %s, hook: %s", cType, hook)
return nil, chainType
}
if family == exprs.NFT_FAMILY_ARP && (cType != exprs.NFT_CHAIN_FILTER || (hook != exprs.NFT_HOOK_OUTPUT || hook != exprs.NFT_HOOK_INPUT)) {
if family == exprs.NFT_FAMILY_ARP && (cType != exprs.NFT_CHAIN_FILTER || (hook != exprs.NFT_HOOK_OUTPUT && hook != exprs.NFT_HOOK_INPUT)) {
log.Warning("[nftables] invalid arp combination of tables and hooks. chain: %s, hook: %s", cType, hook)
return nil, chainType
}

2
daemon/netfilter/queue.go
View file

@ -2,7 +2,7 @@ package netfilter
/*
#cgo pkg-config: libnetfilter_queue
#cgo CFLAGS: -Wall -I/usr/include
#cgo CFLAGS: -I/usr/include
#cgo LDFLAGS: -L/usr/lib64/ -ldl
#include "queue.h"