Use the timestamp instead of the event object when iterating over the last events. ~15x speed increase.
Increase event buffer to 100. On my machine I routinely hit the ceiling of 50 events under some multitasking workloads. Small buffer results in connection attempts not being logged.
Fix Makefile to rebuild when ui.proto changes
The major steps are:
- take advantage of sqlite's default autoincremented rowid column
- add index of the db columns
- when a filter is applied, we build a map of rowids corresponding to the filter
- when user scrolls the view, query the db only for that portion of db which contains the rows to be displayed
- because sqlite cannot use an index when a wildcard is at the start of the LIKE expression, e.g. "process LIKE '%sbin%'", use a workaround:
- keep track of all distinct values in each column
- check in python if any of the distinct values contain the filter string
- reconstruct the query string: instead of "process LIKE '%sbin%'" we use "process IN (<list of distinct values containing 'sbin'>)"
Minor steps:
- mimic some QSqlQueryModel's methods so that our model can be a drop-in replacement
- disable view's default scrollbar and use our own scrollbar which is aware of how many rows are in the db
A common api/lib that other tools can use in order to commnicate with
nodes: a GUI, a TUI, a proxy that sends stats to a remote DB, etc...
In future versions we may add it back.
- Rules are checked in alphabetical order.
- Deny and Priority rules must take precedence.
- If a rule matches and it's Allow-NoPriority, then return the rule.
- Otherwise we'll return nil.
- Fixed 100% CPU spike when pausing interception from the GUI
gustavo-iniguez-goya/opensnitch/issues/104
- Fixed monitoring fw rules after re-enabling interception.
- Fixed cleaning up interception and system rules.
- Fixed network rules types.
- Fixed typo when resetting expanded view.
- Limit rule name length. It was causing errors saving the file to disk
it it was too long.
- Allow to filter connections by destination network. closes#89
- Do not send a rule if the operator data is empty.
- Fixed displaying the path of a process, if it's not in the command
line, e.g.:
binary: /usr/bin/curl
cmdline: curl -L github.com
Now you can filter by destination network, for example:
- 127.0.0.1/8
- 192.168.1.0/24
This will ease to solve the request #89 .
Some common network ranges have also been added so you can select them
from a combo box. More info #73.
Added process.id operator operand for future use, in order to filter by
PID.
python3-slugify is not available in all rpm based distributions.
Adding it as weak dependency will install it if the package is
available, thus avoiding to install it using pip.
The path and arguments of a process were not displayed correctly.
closes#93
On the other hand, the combo box option (allow/deny) "from this process"
was misleading. Changed by "from this executable". #94
We were checking several times if a packet was IPv6.
Additionally we were itereating over all the layers of the packet, when
in reality we're only interested in network layer and transport layer.
This change brings down packets parsing from ~200µs to ~2µs.
