opensnitch

mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 00:24:40 +01:00

History

Gustavo Iñiguez Goia 0526b84309 Allow to intercept more kernel connections (#513 ) * Allow to intercept some kernel connections Some connections are initiated from kernel space, like WireGuard VPNs (#454), NFS or SMB connections (#502) and ip tunnels (#500). Note: This feature is complete for x86_64, WIP for aarch64, and not supported for armhf and i386 https://github.com/evilsocket/opensnitch/pull/513#issuecomment-924400824 More information regarding this change: #493		2021-09-23 01:44:12 +02:00
..
arm-clang-asm-fix.patch	ebpf: added patch to compile ebpf module for arm	2021-04-21 20:49:31 +02:00
file.patch	Use ebpf program to find PID of new connections. (#397 )	2021-04-05 11:28:16 +02:00
Makefile	Use ebpf program to find PID of new connections. (#397 )	2021-04-05 11:28:16 +02:00
opensnitch.c	Allow to intercept more kernel connections (#513 )	2021-09-23 01:44:12 +02:00
README	ebpf: updated dependencies list for compiling	2021-09-13 11:49:27 +02:00

README

opensnitch.c is an eBPF program. Compilation requires getting kernel source.

sudo apt install clang llvm libelf-dev libzip-dev flex bison libssl-dev bc rsync python3
cd opensnitch
wget https://github.com/torvalds/linux/archive/v5.8.tar.gz
tar -xf v5.8.tar.gz
patch linux-5.8/tools/lib/bpf/bpf_helpers.h < ebpf_prog/file.patch
cp ebpf_prog/opensnitch.c ebpf_prog/Makefile linux-5.8/samples/bpf
cd linux-5.8 && yes "" | make oldconfig && make prepare && make headers_install # (1 min)
cd samples/bpf && make
objdump -h opensnitch.o #you should see many section, number 1 should be called kprobe/tcp_v4_connect
llvm-strip -g opensnitch.o #remove debug info
sudo cp opensnitch.o /etc/opensnitchd/ 
cd ../../../daemon

--opensnitchd expects to find opensnitch.o in /etc/opensnitchd/
--start opensnitchd with:

opensnitchd -rules-path /etc/opensnitchd/rules -process-monitor-method ebpf

The kernel where you intend to run it must have some options activated:

$ grep BPF /boot/config-$(uname -r)
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_EVENTS=y
CONFIG_KPROBES=y
CONFIG_KPROBE_EVENTS=y