opensnitch

mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 00:24:40 +01:00

History

calesanz a4b7f57806 Add ebpf based dns lookup hooks (#582 ) When using DoT or DoH opensnitch cannot intercept the dns packets. Therefore the UI always shows IP addresses instead of hostnames. To fix this issue an ebpf (uprobe) filter was created to hook getaddrinfo and gethostbyname calls. In order to be independent of libbcc an additional module was added to ebpf_prog. Without libbcc the libc function offsets must be resolved manually. In order to find the loaded glibc version some cgo code was added.		2022-02-15 21:25:35 +01:00
..
arm-clang-asm-fix.patch	ebpf: added patch to compile ebpf module for arm	2021-04-21 20:49:31 +02:00
file.patch	Use ebpf program to find PID of new connections. (#397 )	2021-04-05 11:28:16 +02:00
Makefile	Add ebpf based dns lookup hooks (#582 )	2022-02-15 21:25:35 +01:00
opensnitch-dns.c	Add ebpf based dns lookup hooks (#582 )	2022-02-15 21:25:35 +01:00
opensnitch.c	Allow to intercept more kernel connections (#513 )	2021-09-23 01:44:12 +02:00
README	ebpf: updated dependencies list for compiling	2021-09-13 11:49:27 +02:00

README

opensnitch.c is an eBPF program. Compilation requires getting kernel source.

sudo apt install clang llvm libelf-dev libzip-dev flex bison libssl-dev bc rsync python3
cd opensnitch
wget https://github.com/torvalds/linux/archive/v5.8.tar.gz
tar -xf v5.8.tar.gz
patch linux-5.8/tools/lib/bpf/bpf_helpers.h < ebpf_prog/file.patch
cp ebpf_prog/opensnitch.c ebpf_prog/Makefile linux-5.8/samples/bpf
cd linux-5.8 && yes "" | make oldconfig && make prepare && make headers_install # (1 min)
cd samples/bpf && make
objdump -h opensnitch.o #you should see many section, number 1 should be called kprobe/tcp_v4_connect
llvm-strip -g opensnitch.o #remove debug info
sudo cp opensnitch.o /etc/opensnitchd/ 
cd ../../../daemon

--opensnitchd expects to find opensnitch.o in /etc/opensnitchd/
--start opensnitchd with:

opensnitchd -rules-path /etc/opensnitchd/rules -process-monitor-method ebpf

The kernel where you intend to run it must have some options activated:

$ grep BPF /boot/config-$(uname -r)
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_EVENTS=y
CONFIG_KPROBES=y
CONFIG_KPROBE_EVENTS=y