How to use plugins?

[kuvaldini]

.

[gustavo-iniguez-goya]

See this descrption for some info:

opensnitch/ui/opensnitch/actions/__init__.py

Line 21 in 8bc2698

"""List of actions to perform on the data that is displayed on the GUI,

For example, in order to colorize rows or cells based on patterns, drop this file to $HOME/.config/opensnitch/actions/common-delegate.json:

common-delegate.json

{
  "name": "commonDelegateConfig",
  "created": "",
  "updated": "",
  "description": "customize Events tab view colors. Name of this action MUST be commonDelegateConfig for now",
  "actions": {
    "Highlight": {
      "enabled": true,
      "cells": [
        {
          "text": [
            "allow",
            "✓ online",
            "LISTEN"
          ],
          "cols": [1, 2, 3],
          "color": "green",
          "bgcolor": "",
          "alignment": [
            "center"
          ]
        },
        {
          "text": [
            "deny",
            "☓ offline"
          ],
          "cols": [1, 2, 3],
          "color": "red",
          "bgcolor": "",
          "alignment": [
            "center"
          ]
        },
        {
          "text": [
            "reject"
          ],
          "cols": [1, 2, 3],
          "color": "purple",
          "bgcolor": "",
          "alignment": [
            "center"
          ]
        }
      ],
      "rows": [
        {
          "text": [
            "53"
          ],
          "cols": [7],
          "color": "black",
          "bgcolor": "yellow",
          "alignment": []
        },
        {
          "text": [
            "443"
          ],
          "cols": [7],
          "color": "white",
          "bgcolor": "darkRed",
          "alignment": []
        }
      ]
    }
  }
}

The Highlight plugin is a bit special, because it's used internally. All the views use the commonDelegateConfig, except rules and netstat that use defaultRulesDelegateConfig, defaultFWDelegateConfig and netstatDelegateConfig. If you create another .json under actions/ using these names in the "name": "" field, they'll be overriden.

Config example to configure the versionchecker plugin (replace "seconds" by minutes or hours):

versionchecker.json

{
  "name": "versionchecker",
  "created": "",
  "updated": "",
  "description": "Checks the latest version published on github",
  "type": ["global"],
  "actions": {
      "versionchecker": {
          "enabled": true,
          "config": {
              "check_on_start": true,
              "name": "check-latest-release",
              "interval": "12",
              "units": "seconds",
              "url": "https://api.github.com/repos/evilsocket/opensnitch/releases"
          }
      }
  }
}

Configuration for the virustotal plugin:

virustotal.json

{
  "name": "virustotal",
  "created": "",
  "updated": "",
  "description": "analyze connections properties with virustotal",
  "type": ["popups", "proc-dialog", "main-dialog"],
  "actions": {
      "virustotal": {
          "enabled": true,
          "config": {
              "loglevel": "debug",
              "api_timeout": 2,
              "api_quota": 500,
              "api_key": "get your api key: https://virustotal.readme.io/docs/please-give-me-an-api-key",
              "api_domains_url": "https://www.virustotal.com/api/v3/domains/",
              "api_ips_url": "https://www.virustotal.com/api/v3/ip_addresses/",
              "api_files_url": "https://www.virustotal.com/api/v3/files/"
          },
          "widgets-color": {
              "malicious": "color: blue",
              "benign": "color: green",
              "unknown": "color: orange"
          },
          "if-malicious": "reject",
          "check": ["ips", "domains", "hashes"],
          "exclusions": {
              "ips": ["127.", "192.168."]
          }
      }
  }
}

I don't know when, but the idea is to let users configure the plugins from the GUI. Now that the dialogs have been refactorized, it should be easier to keep expanding it with more features.

Remember that this is in development and there will be obvious bugs. Issues and PRs are welcome :)

[kuvaldini]

"ips": ["127.", "192.168."] are they regexp.match() or just contains()

it is worth to type "^127." and "^192.168." , isn't it?
if contains() 127. will match 9.127.1.55 and others so with 155.192.168.xx

[kuvaldini]

the idea is to let users configure the plugins from the GUI YEP

[kuvaldini]

So, Plugins GUI is TODO? as stated here
https://github.com/evilsocket/opensnitch/blob/8bc2698d157700adb2c7e83182574cd700df8e0a/ui/opensnitch/plugins/downloader/_gui.py

@gustavo-iniguez-goya Thank you for the effort and responses to my questions! 🩶

[gustavo-iniguez-goya]

yeah, it's pretty much in an early stage. The Virustotal plugin works quite well, at least on the pop-ups. The Highlight plugin also works fine, but the idea is to let users configure it from the GUI to colorize data according to their needs. So there's still a lot of work to be done.

The GUI downloader plugin in particular may be suitable for some tasks (updating the db of network names that may be displayed on the Address tab), but not on others like updating the lists of ads/malware/etc. The problem is that the daemon may not run on the same machine than the GUI.