[Bug Report] Deadlock when asked to approve Kernel Connection for NFS with home directory

[petterreinholdtsen]

When using eBPF based OpenSnitch 1.6.8 (package from Debian), on a workstation with user home on a NFS server, the popup to approve the kernel NFS server connection seem to deadlock when approving the connection. I suspect the client try to write to the NFS volume before the kernel has been told to approve the connection. The popup stay up after I press 'Accept', and the only way to get further is to do a simple pkill -15 opensnitch-ui and restart the GUI using the desktop menu entry.

I could find nothing sensible in the logs. :(

[gustavo-iniguez-goya]

I'll try to reproduce this issue. Could you share the NFS config to be sure that I'm doing it correctly?

[petterreinholdtsen]

[Gustavo Iñiguez Goia]

I'll try to reproduce this issue. Could you share the NFS config to be sure that I'm doing it correctly?

I do not know much about the NFS setup. I believe it is using autofs with LDAP mappings and TCP based mounting to a SAN system, but do not really know the details.

…

-- Happy hacking Petter Reinholdtsen

[gustavo-iniguez-goya]

ok, did you reproduced this issue or was a bug report? I'll try to reproduce it anyway in a few days.

[petterreinholdtsen]

[Gustavo Iñiguez Goia]

ok, did you reproduced this issue or was a bug report? I'll try to reproduce it anyway in a few days.

I experienced the issue myself at work.

…

-- Happy hacking Petter Reinholdtsen

[gustavo-iniguez-goya]

woah, I've reproduced it with the v1.7.0. in my case it does not even show the popup and the desktop freezes until the daemon is stopped. I'll investigate it.

[gustavo-iniguez-goya]

ok, try adding a rule to allow connections to the NFS server:

~ # cat /etc/opensnitchd/rules/000-allow-nfs-home.json

{
  "created": "2023-02-11T23:48:49.990680711+01:00",
  "updated": "2023-02-11T23:48:49.990711427+01:00",
  "name": "000-allow-nfs-home",
  "description": "",
  "enabled": true,
  "precedence": true,
  "nolog": true,
  "action": "allow",
  "duration": "always",
  "operator": {
    "type": "simple",
    "operand": "dest.ip",
    "sensitive": false,
    "data": "192.168.1.100",
    "list": []
  }
}

If you have the latest change to not kill connections, set FlushConnsOnStart to false. Otherwise if you stop/start the daemon while the NFS connection is active it'll kill it.

In this scenario, if the daemon DefaultAction option is not allow, I think that it won't work. The NFS connection is not allowed, and the DE freezes.

[petterreinholdtsen]

[Gustavo Iñiguez Goia]

ok, try adding a rule to allow connections to the NFS server:

I've been able to avoid the deadlocks the last weekend after I added a rule interactively for the NFS host to allow any connection to any port. The rule history indicate that ports 4045 and 4048 have been used.

…

-- Happy hacking Petter Reinholdtsen

[petterreinholdtsen]

According to #1495 the issue is the call to self._cfg.setSettings("promptDialog/geometry", self.saveGeometry()) in _send_rule(), which make sense. It is unclear to me why this call is there in the first place.

[petterreinholdtsen]

The call to setSettings() was introduced in 166cf49 in 2019, as far as I can tell.

[petterreinholdtsen]

Perhaps a change similar to this is a less intrusive fix?

diff --git a/ui/opensnitch/dialogs/prompt/dialog.py b/ui/opensnitch/dialogs/prompt/dialog.py
index 35c3c392..bfed853b 100644
--- a/ui/opensnitch/dialogs/prompt/dialog.py
+++ b/ui/opensnitch/dialogs/prompt/dialog.py
@@ -581,7 +581,6 @@ class PromptDialog(QtWidgets.QDialog, uic.loadUiType(DIALOG_UI_PATH)[0]):
 
     def _send_rule(self):
         try:
-            self._cfg.setSettings("promptDialog/geometry", self.saveGeometry())
             self._rule = ui_pb2.Rule(name="user.choice")
             self._rule.created = int(datetime.now().timestamp())
             self._rule.enabled = True
@@ -689,4 +688,11 @@ class PromptDialog(QtWidgets.QDialog, uic.loadUiType(DIALOG_UI_PATH)[0]):
             # signal that the user took a decision and
             # a new rule is available
             self._done.set()
+
+            # Save geometry after passing the new rule to the
+            # daemon/kernel, to avoid deadlock when the saved file go
+            # to the NFS connection currently being approved (fixes
+            # #1334).
+            self._cfg.setSettings("promptDialog/geometry", self.saveGeometry())
+
             self.hide()

It move the geometry saving after the daemon is notified. The change is not tested.

[gustavo-iniguez-goya]

Can you post the steps to reproduce this issue?

I can't reproduce it now. The DefaultAction of the daemon is allow, so when the system boots up, the nfs share is already mounted.
If I change it to deny I cannot login with the user that has the nfs share as their home.