Connections from binaries

[anpic]

Are you planning to add connection blocking for system binaries for example such as ping or curl?
It works in firewalls like that PCAPdroid and NoRoot Firewall. There is a block even if you run binaries under the root.

[ignoramous]

I don't understand what you mean by "binaries"? Are they installed as apps in Android? Or installed from within tmux or side-loaded to /usr/bin etc on a rooted device?

[anpic]

I don't understand what you mean by "binaries"?

For example /system/bin/ping

[ignoramous]

unless binaries have their own UID (user id), Rethink can't do much. But otherwise, all new UIDs that Rethink "sees" will appear in "Apps" list.

You can enable Block newly installed apps by default to make sure these new UIDs get blocked unless explicitly allowed.

[anpic]

unless binaries have their own UID (user id), Rethink can't do much

But PCAPdroid with exactly the same capabilities does it ;)
In the no root mode

But otherwise, all new UIDs that Rethink "sees" will appear in "Apps" list.

This can be done by firewalls that generally do without permission to access the Internet ;)

[ignoramous]

But PCAPdroid with exactly the same capabilities does it

I don't use pcapdroid or familiar with its code, so I can't say just what it is doing. If pcapdroid developer has any information on this, I'll gladly review and see if we can implement it pronto.

This can be done by firewalls that generally do without permission to access the Internet

I don't understand how this is related to what we are discussing? Rethink is not really a firewall in the traditional sense. Technically, one can say it is but a Network Monitor with Firewall-like capabilities.

[anpic]

I'll gladly review and see if we can implement it pronto

https://emanuele-f.github.io/PCAPdroid/

Technically, one can say it is but a Network Monitor with Firewall-like capabilities.

Oh, that's how it's :)

DNS over HTTPS / DNS over Tor / DNSCrypt client, WireGuard proxifier, firewall, and connection tracker for Android.
Rethink DNS + Firewall + VPN for Android
https://rethinkfirewall.com/
Features Android Firewall Prevent apps from connecting to the Internet

Then you need to fix everything: Firewall --> Firewall-like capabilities ;)

[anpic]

For a technical discussion, I need to be talking to folks who are technical enough. From your responses, it doesn't look like you are; but I may be wrong.

Okay, let's try it ;)

Can you share a screen recording of any app that does this.

https://user-images.githubusercontent.com/5488003/233846260-64ffd9c7-fbb7-4c25-93df-e463c0b18f76.png
You know what NETD is, right?
And there are also items with the word Unknown ;)

You can't "completely" block anything with Rethink

You should have said that right away :)
But then it would be nice to stop promoting with the word Firewall ;)
It looks like you weren't originally going to make a firewall. But how else to lure users?

Because you use the app, and claim it has this functionality. I am merely asking for pointers.

It seemed to me easy to take and read the documentation for PCAPdroid:

When running in non-root mode, PCAPdroid alters the network traffic, which is a required step in order to capture it via the VPNService. The modifications only affect the L3 and L4 layers of the packets, whereas the L7 data is untouched.

For a high-level overview

The question was about something completely different.
Do you understand the problems specifically created at Android API level?
Do you understand the limitations that your favorite company creates for those who are trying to make a full-fledged firewall?

I know from the workings of the AOSP code. For some (non-exhaustive) pointers on this, see #224

This is a good issue. And there are references to NetGuard.
And if you wanted to create a firewall then you would undoubtedly get acquainted with the masterpiece that was created in NetGuard. The worthy heir of which was PCAPdroid.
Or will you also say that @M66B

is ignorant of how Android works

?
Marcel Bokhorst is one of the greatest android developers of our time. And he was the first to prove that tracking almost all of outgoing traffic is possible even in a non root mode.

In practice handling TCP and UDP traffic appears to be sufficient for 99,9% of the NetGuard users.

Which is even more true for PCAPdroid in which the developer has gone even further.
But of course, in order to do this, he had to surpass even Marcel in these competencies.

[ignoramous]

You know what NETD is, right?

These are part of some 7 hardcoded names in pcapdroid (ref). Rethink uses names for some 100+ such components (not just 7) as defined in AOSP (ref). These are shown only when any of these components try to establish a connection. These are not "binaries".

And there are also items with the word Unknown ;)

You'd see Unknown with Rethink, too; these aren't binaries. This is a result of the Android OS losing account of the real owner of a given outgoing connection. This is one reason why Rethink has a Block when source app is unknown setting.

But then it would be nice to stop promoting with the word Firewall ;)

Like I said, there are many types of firewall. Rethink is specifically a userspace stateful Firewall (just like NetGuard and TrackerControl). The kind of firewall you're thinking about (what I call a 'traditional firewall' in the readme linked to above) isn't possible on Android without root (use AfWall+).

But of course, in order to do this, he had to surpass even Marcel in these competencies.

Sure.

[anpic]

These are part of some 7 hardcoded names in pcapdroid (ref). Rethink uses names for some 100+ such components (not just 7) as defined in AOSP (ref). These are shown only when any of these components try to establish a connection.

But let's look at this point first.
How do you filter applications by all these uids?
After all, you said yourself above that you respect Android API.
But standard VpnService doesn't allow to filter by uid.

These are not "binaries"

Of course uids and binaries are generally different things but with intersections. After all, the binary still uses an existing uid to access the network.
But this discussion here has long gone beyond binaries :)

Sure.

You had the opposite opinion above. But come on, let's get to the point.

[ignoramous]

How do you filter applications by all these uids?

As of today, these system components don't show up in the UI unless there's at least one outgoing connection from them. If you enable Block newly installed apps by default then these uid would get blocked the minute they show up. We'll consider pre-loading some of these UIDs upfront and show it in the "All Apps" UI: #1167

But standard VpnService doesn't allow to filter by uid.

You're hearing things no one has said.

But this discussion here has long gone beyond binaries :)

Please start a different discussion (or open an issue, if there's one). I'm closing this one in favour of #1167.

[anpic]

As of today, these system components don't show up in the UI unless there's at least one outgoing connection from them

You haven't answered the main question: how do you actually filter connections by UIDs?
With technical details as it is done in docs of PCAPdroid.
If you can't answer it yourself then at least give a link to the code.

You're hearing things no one has said.

Because you don't want to discuss the technical details. And there is no technical documentation as a starting point. And now you are trying to hide this discussion as far as possible from the public issues.
But this is your business, of course.

[ignoramous]

You haven't answered the main question: how do you actually filter connections by UIDs?

You keep asking the same questions that have been answered already. The specifics of how this is done is mentioned in the README with links to code.

Because you don't want to discuss the technical details.

I have.

[retroluv]

Hi, user 'anpic' seems to be trolling different no-root firewall projects.