rule without executable?

[Golddouble]

Hello

My version: 1.5.8

I have this rule:

{
  "created": "2022-04-22T14:49:21.323352067+02:00",
  "updated": "2022-04-22T14:49:21.323455581+02:00",
  "name": "allow-always-list-usr-lib-thunderbird-thunderbird-bin-1000",
  "enabled": true,
  "precedence": false,
  "action": "allow",
  "duration": "always",
  "operator": {
    "type": "list",
    "operand": "list",
    "sensitive": false,
    "data": "[{\"type\": \"simple\", \"operand\": \"user.id\", \"data\": \"1000\"}, {\"type\": \"simple\", \"operand\": \"process.path\", \"data\": \"/usr/lib/thunderbird/thunderbird-bin\"}]",
    "list": [
      {
        "type": "simple",
        "operand": "user.id",
        "sensitive": false,
        "data": "1000",
        "list": null
      },
      {
        "type": "simple",
        "operand": "process.path",
        "sensitive": false,
        "data": "/usr/lib/thunderbird/thunderbird-bin",
        "list": null
      }
    ]
  }
}

All went as it should. But strange, since some weeks OSn asks me to allow the following rule:

AND

Question: Why is the field "from this executable" empty? Mustn't it be a programme that does trigger this window? If yes, which programme could this be in this case?
(What would no longer work, if I would not allow this rule? (I mean not the first of this post, but the others.))

Thank you.

[gustavo-iniguez-goya]

Hi @Golddouble ,

Do you have the option [x] Intercept unknown enabled? Usually connections without an asociated process occur when the outbound connection is not a TCP SYN package, for example a connection close.

In versions <= 1.5.x we were using the Netfilter Conntrack subsystem to determine if an outbound connection was NEW.

However, Conntrack may tag a connection as NEW if it's the first time that it sees that package, even if it's no a TCP SYN package.

So for example, that connection could very well be a TCP_CLOSE_WAIT or TCP_FIN_WAIT1/2.

We changed how we intercept TCP connections in >= 1.6.x, to avoid these problems. And on v1.7.x we'll be able to debug the intercepted package.

[Golddouble]

Thank you for your reply.

Do you have the option [x] Intercept unknown enabled?

I have not found exactly the option "Intercept unknown". Do you talk about this option?:

Thank you.

[gustavo-iniguez-goya]

yeah, that option. The name has changed several times :)