[Feature Request] <title>Auto generate regular expressions / simplify data input fields.

[pkw365]

I have noticed that opensnitch can generate regular expressions on it's own.
As an example rules for appimages.

Why not implementing this for all data input fields ?

Regular expressions are a real pain for "common" users like myself.
Easy to make mistakes or simply to difficult as is the case with appimages.

[gustavo-iniguez-goya]

Hi @pkw365 ,

Appimages when executed are unpacked to a very specific path (/tmp/.mount_XXXXX), so it's easy to create a generic rule for them.

Could you put examples of other cases/fields?

[pkw365]

Thanks for your reply,

Here are some examples :
^/tmp/.mount_ABCD[0-9A-Za-z]{6}/.abcd$ :
/tmp/.mount_ABCD/abcd

^(tcp|udp)$ :
tcp,udp

^(127.0.0.1|192.168.0.66)$ :
127.0.0.1,192.168.0.66

[gustavo-iniguez-goya]

ah okok, I see. This request is similar to #960. We can use , and - to translate the values to regular expressions. Indeed we used to do that, but there were conflicts with some file paths.

One of the problem is how to determine if the user typed a regular expression or a basic range. We could use , and ":" as suggested in the other issue. "-" can be problematic (1-900 vs ^(500[0-9]).

[pkw365]

Similar as #960 but then with all input fields.

If certain characters cause a problem like "-" other character could be used ?
Or simply add a checkbox if user prefers regular expression.
As is the case on the 1st tab of rules creation window.

[pkw365]

There is a 3rd option :
Regular expressions start with "^" and ends with "$".
So any data input that has those 2 characters should be treated as regular expressions.
Anythings else is simplified input.

Benefits :
-No need for changing character "-".
-Check boxes to indicate regular expressions are used, not needed.
(Avoids clutter and keeps gui "clean".)

[gustavo-iniguez-goya]

thanks @pkw365 . I've implemented the translation from "," to a regexp (^()$).

That's the easy part. Now the problem is whether we want to convert the regexp back into a format separated by "," (or ":", etc). The user will expect it I suppose, but honestly I don't want to mess with it. Not easy way to tell if the user typed the regexp or not.

For now I suggest adding "," -> regexp.

[pkw365]

Ideally the user would like to have a GUI that is consistent and not confusing.
So yes, the user expects that input fields displays what the user entered.
Basically there is not need to "bother" the user with translated data.

What about a single option were user can select between regular expression or simplified input only ?
With this we avoid a mish mash and the confusion it creates.
Also only 1 checkbox needed instead of multiple as we currently have.

[gustavo-iniguez-goya]

Added for the following fields:

• src/dst ip: 1.2.3.4, 5.6.7.8
• dst host: www.a-b-c.org, www.abcd.org
• proto: tcp, udp
• net ifaces: eth0, eth1
• src/dst port: 123, 456

Although I think this is not the correct approach. It'd better to add a new Operator to the daemon/rules, like "simple-regexp" or something similar, and instead of using regular expressions which are super inefficient, use maps or arrays to match the properties of a connection.

[pkw365]

Getting rid of regular expression would be great.
Thanks !