[ozdil]

Requested by ozan · project thread

Description

Fixes from a full-stack review. The bugs that were visible to users:

• Every apply appended another copy of the nft rules.
• Turning kernel enforcement off left the table in place.
• Kernel enforcement and panic blackout never worked, because the unprivileged engine ran nft itself.
• Removing the package left the hosts block, the nft table and the browser policies behind.
• Packaged installs could not load the bar widget because BoundedTextInput.qml was missing.
• Quick clicks in the panel silently dropped actions. Concurrent engine runs also lost config changes.
• cargo test and the Python tests could touch the real /etc and config files.
• The Ultimate level ignored the category and DoH toggles, and the DoH toggle had no effect.
• A pause only ended when the panel happened to poll status.
• The builtin list blocked reserved names (local, localhost.localdomain).

Privileged nft and locking

• The helper owns every nft change, including the new --blackout-on and --blackout-off.
• The helper publishes /run/omablock/kernel_state.json, which the engine reads for status.
• A single run_privileged_helper() is used. sudo gets 30 s and pkexec 90 s, so a slow but authorised run is not repeated with a second password prompt.
• Engine commands lock engine.lock with flock. --update reloads the config under that lock before its final save. With 12 parallel adds, 1 entry survived before and all 12 survive now.
• Helper runs are serialised with flock, and /etc/hosts keeps its mode and owner.

Hosts helper (omablock-hosts-sync)

• The nft table is replaced atomically and cleared when --with-kernel is absent.
• An unterminated marker block keeps the user entries that follow it.
• Non-UTF-8 bytes are preserved.
• fsync runs around the atomic replace.
• --clear always removes the browser DoH policies.
• The rules file is checked with fstat on the opened fd.
• Inner underscores are allowed; .localdomain, .test and .invalid are rejected.
• New --restore-backup restores /etc/hosts.omablock.bak and keeps the current file as /etc/hosts.omablock.pre-restore.

Engine

• The binary now uses the library crate instead of compiling a second copy of every module and of validate_domain.
• active_rules reports the entries actually present in /etc/hosts.
• A corrupt config.json is moved to config.json.corrupt-<ts> rather than overwritten. An unreadable one is left untouched.
• The home directory comes from $HOME or the passwd entry; there is no /home/ozdil fallback.
• Blocklist downloads are capped with curl --max-filesize.
• DGA classifier:
  • Decodes punycode. Plain IDNs such as münchen.de and яндекс.рф are no longer flagged.
  • Mixed-script, whole-script and brand look-alike spoofs are still flagged.
  • Brand first-party domains (githubusercontent.com, googleapis.com) and compound suffixes such as co.uk no longer produce false positives.
• Panic blackout:
  • Matches oifname, so the loopback DNS stub stays reachable.
  • Uses its own omablock_blackout table.
• Exit codes: 1 when a change was saved but the privileged sync failed, 2 for an invalid domain, category or option, 4 when the system helper is not installed. Without the helper the engine no longer runs pkexec, so there is no password prompt that can only fail.

Level semantics and new commands

• Ultimate filters categories like Aggressive and respects the DoH toggle. Leaving Ultimate resets DoH and kernel enforcement.
• doh_prevention defaults to false, and a whitelisted DoH resolver stays reachable.
• With AI protection on, whitelisting a look-alike domain prints a warning, sends a notification and sets the IDN flag. The flag stays on only while that domain is still whitelisted.
• verify-integrity compares the binary with the hash in the install manifest: OK (0), MISMATCH (1), UNKNOWN (3).
• --pause schedules a systemd-run --user timer that runs --expire-pause. The status-time expiry stays as a fallback.
• --restore-hosts runs the helper's restore, then turns protection off so the next action does not re-apply the block.
• Rule parsing moved to src/rules.rs and validates every domain, so a tampered cache cannot inject hosts syntax.

QML

• qml/EngineClient.qml holds status polling and the action queue for both Panel and MainWindow, and reports exit codes.
• Toasts show the real update and test result, and a rejected or failed action, or a missing system helper, is reported.
• MainWindow parses the test result and counts down a pause.
• hoverEnabled is set on 7 buttons.
• BoundedTextInput (a single copy in qml/, which Panel now imports):
  • emits textEdited() only where TextEdit provides it (Qt 6.9+), since declaring it there is an invalid override;
  • no longer inserts Tab characters;
  • counts the paste limit in UTF-8 bytes;
  • shows a toast in Panel when a paste is refused.

Packaging and scripts

• PKGBUILD:
  • adds a pre_remove hook (--clear, --blackout-off);
  • adds the nftables optdepend;
  • adds a prepare() that runs cargo fetch, so build() uses --frozen.
• The dashboard finds the plugin's qml/ directory.
• build.sh checks ownership before compiling.
• uninstall.sh disables the shield first and keeps the manifest when it preserved files.

Chrome extension 1.0.5

• Whitelisting a site also adds a DNR allowAllRequests rule. The popup and content script share one matcher.
• The badge shows ON/OFF per tab.
• Cosmetic CSS is injected before the storage read, so ads no longer flash in.
• The tabs permission is dropped.
• The popup, name and description are localized (_locales/en, _locales/tr).
• extensions/build-chrome-zip.sh builds the store package without the store images and without the key field. The stale 1.0.0 zip is removed.
• The permission docs match the manifest.

Docs

• README and README.tr: hosts filtering is described as resolver (NSS) based rather than kernel level, the nft tables are described as they are, Polkit asks once (auth_admin_keep), output caps are 16 to 32 KiB, and the zeroize claim is removed. New commands and exit codes are documented.
• USB armor is documented as experimental; it only stores a flag.

CI

• New ci.yml runs:
  • clippy with -D warnings;
  • cargo test;
  • the Python tests, including tests/test_qml_runtime.py, which loads EngineClient and MainWindow under PySide6 with Quickshell stand-ins (tests/qml/quickshell_stub.py);
  • shell syntax checks;
  • rules.json and version consistency checks.
• CodeQL now also scans python and rust.

Type of Change

• Bug fix
• New feature
• Code style / Refactor
• Documentation update

Verification Checklist

• Conforms to Zero-Trust and HANCORE guidelines
• JetBrainsMono Nerd Font typography preserved
• Tested locally on Omarchy Linux

Tests run

• cargo test and cargo clippy --all-targets -D warnings: clean. The simulation tests now use the real rule parser, and a new test checks that every builtin rule is a valid domain.
• Python tests pass 28/28. They cover the full build and uninstall lifecycle, the hosts restore and the QML runtime: action order, exit codes, refresh coalescing and status mapping.
• The engine was run end to end with a temporary HOME. This covered level transitions, DoH whitelisting in the generated hosts list, the IDN flag, verify-integrity OK and MISMATCH, and exit codes 2 and 4.
• The extension was loaded in headless Chromium in English and Turkish:
  • a tracker script is blocked with ERR_BLOCKED_BY_CLIENT;
  • whitelisting the site lifts the block and adds the allowAllRequests rule;
  • the badge switches from ON to OFF, and other sites stay blocked;
  • the popup is localized.
• Both nft scripts were applied twice in an isolated netns, with no rule accumulation.
• Blackout on/off was checked end to end through the state file.

Not tested: Panel.qml, which needs Omarchy's qs.* modules; the real Quickshell runtime; the sudo/polkit flow and the systemd pause timer on Omarchy.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QkEeVbVXsojuz4Jb4j693q

Confidence Score: 2/5

Fix startup locking, unreadable configuration recovery, and blackout cleanup before merging.

Findings

1.  Startup reapplies old settings ▶
2.  Unreadable lists get overwritten ▶
3.  Blackout survives uninstall ▶
4.  Active rules look absent ▶
5.  Remaining look-alikes lose their warning ▶
6.  Saved whitelist and blocking disagree ▶
7.   CI runs movable action code ▶

Fix with agent prompt

### Issue 1
src/main.rs:1117-1120
`--startup` skips `engine.lock` but still applies the configuration loaded at process start. If a user disables protection while startup is loading rules, startup can apply its older enabled configuration afterward. Hosts rules then remain active while the saved setting says protection is off.

`--startup` and `--update` also run pause-expiry saves without the lock. Lock and reload before these writes and privileged changes; release the lock during downloads.

### Issue 2
src/main.rs:467-474
The unreadable-file branch returns defaults, but callers still save those defaults over `config.json`. If a user-owned file exceeds 1 MiB or contains invalid UTF-8, it fails the read but passes the write checks. Running `--enable` then replaces the original whitelist and blacklist without a backup.

Return a load error that stops mutations, rather than a writable default configuration.

### Issue 3
uninstall.sh:14
`uninstall.sh` only runs `--disable`, which calls the helper's `--clear`. That removes `omablock`, not the newly separate `omablock_blackout` table. Uninstalling while blackout is active leaves external DNS blocked after the user executables are removed.

Run `--resume-network` before deleting them, as the package removal hook already does through `--blackout-off`.

### Issue 4
src/rules.rs:44
`count_managed_hosts_rules` stops at the first line containing invalid UTF-8. The helper now deliberately preserves those bytes. If an existing comment contains bytes such as `caf\xe9` before the managed block, status reports zero active rules even after a successful apply.

Read hosts lines as bytes, or decode them without stopping, before matching the ASCII markers.

### Issue 5
src/main.rs:565-566
Each flagged whitelist addition replaces `idn_detected.state` with one domain. If two look-alike domains are added and the last one is removed, removal deletes the flag even though the first remains whitelisted.

Track all flagged entries, or compute the alert from the remaining whitelist, so removing one domain does not hide the others.

### Issue 6
extensions/chrome/popup.js:81-82
The popup saves `omablock_whitelist` before updating the browser's allow rules. If the popup closes during those awaits, or the rule update fails, the saved list and network rules stay different. The background listener only refreshes badges, including after restart.

Move rule updates into the background listener, with retry or startup repair, so a closed popup cannot leave a site showing OFF while requests remain blocked.

### Issue 7
.github/workflows/ci.yml:21
The new workflow executes `actions/checkout@v4` and `dtolnay/rust-toolchain@stable` through movable references. If either reference is repointed, CI runs changed code without a repository change. Read-only permissions limit the damage but do not prevent this.

Pin both actions to full commit hashes so updates are reviewed explicitly.

**How this was verified:** Both action references execute in the test job and neither identifies an immutable commit.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This release moves privileged changes into the helper and adds shared QML action queues, browser whitelist rules, safer hosts writes, and broader tests.

• The privileged helper applies system rules and reports their state.
• The engine applies validated rules and gives callers clearer control results.
• The domain classifier recognizes ordinary international domains without losing spoof detection.
• Panel actions run in order and show their actual results.
• Chrome whitelists now update network rules and show status per tab.
• OmaBlock installs, updates, and removes with the right cleanup steps.
• Release notes and automated checks now describe OmaBlock 1.5.0.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  UI["Panel / MainWindow"] --> Queue["EngineClient action queue"]
  Queue --> Engine["Rust engine"]
  Timer["Pause timer"] --> Engine
  Engine --> Config["User configuration"]
  Engine --> Auth["sudo / pkexec"]
  Auth --> Helper["Privileged helper"]
  Helper --> Hosts["Hosts file and browser policies"]
  Helper --> NFT["Enforcement and blackout tables"]
  Helper --> State["Published kernel state"]
  State --> Engine

Loading

_{Reviews (1) · Last reviewed commit: "Release 1.5.0: changelog and what's new ..." · Reviewed by Greptile}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-16T13:20:10.131384Z	505b5a3	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[greptile-apps]

ozdil has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

ozdil has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.