320 lines
13 KiB
Python
320 lines
13 KiB
Python
|
#!/usr/bin/python
|
||
|
|
# -*- coding: utf-8 -*-
|
||
|
|
#
|
||
|
|
# The Qubes OS Project, http://www.qubes-os.org
|
||
|
|
#
|
||
|
|
# Copyright (C) 2015 Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
|
||
|
|
#
|
||
|
|
# This program is free software; you can redistribute it and/or
|
||
|
|
# modify it under the terms of the GNU General Public License
|
||
|
|
# as published by the Free Software Foundation; either version 2
|
||
|
|
# of the License, or (at your option) any later version.
|
||
|
|
#
|
||
|
|
# This program is distributed in the hope that it will be useful,
|
||
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||
|
|
# GNU General Public License for more details.
|
||
|
|
#
|
||
|
|
# You should have received a copy of the GNU General Public License
|
||
|
|
# along with this program; if not, write to the Free Software
|
||
|
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
|
||
|
|
# USA.
|
||
|
|
#
|
||
|
|
import multiprocessing
|
||
|
|
import os
|
||
|
|
import subprocess
|
||
|
|
import unittest
|
||
|
|
import time
|
||
|
|
|
||
|
|
from qubes.qubes import QubesVmCollection, defaults
|
||
|
|
|
||
|
|
|
||
|
|
VM_PREFIX = "test-"
|
||
|
|
|
||
|
|
class VmNetworkingTests(unittest.TestCase):
|
||
|
|
ping_ip = "ping -W 1 -n -c 1 192.168.123.45"
|
||
|
|
ping_name = "ping -W 1 -c 1 test.example.com"
|
||
|
|
|
||
|
|
def run_cmd(self, vm, cmd, user="root"):
|
||
|
|
p = vm.run(cmd, user=user, passio_popen=True, ignore_stderr=True)
|
||
|
|
p.stdin.close()
|
||
|
|
p.stdout.read()
|
||
|
|
return p.wait()
|
||
|
|
|
||
|
|
def setUp(self):
|
||
|
|
self.qc = QubesVmCollection()
|
||
|
|
self.qc.lock_db_for_writing()
|
||
|
|
self.qc.load()
|
||
|
|
self.testnetvm = self.qc.add_new_vm("QubesNetVm",
|
||
|
|
name="%snetvm1" % VM_PREFIX,
|
||
|
|
template=self.qc.get_default_template())
|
||
|
|
self.testnetvm.create_on_disk(verbose=False)
|
||
|
|
self.testvm1 = self.qc.add_new_vm("QubesAppVm",
|
||
|
|
name="%svm2" % VM_PREFIX,
|
||
|
|
template=self.qc.get_default_template())
|
||
|
|
self.testvm1.create_on_disk(verbose=False)
|
||
|
|
self.testvm1.netvm = self.testnetvm
|
||
|
|
self.qc.save()
|
||
|
|
self.qc.unlock_db()
|
||
|
|
self.configure_netvm()
|
||
|
|
|
||
|
|
def configure_netvm(self):
|
||
|
|
def run_netvm_cmd(cmd):
|
||
|
|
if self.run_cmd(self.testnetvm, cmd) != 0:
|
||
|
|
self.fail("Command '%s' failed" % cmd)
|
||
|
|
|
||
|
|
if not self.testnetvm.is_running():
|
||
|
|
self.testnetvm.start()
|
||
|
|
# Ensure that dnsmasq is installed:
|
||
|
|
p = self.testnetvm.run("dnsmasq --version", user="root",
|
||
|
|
passio_popen=True)
|
||
|
|
if p.wait() != 0:
|
||
|
|
self.skipTest("dnsmasq not installed")
|
||
|
|
|
||
|
|
run_netvm_cmd("ip link add test0 type dummy")
|
||
|
|
run_netvm_cmd("ip link set test0 up")
|
||
|
|
run_netvm_cmd("ip addr add 192.168.123.45/24 dev test0")
|
||
|
|
run_netvm_cmd("iptables -I INPUT -d 192.168.123.45 -j ACCEPT")
|
||
|
|
run_netvm_cmd("dnsmasq -a 192.168.123.45 -A /example.com/192.168.123.45 -i test0 -z")
|
||
|
|
run_netvm_cmd("echo nameserver 192.168.123.45 > /etc/resolv.conf")
|
||
|
|
run_netvm_cmd("/usr/lib/qubes/qubes-setup-dnat-to-ns")
|
||
|
|
|
||
|
|
def remove_vms(self, vms):
|
||
|
|
self.qc.lock_db_for_writing()
|
||
|
|
self.qc.load()
|
||
|
|
|
||
|
|
for vm in vms:
|
||
|
|
if isinstance(vm, str):
|
||
|
|
vm = self.qc.get_vm_by_name(vm)
|
||
|
|
else:
|
||
|
|
vm = self.qc[vm.qid]
|
||
|
|
if vm.is_running():
|
||
|
|
try:
|
||
|
|
vm.force_shutdown()
|
||
|
|
except:
|
||
|
|
pass
|
||
|
|
try:
|
||
|
|
vm.remove_from_disk()
|
||
|
|
except OSError:
|
||
|
|
pass
|
||
|
|
self.qc.pop(vm.qid)
|
||
|
|
self.qc.save()
|
||
|
|
self.qc.unlock_db()
|
||
|
|
|
||
|
|
def tearDown(self):
|
||
|
|
vmlist = [vm for vm in self.qc.values() if vm.name.startswith(
|
||
|
|
VM_PREFIX)]
|
||
|
|
self.remove_vms(vmlist)
|
||
|
|
|
||
|
|
def test_000_simple_networking(self):
|
||
|
|
self.testvm1.start()
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1,
|
||
|
|
"ping -c 1 192.168.123.45"), 0)
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1,
|
||
|
|
"ping -c 1 test.example.com"), 0)
|
||
|
|
|
||
|
|
def test_010_simple_proxyvm(self):
|
||
|
|
self.qc.lock_db_for_writing()
|
||
|
|
self.qc.load()
|
||
|
|
self.proxy = self.qc.add_new_vm("QubesProxyVm",
|
||
|
|
name="%sproxy" % VM_PREFIX,
|
||
|
|
template=self.qc.get_default_template())
|
||
|
|
self.proxy.create_on_disk(verbose=False)
|
||
|
|
self.proxy.netvm = self.testnetvm
|
||
|
|
self.testvm1.netvm = self.proxy
|
||
|
|
self.qc.save()
|
||
|
|
self.qc.unlock_db()
|
||
|
|
|
||
|
|
self.testvm1.start()
|
||
|
|
self.assertTrue(self.proxy.is_running())
|
||
|
|
self.assertEqual(self.run_cmd(self.proxy, self.ping_ip), 0,
|
||
|
|
"Ping by IP from ProxyVM failed")
|
||
|
|
self.assertEqual(self.run_cmd(self.proxy, self.ping_name), 0,
|
||
|
|
"Ping by name from ProxyVM failed")
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
|
||
|
|
"Ping by IP from AppVM failed")
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
|
||
|
|
"Ping by IP from AppVM failed")
|
||
|
|
|
||
|
|
def test_020_simple_proxyvm_nm(self):
|
||
|
|
self.qc.lock_db_for_writing()
|
||
|
|
self.qc.load()
|
||
|
|
self.proxy = self.qc.add_new_vm("QubesProxyVm",
|
||
|
|
name="%sproxy" % VM_PREFIX,
|
||
|
|
template=self.qc.get_default_template())
|
||
|
|
self.proxy.create_on_disk(verbose=False)
|
||
|
|
self.proxy.netvm = self.testnetvm
|
||
|
|
self.proxy.services['network-manager'] = True
|
||
|
|
self.testvm1.netvm = self.proxy
|
||
|
|
self.qc.save()
|
||
|
|
self.qc.unlock_db()
|
||
|
|
|
||
|
|
self.testvm1.start()
|
||
|
|
self.assertTrue(self.proxy.is_running())
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
|
||
|
|
"Ping by IP failed")
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
|
||
|
|
"Ping by name failed")
|
||
|
|
# reconnect to make sure that device was configured by NM
|
||
|
|
self.assertEqual(
|
||
|
|
self.run_cmd(self.proxy, "nmcli device disconnect eth0",
|
||
|
|
user="user"),
|
||
|
|
0, "Failed to disconnect eth0 using nmcli")
|
||
|
|
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 1,
|
||
|
|
"Network should be disabled, but apparently it isn't")
|
||
|
|
self.assertEqual(
|
||
|
|
self.run_cmd(self.proxy, "nmcli connection up \"VM uplink eth0\" "
|
||
|
|
"ifname eth0",
|
||
|
|
user="user"),
|
||
|
|
0, "Failed to connect eth0 using nmcli")
|
||
|
|
self.assertEqual(self.run_cmd(self.proxy, "nm-online", user="user"), 0,
|
||
|
|
"Failed to wait for NM connection")
|
||
|
|
# check for nm-applet presence
|
||
|
|
self.assertEqual(subprocess.call([
|
||
|
|
'xdotool', 'search', '--all', '--name',
|
||
|
|
'--class', '^(NetworkManager Applet|{})$'.format(self.proxy.name)
|
||
|
|
], stdout=open('/dev/null', 'w')), 0, "nm-applet window not found")
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
|
||
|
|
"Ping by IP failed (after NM reconnection")
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
|
||
|
|
"Ping by name failed (after NM reconnection)")
|
||
|
|
|
||
|
|
def test_030_firewallvm_firewall(self):
|
||
|
|
self.qc.lock_db_for_writing()
|
||
|
|
self.qc.load()
|
||
|
|
self.proxy = self.qc.add_new_vm("QubesProxyVm",
|
||
|
|
name="%sproxy" % VM_PREFIX,
|
||
|
|
template=self.qc.get_default_template())
|
||
|
|
self.proxy.create_on_disk(verbose=False)
|
||
|
|
self.proxy.netvm = self.testnetvm
|
||
|
|
self.testvm1.netvm = self.proxy
|
||
|
|
self.qc.save()
|
||
|
|
self.qc.unlock_db()
|
||
|
|
|
||
|
|
# block all for first
|
||
|
|
|
||
|
|
self.testvm1.write_firewall_conf({
|
||
|
|
'allow': False,
|
||
|
|
'allowDns': False,
|
||
|
|
'allowIcmp': False,
|
||
|
|
})
|
||
|
|
self.testvm1.start()
|
||
|
|
self.assertTrue(self.proxy.is_running())
|
||
|
|
|
||
|
|
self.testnetvm.run("nc -l --send-only -e /bin/hostname -k 1234")
|
||
|
|
|
||
|
|
self.assertEqual(self.run_cmd(self.proxy, self.ping_ip), 0,
|
||
|
|
"Ping by IP from ProxyVM failed")
|
||
|
|
self.assertEqual(self.run_cmd(self.proxy, self.ping_name), 0,
|
||
|
|
"Ping by name from ProxyVM failed")
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 1,
|
||
|
|
"Ping by IP should be blocked")
|
||
|
|
nc_cmd = "nc -w 1 --recv-only 192.168.123.45 1234"
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, nc_cmd), 1,
|
||
|
|
"TCP connection should be blocked")
|
||
|
|
|
||
|
|
# block all except ICMP
|
||
|
|
|
||
|
|
self.testvm1.write_firewall_conf({
|
||
|
|
'allow': False,
|
||
|
|
'allowDns': False,
|
||
|
|
'allowIcmp': True,
|
||
|
|
})
|
||
|
|
self.proxy.write_iptables_xenstore_entry()
|
||
|
|
# Ugly hack b/c there is no feedback when the rules are actually applied
|
||
|
|
time.sleep(1)
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
|
||
|
|
"Ping by IP failed (should be allowed now)")
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 2,
|
||
|
|
"Ping by name should be blocked")
|
||
|
|
|
||
|
|
# all TCP still blocked
|
||
|
|
|
||
|
|
self.testvm1.write_firewall_conf({
|
||
|
|
'allow': False,
|
||
|
|
'allowDns': True,
|
||
|
|
'allowIcmp': True,
|
||
|
|
})
|
||
|
|
self.proxy.write_iptables_xenstore_entry()
|
||
|
|
# Ugly hack b/c there is no feedback when the rules are actually applied
|
||
|
|
time.sleep(1)
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
|
||
|
|
"Ping by name failed (should be allowed now)")
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, nc_cmd), 1,
|
||
|
|
"TCP connection should be blocked")
|
||
|
|
|
||
|
|
# block all except target
|
||
|
|
|
||
|
|
self.testvm1.write_firewall_conf({
|
||
|
|
'allow': False,
|
||
|
|
'allowDns': True,
|
||
|
|
'allowIcmp': True,
|
||
|
|
'rules': [{'address': '192.168.123.45',
|
||
|
|
'netmask': 32,
|
||
|
|
'proto': 'tcp',
|
||
|
|
'portBegin': 1234
|
||
|
|
}] })
|
||
|
|
self.proxy.write_iptables_xenstore_entry()
|
||
|
|
# Ugly hack b/c there is no feedback when the rules are actually applied
|
||
|
|
time.sleep(1)
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, nc_cmd), 0,
|
||
|
|
"TCP connection failed (should be allowed now)")
|
||
|
|
|
||
|
|
# allow all except target
|
||
|
|
|
||
|
|
self.testvm1.write_firewall_conf({
|
||
|
|
'allow': True,
|
||
|
|
'allowDns': True,
|
||
|
|
'allowIcmp': True,
|
||
|
|
'rules': [{'address': '192.168.123.45',
|
||
|
|
'netmask': 32,
|
||
|
|
'proto': 'tcp',
|
||
|
|
'portBegin': 1234
|
||
|
|
}]
|
||
|
|
})
|
||
|
|
self.proxy.write_iptables_xenstore_entry()
|
||
|
|
# Ugly hack b/c there is no feedback when the rules are actually applied
|
||
|
|
time.sleep(1)
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1, nc_cmd), 1,
|
||
|
|
"TCP connection should be blocked")
|
||
|
|
|
||
|
|
|
||
|
|
def test_040_inter_vm(self):
|
||
|
|
self.qc.lock_db_for_writing()
|
||
|
|
self.qc.load()
|
||
|
|
self.proxy = self.qc.add_new_vm("QubesProxyVm",
|
||
|
|
name="%sproxy" % VM_PREFIX,
|
||
|
|
template=self.qc.get_default_template())
|
||
|
|
self.proxy.create_on_disk(verbose=False)
|
||
|
|
self.proxy.netvm = self.testnetvm
|
||
|
|
self.testvm1.netvm = self.proxy
|
||
|
|
|
||
|
|
self.testvm2 = self.qc.add_new_vm("QubesAppVm",
|
||
|
|
name="%svm3" % VM_PREFIX,
|
||
|
|
template=self.qc.get_default_template())
|
||
|
|
self.testvm2.create_on_disk(verbose=False)
|
||
|
|
self.testvm2.netvm = self.proxy
|
||
|
|
self.qc.save()
|
||
|
|
self.qc.unlock_db()
|
||
|
|
|
||
|
|
self.testvm1.start()
|
||
|
|
self.testvm2.start()
|
||
|
|
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1,
|
||
|
|
"ping -W 1 -n -c 1 {}".format(self.testvm2.ip)), 1)
|
||
|
|
|
||
|
|
self.testvm2.netvm = self.testnetvm
|
||
|
|
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1,
|
||
|
|
"ping -W 1 -n -c 1 {}".format(self.testvm2.ip)), 1)
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm2,
|
||
|
|
"ping -W 1 -n -c 1 {}".format(self.testvm1.ip)), 1)
|
||
|
|
|
||
|
|
self.testvm1.netvm = self.testnetvm
|
||
|
|
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm1,
|
||
|
|
"ping -W 1 -n -c 1 {}".format(self.testvm2.ip)), 1)
|
||
|
|
self.assertEqual(self.run_cmd(self.testvm2,
|
||
|
|
"ping -W 1 -n -c 1 {}".format(self.testvm1.ip)), 1)
|