Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Maintain a list of connected machine IPs in qubesdb

Browse Source 
Necessary for anti-spoofing, see QubesOS/qubes-issues#5540.
This commit is contained in:
Pawel Marczewski 2020-01-09 11:59:53 +01:00
parent 35fa733a67
commit 7597a50b20
No known key found for this signature in database
GPG Key ID: DE42EE9B14F96465
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
qubes/vm/mix/net.py
View File

@ -389,6 +389,16 @@ class NetVMMixin(qubes.events.Emitter):
else: else:
self.untrusted_qdb.rm(mapped_ip_base + '/visible-gateway') self.untrusted_qdb.rm(mapped_ip_base + '/visible-gateway')
def reload_connected_ips(self):
'''
Update list of IPs possibly connected to this machine.
This is used by qubes-firewall to implement anti-spoofing.
'''
connected_ips = [str(vm.visible_ip) for vm in self.connected_vms]
self.untrusted_qdb.write(
'/connected-ips',
' '.join(connected_ips))
@qubes.events.handler('property-pre-del:netvm') @qubes.events.handler('property-pre-del:netvm')
def on_property_pre_del_netvm(self, event, name, oldvalue=None): def on_property_pre_del_netvm(self, event, name, oldvalue=None):
''' Sets the the NetVM to default NetVM ''' ''' Sets the the NetVM to default NetVM '''
@ -436,9 +446,14 @@ class NetVMMixin(qubes.events.Emitter):
''' '''
# pylint: disable=unused-argument # pylint: disable=unused-argument
if oldvalue is not None:
oldvalue.reload_connected_ips()
if newvalue is None: if newvalue is None:
return return
newvalue.reload_connected_ips()
if self.is_running(): if self.is_running():
# refresh IP, DNS etc # refresh IP, DNS etc
self.create_qdb_entries() self.create_qdb_entries()
@ -456,6 +471,7 @@ class NetVMMixin(qubes.events.Emitter):
def on_domain_qdb_create(self, event): def on_domain_qdb_create(self, event):
''' Fills the QubesDB with firewall entries. ''' ''' Fills the QubesDB with firewall entries. '''
# pylint: disable=unused-argument # pylint: disable=unused-argument
self.reload_connected_ips()
for vm in self.connected_vms: for vm in self.connected_vms:
if vm.is_running(): if vm.is_running():
# keep in sync with on_firewall_changed # keep in sync with on_firewall_changed