Commit Graph

2258 Commits

Author SHA1 Message Date
Marek Marczykowski
1aebb12f30 dom0+vm/qvm-block: speed up udev block handler (#560)
xenstore is very slow, so don't bother it when unneeded. Namely do not try to
remove entries, which haven't even created.
2012-06-06 02:12:10 +02:00
Marek Marczykowski
f2abc5e26d dom0: populate unchanged firewall settings with previous values (#589)
Missed settings in new firewall configuration caused exception. In old qubes-manager (before #582 done) this exception silently broke saving operation, leaving user with progress bar windows infinitely...
2012-06-05 21:21:53 +02:00
Marek Marczykowski
3b8272c1b6 dom0/qvm-ls: replace 'netmask' column with 'ip back' (#573) 2012-06-05 21:21:53 +02:00
Marek Marczykowski
aea8d189f0 dom0/core: fix QubesVM.gateway
To be consistent with QubesNetVM, where gateway property contain gateway IP for
_other_ VMs, in non-network-provider VM it should be empty.
2012-06-05 21:21:53 +02:00
Marek Marczykowski
1a8682ace3 vm: use yum proxy in TemplateVM by default (#590) 2012-06-05 21:21:53 +02:00
Marek Marczykowski
a528befbc4 dom0: default TemplateVM firewall: block all traffic and allow use of yum proxy (#590) 2012-06-05 21:21:53 +02:00
Marek Marczykowski
a8b992e647 dom0/core: implement per-VM-type firewall defaults 2012-06-05 21:21:53 +02:00
Marek Marczykowski
79f13d6c66 vm: yum plugin to notify dom0 about installed updates (#592) 2012-06-05 21:21:53 +02:00
Marek Marczykowski
c5c916b74c vm/systemd: fix ProxyVM related services deps (#578) 2012-06-05 21:21:53 +02:00
Marek Marczykowski
ea08560e43 makefile: rename vchan Makefile to not conflict with windows build 2012-06-05 21:21:53 +02:00
Marek Marczykowski
1732679b18 vm/qrexec: removed obsolete "directly:" command prefix support
This was used for launching DispVM editor in pre-qrexec-RPC times.
2012-06-05 21:21:52 +02:00
Marek Marczykowski
3f3dc4708c dom0: populate unchanged firewall settings with previous values (#589)
Missed settings in new firewall configuration caused exception. In old qubes-manager (before #582 done) this exception silently broke saving operation, leaving user with progress bar windows infinitely...
2012-06-05 20:57:40 +02:00
Marek Marczykowski
2c7227066c dom0/qvm-ls: replace 'netmask' column with 'ip back' (#573) 2012-06-05 19:58:58 +02:00
Marek Marczykowski
3255f81a1c dom0/core: fix QubesVM.gateway
To be consistent with QubesNetVM, where gateway property contain gateway IP for
_other_ VMs, in non-network-provider VM it should be empty.
2012-06-05 19:57:19 +02:00
Marek Marczykowski
c3a403f395 vm: use yum proxy in TemplateVM by default (#590) 2012-06-05 19:42:11 +02:00
Marek Marczykowski
8b366f1148 dom0: default TemplateVM firewall: block all traffic and allow use of yum proxy (#590) 2012-06-05 19:37:39 +02:00
Marek Marczykowski
01e8a2dff9 dom0/core: implement per-VM-type firewall defaults 2012-06-05 19:37:12 +02:00
Marek Marczykowski
8023c66020 vm: yum plugin to notify dom0 about installed updates (#592) 2012-06-05 19:28:59 +02:00
Marek Marczykowski
038380984f vm/systemd: fix ProxyVM related services deps (#578) 2012-06-04 15:29:26 +02:00
Alexander Tereshkin
c19a63b175 Merge branch 'hvm' of 10.141.1.101:/var/lib/qubes/git/marmarek/core into hvm 2012-06-04 17:11:03 +04:00
Marek Marczykowski
01c9fdfe59 vchan: fix ASYNC_INIT macro 2012-06-04 14:59:11 +02:00
Alexander Tereshkin
732b3bf78b Merge branch 'hvm' of git://10.141.1.101/joanna/core into hvm 2012-06-04 16:42:30 +04:00
Marek Marczykowski
22207ddf75 vchan: introduce features macros
Use features macros (QREXEC_RING_V2 and ASYNC_INIT) instead of directly
depending on building environment. The macros are turned on (when required) in
libvchan.h based on target system.
2012-06-03 17:23:07 +02:00
Marek Marczykowski
f01b1b40ac vchan: fix xc_gnttab_open call 2012-06-03 17:23:07 +02:00
Marek Marczykowski
edf1ecfcfd vchan: remove unused variables 2012-06-03 17:23:07 +02:00
Marek Marczykowski
a2a21c0467 vchan: unify calls to xc_evtchn_close
Calls to this function can be the same on all systems and xen versions, so
simplify code.
2012-06-03 17:23:06 +02:00
Marek Marczykowski
87115716ba vchan/stubdom: remove temp hack (unneded now)
This was needed when stubdom have no write access to device/vchan.
2012-06-03 17:22:59 +02:00
Joanna Rutkowska
e4dab493da version 2.0.25 2012-06-02 15:31:18 +02:00
Marek Marczykowski
1462e36454 win: convert vchan/sources to windows EOL-style 2012-06-02 12:34:35 +02:00
Marek Marczykowski
dd60d3da95 makefile: rename vchan Makefile to not conflict with windows build 2012-06-02 12:32:49 +02:00
Marek Marczykowski
2e9fcbbc1f Merge branch 'hvm' of git://gitpro.qubes-os.org/alex/core into hvm 2012-06-02 00:46:41 +02:00
Marek Marczykowski
1f194cbe08 dom0: block_cleaner: removes ejected devices from xenstore
When device is ejected by some VM (state=6, effectively inactive), it should be
removed from xenstore to free slot for some another device. This should be done
by libxl toolstack, but not implemented in xen 4.1 - AFAIR done in xen 4.2.
2012-06-01 20:59:45 +02:00
Marek Marczykowski
65a94681b2 vm/qrexec: removed obsolete "directly:" command prefix support
This was used for launching DispVM editor in pre-qrexec-RPC times.
2012-06-01 20:46:23 +02:00
Marek Marczykowski
e4f64fd600 dom0/core: remove trailing spaces 2012-05-31 03:11:44 +02:00
Marek Marczykowski
65fc62a989 dom0/core: setup yum to use proxy when it have access to it (#568)
To simplify configuration, automatically enable 'yum-proxy-setup'
pseudo-service when allowing access to the proxy. Also disable this service,
when access is revoked. Thanks to this the user can enable this feature by one
click in firewall settings.
2012-05-31 03:11:44 +02:00
Marek Marczykowski
ec52d15dfe dom0/qvm-firewall: add support for 'allowYumProxy' setting (#568) 2012-05-31 03:11:44 +02:00
Marek Marczykowski
2ca4b11183 dom0/core-firewall: firewall setting for qubes-yum-proxy (#568)
New setting for access to qubes-yum-proxy. The difference from other firewall
setting (and reason for new top-level setting): 'deny' is enforced even if
policy is set to 'allow'. This proxy service is mainly used to filter network
traffic, so do not expose it to VMs which can connect to any host directly (eg
'untrusted' VM).
2012-05-31 03:11:44 +02:00
Marek Marczykowski
4bac57818e vm/qubes-yum-proxy: setup yum to use qubes-yum-proxy (#568)
The simplest way is just add proxy=... entry to /etc/yum.conf, but sometimes it
is reasonable to bypass the proxy. Some examples:
 - usage of non-standard repos with some exotic file layout, which will be
   blocked by the proxy
 - usage of repos not-accessible via proxy (eg only via VPN stared in VpnVM)

This commit introduces 'yum-proxy-setup' pseudo-service, which can be
controlled via standard qvm-service or qubes-manager. When enabled - yum will
be configured at VM startup to use qubes proxy, otherwise - to connect directly
(proxy setting will be cleared).
2012-05-31 03:11:44 +02:00
Marek Marczykowski
1a3a2a05e3 vm/qubes-yum-proxy: create dir for pidfile under FC15 (#568)
On FC>=15 /var/run is on tmpfs, so /var/run/tinyproxy from rpm don't survive
reboot. This is bug in Fedora package (should include config file for tmpfiles
service). For now create dir just before starting service.
2012-05-31 03:11:43 +02:00
Marek Marczykowski
96508abf2c vm: qubes-yum-proxy service (#568)
Introduce proxy service, which allow only http(s) traffic to yum repos. The
filter rules are based on URL regexp, so it isn't full-featured content
inspection and can be easy bypassed, but should be enough to prevent some
erroneus user actions (like clicking on invalid link).

It is set up to intercept connections to 10.137.255.254:8082, so VM can connect
to this IP regardless of VM in which proxy is running. By default it is
started in every NetVM, but this can be changed using qvm-service or
qubes-manager (as always).
2012-05-31 03:11:43 +02:00
Marek Marczykowski
341fbe012c vm/spec: remove executable perm where not needed 2012-05-31 03:11:43 +02:00
Marek Marczykowski
3224026355 dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table
Additional chain for some qubes-related redirections. BTW PR-QBS should be
renamed now to PR-QBS-DNS...
2012-05-31 03:11:43 +02:00
Marek Marczykowski
303355a168 dom0+vm/vif-script: setup IP address of net backend interface
This is needed to connect to ProxyVM/NetVM, not only pass traffic ahead. Still
firewall rules applies.
2012-05-31 03:11:43 +02:00
Marek Marczykowski
556bc7ac38 vm+dom0/vif-script: indent fix 2012-05-31 03:11:43 +02:00
Marek Marczykowski
a2b222166a dom0/qvm-tools: introduce qvm-service tool
Allow setting vm services same as in qubes-manager
2012-05-31 03:09:22 +02:00
Marek Marczykowski
7b00b8fbe6 vm/notify-update: do not treat network problems as updates pending symptom 2012-05-31 03:09:22 +02:00
Marek Marczykowski
1f8251eefb dom0/qvm-block: hide devices mounted in dom0 (#579) 2012-05-31 03:09:22 +02:00
Marek Marczykowski
39b15033aa dom0/qvm-ls: add 'kernel' and 'kernelopts' columns 2012-05-31 03:09:22 +02:00
Marek Marczykowski
812264cfb0 dom0/core: don't limit netvm/proxyvm vcpu count to 1 (#571) 2012-05-31 03:09:22 +02:00
Marek Marczykowski
63d7cb5231 qrexec: describe msg types in header file 2012-05-31 03:09:22 +02:00