r3compatibility.py 6.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2010 Joanna Rutkowska <joanna@invisiblethingslab.com>
  5. # Copyright (C) 2013-2016 Marek Marczykowski-Górecki
  6. # <marmarek@invisiblethingslab.com>
  7. #
  8. # This program is free software; you can redistribute it and/or modify
  9. # it under the terms of the GNU General Public License as published by
  10. # the Free Software Foundation; either version 2 of the License, or
  11. # (at your option) any later version.
  12. #
  13. # This program is distributed in the hope that it will be useful,
  14. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16. # GNU General Public License for more details.
  17. #
  18. # You should have received a copy of the GNU General Public License along
  19. # with this program; if not, write to the Free Software Foundation, Inc.,
  20. # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21. #
  22. import datetime
  23. import qubes.ext
  24. import qubes.firewall
  25. import qubes.vm.qubesvm
  26. import qubes.vm.appvm
  27. import qubes.vm.templatevm
  28. import qubes.utils
  29. yum_proxy_ip = '10.137.255.254'
  30. yum_proxy_port = '8082'
  31. class R3Compatibility(qubes.ext.Extension):
  32. '''Maintain VM interface compatibility with R3.0 and R3.1.
  33. At lease where possible.
  34. '''
  35. features_to_services = {
  36. 'service.ntpd': 'ntpd',
  37. 'check-updates': 'qubes-update-check',
  38. 'dvm': 'qubes-dvm',
  39. }
  40. # noinspection PyUnusedLocal
  41. @qubes.ext.handler('domain-qdb-create')
  42. def on_domain_qdb_create(self, vm, event):
  43. '''
  44. :param qubes.vm.qubesvm.QubesVM vm: \
  45. VM on which QubesDB entries were just created
  46. ''' # pylint: disable=unused-argument
  47. # /qubes-vm-type: AppVM, NetVM, ProxyVM, TemplateVM
  48. if isinstance(vm, qubes.vm.templatevm.TemplateVM):
  49. vmtype = 'TemplateVM'
  50. elif vm.netvm is not None and vm.provides_network:
  51. vmtype = 'ProxyVM'
  52. elif vm.netvm is None and vm.provides_network:
  53. vmtype = 'NetVM'
  54. else:
  55. vmtype = 'AppVM'
  56. vm.untrusted_qdb.write('/qubes-vm-type', vmtype)
  57. vm.untrusted_qdb.write("/qubes-iptables-error", '')
  58. self.write_iptables_qubesdb_entry(vm)
  59. self.write_services(vm)
  60. @qubes.ext.handler('domain-spawn')
  61. def on_domain_started(self, vm, event, **kwargs):
  62. # pylint: disable=unused-argument
  63. if vm.netvm:
  64. self.write_iptables_qubesdb_entry(vm.netvm)
  65. @qubes.ext.handler('firewall-changed')
  66. def on_firewall_changed(self, vm, event):
  67. # pylint: disable=unused-argument
  68. if vm.is_running() and vm.netvm:
  69. self.write_iptables_qubesdb_entry(vm.netvm)
  70. def write_iptables_qubesdb_entry(self, firewallvm):
  71. # pylint: disable=no-self-use
  72. firewallvm.untrusted_qdb.rm("/qubes-iptables-domainrules/")
  73. iptables = "# Generated by Qubes Core on {0}\n".format(
  74. datetime.datetime.now().ctime())
  75. iptables += "*filter\n"
  76. iptables += ":INPUT DROP [0:0]\n"
  77. iptables += ":FORWARD DROP [0:0]\n"
  78. iptables += ":OUTPUT ACCEPT [0:0]\n"
  79. # Strict INPUT rules
  80. iptables += "-A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP\n"
  81. iptables += "-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED " \
  82. "-j ACCEPT\n"
  83. iptables += "-A INPUT -p icmp -j ACCEPT\n"
  84. iptables += "-A INPUT -i lo -j ACCEPT\n"
  85. iptables += "-A INPUT -j REJECT --reject-with icmp-host-prohibited\n"
  86. iptables += "-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED " \
  87. "-j ACCEPT\n"
  88. # Deny inter-VMs networking
  89. iptables += "-A FORWARD -i vif+ -o vif+ -j DROP\n"
  90. iptables += "COMMIT\n"
  91. firewallvm.untrusted_qdb.write("/qubes-iptables-header", iptables)
  92. for vm in firewallvm.connected_vms:
  93. iptables = "*filter\n"
  94. conf = vm.firewall
  95. xid = vm.xid
  96. if xid < 0: # VM not active ATM
  97. continue
  98. ip = vm.ip
  99. if ip is None:
  100. continue
  101. # Anti-spoof rules are added by vif-script (vif-route-qubes),
  102. # here we trust IP address
  103. for rule in conf.rules:
  104. if rule.specialtarget == 'dns':
  105. if rule.dstports not in ('53', None):
  106. continue
  107. if rule.proto:
  108. protos = {'tcp', 'udp'}.intersection(str(rule.proto))
  109. else:
  110. protos = {'tcp', 'udp'}
  111. for proto in protos:
  112. if rule.dsthost:
  113. dsthosts = set(vm.dns).intersection(
  114. [str(rule.dsthost).replace('/24', '')])
  115. else:
  116. dsthosts = vm.dns
  117. for dsthost in dsthosts:
  118. iptables += '-A FORWARD -s {}'.format(ip)
  119. iptables += ' -d {!s}'.format(dsthost)
  120. iptables += ' -p {!s}'.format(proto)
  121. iptables += ' --dport 53'
  122. iptables += ' -j {}\n'.format(
  123. str(rule.action).upper())
  124. else:
  125. iptables += '-A FORWARD -s {}'.format(ip)
  126. if rule.dsthost:
  127. iptables += ' -d {!s}'.format(rule.dsthost)
  128. if rule.proto:
  129. iptables += ' -p {!s}'.format(rule.proto)
  130. if rule.dstports:
  131. iptables += ' --dport {}'.format(
  132. str(rule.dstports).replace('-', ':'))
  133. iptables += ' -j {0}\n'.format(str(rule.action).upper())
  134. iptables += '-A FORWARD -s {0} -j {1}\n'.format(ip,
  135. str(conf.policy).upper())
  136. iptables += 'COMMIT\n'
  137. firewallvm.untrusted_qdb.write(
  138. '/qubes-iptables-domainrules/' + str(xid),
  139. iptables)
  140. # no need for ending -A FORWARD -j DROP, cause default action is DROP
  141. firewallvm.untrusted_qdb.write('/qubes-iptables', 'reload')
  142. def write_services(self, vm):
  143. for feature, value in vm.features.items():
  144. service = self.features_to_services.get(feature, None)
  145. if service is None:
  146. continue
  147. # forcefully convert to '0' or '1'
  148. vm.untrusted_qdb.write('/qubes-service/{}'.format(service),
  149. str(int(bool(value))))
  150. if 'updates-proxy-setup' in vm.features.keys():
  151. vm.untrusted_qdb.write(
  152. '/qubes-service/{}'.format('yum-proxy-setup'),
  153. str(int(bool(vm.features['updates-proxy-setup']))))