network.py 39 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2015
  5. # Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
  6. # Copyright (C) 2015 Wojtek Porczyk <woju@invisiblethingslab.com>
  7. #
  8. # This program is free software; you can redistribute it and/or modify
  9. # it under the terms of the GNU General Public License as published by
  10. # the Free Software Foundation; either version 2 of the License, or
  11. # (at your option) any later version.
  12. #
  13. # This program is distributed in the hope that it will be useful,
  14. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16. # GNU General Public License for more details.
  17. #
  18. # You should have received a copy of the GNU General Public License along
  19. # with this program; if not, write to the Free Software Foundation, Inc.,
  20. # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21. #
  22. from distutils import spawn
  23. import asyncio
  24. import multiprocessing
  25. import os
  26. import subprocess
  27. import unittest
  28. import time
  29. import qubes.tests
  30. import qubes.vm.appvm
  31. class NcVersion:
  32. Trad = 1
  33. Nmap = 2
  34. # noinspection PyAttributeOutsideInit
  35. class VmNetworkingMixin(object):
  36. test_ip = '192.168.123.45'
  37. test_name = 'test.example.com'
  38. ping_cmd = 'ping -W 1 -n -c 1 {target}'
  39. ping_ip = ping_cmd.format(target=test_ip)
  40. ping_name = ping_cmd.format(target=test_name)
  41. # filled by load_tests
  42. template = None
  43. def run_cmd(self, vm, cmd, user="root"):
  44. try:
  45. self.loop.run_until_complete(vm.run_for_stdio(cmd))
  46. except subprocess.CalledProcessError as e:
  47. return e.returncode
  48. return 0
  49. def setUp(self):
  50. super(VmNetworkingMixin, self).setUp()
  51. if self.template.startswith('whonix-gw'):
  52. self.skipTest("Test not supported here - Whonix uses its own "
  53. "firewall settings")
  54. self.init_default_template(self.template)
  55. self.testnetvm = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  56. name=self.make_vm_name('netvm1'),
  57. label='red')
  58. self.testnetvm.create_on_disk()
  59. self.testnetvm.provides_network = True
  60. self.testvm1 = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  61. name=self.make_vm_name('vm2'),
  62. label='red')
  63. self.testvm1.create_on_disk()
  64. self.testvm1.netvm = self.testnetvm
  65. self.app.save()
  66. self.configure_netvm()
  67. def configure_netvm(self):
  68. def run_netvm_cmd(cmd):
  69. if self.run_cmd(self.testnetvm, cmd) != 0:
  70. self.fail("Command '%s' failed" % cmd)
  71. if not self.testnetvm.is_running():
  72. self.loop.run_until_complete(self.testnetvm.start())
  73. # Ensure that dnsmasq is installed:
  74. try:
  75. self.loop.run_until_complete(self.testnetvm.run_for_stdio(
  76. 'dnsmasq --version', user='root'))
  77. except subprocess.CalledProcessError:
  78. self.skipTest("dnsmasq not installed")
  79. run_netvm_cmd("ip link add test0 type dummy")
  80. run_netvm_cmd("ip link set test0 up")
  81. run_netvm_cmd("ip addr add {}/24 dev test0".format(self.test_ip))
  82. run_netvm_cmd("iptables -I INPUT -d {} -j ACCEPT".format(self.test_ip))
  83. # ignore failure
  84. self.run_cmd(self.testnetvm, "killall --wait dnsmasq")
  85. run_netvm_cmd("dnsmasq -a {ip} -A /{name}/{ip} -i test0 -z".format(
  86. ip=self.test_ip, name=self.test_name))
  87. run_netvm_cmd("echo nameserver {} > /etc/resolv.conf".format(
  88. self.test_ip))
  89. run_netvm_cmd("/usr/lib/qubes/qubes-setup-dnat-to-ns")
  90. def test_000_simple_networking(self):
  91. self.loop.run_until_complete(self.testvm1.start())
  92. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0)
  93. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0)
  94. def test_010_simple_proxyvm(self):
  95. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  96. name=self.make_vm_name('proxy'),
  97. label='red')
  98. self.proxy.provides_network = True
  99. self.proxy.netvm = self.testnetvm
  100. self.loop.run_until_complete(self.proxy.create_on_disk())
  101. self.testvm1.netvm = self.proxy
  102. self.app.save()
  103. self.loop.run_until_complete(self.testvm1.start())
  104. self.assertTrue(self.proxy.is_running())
  105. self.assertEqual(self.run_cmd(self.proxy, self.ping_ip), 0,
  106. "Ping by IP from ProxyVM failed")
  107. self.assertEqual(self.run_cmd(self.proxy, self.ping_name), 0,
  108. "Ping by name from ProxyVM failed")
  109. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  110. "Ping by IP from AppVM failed")
  111. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
  112. "Ping by IP from AppVM failed")
  113. @qubes.tests.expectedFailureIfTemplate('debian-7')
  114. @unittest.skipUnless(spawn.find_executable('xdotool'),
  115. "xdotool not installed")
  116. def test_020_simple_proxyvm_nm(self):
  117. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  118. name=self.make_vm_name('proxy'),
  119. label='red')
  120. self.proxy.provides_network = True
  121. self.loop.run_until_complete(self.proxy.create_on_disk())
  122. self.proxy.netvm = self.testnetvm
  123. self.proxy.features['network-manager'] = True
  124. self.testvm1.netvm = self.proxy
  125. self.app.save()
  126. self.loop.run_until_complete(self.testvm1.start())
  127. self.assertTrue(self.proxy.is_running())
  128. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  129. "Ping by IP failed")
  130. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
  131. "Ping by name failed")
  132. # reconnect to make sure that device was configured by NM
  133. self.assertEqual(
  134. self.run_cmd(self.proxy, "nmcli device disconnect eth0",
  135. user="user"),
  136. 0, "Failed to disconnect eth0 using nmcli")
  137. self.assertNotEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  138. "Network should be disabled, but apparently it isn't")
  139. self.assertEqual(
  140. self.run_cmd(self.proxy,
  141. 'nmcli connection up "VM uplink eth0" ifname eth0',
  142. user="user"),
  143. 0, "Failed to connect eth0 using nmcli")
  144. self.assertEqual(self.run_cmd(self.proxy, "nm-online", user="user"), 0,
  145. "Failed to wait for NM connection")
  146. # check for nm-applet presence
  147. self.assertEqual(subprocess.call([
  148. 'xdotool', 'search', '--class', '{}:nm-applet'.format(
  149. self.proxy.name)],
  150. stdout=open('/dev/null', 'w')), 0, "nm-applet window not found")
  151. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  152. "Ping by IP failed (after NM reconnection")
  153. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
  154. "Ping by name failed (after NM reconnection)")
  155. def test_030_firewallvm_firewall(self):
  156. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  157. name=self.make_vm_name('proxy'),
  158. label='red')
  159. self.proxy.provides_network = True
  160. self.loop.run_until_complete(self.proxy.create_on_disk())
  161. self.proxy.netvm = self.testnetvm
  162. self.testvm1.netvm = self.proxy
  163. self.app.save()
  164. if self.run_cmd(self.testnetvm, 'nc -h 2>&1|grep -q nmap.org') == 0:
  165. nc_version = NcVersion.Nmap
  166. else:
  167. nc_version = NcVersion.Trad
  168. # block all for first
  169. self.testvm1.firewall.policy = 'drop'
  170. self.testvm1.firewall.save()
  171. self.loop.run_until_complete(self.testvm1.start())
  172. self.assertTrue(self.proxy.is_running())
  173. nc = self.loop.run_until_complete(self.testnetvm.run(
  174. 'nc -l --send-only -e /bin/hostname -k 1234'
  175. if nc_version == NcVersion.Nmap
  176. else 'while nc -l -e /bin/hostname -p 1234; do true; done'))
  177. try:
  178. self.assertEqual(self.run_cmd(self.proxy, self.ping_ip), 0,
  179. "Ping by IP from ProxyVM failed")
  180. self.assertEqual(self.run_cmd(self.proxy, self.ping_name), 0,
  181. "Ping by name from ProxyVM failed")
  182. self.assertNotEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  183. "Ping by IP should be blocked")
  184. if nc_version == NcVersion.Nmap:
  185. nc_cmd = "nc -w 1 --recv-only {} 1234".format(self.test_ip)
  186. else:
  187. nc_cmd = "nc -w 1 {} 1234".format(self.test_ip)
  188. self.assertNotEqual(self.run_cmd(self.testvm1, nc_cmd), 0,
  189. "TCP connection should be blocked")
  190. # block all except ICMP
  191. self.testvm1.firewall.rules = [(
  192. qubes.firewall.Rule(None, action='accept', proto='icmp')
  193. )]
  194. self.testvm1.firewall.save()
  195. # Ugly hack b/c there is no feedback when the rules are actually
  196. # applied
  197. time.sleep(3)
  198. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  199. "Ping by IP failed (should be allowed now)")
  200. self.assertNotEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
  201. "Ping by name should be blocked")
  202. # all TCP still blocked
  203. self.testvm1.firewall.rules = [
  204. qubes.firewall.Rule(None, action='accept', proto='icmp'),
  205. qubes.firewall.Rule(None, action='accept', specialtarget='dns'),
  206. ]
  207. self.testvm1.firewall.save()
  208. # Ugly hack b/c there is no feedback when the rules are actually
  209. # applied
  210. time.sleep(3)
  211. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
  212. "Ping by name failed (should be allowed now)")
  213. self.assertNotEqual(self.run_cmd(self.testvm1, nc_cmd), 0,
  214. "TCP connection should be blocked")
  215. # block all except target
  216. self.testvm1.firewall.policy = 'drop'
  217. self.testvm1.firewall.rules = [
  218. qubes.firewall.Rule(None, action='accept', dsthost=self.test_ip,
  219. proto='tcp', dstports=1234),
  220. ]
  221. self.testvm1.firewall.save()
  222. # Ugly hack b/c there is no feedback when the rules are actually
  223. # applied
  224. time.sleep(3)
  225. self.assertEqual(self.run_cmd(self.testvm1, nc_cmd), 0,
  226. "TCP connection failed (should be allowed now)")
  227. # allow all except target
  228. self.testvm1.firewall.policy = 'accept'
  229. self.testvm1.firewall.rules = [
  230. qubes.firewall.Rule(None, action='drop', dsthost=self.test_ip,
  231. proto='tcp', dstports=1234),
  232. ]
  233. self.testvm1.firewall.save()
  234. # Ugly hack b/c there is no feedback when the rules are actually
  235. # applied
  236. time.sleep(3)
  237. self.assertNotEqual(self.run_cmd(self.testvm1, nc_cmd), 0,
  238. "TCP connection should be blocked")
  239. finally:
  240. nc.terminate()
  241. self.loop.run_until_complete(nc.wait())
  242. def test_040_inter_vm(self):
  243. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  244. name=self.make_vm_name('proxy'),
  245. label='red')
  246. self.loop.run_until_complete(self.proxy.create_on_disk())
  247. self.proxy.provides_network = True
  248. self.proxy.netvm = self.testnetvm
  249. self.testvm1.netvm = self.proxy
  250. self.testvm2 = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  251. name=self.make_vm_name('vm3'),
  252. label='red')
  253. self.loop.run_until_complete(self.testvm2.create_on_disk())
  254. self.testvm2.netvm = self.proxy
  255. self.app.save()
  256. self.loop.run_until_complete(asyncio.wait([
  257. self.testvm1.start(),
  258. self.testvm2.start()]))
  259. self.assertNotEqual(self.run_cmd(self.testvm1,
  260. self.ping_cmd.format(target=self.testvm2.ip)), 0)
  261. self.testvm2.netvm = self.testnetvm
  262. self.assertNotEqual(self.run_cmd(self.testvm1,
  263. self.ping_cmd.format(target=self.testvm2.ip)), 0)
  264. self.assertNotEqual(self.run_cmd(self.testvm2,
  265. self.ping_cmd.format(target=self.testvm1.ip)), 0)
  266. self.testvm1.netvm = self.testnetvm
  267. self.assertNotEqual(self.run_cmd(self.testvm1,
  268. self.ping_cmd.format(target=self.testvm2.ip)), 0)
  269. self.assertNotEqual(self.run_cmd(self.testvm2,
  270. self.ping_cmd.format(target=self.testvm1.ip)), 0)
  271. def test_050_spoof_ip(self):
  272. """Test if VM IP spoofing is blocked"""
  273. self.loop.run_until_complete(self.testvm1.start())
  274. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0)
  275. self.loop.run_until_complete(self.testvm1.run_for_stdio('''
  276. ip addr flush dev eth0 &&
  277. ip addr add 10.137.1.128/24 dev eth0 &&
  278. ip route add default dev eth0 &&
  279. ''', user='root'))
  280. self.assertNotEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  281. "Spoofed ping should be blocked")
  282. def test_100_late_xldevd_startup(self):
  283. """Regression test for #1990"""
  284. # Simulater late xl devd startup
  285. cmd = "systemctl stop xendriverdomain"
  286. if self.run_cmd(self.testnetvm, cmd) != 0:
  287. self.fail("Command '%s' failed" % cmd)
  288. self.loop.run_until_complete(self.testvm1.start())
  289. cmd = "systemctl start xendriverdomain"
  290. if self.run_cmd(self.testnetvm, cmd) != 0:
  291. self.fail("Command '%s' failed" % cmd)
  292. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0)
  293. def test_200_fake_ip_simple(self):
  294. '''Test hiding VM real IP'''
  295. self.testvm1.features['net.fake-ip'] = '192.168.1.128'
  296. self.testvm1.features['net.fake-gateway'] = '192.168.1.1'
  297. self.testvm1.features['net.fake-netmask'] = '255.255.255.0'
  298. self.app.save()
  299. self.loop.run_until_complete(self.testvm1.start())
  300. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0)
  301. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0)
  302. try:
  303. (output, _) = self.loop.run_until_complete(
  304. self.testvm1.run_for_stdio(
  305. 'ip addr show dev eth0', user='root'))
  306. except subprocess.CalledProcessError:
  307. self.fail('ip addr show dev eth0 failed')
  308. output = output.decode()
  309. self.assertIn('192.168.1.128', output)
  310. self.assertNotIn(self.testvm1.ip, output)
  311. try:
  312. (output, _) = self.loop.run_until_complete(
  313. self.testvm1.run_for_stdio('ip route show', user='root'))
  314. except subprocess.CalledProcessError:
  315. self.fail('ip route show failed')
  316. output = output.decode()
  317. self.assertIn('192.168.1.1', output)
  318. self.assertNotIn(self.testvm1.netvm.ip, output)
  319. def test_201_fake_ip_without_gw(self):
  320. '''Test hiding VM real IP'''
  321. self.testvm1.features['net.fake-ip'] = '192.168.1.128'
  322. self.app.save()
  323. self.loop.run_until_complete(self.testvm1.start())
  324. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0)
  325. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0)
  326. try:
  327. (output, _) = self.loop.run_until_complete(
  328. self.testvm1.run_for_stdio('ip addr show dev eth0',
  329. user='root'))
  330. except subprocess.CalledProcessError:
  331. self.fail('ip addr show dev eth0 failed')
  332. output = output.decode()
  333. self.assertIn('192.168.1.128', output)
  334. self.assertNotIn(self.testvm1.ip, output)
  335. def test_202_fake_ip_firewall(self):
  336. '''Test hiding VM real IP, firewall'''
  337. self.testvm1.features['net.fake-ip'] = '192.168.1.128'
  338. self.testvm1.features['net.fake-gateway'] = '192.168.1.1'
  339. self.testvm1.features['net.fake-netmask'] = '255.255.255.0'
  340. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  341. name=self.make_vm_name('proxy'),
  342. label='red')
  343. self.proxy.provides_network = True
  344. self.loop.run_until_complete(self.proxy.create_on_disk())
  345. self.proxy.netvm = self.testnetvm
  346. self.testvm1.netvm = self.proxy
  347. self.app.save()
  348. if self.run_cmd(self.testnetvm, 'nc -h 2>&1|grep -q nmap.org') == 0:
  349. nc_version = NcVersion.Nmap
  350. else:
  351. nc_version = NcVersion.Trad
  352. # block all but ICMP and DNS
  353. self.testvm1.firewall.policy = 'drop'
  354. self.testvm1.firewall.rules = [
  355. qubes.firewall.Rule(None, action='accept', proto='icmp'),
  356. qubes.firewall.Rule(None, action='accept', specialtarget='dns'),
  357. ]
  358. self.testvm1.firewall.save()
  359. self.loop.run_until_complete(self.testvm1.start())
  360. self.assertTrue(self.proxy.is_running())
  361. nc = self.loop.run_until_complete(self.testnetvm.run(
  362. 'nc -l --send-only -e /bin/hostname -k 1234'
  363. if nc_version == NcVersion.Nmap
  364. else 'while nc -l -e /bin/hostname -p 1234; do true; done'))
  365. try:
  366. self.assertEqual(self.run_cmd(self.proxy, self.ping_ip), 0,
  367. "Ping by IP from ProxyVM failed")
  368. self.assertEqual(self.run_cmd(self.proxy, self.ping_name), 0,
  369. "Ping by name from ProxyVM failed")
  370. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  371. "Ping by IP should be allowed")
  372. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
  373. "Ping by name should be allowed")
  374. if nc_version == NcVersion.Nmap:
  375. nc_cmd = "nc -w 1 --recv-only {} 1234".format(self.test_ip)
  376. else:
  377. nc_cmd = "nc -w 1 {} 1234".format(self.test_ip)
  378. self.assertNotEqual(self.run_cmd(self.testvm1, nc_cmd), 0,
  379. "TCP connection should be blocked")
  380. finally:
  381. nc.terminate()
  382. self.loop.run_until_complete(nc.wait())
  383. def test_203_fake_ip_inter_vm_allow(self):
  384. '''Access VM with "fake IP" from other VM (when firewall allows)'''
  385. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  386. name=self.make_vm_name('proxy'),
  387. label='red')
  388. self.loop.run_until_complete(self.proxy.create_on_disk())
  389. self.proxy.provides_network = True
  390. self.proxy.netvm = self.testnetvm
  391. self.testvm1.netvm = self.proxy
  392. self.testvm1.features['net.fake-ip'] = '192.168.1.128'
  393. self.testvm1.features['net.fake-gateway'] = '192.168.1.1'
  394. self.testvm1.features['net.fake-netmask'] = '255.255.255.0'
  395. self.testvm2 = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  396. name=self.make_vm_name('vm3'),
  397. label='red')
  398. self.loop.run_until_complete(self.testvm2.create_on_disk())
  399. self.testvm2.netvm = self.proxy
  400. self.app.save()
  401. self.loop.run_until_complete(self.testvm1.start())
  402. self.loop.run_until_complete(self.testvm2.start())
  403. try:
  404. self.loop.run_until_complete(self.proxy.run_for_stdio(
  405. 'iptables -I FORWARD -s {} -d {} -j ACCEPT'.format(
  406. self.testvm2.ip, self.testvm1.ip), user='root'))
  407. except subprocess.CalledProcessError as e:
  408. self.fail('{} failed with: {}'.format(cmd, e.returncode))
  409. try:
  410. self.loop.run_until_complete(self.proxy.run_for_stdio(
  411. 'iptables -I INPUT -s {} -j ACCEPT'.format(
  412. self.testvm2.ip), user='root'))
  413. except subprocess.CalledProcessError as e:
  414. self.fail('{} failed with: {}'.format(cmd, e.returncode))
  415. self.assertEqual(self.run_cmd(self.testvm2,
  416. self.ping_cmd.format(target=self.testvm1.ip)), 0)
  417. try:
  418. (stdout, _) = self.loop.run_until_complete(
  419. self.testvm1.run_for_stdio(
  420. 'iptables -nvxL INPUT | grep {}'.format(self.testvm2.ip),
  421. user='root'))
  422. except subprocess.CalledProcessError as e:
  423. self.fail(
  424. '{} failed with {}'.format(cmd, e.returncode))
  425. self.assertNotEqual(stdout.decode().split()[0], '0',
  426. 'Packets didn\'t managed to the VM')
  427. def test_204_fake_ip_proxy(self):
  428. '''Test hiding VM real IP'''
  429. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  430. name=self.make_vm_name('proxy'),
  431. label='red')
  432. self.loop.run_until_complete(self.proxy.create_on_disk())
  433. self.proxy.provides_network = True
  434. self.proxy.netvm = self.testnetvm
  435. self.proxy.features['net.fake-ip'] = '192.168.1.128'
  436. self.proxy.features['net.fake-gateway'] = '192.168.1.1'
  437. self.proxy.features['net.fake-netmask'] = '255.255.255.0'
  438. self.testvm1.netvm = self.proxy
  439. self.app.save()
  440. self.loop.run_until_complete(self.testvm1.start())
  441. self.assertEqual(self.run_cmd(self.proxy, self.ping_ip), 0)
  442. self.assertEqual(self.run_cmd(self.proxy, self.ping_name), 0)
  443. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0)
  444. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0)
  445. try:
  446. (output, _) = self.loop.run_until_complete(
  447. self.proxy.run_for_stdio(
  448. 'ip addr show dev eth0', user='root'))
  449. except subprocess.CalledProcessError as e:
  450. self.fail('ip addr show dev eth0 failed')
  451. output = output.decode()
  452. self.assertIn('192.168.1.128', output)
  453. self.assertNotIn(self.testvm1.ip, output)
  454. try:
  455. (output, _) = self.loop.run_until_complete(
  456. self.proxy.run_for_stdio(
  457. 'ip route show', user='root'))
  458. except subprocess.CalledProcessError as e:
  459. self.fail('ip route show failed')
  460. output = output.decode()
  461. self.assertIn('192.168.1.1', output)
  462. self.assertNotIn(self.testvm1.netvm.ip, output)
  463. try:
  464. (output, _) = self.loop.run_until_complete(
  465. self.testvm1.run_for_stdio(
  466. 'ip addr show dev eth0', user='root'))
  467. except subprocess.CalledProcessError as e:
  468. self.fail('ip addr show dev eth0 failed')
  469. output = output.decode()
  470. self.assertNotIn('192.168.1.128', output)
  471. self.assertIn(self.testvm1.ip, output)
  472. try:
  473. (output, _) = self.loop.run_until_complete(
  474. self.testvm1.run_for_stdio(
  475. 'ip route show', user='root'))
  476. except subprocess.CalledProcessError as e:
  477. self.fail('ip route show failed')
  478. output = output.decode()
  479. self.assertIn('192.168.1.128', output)
  480. self.assertNotIn(self.proxy.ip, output)
  481. def test_210_custom_ip_simple(self):
  482. '''Custom AppVM IP'''
  483. self.testvm1.ip = '192.168.1.1'
  484. self.app.save()
  485. self.loop.run_until_complete(self.testvm1.start())
  486. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0)
  487. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0)
  488. def test_211_custom_ip_proxy(self):
  489. '''Custom ProxyVM IP'''
  490. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  491. name=self.make_vm_name('proxy'),
  492. label='red')
  493. self.loop.run_until_complete(self.proxy.create_on_disk())
  494. self.proxy.provides_network = True
  495. self.proxy.netvm = self.testnetvm
  496. self.proxy.ip = '192.168.1.1'
  497. self.testvm1.netvm = self.proxy
  498. self.app.save()
  499. self.loop.run_until_complete(self.testvm1.start())
  500. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0)
  501. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0)
  502. def test_212_custom_ip_firewall(self):
  503. '''Custom VM IP and firewall'''
  504. self.testvm1.ip = '192.168.1.1'
  505. self.proxy = self.app.add_new_vm(qubes.vm.appvm.AppVM,
  506. name=self.make_vm_name('proxy'),
  507. label='red')
  508. self.proxy.provides_network = True
  509. self.loop.run_until_complete(self.proxy.create_on_disk())
  510. self.proxy.netvm = self.testnetvm
  511. self.testvm1.netvm = self.proxy
  512. self.app.save()
  513. if self.run_cmd(self.testnetvm, 'nc -h 2>&1|grep -q nmap.org') == 0:
  514. nc_version = NcVersion.Nmap
  515. else:
  516. nc_version = NcVersion.Trad
  517. # block all but ICMP and DNS
  518. self.testvm1.firewall.policy = 'drop'
  519. self.testvm1.firewall.rules = [
  520. qubes.firewall.Rule(None, action='accept', proto='icmp'),
  521. qubes.firewall.Rule(None, action='accept', specialtarget='dns'),
  522. ]
  523. self.testvm1.firewall.save()
  524. self.loop.run_until_complete(self.testvm1.start())
  525. self.assertTrue(self.proxy.is_running())
  526. nc = self.loop.run_until_complete(self.testnetvm.run(
  527. 'nc -l --send-only -e /bin/hostname -k 1234'
  528. if nc_version == NcVersion.Nmap
  529. else 'while nc -l -e /bin/hostname -p 1234; do true; done'))
  530. try:
  531. self.assertEqual(self.run_cmd(self.proxy, self.ping_ip), 0,
  532. "Ping by IP from ProxyVM failed")
  533. self.assertEqual(self.run_cmd(self.proxy, self.ping_name), 0,
  534. "Ping by name from ProxyVM failed")
  535. self.assertEqual(self.run_cmd(self.testvm1, self.ping_ip), 0,
  536. "Ping by IP should be allowed")
  537. self.assertEqual(self.run_cmd(self.testvm1, self.ping_name), 0,
  538. "Ping by name should be allowed")
  539. if nc_version == NcVersion.Nmap:
  540. nc_cmd = "nc -w 1 --recv-only {} 1234".format(self.test_ip)
  541. else:
  542. nc_cmd = "nc -w 1 {} 1234".format(self.test_ip)
  543. self.assertNotEqual(self.run_cmd(self.testvm1, nc_cmd), 0,
  544. "TCP connection should be blocked")
  545. finally:
  546. nc.terminate()
  547. self.loop.run_until_complete(nc.wait())
  548. # noinspection PyAttributeOutsideInit
  549. class VmUpdatesMixin(object):
  550. """
  551. Tests for VM updates
  552. """
  553. # filled by load_tests
  554. template = None
  555. # made this way to work also when no package build tools are installed
  556. """
  557. $ cat test-pkg.spec:
  558. Name: test-pkg
  559. Version: 1.0
  560. Release: 1%{?dist}
  561. Summary: Test package
  562. Group: System
  563. License: GPL
  564. URL: http://example.com/
  565. %description
  566. Test package
  567. %files
  568. %changelog
  569. $ rpmbuild -bb test-pkg.spec
  570. $ cat test-pkg-1.0-1.fc21.x86_64.rpm | gzip | base64
  571. """
  572. RPM_PACKAGE_GZIP_BASE64 = (
  573. b"H4sIAPzRLlYAA+2Y728URRjHn7ueUCkERKJVJDnTxLSxs7293o8WOER6ljYYrtKCLUSa3"
  574. b"bnZ64bd22VmTq8nr4wJbwxvjNHIG0x8oTHGGCHB8AcYE1/0lS80GgmQFCJU3wgB4ZjdfZ"
  575. b"q2xDe8NNlvMjfzmeeZH7tPbl98b35169cOUEpIJiTxT9SIrmVUs2hWh8dUAp54dOrM14s"
  576. b"JHK4D2DKl+j2qrVfjsuq3qEWbohjuAB2Lqk+p1o/8Z5QPmSi/YwnjezH+F8bLQZjqllW0"
  577. b"hvODRmFIL5hFk9JMXi/mi5ZuDleNwSEzP5wtmLnouNQnm3/6fndz7FLt9M/Hruj37gav4"
  578. b"tTjPnasWLFixYoVK1asWLFixYoV63+p0KNot9vnIPQc1vgYOwCSgXfxCoS+QzKHOVXVOj"
  579. b"Fn2ccIfI0k8nXkLuQbyJthxed4UrVnkG8i9yDfgsj3yCAv4foc8t+w1hf5B+Nl5Du43xj"
  580. b"yvxivIN9HpsgPkO2IU9uQfeRn8Xk/iJ4x1Y3nfxH1qecwfhH5+YgT25F7o/0SRdxvOppP"
  581. b"7MX9ZjB/DNnE/OOYX404uRGZIT+FbCFvQ3aQ8f0+/WF0XjJ8nyOw7H+BrmUA/a8pNZf2D"
  582. b"XrCqLG1cERbWHI8ajhznpBY9P0Tr8PkvJDMhTkp/Z0DA6xpuL7DNOq5A+DY9UYTmkOF2U"
  583. b"IO/sNt0wSnGvfdlZssD3rVIlLI9UUX37C6qXzHNntHPNfnTAhWHbUddtBwmegDjAUzZbu"
  584. b"m9lqZmzDmHc8Ik8WY8Tab4Myym4+Gx8V0qw8GtYyWIzrktEJwV9UHv3ktG471rAqHTmFQ"
  585. b"685V5uGqIalk06SWJr7tszR503Ac9cs493jJ8rhrSCIYbXBbzqt5v5+UZ0crh6bGR2dmJ"
  586. b"yuHD428VlLLLdakzJe2VxcKhFSFID73JKPS40RI7tXVCcQ3uOGWhPCJ2bAspiJ2i5Vy6n"
  587. b"jOqMerpEYpEe/Yks4xkU4Tt6BirmzUWanG6ozbFKhve9BsQRaLRTirzqk7hgUktXojKnf"
  588. b"n8jeg3X4QepP3i63po6oml+9t/CwJLya2Bn/ei6f7/4B3Ycdb0L3pt5Q5mNz16rWJ9fLk"
  589. b"vvOff/nxS7//8O2P2gvt7nDDnoV9L1du9N4+ucjl9u/8+a7dC5Nnvjlv9Ox5r+v9Cy0NE"
  590. b"m+c6rv60S/dZw98Gn6MNswcfQiWUvg3wBUAAA=="
  591. )
  592. """
  593. Minimal package generated by running dh_make on empty directory
  594. Then cat test-pkg_1.0-1_amd64.deb | gzip | base64
  595. """
  596. DEB_PACKAGE_GZIP_BASE64 = (
  597. b"H4sIACTXLlYAA1O0SSxKzrDjSklNykzM003KzEssqlRQUDA0MTG1NDQwNDVTUDBQAAEIa"
  598. b"WhgYGZioqBgogADCVxGegZcyfl5JUX5OXoliUV66VVE6DcwheuX7+ZgAAEW5rdXHb0PG4"
  599. b"iwf5j3WfMT6zWzzMuZgoE3jjYraNzbbFKWGms0SaRw/r2SV23WZ4IdP8preM4yqf0jt95"
  600. b"3c8qnacfNxJUkf9/w+/3X9ph2GEdgQdixrz/niHKKTnYXizf4oSC7tHOz2Zzq+/6vn8/7"
  601. b"ezQ7c1tmi7xZ3SGJ4yzhT2dcr7V+W3zM5ZPu/56PSv4Zdok+7Yv/V/6buWaKVlFkkV58S"
  602. b"N3GmLgnqzRmeZ3V3ymmurS5fGa85/LNx1bpZMin3S6dvXKqydp3ubP1vmyarJZb/qSh62"
  603. b"C8oIdxqm/BtvkGDza+On/Vfv2py7/0LV7VH+qR6a+bkKUbHXt5/SG187d+nps1a5PJfMO"
  604. b"i11dWcUe1HjwaW3Q5RHXn9LmcHy+tW9YcKf0768XVB1t3R0bKrzs5t9P+6r7rZ99svH10"
  605. b"+Q6F/o8tf1fO/32y+fWa14eifd+WxUy0jcxYH7N9/tUvmnUZL74pW32qLeuRU+ZwYGASa"
  606. b"GBgUWBgxM90ayy3VdmykkGDgYErJbEkERydFVWQmCMQo8aWZvAY/WteFRHFwMCYqXTPjI"
  607. b"lBkVEMGLsl+k8XP1D/z+gXyyDOvUemlnHqAVkvu0rRQ2fUFodkN3mtU9uwhqk8V+TqPEE"
  608. b"Nc7fzoQ4n71lqRs/7kbbT0+qOZuKH4r8mjzsc1k/YkCHN8Pjg48fbpE+teHa96LNcfu0V"
  609. b"5n2/Z2xa2KDvaCOx8cqBFxc514uZ3TmadXS+6cpzU7wSzq5SWfapJOD9n6wLXSwtlgxZh"
  610. b"xITzWW7buhx/bb291RcVlEfeC9K5hlrqunSzIMSZT7/Nqgc/qMvMNW227WI8ezB8mVuZh"
  611. b"0hERJSvysfburr4Dx0I9BW57UwR4+e1gxu49PcEt8sbK18Xpvt//Hj5UYm+Zc25q+T4xl"
  612. b"rJvxfVnh80oadq57OZxPaU1bbztv1yF365W4t45Yr+XrFzov237GVY1Zgf7NvE4+W2SuR"
  613. b"lQtLauR1TQ/mbOiIONYya6tU1jPGpWfk/i1+ttiXe3ZO14n0YOWggndznjGlGLyfVbBC6"
  614. b"MRP5aMM7aCco/s7sZqB8RlTQwADw8rnuT/sDHi7mUASjJFRAAbWwNLiAwAA"
  615. )
  616. def run_cmd(self, vm, cmd, user="root"):
  617. try:
  618. self.loop.run_until_complete(vm.run_for_stdio(cmd))
  619. except subprocess.CalledProcessError as e:
  620. return e.returncode
  621. return 0
  622. def setUp(self):
  623. super(VmUpdatesMixin, self).setUp()
  624. self.update_cmd = None
  625. if self.template.count("debian"):
  626. self.update_cmd = "set -o pipefail; apt-get update 2>&1 | " \
  627. "{ ! grep '^W:\|^E:'; }"
  628. self.install_cmd = "apt-get install -y {}"
  629. self.install_test_cmd = "dpkg -l {}"
  630. self.exit_code_ok = [0]
  631. elif self.template.count("fedora"):
  632. cmd = "yum"
  633. try:
  634. # assume template name in form "fedora-XX-suffix"
  635. if int(self.template.split("-")[1]) > 21:
  636. cmd = "dnf"
  637. except ValueError:
  638. pass
  639. self.update_cmd = "{cmd} clean all; {cmd} check-update".format(
  640. cmd=cmd)
  641. self.install_cmd = cmd + " install -y {}"
  642. self.install_test_cmd = "rpm -q {}"
  643. self.exit_code_ok = [0, 100]
  644. else:
  645. self.skipTest("Template {} not supported by this test".format(
  646. self.template))
  647. self.init_default_template(self.template)
  648. self.init_networking()
  649. self.testvm1 = self.app.add_new_vm(
  650. qubes.vm.appvm.AppVM,
  651. name=self.make_vm_name('vm1'),
  652. label='red')
  653. self.loop.run_until_complete(self.testvm1.create_on_disk())
  654. def test_000_simple_update(self):
  655. self.app.save()
  656. # reload the VM to have all the properties properly set (especially
  657. # default netvm)
  658. self.testvm1 = self.app.domains[self.testvm1.qid]
  659. self.loop.run_until_complete(self.testvm1.start())
  660. p = self.loop.run_until_complete(
  661. self.testvm1.run(self.update_cmd, user='root'))
  662. (stdout, stderr) = self.loop.run_until_complete(p.communicate())
  663. self.assertIn(p.returncode, self.exit_code_ok,
  664. '{}: {}\n{}'.format(self.update_cmd, stdout, stderr))
  665. def create_repo_apt(self):
  666. pkg_file_name = "test-pkg_1.0-1_amd64.deb"
  667. self.loop.run_until_complete(self.netvm_repo.run_for_stdio('''
  668. mkdir /tmp/apt-repo \
  669. && cd /tmp/apt-repo \
  670. && base64 -d | zcat > {}
  671. '''.format(pkg_file_name),
  672. input=self.DEB_PACKAGE_GZIP_BASE64))
  673. # do not assume dpkg-scanpackage installed
  674. packages_path = "dists/test/main/binary-amd64/Packages"
  675. self.loop.run_until_complete(self.netvm_repo.run_for_stdio('''
  676. mkdir -p /tmp/apt-repo/dists/test/main/binary-amd64 \
  677. && cd /tmp/apt-repo \
  678. && cat > {packages} \
  679. && echo MD5sum: $(openssl md5 -r {pkg} | cut -f 1 -d ' ') \
  680. >> {packages} \
  681. && echo SHA1: $(openssl sha1 -r {pkg} | cut -f 1 -d ' ') \
  682. >> {packages} \
  683. && echo SHA256: $(openssl sha256 -r {pkg} | cut -f 1 -d ' ') \
  684. >> {packages} \
  685. && gzip < {packages} > {packages}.gz
  686. '''.format(pkg=pkg_file_name, packages=packages_path),
  687. input='''\
  688. Package: test-pkg
  689. Version: 1.0-1
  690. Architecture: amd64
  691. Maintainer: unknown <user@host>
  692. Installed-Size: 25
  693. Filename: {pkg}
  694. Size: 994
  695. Section: unknown
  696. Priority: optional
  697. Description: Test package'''.format(pkg=pkg_file_name).encode('utf-8')))
  698. self.loop.run_until_complete(self.netvm_repo.run_for_stdio('''
  699. mkdir -p /tmp/apt-repo/dists/test \
  700. && cd /tmp/apt-repo/dists/test \
  701. && cat > Release \
  702. && echo '' $(sha256sum {p} | cut -f 1 -d ' ') $(stat -c %s {p}) {p}\
  703. >> Release \
  704. && echo '' $(sha256sum {z} | cut -f 1 -d ' ') $(stat -c %s {z}) {z}\
  705. >> Release
  706. '''.format(p='main/binary-amd64/Packages',
  707. z='main/binary-amd64/Packages.gz'),
  708. input='''\
  709. Label: Test repo
  710. Suite: test
  711. Codename: test
  712. Date: Tue, 27 Oct 2015 03:22:09 UTC
  713. Architectures: amd64
  714. Components: main
  715. SHA256:
  716. '''))
  717. def create_repo_yum(self):
  718. pkg_file_name = "test-pkg-1.0-1.fc21.x86_64.rpm"
  719. self.loop.run_until_complete(self.netvm_repo.run_for_stdio('''
  720. mkdir /tmp/yum-repo \
  721. && cd /tmp/yum-repo \
  722. && base64 -d | zcat > {}
  723. '''.format(pkg_file_name), input=self.RPM_PACKAGE_GZIP_BASE64))
  724. # createrepo is installed by default in Fedora template
  725. self.loop.run_until_complete(self.netvm_repo.run_for_stdio(
  726. 'createrepo /tmp/yum-repo'))
  727. def create_repo_and_serve(self):
  728. if self.template.count("debian") or self.template.count("whonix"):
  729. self.create_repo_apt()
  730. self.loop.run_until_complete(self.netvm_repo.run(
  731. 'cd /tmp/apt-repo && python -m SimpleHTTPServer 8080'))
  732. elif self.template.count("fedora"):
  733. self.create_repo_yum()
  734. self.loop.run_until_complete(self.netvm_repo.run(
  735. 'cd /tmp/yum-repo && python -m SimpleHTTPServer 8080'))
  736. else:
  737. # not reachable...
  738. self.skipTest("Template {} not supported by this test".format(
  739. self.template))
  740. def configure_test_repo(self):
  741. """
  742. Configure test repository in test-vm and disable rest of them.
  743. The critical part is to use "localhost" - this will work only when
  744. accessed through update proxy and this is exactly what we want to
  745. test here.
  746. """
  747. if self.template.count("debian") or self.template.count("whonix"):
  748. self.loop.run_until_complete(self.testvm1.run_for_stdio(
  749. "rm -f /etc/apt/sources.list.d/* &&"
  750. "echo 'deb [trusted=yes] http://localhost:8080 test main' "
  751. "> /etc/apt/sources.list",
  752. user="root"))
  753. elif self.template.count("fedora"):
  754. self.loop.run_until_complete(self.testvm1.run_for_stdio(
  755. "rm -f /etc/yum.repos.d/*.repo &&"
  756. "echo '[test]' > /etc/yum.repos.d/test.repo &&"
  757. "echo 'name=Test repo' >> /etc/yum.repos.d/test.repo &&"
  758. "echo 'gpgcheck=0' >> /etc/yum.repos.d/test.repo &&"
  759. "echo 'baseurl=http://localhost:8080/'"
  760. " >> /etc/yum.repos.d/test.repo",
  761. user="root"
  762. ))
  763. else:
  764. # not reachable...
  765. self.skipTest("Template {} not supported by this test".format(
  766. self.template))
  767. def test_010_update_via_proxy(self):
  768. """
  769. Test both whether updates proxy works and whether is actually used by the VM
  770. """
  771. if self.template.count("minimal"):
  772. self.skipTest("Template {} not supported by this test".format(
  773. self.template))
  774. self.netvm_repo = self.app.add_new_vm(
  775. qubes.vm.appvm.AppVM,
  776. name=self.make_vm_name('net'),
  777. label='red')
  778. self.netvm_repo.provides_network = True
  779. self.loop.run_until_complete(self.netvm_repo.create_on_disk())
  780. self.testvm1.netvm = self.netvm_repo
  781. # NetVM should have qubes-updates-proxy enabled by default
  782. #self.netvm_repo.features['qubes-updates-proxy'] = True
  783. # TODO: consider also adding a test for the template itself
  784. self.testvm1.features['updates-proxy-setup'] = True
  785. self.app.save()
  786. # Setup test repo
  787. self.loop.run_until_complete(self.netvm_repo.start())
  788. self.create_repo_and_serve()
  789. # Configure local repo
  790. self.loop.run_until_complete(self.testvm1.start())
  791. self.configure_test_repo()
  792. # update repository metadata
  793. p = self.loop.run_until_complete(self.testvm1.run(
  794. self.update_cmd, user='root'))
  795. (stdout, stderr) = self.loop.run_until_complete(p.communicate())
  796. self.assertIn(self.loop.run_until_complete(p.wait()), self.exit_code_ok,
  797. '{}: {}\n{}'.format(self.update_cmd, stdout, stderr))
  798. # install test package
  799. p = self.loop.run_until_complete(self.testvm1.run(
  800. self.install_cmd.format('test-pkg'), user='root'))
  801. (stdout, stderr) = self.loop.run_until_complete(p.communicate())
  802. self.assertIn(self.loop.run_until_complete(p.wait()), self.exit_code_ok,
  803. '{}: {}\n{}'.format(self.update_cmd, stdout, stderr))
  804. # verify if it was really installed
  805. p = self.loop.run_until_complete(self.testvm1.run(
  806. self.install_test_cmd.format('test-pkg'), user='root'))
  807. (stdout, stderr) = self.loop.run_until_complete(p.communicate())
  808. self.assertIn(self.loop.run_until_complete(p.wait()), self.exit_code_ok,
  809. '{}: {}\n{}'.format(self.update_cmd, stdout, stderr))
  810. def load_tests(loader, tests, pattern):
  811. try:
  812. app = qubes.Qubes()
  813. templates = [vm.name for vm in app.domains if
  814. isinstance(vm, qubes.vm.templatevm.TemplateVM)]
  815. except OSError:
  816. templates = []
  817. for template in templates:
  818. tests.addTests(loader.loadTestsFromTestCase(
  819. type(
  820. 'VmNetworking_' + template,
  821. (VmNetworkingMixin, qubes.tests.SystemTestCase),
  822. {'template': template})))
  823. tests.addTests(loader.loadTestsFromTestCase(
  824. type(
  825. 'VmUpdates_' + template,
  826. (VmUpdatesMixin, qubes.tests.SystemTestCase),
  827. {'template': template})))
  828. return tests