2c6c476410
This helps hiding VM IP for anonymous VMs (Whonix) even when some application leak it. VM will know only some fake IP, which should be set to something as common as possible. The feature is mostly implemented at (Proxy)VM side using NAT in separate network namespace. Core here is only passing arguments to it. It is designed the way that multiple VMs can use the same IP and still do not interfere with each other. Even more: it is possible to address each of them (using their "native" IP), even when multiple of them share the same "fake" IP. Original approach (marmarek/old-qubes-core-admin#2) used network script arguments by appending them to script name, but libxl in Xen >= 4.6 fixed that side effect and it isn't possible anymore. So use QubesDB instead. From user POV, this adds 3 "features": - net/fake-ip - IP address visible in the VM - net/fake-gateway - default gateway in the VM - net/fake-netmask - network mask The feature is enabled if net/fake-ip is set (to some IP address) and is different than VM native IP. All of those "features" can be set on template, to affect all of VMs. Firewall rules etc in (Proxy)VM should still be applied to VM "native" IP. Fixes QubesOS/qubes-issues#1143 |
||
|---|---|---|
| ci | ||
| contrib | ||
| core | ||
| core-modules | ||
| dispvm | ||
| doc | ||
| etc | ||
| linux | ||
| qubes | ||
| qubes-rpc | ||
| qubes-rpc-policy | ||
| qvm-tools | ||
| relaxng | ||
| rpm_spec | ||
| templates | ||
| test-packages | ||
| tests | ||
| .coveragerc | ||
| .gitignore | ||
| .pylintrc | ||
| .travis.yml | ||
| installer.wxs | ||
| LICENSE | ||
| Makefile | ||
| Makefile.builder | ||
| README.md | ||
| run-tests | ||
| setup.cfg | ||
| setup.py | ||
| version | ||
Qubes core, version 3
This is development branch of the Qubes OS core. This branch is subject to rebase without warning until further notice.
API documentation is available: https://qubes-core-admin.readthedocs.org/en/latest/.