core-agent-linux/network/qubes-firewall

#!/bin/sh
set -e

PIDFILE=/var/run/qubes/qubes-firewall.pid
XENSTORE_IPTABLES=/qubes-iptables
XENSTORE_IPTABLES_HEADER=/qubes-iptables-header
XENSTORE_ERROR=/qubes-iptables-error
OLD_RULES=""
# PIDfile handling
[ -e "$PIDFILE" ] && kill -s 0 $(cat "$PIDFILE") 2>/dev/null && exit 0
echo $$ >$PIDFILE

trap 'exit 0' TERM

FIRST_TIME=yes

while true; do

	echo "1" > /proc/sys/net/ipv4/ip_forward

	if [ "$FIRST_TIME" ]; then
		FIRST_TIME=
		TRIGGER=reload
	else
		# Wait for changes in qubesdb file
		qubesdb-watch $XENSTORE_IPTABLES
		TRIGGER=$(qubesdb-read $XENSTORE_IPTABLES)
	fi

	if ! [ "$TRIGGER" = "reload" ]; then continue ; fi

	# Disable forwarding to prevent potential "leaks" that might
	# be bypassing the firewall or some proxy service (e.g. tor)
	# during the time when the rules are being (re)applied
	echo "0" > /proc/sys/net/ipv4/ip_forward

	RULES=$(qubesdb-read $XENSTORE_IPTABLES_HEADER)
	IPTABLES_SAVE=$(iptables-save | sed '/^\*filter/,/^COMMIT/d')
	OUT=$(printf '%s\n%s\n' "$RULES" "$IPTABLES_SAVE" | sed 's/\\n\|\\x0a/\n/g' | iptables-restore 2>&1 || true)

	for i in $(qubesdb-list -f /qubes-iptables-domainrules) ; do
		RULES=$(qubesdb-read "$i")
		ERRS=$(printf '%s\n' "$RULES" | sed 's/\\n\|\\x0a/\n/g' | /sbin/iptables-restore -n 2>&1 || true)
		if [ -n "$ERRS" ]; then
			echo "Failed applying rules for $i: $ERRS" >&2
			OUT="$OUT$ERRS"
		fi
	done
	qubesdb-write $XENSTORE_ERROR "$OUT"
	if [ -n "$OUT" ]; then
		DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($(hostname))" "$OUT" || :
	fi

	if [ `systemctl is-active qubes-updates-proxy` = "active" ]; then
		iptables -I INPUT -i vif+ -p tcp --dport 8082 -j ACCEPT
	fi

	# Check if user didn't define some custom rules to be applied as well...
	[ -x /rw/config/qubes-firewall-user-script ] && /rw/config/qubes-firewall-user-script
	# XXX: Backward compatibility
	[ -x /rw/config/qubes_firewall_user_script ] && /rw/config/qubes_firewall_user_script
done