Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

network: stop IP forwarding before disabling firewall

Browse Source 
Stop IP forwarding when stopping qubes-network service (which initially
enables it). This makes ordering against qubes-firewall safe - firewall
is applied before allowing IP forward and then is removed when IP
forward is already disabled.

Fixes QubesOS/qubes-issues#5599
This commit is contained in:
Marek Marczykowski-Górecki 2020-11-12 00:53:48 +01:00
parent f66a494cc2
commit 0caa7fcf75
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
4 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
debian/qubes-core-agent-networking.install vendored
View File

@ -13,6 +13,7 @@ lib/systemd/system/qubes-iptables.service
lib/systemd/system/qubes-network.service
lib/systemd/system/qubes-updates-proxy.service
usr/lib/qubes/init/network-proxy-setup.sh
usr/lib/qubes/init/network-proxy-stop.sh
usr/lib/qubes/init/qubes-iptables
usr/lib/qubes/iptables-updates-proxy
usr/lib/qubes/qubes-setup-dnat-to-ns

1
rpm_spec/core-agent.spec.in
View File

@ -799,6 +799,7 @@ rm -f %{name}-%{version}
/lib/systemd/system/qubes-network.service
/lib/systemd/system/qubes-updates-proxy.service
/usr/lib/qubes/init/network-proxy-setup.sh
/usr/lib/qubes/init/network-proxy-stop.sh
/usr/lib/qubes/init/qubes-iptables
/usr/lib/qubes/iptables-updates-proxy
/usr/lib/qubes/qubes-setup-dnat-to-ns

7
vm-systemd/network-proxy-stop.sh Executable file
View File

@ -0,0 +1,7 @@
#!/bin/sh
echo 0 > /proc/sys/net/ipv4/ip_forward
# disable also IPv6 forwarding, if IPv6 applicable
if [ -w /proc/sys/net/ipv6/conf/all/forwarding ]; then
echo 0 > /proc/sys/net/ipv6/conf/all/forwarding
fi

1
vm-systemd/qubes-network.service
View File

@ -8,6 +8,7 @@ After=network-pre.target qubes-iptables.service
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/lib/qubes/init/network-proxy-setup.sh
ExecStop=/usr/lib/qubes/init/network-proxy-stop.sh
[Install]
WantedBy=multi-user.target