Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

updates-proxy: explicitly block connection looping back to the proxy IP

Browse Source 
Explicitly block something like "curl http://10.137.255.254:8082" and
return error page in this case. This error page is used in Whonix to
detect if the proxy is torrified. If not blocked, it may happen that
empty response is returned instead of error. See linked ticket for
details.

Fixes QubesOS/qubes-issues#1482
This commit is contained in:
Marek Marczykowski-Górecki 2015-12-04 14:57:07 +01:00
parent 5aa0f32c78
commit 181c15f422
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
4 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Makefile
View File

@ -185,6 +185,7 @@ install-common:
install network/{qubes-nmhook,30-qubes-external-ip} $(DESTDIR)/etc/NetworkManager/dispatcher.d/ install network/{qubes-nmhook,30-qubes-external-ip} $(DESTDIR)/etc/NetworkManager/dispatcher.d/
install -D network/vif-route-qubes $(DESTDIR)/etc/xen/scripts/vif-route-qubes install -D network/vif-route-qubes $(DESTDIR)/etc/xen/scripts/vif-route-qubes
install -m 0644 -D network/tinyproxy-updates.conf $(DESTDIR)/etc/tinyproxy/tinyproxy-updates.conf install -m 0644 -D network/tinyproxy-updates.conf $(DESTDIR)/etc/tinyproxy/tinyproxy-updates.conf
install -m 0644 -D network/updates-blacklist $(DESTDIR)/etc/tinyproxy/updates-blacklist
install -m 0755 -D network/iptables-updates-proxy $(DESTDIR)$(LIBDIR)/qubes/iptables-updates-proxy install -m 0755 -D network/iptables-updates-proxy $(DESTDIR)$(LIBDIR)/qubes/iptables-updates-proxy
install -d $(DESTDIR)/etc/xdg/autostart install -d $(DESTDIR)/etc/xdg/autostart
install -m 0755 network/show-hide-nm-applet.sh $(DESTDIR)$(LIBDIR)/qubes/show-hide-nm-applet.sh install -m 0755 network/show-hide-nm-applet.sh $(DESTDIR)$(LIBDIR)/qubes/show-hide-nm-applet.sh

5
network/tinyproxy-updates.conf
View File

@ -22,3 +22,8 @@ Allow 10.137.0.0/16
ConnectPort 443 ConnectPort 443
# Explicitly block connections to the proxy IP, to return an error in such
# case. This error page contains a magic string which is used in Whonix to
# detect whether proxy is torified or not.
# See https://github.com/qubesos/qubes-issues/issues/1482 for details
Filter "/etc/tinyproxy/updates-blacklist"

1
network/updates-blacklist Normal file
View File

@ -0,0 +1 @@
10.137.255.254

1
rpm_spec/core-vm.spec
View File

@ -331,6 +331,7 @@ rm -f %{name}-%{version}
%config(noreplace) /etc/qubes/iptables.rules %config(noreplace) /etc/qubes/iptables.rules
%config(noreplace) /etc/qubes/ip6tables.rules %config(noreplace) /etc/qubes/ip6tables.rules
%config(noreplace) /etc/tinyproxy/tinyproxy-updates.conf %config(noreplace) /etc/tinyproxy/tinyproxy-updates.conf
%config(noreplace) /etc/tinyproxy/updates-blacklist
%config(noreplace) /etc/udev/rules.d/50-qubes-misc.rules %config(noreplace) /etc/udev/rules.d/50-qubes-misc.rules
%config(noreplace) /etc/udev/rules.d/99-qubes-network.rules %config(noreplace) /etc/udev/rules.d/99-qubes-network.rules
/etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop /etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop