Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

firewall: don't crash the whole qubes-firewall service on DNS fail

Browse Source 
If DNS resolution fails, just block the traffic (for this VM), but don't
crash the whole service.

Fixes QubesOS/qubes-issues#3277
This commit is contained in:
Marek Marczykowski-Górecki 2017-12-28 05:15:00 +01:00
parent 180146a5c2
commit 3a83623647
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
qubesagent/firewall.py
View File

@ -248,8 +248,12 @@ class IptablesWorker(FirewallWorker):
elif 'dst6' in rule: elif 'dst6' in rule:
dsthosts = [rule['dst6']] dsthosts = [rule['dst6']]
elif 'dsthost' in rule: elif 'dsthost' in rule:
try:
addrinfo = socket.getaddrinfo(rule['dsthost'], None, addrinfo = socket.getaddrinfo(rule['dsthost'], None,
(socket.AF_INET6 if family == 6 else socket.AF_INET)) (socket.AF_INET6 if family == 6 else socket.AF_INET))
except socket.gaierror as e:
raise RuleParseError('Failed to resolve {}: {}'.format(
rule['dsthost'], str(e)))
dsthosts = set(item[4][0] + fullmask for item in addrinfo) dsthosts = set(item[4][0] + fullmask for item in addrinfo)
else: else:
dsthosts = None dsthosts = None
@ -458,8 +462,12 @@ class NftablesWorker(FirewallWorker):
elif 'dst6' in rule: elif 'dst6' in rule:
nft_rule += ' ip6 daddr {}'.format(rule['dst6']) nft_rule += ' ip6 daddr {}'.format(rule['dst6'])
elif 'dsthost' in rule: elif 'dsthost' in rule:
try:
addrinfo = socket.getaddrinfo(rule['dsthost'], None, addrinfo = socket.getaddrinfo(rule['dsthost'], None,
(socket.AF_INET6 if family == 6 else socket.AF_INET)) (socket.AF_INET6 if family == 6 else socket.AF_INET))
except socket.gaierror as e:
raise RuleParseError('Failed to resolve {}: {}'.format(
rule['dsthost'], str(e)))
nft_rule += ' {} daddr {{ {} }}'.format(ip_match, nft_rule += ' {} daddr {{ {} }}'.format(ip_match,
', '.join(set(item[4][0] + fullmask for item in addrinfo))) ', '.join(set(item[4][0] + fullmask for item in addrinfo)))