Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge branch 'master' of ssh://git.qubes-os.org/var/lib/qubes/git/joanna/core

Browse Source
This commit is contained in:
Marek Marczykowski 2011-08-31 18:22:00 +02:00
commit 84ff7b802a
2 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
common/setup_ip
View File

@ -19,6 +19,7 @@ if [ x$ip != x ]; then
echo "NS1=$gateway" > /var/run/qubes/qubes_ns echo "NS1=$gateway" > /var/run/qubes/qubes_ns
echo "NS2=$secondary_dns" >> /var/run/qubes/qubes_ns echo "NS2=$secondary_dns" >> /var/run/qubes/qubes_ns
/usr/lib/qubes/qubes_setup_dnat_to_ns /usr/lib/qubes/qubes_setup_dnat_to_ns
[ -x /rw/config/qubes_ip_change_hook ] && /rw/config/qubes_ip_change_hook
fi fi
fi fi

16
proxyvm/bin/qubes_firewall
View File

@ -13,11 +13,20 @@ echo $$ >$PIDFILE
trap 'exit 0' SIGTERM trap 'exit 0' SIGTERM
while true; do while true; do
echo "1" > /proc/sys/net/ipv4/ip_forward
# Wait for changes in xenstore file # Wait for changes in xenstore file
/usr/bin/xenstore-watch-qubes $XENSTORE_IPTABLES /usr/bin/xenstore-watch-qubes $XENSTORE_IPTABLES
TRIGGER=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES) TRIGGER=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES)
if ! [ "$TRIGGER" = "reload" ]; then continue ; fi if ! [ "$TRIGGER" = "reload" ]; then continue ; fi
# Disable forarding to prevent potential "leaks" that might
# be bypassing the firewall or some proxy service (e.g. tor)
# during the time when the rules are being (re)applied
echo "0" > /proc/sys/net/ipv4/ip_forward
RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES_HEADER) RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES_HEADER)
IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d') IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d')
OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || :` OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || :`
@ -31,8 +40,7 @@ while true; do
if [ "$OUT" ]; then if [ "$OUT" ]; then
DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || : DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || :
fi fi
if [[ -z "$OUT" ]]; then
# If OK save it for later # Check if user didn't define some custom rules to be applied as well...
/sbin/service iptables save >/dev/null [ -x /rw/config/qubes_firewall_user_script ] && /rw/config/qubes_firewall_user_script
fi
done done