network: rewrite qubes-firewall daemon

This rewrite is mainly to adopt new interface for Qubes 4.x.
Main changes:
 - change language from bash to python, introduce qubesagent python package
 - support both nftables (preferred) and iptables
 - new interface (https://qubes-os.org/doc/vm-interface/)
 - IPv6 support
 - unit tests included
 - nftables version support running along with other firewall loaded

Fixes QubesOS/qubes-issues#1815
QubesOS/qubes-issues#718

Makefile

@@ -146,6 +146,11 @@ install-common:
 	$(MAKE) -C autostart-dropins install
 	install -m 0644 -D misc/fstab $(DESTDIR)/etc/fstab
 
+	# force /usr/bin before /bin to have /usr/bin/python instead of /bin/python
+	PATH="/usr/bin:$(PATH)" python setup.py install -O1 --root $(DESTDIR)
+	mkdir -p $(DESTDIR)$(SBINDIR)
+	mv $(DESTDIR)/usr/bin/qubes-firewall $(DESTDIR)$(SBINDIR)/qubes-firewall
+
 	install -D -m 0440 misc/qubes.sudoers $(DESTDIR)/etc/sudoers.d/qubes
 	install -D -m 0440 misc/sudoers.d_qt_x11_no_mitshm $(DESTDIR)/etc/sudoers.d/qt_x11_no_mitshm
 	install -D -m 0644 misc/20_tcp_timestamps.conf $(DESTDIR)/etc/sysctl.d/20_tcp_timestamps.conf
@@ -200,7 +205,6 @@ install-common:
 
 
 	install -d $(DESTDIR)/$(SBINDIR)
-	install network/qubes-firewall $(DESTDIR)/$(SBINDIR)/
 	install network/qubes-netwatcher $(DESTDIR)/$(SBINDIR)/
 
 	install -d $(DESTDIR)$(BINDIR)

debian/control

@@ -38,6 +38,7 @@ Depends:
     net-tools,
     psmisc,
     python2.7,
+    python-daemon,
     python-gi,
     python-xdg,
     python-dbus,

network/ip6tables

@@ -3,6 +3,8 @@
 :INPUT DROP [1:72]
 :FORWARD DROP [0:0]
 :OUTPUT ACCEPT [0:0]
+:QBS-FORWARD - [0:0]
 -A INPUT -i lo -j ACCEPT
+-A FORWARD -j QBS-FORWARD
 COMMIT
 # Completed on Tue Sep 25 16:00:20 2012

network/iptables

@@ -17,6 +17,7 @@ COMMIT
 :INPUT ACCEPT [168:11399]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [128:12536]
+:QBS-FORWARD - [0:0]
 -A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP
 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -i vif+ -p icmp -j ACCEPT
@@ -24,6 +25,7 @@ COMMIT
 -A INPUT -i vif+ -j REJECT --reject-with icmp-host-prohibited
 -A INPUT -j DROP
 -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -j QBS-FORWARD
 -A FORWARD -i vif+ -o vif+ -j DROP
 -A FORWARD -i vif+ -j ACCEPT
 -A FORWARD -j DROP

network/qubes-firewall

@@ -1,58 +0,0 @@
-#!/bin/sh
-set -e
-
-PIDFILE=/var/run/qubes/qubes-firewall.pid
-XENSTORE_IPTABLES=/qubes-iptables
-XENSTORE_IPTABLES_HEADER=/qubes-iptables-header
-XENSTORE_ERROR=/qubes-iptables-error
-OLD_RULES=""
-# PIDfile handling
-[ -e "$PIDFILE" ] && kill -s 0 $(cat "$PIDFILE") 2>/dev/null && exit 0
-echo $$ >$PIDFILE
-
-trap 'exit 0' TERM
-
-FIRST_TIME=yes
-
-while true; do
-
-	echo "1" > /proc/sys/net/ipv4/ip_forward
-
-	if [ "$FIRST_TIME" ]; then
-		FIRST_TIME=
-		TRIGGER=reload
-	else
-		# Wait for changes in qubesdb file
-		/usr/bin/qubesdb-watch $XENSTORE_IPTABLES
-		TRIGGER=$(/usr/bin/qubesdb-read $XENSTORE_IPTABLES)
-	fi
-
-	if ! [ "$TRIGGER" = "reload" ]; then continue ; fi
-
-	# Disable forwarding to prevent potential "leaks" that might
-	# be bypassing the firewall or some proxy service (e.g. tor)
-	# during the time when the rules are being (re)applied
-	echo "0" > /proc/sys/net/ipv4/ip_forward
-
-	RULES=$(qubesdb-read $XENSTORE_IPTABLES_HEADER)
-	IPTABLES_SAVE=$(iptables-save | sed '/^\*filter/,/^COMMIT/d')
-	OUT=$(printf '%s\n%s\n' "$RULES" "$IPTABLES_SAVE" | sed 's/\\n\|\\x0a/\n/g' | iptables-restore 2>&1 || true)
-
-	for i in $(qubesdb-list -f /qubes-iptables-domainrules) ; do
-		RULES=$(qubesdb-read "$i")
-		ERRS=$(printf '%s\n' "$RULES" | sed 's/\\n\|\\x0a/\n/g' | /sbin/iptables-restore -n 2>&1 || true)
-		if [ -n "$ERRS" ]; then
-			echo "Failed applying rules for $i: $ERRS" >&2
-			OUT="$OUT$ERRS"
-		fi
-	done
-	qubesdb-write $XENSTORE_ERROR "$OUT"
-	if [ -n "$OUT" ]; then
-		DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($(hostname))" "$OUT" || :
-	fi
-
-	# Check if user didn't define some custom rules to be applied as well...
-	[ -x /rw/config/qubes-firewall-user-script ] && /rw/config/qubes-firewall-user-script
-	# XXX: Backward compatibility
-	[ -x /rw/config/qubes_firewall_user_script ] && /rw/config/qubes_firewall_user_script
-done

qubesagent/firewall.py

@@ -0,0 +1,576 @@
+#!/usr/bin/python2 -O
+# vim: fileencoding=utf-8
+
+#
+# The Qubes OS Project, https://www.qubes-os.org/
+#
+# Copyright (C) 2016
+#                   Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+import logging
+import os
+import socket
+import subprocess
+from distutils import spawn
+
+import daemon
+
+import qubesdb
+import sys
+
+import signal
+
+
+class RuleParseError(Exception):
+    pass
+
+
+class RuleApplyError(Exception):
+    pass
+
+
+class FirewallWorker(object):
+    def __init__(self):
+        self.terminate_requested = False
+        self.qdb = qubesdb.QubesDB()
+        self.log = logging.getLogger('qubes.firewall')
+        self.log.addHandler(logging.StreamHandler(sys.stderr))
+
+    def init(self):
+        '''Create appropriate chains/tables'''
+        raise NotImplementedError
+
+    def cleanup(self):
+        '''Remove tables/chains - reverse work done by init'''
+        raise NotImplementedError
+
+    def apply_rules(self, source_addr, rules):
+        '''Apply rules in given source address'''
+        raise NotImplementedError
+
+    def read_rules(self, target):
+        '''Read rules from QubesDB and return them as a list of dicts'''
+        entries = self.qdb.multiread('/qubes-firewall/{}/'.format(target))
+        assert isinstance(entries, dict)
+        # drop full path
+        entries = dict(((k.split('/')[3], v) for k, v in entries.items()))
+        if 'policy' not in entries:
+            raise RuleParseError('No \'policy\' defined')
+        policy = entries.pop('policy')
+        rules = []
+        for ruleno, rule in sorted(entries.items()):
+            if len(ruleno) != 4 or not ruleno.isdigit():
+                raise RuleParseError(
+                    'Unexpected non-rule found: {}={}'.format(ruleno, rule))
+            rule_dict = dict(elem.split('=') for elem in rule.split(' '))
+            if 'action' not in rule_dict:
+                raise RuleParseError('Rule \'{}\' lack action'.format(rule))
+            rules.append(rule_dict)
+        rules.append({'action': policy})
+        return rules
+
+    def list_targets(self):
+        return set(t.split('/')[2] for t in self.qdb.list('/qubes-firewall/'))
+
+    @staticmethod
+    def is_ip6(addr):
+        return addr.count(':') > 0
+
+    def log_error(self, msg):
+        self.log.error(msg)
+        subprocess.call(
+            ['notify-send', '-t', '3000', msg],
+            env=os.environ.copy().update({'DISPLAY': ':0'})
+        )
+
+    def handle_addr(self, addr):
+        try:
+            rules = self.read_rules(addr)
+            self.apply_rules(addr, rules)
+        except RuleParseError as e:
+            self.log_error(
+                'Failed to parse rules for {} ({}), blocking traffic'.format(
+                    addr, str(e)
+                ))
+            self.apply_rules(addr, [{'action': 'drop'}])
+        except RuleApplyError as e:
+            self.log_error(
+                'Failed to apply rules for {} ({}), blocking traffic'.format(
+                    addr, str(e))
+            )
+            # retry with fallback rules
+            try:
+                self.apply_rules(addr, [{'action': 'drop'}])
+            except RuleApplyError:
+                self.log_error(
+                    'Failed to block traffic for {}'.format(addr))
+
+    @staticmethod
+    def dns_addresses(family=None):
+        with open('/etc/resolv.conf') as resolv:
+            for line in resolv.readlines():
+                line = line.strip()
+                if line.startswith('nameserver'):
+                    if line.count('.') == 3 and (family or 4) == 4:
+                        yield line.split(' ')[1]
+                    elif line.count(':') and (family or 6) == 6:
+                        yield line.split(' ')[1]
+
+    def main(self):
+        self.terminate_requested = False
+        self.init()
+        # initial load
+        for source_addr in self.list_targets():
+            self.handle_addr(source_addr)
+        self.qdb.watch('/qubes-firewall/')
+        try:
+            for watch_path in iter(self.qdb.read_watch, None):
+                # ignore writing rules itself - wait for final write at
+                # source_addr level empty write (/qubes-firewall/SOURCE_ADDR)
+                if watch_path.count('/') > 2:
+                    continue
+                source_addr = watch_path.split('/')[2]
+                self.handle_addr(source_addr)
+        except OSError:  # EINTR
+            # signal received, don't continue the loop
+            pass
+
+        self.cleanup()
+
+    def terminate(self):
+        self.terminate_requested = True
+
+
+class IptablesWorker(FirewallWorker):
+    supported_rule_opts = ['action', 'proto', 'dst4', 'dst6', 'dsthost',
+        'dstports', 'specialtarget', 'icmptype']
+
+    def __init__(self):
+        super(IptablesWorker, self).__init__()
+        self.chains = {
+            4: set(),
+            6: set(),
+        }
+
+    @staticmethod
+    def chain_for_addr(addr):
+        '''Generate iptables chain name for given source address address'''
+        return 'qbs-' + addr.replace('.', '-').replace(':', '-')
+
+    def run_ipt(self, family, args, **kwargs):
+        # pylint: disable=no-self-use
+        if family == 6:
+            subprocess.check_call(['ip6tables'] + args, **kwargs)
+        else:
+            subprocess.check_call(['iptables'] + args, **kwargs)
+
+    def run_ipt_restore(self, family, args):
+        # pylint: disable=no-self-use
+        if family == 6:
+            return subprocess.Popen(['ip6tables-restore'] + args,
+                stdin=subprocess.PIPE,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.STDOUT)
+        else:
+            return subprocess.Popen(['iptables-restore'] + args,
+                stdin=subprocess.PIPE,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.STDOUT)
+
+    def create_chain(self, addr, chain, family):
+        '''
+        Create iptables chain and hook traffic coming from `addr` to it.
+
+        :param addr: source IP from which traffic should be handled by the
+        chain
+        :param chain: name of the chain to create
+        :param family: address family (4 or 6)
+        :return: None
+        '''
+
+        self.run_ipt(family, ['-N', chain])
+        self.run_ipt(family,
+            ['-A', 'QBS-FORWARD', '-s', addr, '-j', chain])
+        self.chains[family].add(chain)
+
+    def prepare_rules(self, chain, rules, family):
+        '''
+        Helper function to translate rules list into input for iptables-restore
+
+        :param chain: name of the chain to put rules into
+        :param rules: list of rules
+        :param family: address family (4 or 6)
+        :return: input for iptables-restore
+        :rtype: str
+        '''
+
+        iptables = "*filter\n"
+
+        fullmask = '/128' if family == 6 else '/32'
+
+        dns = list(addr + fullmask for addr in self.dns_addresses(family))
+
+        for rule in rules:
+            unsupported_opts = set(rule.keys()).difference(
+                set(self.supported_rule_opts))
+            if unsupported_opts:
+                raise RuleParseError(
+                    'Unsupported rule option(s): {!s}'.format(unsupported_opts))
+            if 'dst4' in rule and family == 6:
+                raise RuleParseError('IPv4 rule found for IPv6 address')
+            if 'dst6' in rule and family == 4:
+                raise RuleParseError('dst6 rule found for IPv4 address')
+
+            if 'proto' in rule:
+                protos = [rule['proto']]
+            else:
+                protos = None
+
+            if 'dst4' in rule:
+                dsthosts = [rule['dst4']]
+            elif 'dst6' in rule:
+                dsthosts = [rule['dst6']]
+            elif 'dsthost' in rule:
+                addrinfo = socket.getaddrinfo(rule['dsthost'], None,
+                    (socket.AF_INET6 if family == 6 else socket.AF_INET))
+                dsthosts = set(item[4][0] + fullmask for item in addrinfo)
+            else:
+                dsthosts = None
+
+            if 'dstports' in rule:
+                dstports = rule['dstports'].replace('-', ':')
+            else:
+                dstports = None
+
+            if rule.get('specialtarget', None) == 'dns':
+                if dstports not in ('53:53', None):
+                    continue
+                else:
+                    dstports = '53:53'
+                if not dns:
+                    continue
+                if protos is not None:
+                    protos = {'tcp', 'udp'}.intersection(protos)
+                else:
+                    protos = {'tcp', 'udp'}
+
+                if dsthosts is not None:
+                    dsthosts = set(dns).intersection(dsthosts)
+                else:
+                    dsthosts = dns
+
+            if 'icmptype' in rule:
+                icmptype = rule['icmptype']
+            else:
+                icmptype = None
+
+            # make them iterable
+            if protos is None:
+                protos = [None]
+            if dsthosts is None:
+                dsthosts = [None]
+
+            # sorting here is only to ease writing tests
+            for proto in sorted(protos):
+                for dsthost in sorted(dsthosts):
+                    ipt_rule = '-A {}'.format(chain)
+                    if dsthost is not None:
+                        ipt_rule += ' -d {}'.format(dsthost)
+                    if proto is not None:
+                        ipt_rule += ' -p {}'.format(proto)
+                    if dstports is not None:
+                        ipt_rule += ' --dport {}'.format(dstports)
+                    if icmptype is not None:
+                        ipt_rule += ' --icmp-type {}'.format(icmptype)
+                    ipt_rule += ' -j {}\n'.format(
+                        str(rule['action']).upper())
+                    iptables += ipt_rule
+
+        iptables += 'COMMIT\n'
+        return iptables
+
+    def apply_rules_family(self, source, rules, family):
+        '''
+        Apply rules for given source address.
+        Handle only rules for given address family (IPv4 or IPv6).
+
+        :param source: source address
+        :param rules: rules list
+        :param family: address family, either 4 or 6
+        :return: None
+        '''
+
+        chain = self.chain_for_addr(source)
+        if chain not in self.chains[family]:
+            self.create_chain(source, chain, family)
+
+        iptables = self.prepare_rules(chain, rules, family)
+        try:
+            self.run_ipt(family, ['-F', chain])
+            p = self.run_ipt_restore(family, ['-n'])
+            (output, _) = p.communicate(iptables)
+            if p.returncode != 0:
+                raise RuleApplyError(
+                    'iptables-restore failed: {}'.format(output))
+        except subprocess.CalledProcessError as e:
+            raise RuleApplyError('\'iptables -F {}\' failed: {}'.format(
+                chain, e.output))
+
+    def apply_rules(self, source, rules):
+        if self.is_ip6(source):
+            self.apply_rules_family(source, rules, 6)
+        else:
+            self.apply_rules_family(source, rules, 4)
+
+    def init(self):
+        # make sure 'QBS_FORWARD' chain exists - should be created before
+        # starting qubes-firewall
+        try:
+            self.run_ipt(4, ['-nL', 'QBS-FORWARD'])
+            self.run_ipt(6, ['-nL', 'QBS-FORWARD'])
+        except subprocess.CalledProcessError:
+            self.log_error('\'QBS-FORWARD\' chain not found, create it first')
+            sys.exit(1)
+
+    def cleanup(self):
+        for family in (4, 6):
+            self.run_ipt(family, ['-F', 'QBS-FORWARD'])
+            for chain in self.chains[family]:
+                self.run_ipt(family, ['-F', chain])
+                self.run_ipt(family, ['-X', chain])
+
+
+class NftablesWorker(FirewallWorker):
+    supported_rule_opts = ['action', 'proto', 'dst4', 'dst6', 'dsthost',
+        'dstports', 'specialtarget', 'icmptype']
+
+    def __init__(self):
+        super(NftablesWorker, self).__init__()
+        self.chains = {
+            4: set(),
+            6: set(),
+        }
+
+    @staticmethod
+    def chain_for_addr(addr):
+        '''Generate iptables chain name for given source address address'''
+        return 'qbs-' + addr.replace('.', '-').replace(':', '-')
+
+    def run_nft(self, nft_input):
+        # pylint: disable=no-self-use
+        p = subprocess.Popen(['nft', '-f', '/dev/stdin'],
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT)
+        stdout, _ = p.communicate(nft_input)
+        if p.returncode != 0:
+            raise RuleApplyError('nft failed: {}'.format(stdout))
+
+    def create_chain(self, addr, chain, family):
+        '''
+        Create iptables chain and hook traffic coming from `addr` to it.
+
+        :param addr: source IP from which traffic should be handled by the
+        chain
+        :param chain: name of the chain to create
+        :param family: address family (4 or 6)
+        :return: None
+        '''
+        nft_input = (
+            'table {family} {table} {{\n'
+            '  chain {chain} {{\n'
+            '  }}\n'
+            '  chain forward {{\n'
+            '    {family} saddr {ip} jump {chain}\n'
+            '  }}\n'
+            '}}\n'.format(
+                family=("ip6" if family == 6 else "ip"),
+                table='qubes-firewall',
+                chain=chain,
+                ip=addr,
+            )
+        )
+        self.run_nft(nft_input)
+        self.chains[family].add(chain)
+
+    def prepare_rules(self, chain, rules, family):
+        '''
+        Helper function to translate rules list into input for iptables-restore
+
+        :param chain: name of the chain to put rules into
+        :param rules: list of rules
+        :param family: address family (4 or 6)
+        :return: input for iptables-restore
+        :rtype: str
+        '''
+
+        assert family in (4, 6)
+        nft_rules = []
+        ip_match = 'ip6' if family == 6 else 'ip'
+
+        fullmask = '/128' if family == 6 else '/32'
+
+        dns = list(addr + fullmask for addr in self.dns_addresses(family))
+
+        for rule in rules:
+            unsupported_opts = set(rule.keys()).difference(
+                set(self.supported_rule_opts))
+            if unsupported_opts:
+                raise RuleParseError(
+                    'Unsupported rule option(s): {!s}'.format(unsupported_opts))
+            if 'dst4' in rule and family == 6:
+                raise RuleParseError('IPv4 rule found for IPv6 address')
+            if 'dst6' in rule and family == 4:
+                raise RuleParseError('dst6 rule found for IPv4 address')
+
+            nft_rule = ""
+
+            if 'proto' in rule:
+                if family == 4:
+                    nft_rule += ' ip protocol {}'.format(rule['proto'])
+                elif family == 6:
+                    proto = 'icmpv6' if rule['proto'] == 'icmp' \
+                        else rule['proto']
+                    nft_rule += ' ip6 nexthdr {}'.format(proto)
+
+
+            if 'dst4' in rule:
+                nft_rule += ' ip daddr {}'.format(rule['dst4'])
+            elif 'dst6' in rule:
+                nft_rule += ' ip6 daddr {}'.format(rule['dst6'])
+            elif 'dsthost' in rule:
+                addrinfo = socket.getaddrinfo(rule['dsthost'], None,
+                    (socket.AF_INET6 if family == 6 else socket.AF_INET))
+                nft_rule += ' {} daddr {{ {} }}'.format(ip_match,
+                    ', '.join(set(item[4][0] + fullmask for item in addrinfo)))
+
+            if 'dstports' in rule:
+                dstports = rule['dstports']
+                if len(set(dstports.split('-'))) == 1:
+                    dstports = dstports.split('-')[0]
+            else:
+                dstports = None
+
+            if rule.get('specialtarget', None) == 'dns':
+                if dstports not in ('53', None):
+                    continue
+                else:
+                    dstports = '53'
+                if not dns:
+                    continue
+                nft_rule += ' {} daddr {{ {} }}'.format(ip_match, ', '.join(
+                    dns))
+
+            if 'icmptype' in rule:
+                if family == 4:
+                    nft_rule += ' icmp type {}'.format(rule['icmptype'])
+                elif family == 6:
+                    nft_rule += ' icmpv6 type {}'.format(rule['icmptype'])
+
+            # now duplicate rules for tcp/udp if needed
+            # it isn't possible to specify "tcp dport xx || udp dport xx" in
+            # one rule
+            if dstports is not None:
+                if 'proto' not in rule:
+                    nft_rules.append(
+                        nft_rule + ' tcp dport {} {}'.format(
+                            dstports, rule['action']))
+                    nft_rules.append(
+                        nft_rule + ' udp dport {} {}'.format(
+                            dstports, rule['action']))
+                else:
+                    nft_rules.append(
+                        nft_rule + ' {} dport {} {}'.format(
+                            rule['proto'], dstports, rule['action']))
+            else:
+                nft_rules.append(nft_rule + ' ' + rule['action'])
+
+        return (
+            'flush chain {family} {table} {chain}\n'
+            'table {family} {table} {{\n'
+            '  chain {chain} {{\n'
+            '   {rules}\n'
+            '  }}\n'
+            '}}\n'.format(
+                family=('ip6' if family == 6 else 'ip'),
+                table='qubes-firewall',
+                chain=chain,
+                rules='\n   '.join(nft_rules)
+            ))
+
+    def apply_rules_family(self, source, rules, family):
+        '''
+        Apply rules for given source address.
+        Handle only rules for given address family (IPv4 or IPv6).
+
+        :param source: source address
+        :param rules: rules list
+        :param family: address family, either 4 or 6
+        :return: None
+        '''
+
+        chain = self.chain_for_addr(source)
+        if chain not in self.chains[family]:
+            self.create_chain(source, chain, family)
+
+        self.run_nft(self.prepare_rules(chain, rules, family))
+
+    def apply_rules(self, source, rules):
+        if self.is_ip6(source):
+            self.apply_rules_family(source, rules, 6)
+        else:
+            self.apply_rules_family(source, rules, 4)
+
+    def init(self):
+        # make sure 'QBS_FORWARD' chain exists - should be created before
+        # starting qubes-firewall
+        nft_init = (
+            'table {family} qubes-firewall {{\n'
+            '  chain forward {{\n'
+            '    type filter hook forward priority 0;\n'
+            '  }}\n'
+            '}}\n'
+        )
+        nft_init = ''.join(
+            nft_init.format(family=family) for family in ('ip', 'ip6'))
+        self.run_nft(nft_init)
+
+    def cleanup(self):
+        nft_cleanup = (
+            'delete table ip qubes-firewall\n'
+            'delete table ip6 qubes-firewall\n'
+        )
+        self.run_nft(nft_cleanup)
+
+
+def main():
+    if spawn.find_executable('nft'):
+        worker = NftablesWorker()
+    else:
+        worker = IptablesWorker()
+    context = daemon.DaemonContext()
+    context.stderr = sys.stderr
+    context.detach_process = False
+    context.files_preserve = [worker.qdb.watch_fd()]
+    context.signal_map = {
+        signal.SIGTERM: lambda _signal, _stack: worker.terminate(),
+    }
+    with context:
+        worker.main()
+
+if __name__ == '__main__':
+    main()

qubesagent/test_firewall.py

@@ -0,0 +1,507 @@
+import logging
+from unittest import TestCase
+
+import qubesagent.firewall
+
+
+class DummyIptablesRestore(object):
+    # pylint: disable=too-few-public-methods
+    def __init__(self, worker_mock, family):
+        self._worker_mock = worker_mock
+        self._family = family
+        self.returncode = 0
+
+    def communicate(self, stdin=None):
+        self._worker_mock.loaded_iptables[self._family] = stdin
+        return ("", None)
+
+class DummyQubesDB(object):
+    def __init__(self, worker_mock):
+        self._worker_mock = worker_mock
+        self.entries = {}
+        self.pending_watches = []
+
+    def read(self, key):
+        try:
+            return self.entries[key]
+        except KeyError:
+            return None
+
+    def multiread(self, prefix):
+        result = {}
+        for key, value in self.entries.items():
+            if key.startswith(prefix):
+                result[key] = value
+        return result
+
+    def list(self, prefix):
+        result = []
+        for key in self.entries.keys():
+            if key.startswith(prefix):
+                result.append(key)
+        return result
+
+    def watch(self, path):
+        pass
+
+    def read_watch(self):
+        try:
+            return self.pending_watches.pop(0)
+        except IndexError:
+            return None
+
+
+class FirewallWorker(qubesagent.firewall.FirewallWorker):
+    def __init__(self):
+        # pylint: disable=super-init-not-called
+        # don't call super on purpose - avoid connecting to QubesDB
+        # super(FirewallWorker, self).__init__()
+        self.qdb = DummyQubesDB(self)
+        self.log = logging.getLogger('qubes.tests')
+
+        self.init_called = False
+        self.cleanup_called = False
+        self.rules = {}
+
+    def apply_rules(self, source_addr, rules):
+        self.rules[source_addr] = rules
+
+    def cleanup(self):
+        self.init_called = True
+
+    def init(self):
+        self.cleanup_called = True
+
+
+class IptablesWorker(qubesagent.firewall.IptablesWorker):
+    '''Override methods actually modifying system state to only log what
+    would be done'''
+
+    def __init__(self):
+        # pylint: disable=super-init-not-called
+        # don't call super on purpose - avoid connecting to QubesDB
+        # super(IptablesWorker, self).__init__()
+        # copied __init__:
+        self.qdb = DummyQubesDB(self)
+        self.log = logging.getLogger('qubes.tests')
+        self.chains = {
+            4: set(),
+            6: set(),
+        }
+
+        #: instead of really running `iptables`, log what would be called
+        self.called_commands = {
+            4: [],
+            6: [],
+        }
+        #: rules that would be loaded with `iptables-restore`
+        self.loaded_iptables = {
+            4: None,
+            6: None,
+        }
+
+    def run_ipt(self, family, args, **kwargs):
+        self.called_commands[family].append(args)
+
+    def run_ipt_restore(self, family, args):
+        return DummyIptablesRestore(self, family)
+
+    @staticmethod
+    def dns_addresses(family=None):
+        if family == 4:
+            return ['1.1.1.1', '2.2.2.2']
+        else:
+            return ['2001::1', '2001::2']
+
+
+class NftablesWorker(qubesagent.firewall.NftablesWorker):
+    '''Override methods actually modifying system state to only log what
+    would be done'''
+
+    def __init__(self):
+        # pylint: disable=super-init-not-called
+        # don't call super on purpose - avoid connecting to QubesDB
+        # super(IptablesWorker, self).__init__()
+        # copied __init__:
+        self.qdb = DummyQubesDB(self)
+        self.log = logging.getLogger('qubes.tests')
+        self.chains = {
+            4: set(),
+            6: set(),
+        }
+
+        #: instead of really running `nft`, log what would be loaded
+        #: rules that would be loaded with `nft`
+        self.loaded_rules = []
+
+    def run_nft(self, nft_input):
+        self.loaded_rules.append(nft_input)
+
+    @staticmethod
+    def dns_addresses(family=None):
+        if family == 4:
+            return ['1.1.1.1', '2.2.2.2']
+        else:
+            return ['2001::1', '2001::2']
+
+
+class TestIptablesWorker(TestCase):
+    def setUp(self):
+        super(TestIptablesWorker, self).setUp()
+        self.obj = IptablesWorker()
+
+    def test_000_chain_for_addr(self):
+        self.assertEqual(
+            self.obj.chain_for_addr('10.137.0.1'), 'qbs-10-137-0-1')
+        self.assertEqual(
+            self.obj.chain_for_addr('fd09:24ef:4179:0000::3'),
+            'qbs-fd09-24ef-4179-0000--3')
+
+    def test_001_create_chain(self):
+        testdata = [
+            (4, '10.137.0.1', 'qbs-10-137-0-1'),
+            (6, 'fd09:24ef:4179:0000::3', 'qbs-fd09-24ef-4179-0000--3')
+        ]
+        for family, addr, chain in testdata:
+            self.obj.create_chain(addr, chain, family)
+            self.assertEqual(self.obj.called_commands[family],
+                [['-N', chain],
+                    ['-A', 'QBS-FORWARD', '-s', addr, '-j', chain]])
+
+    def test_002_prepare_rules4(self):
+        rules = [
+            {'action': 'accept', 'proto': 'tcp',
+                'dstports': '80-80', 'dst4': '1.2.3.0/24'},
+            {'action': 'accept', 'proto': 'udp',
+                'dstports': '443-1024', 'dsthost': 'yum.qubes-os.org'},
+            {'action': 'accept', 'specialtarget': 'dns'},
+            {'action': 'drop', 'proto': 'udp', 'specialtarget': 'dns'},
+            {'action': 'drop', 'proto': 'icmp'},
+            {'action': 'drop'},
+        ]
+        expected_iptables = (
+            "*filter\n"
+            "-A chain -d 1.2.3.0/24 -p tcp --dport 80:80 -j ACCEPT\n"
+            "-A chain -d 82.94.215.165/32 -p udp --dport 443:1024 -j ACCEPT\n"
+            "-A chain -d 1.1.1.1/32 -p tcp --dport 53:53 -j ACCEPT\n"
+            "-A chain -d 2.2.2.2/32 -p tcp --dport 53:53 -j ACCEPT\n"
+            "-A chain -d 1.1.1.1/32 -p udp --dport 53:53 -j ACCEPT\n"
+            "-A chain -d 2.2.2.2/32 -p udp --dport 53:53 -j ACCEPT\n"
+            "-A chain -d 1.1.1.1/32 -p udp --dport 53:53 -j DROP\n"
+            "-A chain -d 2.2.2.2/32 -p udp --dport 53:53 -j DROP\n"
+            "-A chain -p icmp -j DROP\n"
+            "-A chain -j DROP\n"
+            "COMMIT\n"
+        )
+        self.assertEqual(self.obj.prepare_rules('chain', rules, 4),
+            expected_iptables)
+        with self.assertRaises(qubesagent.firewall.RuleParseError):
+            self.obj.prepare_rules('chain', [{'unknown': 'xxx'}], 4)
+        with self.assertRaises(qubesagent.firewall.RuleParseError):
+            self.obj.prepare_rules('chain', [{'dst6': 'a::b'}], 4)
+        with self.assertRaises(qubesagent.firewall.RuleParseError):
+            self.obj.prepare_rules('chain', [{'dst4': '3.3.3.3'}], 6)
+
+    def test_003_prepare_rules6(self):
+        rules = [
+            {'action': 'accept', 'proto': 'tcp',
+                'dstports': '80-80', 'dst6': 'a::b/128'},
+            {'action': 'accept', 'proto': 'tcp',
+                'dsthost': 'ripe.net'},
+            {'action': 'accept', 'specialtarget': 'dns'},
+            {'action': 'drop', 'proto': 'udp', 'specialtarget': 'dns'},
+            {'action': 'drop', 'proto': 'icmp'},
+            {'action': 'drop'},
+        ]
+        expected_iptables = (
+            "*filter\n"
+            "-A chain -d a::b/128 -p tcp --dport 80:80 -j ACCEPT\n"
+            "-A chain -d 2001:67c:2e8:22::c100:68b/128 -p tcp -j ACCEPT\n"
+            "-A chain -d 2001::1/128 -p tcp --dport 53:53 -j ACCEPT\n"
+            "-A chain -d 2001::2/128 -p tcp --dport 53:53 -j ACCEPT\n"
+            "-A chain -d 2001::1/128 -p udp --dport 53:53 -j ACCEPT\n"
+            "-A chain -d 2001::2/128 -p udp --dport 53:53 -j ACCEPT\n"
+            "-A chain -d 2001::1/128 -p udp --dport 53:53 -j DROP\n"
+            "-A chain -d 2001::2/128 -p udp --dport 53:53 -j DROP\n"
+            "-A chain -p icmp -j DROP\n"
+            "-A chain -j DROP\n"
+            "COMMIT\n"
+        )
+        self.assertEqual(self.obj.prepare_rules('chain', rules, 6),
+            expected_iptables)
+
+    def test_004_apply_rules4(self):
+        rules = [{'action': 'accept'}]
+        chain = 'qbs-10-137-0-1'
+        self.obj.apply_rules('10.137.0.1', rules)
+        self.assertEqual(self.obj.called_commands[4],
+            [
+                ['-N', chain],
+                ['-A', 'QBS-FORWARD', '-s', '10.137.0.1', '-j', chain],
+                ['-F', chain]])
+        self.assertEqual(self.obj.loaded_iptables[4],
+            self.obj.prepare_rules(chain, rules, 4))
+        self.assertEqual(self.obj.called_commands[6], [])
+        self.assertIsNone(self.obj.loaded_iptables[6])
+
+    def test_005_apply_rules6(self):
+        rules = [{'action': 'accept'}]
+        chain = 'qbs-2000--a'
+        self.obj.apply_rules('2000::a', rules)
+        self.assertEqual(self.obj.called_commands[6],
+            [
+                ['-N', chain],
+                ['-A', 'QBS-FORWARD', '-s', '2000::a', '-j', chain],
+                ['-F', chain]])
+        self.assertEqual(self.obj.loaded_iptables[6],
+            self.obj.prepare_rules(chain, rules, 6))
+        self.assertEqual(self.obj.called_commands[4], [])
+        self.assertIsNone(self.obj.loaded_iptables[4])
+
+    def test_006_init(self):
+        self.obj.init()
+        self.assertEqual(self.obj.called_commands[4],
+            [['-nL', 'QBS-FORWARD']])
+        self.assertEqual(self.obj.called_commands[6],
+            [['-nL', 'QBS-FORWARD']])
+
+    def test_007_cleanup(self):
+        self.obj.init()
+        self.obj.create_chain('1.2.3.4', 'chain-ip4-1', 4)
+        self.obj.create_chain('1.2.3.6', 'chain-ip4-2', 4)
+        self.obj.create_chain('2000::1', 'chain-ip6-1', 6)
+        self.obj.create_chain('2000::2', 'chain-ip6-2', 6)
+        # forget about commands called earlier
+        self.obj.called_commands[4] = []
+        self.obj.called_commands[6] = []
+        self.obj.cleanup()
+        self.assertEqual(self.obj.called_commands[4],
+            [['-F', 'QBS-FORWARD'],
+                ['-F', 'chain-ip4-1'],
+                ['-X', 'chain-ip4-1'],
+                ['-F', 'chain-ip4-2'],
+                ['-X', 'chain-ip4-2']])
+        self.assertEqual(self.obj.called_commands[6],
+            [['-F', 'QBS-FORWARD'],
+                ['-F', 'chain-ip6-2'],
+                ['-X', 'chain-ip6-2'],
+                ['-F', 'chain-ip6-1'],
+                ['-X', 'chain-ip6-1']])
+
+
+class TestNftablesWorker(TestCase):
+    def setUp(self):
+        super(TestNftablesWorker, self).setUp()
+        self.obj = NftablesWorker()
+
+    def test_000_chain_for_addr(self):
+        self.assertEqual(
+            self.obj.chain_for_addr('10.137.0.1'), 'qbs-10-137-0-1')
+        self.assertEqual(
+            self.obj.chain_for_addr('fd09:24ef:4179:0000::3'),
+            'qbs-fd09-24ef-4179-0000--3')
+
+    def expected_create_chain(self, family, addr, chain):
+        return (
+            'table {family} qubes-firewall {{\n'
+            '  chain {chain} {{\n'
+            '  }}\n'
+            '  chain forward {{\n'
+            '    {family} saddr {addr} jump {chain}\n'
+            '  }}\n'
+            '}}\n'.format(family=family, addr=addr, chain=chain))
+
+    def test_001_create_chain(self):
+        testdata = [
+            (4, '10.137.0.1', 'qbs-10-137-0-1'),
+            (6, 'fd09:24ef:4179:0000::3', 'qbs-fd09-24ef-4179-0000--3')
+        ]
+        for family, addr, chain in testdata:
+            self.obj.create_chain(addr, chain, family)
+        self.assertEqual(self.obj.loaded_rules,
+            [self.expected_create_chain('ip', '10.137.0.1', 'qbs-10-137-0-1'),
+             self.expected_create_chain(
+                 'ip6', 'fd09:24ef:4179:0000::3', 'qbs-fd09-24ef-4179-0000--3'),
+             ])
+
+    def test_002_prepare_rules4(self):
+        rules = [
+            {'action': 'accept', 'proto': 'tcp',
+                'dstports': '80-80', 'dst4': '1.2.3.0/24'},
+            {'action': 'accept', 'proto': 'udp',
+                'dstports': '443-1024', 'dsthost': 'yum.qubes-os.org'},
+            {'action': 'accept', 'specialtarget': 'dns'},
+            {'action': 'drop', 'proto': 'udp', 'specialtarget': 'dns'},
+            {'action': 'drop', 'proto': 'icmp'},
+            {'action': 'drop'},
+        ]
+        expected_nft = (
+            'flush chain ip qubes-firewall chain\n'
+            'table ip qubes-firewall {\n'
+            '  chain chain {\n'
+            '    ip protocol tcp ip daddr 1.2.3.0/24 tcp dport 80 accept\n'
+            '    ip protocol udp ip daddr { 82.94.215.165/32 } '
+            'udp dport 443-1024 accept\n'
+            '    ip daddr { 1.1.1.1/32, 2.2.2.2/32 } tcp dport 53 accept\n'
+            '    ip daddr { 1.1.1.1/32, 2.2.2.2/32 } udp dport 53 accept\n'
+            '    ip protocol udp ip daddr { 1.1.1.1/32, 2.2.2.2/32 } udp dport '
+            '53 drop\n'
+            '    ip protocol icmp drop\n'
+            '    drop\n'
+            '  }\n'
+            '}\n'
+        )
+        self.assertEqual(self.obj.prepare_rules('chain', rules, 4),
+            expected_nft)
+        with self.assertRaises(qubesagent.firewall.RuleParseError):
+            self.obj.prepare_rules('chain', [{'unknown': 'xxx'}], 4)
+        with self.assertRaises(qubesagent.firewall.RuleParseError):
+            self.obj.prepare_rules('chain', [{'dst6': 'a::b'}], 4)
+        with self.assertRaises(qubesagent.firewall.RuleParseError):
+            self.obj.prepare_rules('chain', [{'dst4': '3.3.3.3'}], 6)
+
+    def test_003_prepare_rules6(self):
+        rules = [
+            {'action': 'accept', 'proto': 'tcp',
+                'dstports': '80-80', 'dst6': 'a::b/128'},
+            {'action': 'accept', 'proto': 'tcp',
+                'dsthost': 'ripe.net'},
+            {'action': 'accept', 'specialtarget': 'dns'},
+            {'action': 'drop', 'proto': 'udp', 'specialtarget': 'dns'},
+            {'action': 'drop', 'proto': 'icmp', 'icmptype': '128'},
+            {'action': 'drop'},
+        ]
+        expected_nft = (
+            'flush chain ip6 qubes-firewall chain\n'
+            'table ip6 qubes-firewall {\n'
+            '  chain chain {\n'
+            '    ip6 nexthdr tcp ip6 daddr a::b/128 tcp dport 80 accept\n'
+            '    ip6 nexthdr tcp ip6 daddr { 2001:67c:2e8:22::c100:68b/128 } '
+            'accept\n'
+            '    ip6 daddr { 2001::1/128, 2001::2/128 } tcp dport 53 accept\n'
+            '    ip6 daddr { 2001::1/128, 2001::2/128 } udp dport 53 accept\n'
+            '    ip6 nexthdr udp ip6 daddr { 2001::1/128, 2001::2/128 } '
+            'udp dport 53 drop\n'
+            '    ip6 nexthdr icmpv6 icmpv6 type 128 drop\n'
+            '    drop\n'
+            '  }\n'
+            '}\n'
+        )
+        self.assertEqual(self.obj.prepare_rules('chain', rules, 6),
+            expected_nft)
+
+    def test_004_apply_rules4(self):
+        rules = [{'action': 'accept'}]
+        chain = 'qbs-10-137-0-1'
+        self.obj.apply_rules('10.137.0.1', rules)
+        self.assertEqual(self.obj.loaded_rules,
+            [self.expected_create_chain('ip', '10.137.0.1', chain),
+             self.obj.prepare_rules(chain, rules, 4),
+             ])
+
+    def test_005_apply_rules6(self):
+        rules = [{'action': 'accept'}]
+        chain = 'qbs-2000--a'
+        self.obj.apply_rules('2000::a', rules)
+        self.assertEqual(self.obj.loaded_rules,
+            [self.expected_create_chain('ip6', '2000::a', chain),
+             self.obj.prepare_rules(chain, rules, 6),
+             ])
+
+    def test_006_init(self):
+        self.obj.init()
+        self.assertEqual(self.obj.loaded_rules,
+        [
+            'table ip qubes-firewall {\n'
+            '  chain forward {\n'
+            '    type filter hook forward priority 0;\n'
+            '  }\n'
+            '}\n'
+            'table ip6 qubes-firewall {\n'
+            '  chain forward {\n'
+            '    type filter hook forward priority 0;\n'
+            '  }\n'
+            '}\n'
+        ])
+
+    def test_007_cleanup(self):
+        self.obj.init()
+        self.obj.create_chain('1.2.3.4', 'chain-ip4-1', 4)
+        self.obj.create_chain('1.2.3.6', 'chain-ip4-2', 4)
+        self.obj.create_chain('2000::1', 'chain-ip6-1', 6)
+        self.obj.create_chain('2000::2', 'chain-ip6-2', 6)
+        # forget about commands called earlier
+        self.obj.loaded_rules = []
+        self.obj.cleanup()
+        self.assertEqual(self.obj.loaded_rules,
+            ['delete table ip qubes-firewall\n'
+             'delete table ip6 qubes-firewall\n',
+             ])
+
+class TestFirewallWorker(TestCase):
+    def setUp(self):
+        self.obj = FirewallWorker()
+        rules = {
+            '10.137.0.1': {
+                'policy': 'accept',
+                '0000': 'proto=tcp dstports=80-80 action=drop',
+                '0001': 'proto=udp specialtarget=dns action=accept',
+                '0002': 'proto=udp action=drop',
+            },
+            '10.137.0.2': {'policy': 'accept'},
+            # no policy
+            '10.137.0.3': {'0000': 'proto=tcp action=accept'},
+            # no action
+            '10.137.0.4': {
+                'policy': 'drop',
+                '0000': 'proto=tcp'
+            },
+        }
+        for addr, entries in rules.items():
+            for key, value in entries.items():
+                self.obj.qdb.entries[
+                    '/qubes-firewall/{}/{}'.format(addr, key)] = value
+
+    def test_read_rules(self):
+        expected_rules1 = [
+            {'proto': 'tcp', 'dstports': '80-80', 'action': 'drop'},
+            {'proto': 'udp', 'specialtarget': 'dns', 'action': 'accept'},
+            {'proto': 'udp', 'action': 'drop'},
+            {'action': 'accept'},
+        ]
+        expected_rules2 = [
+            {'action': 'accept'},
+        ]
+        self.assertEqual(self.obj.read_rules('10.137.0.1'), expected_rules1)
+        self.assertEqual(self.obj.read_rules('10.137.0.2'), expected_rules2)
+        with self.assertRaises(qubesagent.firewall.RuleParseError):
+            self.obj.read_rules('10.137.0.3')
+        with self.assertRaises(qubesagent.firewall.RuleParseError):
+            self.obj.read_rules('10.137.0.4')
+
+
+    def test_list_targets(self):
+        self.assertEqual(self.obj.list_targets(), set(['10.137.0.{}'.format(x)
+            for x in range(1, 5)]))
+
+    def test_is_ip6(self):
+        self.assertTrue(self.obj.is_ip6('2000::abcd'))
+        self.assertTrue(self.obj.is_ip6('2000:1:2:3:4:5:6:abcd'))
+        self.assertFalse(self.obj.is_ip6('10.137.0.1'))
+
+    def test_handle_addr(self):
+        self.obj.handle_addr('10.137.0.2')
+        self.assertEqual(self.obj.rules['10.137.0.2'], [{'action': 'accept'}])
+        # fallback to block all
+        self.obj.handle_addr('10.137.0.3')
+        self.assertEqual(self.obj.rules['10.137.0.3'], [{'action': 'drop'}])
+        self.obj.handle_addr('10.137.0.4')
+        self.assertEqual(self.obj.rules['10.137.0.4'], [{'action': 'drop'}])
+
+
+    def test_main(self):
+        self.obj.main()
+        self.assertTrue(self.obj.init_called)
+        self.assertTrue(self.obj.cleanup_called)
+        self.assertEqual(set(self.obj.rules.keys()), self.obj.list_targets())
+        # rules content were already tested

rpm_spec/core-vm.spec

@@ -54,6 +54,8 @@ Requires:   pygobject3-base
 Requires:   dbus-python
 # for qubes-session-autostart, xdg-icon
 Requires:   pyxdg
+Requires:   python-daemon
+Requires:   nftables
 %if %{fedora} >= 20
 # gpk-update-viewer required by qubes-manager
 Requires:   gnome-packagekit-updater
@@ -437,6 +439,13 @@ rm -f %{name}-%{version}
 /usr/share/nautilus-python/extensions/qvm_move_nautilus.py*
 /usr/share/nautilus-python/extensions/qvm_dvm_nautilus.py*
 
+%dir %{python_sitelib}/qubesagent-*-py2.7.egg-info
+%{python_sitelib}/qubesagent-*-py2.7.egg-info/*
+%dir %{python_sitelib}/qubesagent
+%{python_sitelib}/qubesagent/__init__.py*
+%{python_sitelib}/qubesagent/firewall.py*
+%{python_sitelib}/qubesagent/test_firewall.py*
+
 /usr/share/qubes/mime-override/globs
 /usr/share/qubes/qubes-master-key.asc
 %dir /home_volatile

setup.py

@@ -0,0 +1,22 @@
+# vim: fileencoding=utf-8
+
+import setuptools
+
+if __name__ == '__main__':
+    setuptools.setup(
+        name='qubesagent',
+        version=open('version').read().strip(),
+        author='Invisible Things Lab',
+        author_email='marmarek@invisiblethingslab.com',
+        description='Qubes core-agent-linux package',
+        license='GPL2+',
+        url='https://www.qubes-os.org/',
+
+        packages=('qubesagent',),
+
+        entry_points={
+            'console_scripts': [
+                'qubes-firewall = qubesagent.firewall:main'
+            ],
+        }
+    )