Commit Graph

210 Commits

Author SHA1 Message Date
Frédéric Pierret (fepitre)
b18efe3257
Make ShellCheck happy 2019-05-21 17:21:51 +02:00
Frédéric Pierret (fepitre)
0ce79d4895
Handle non-default 'eth0' Qubes managed interface 2019-05-16 17:32:50 +02:00
Marek Marczykowski-Górecki
e3db225aab
vif-route-qubes: \n -> \\n
Make shellcheck happy.
2018-10-15 06:20:32 +02:00
Marek Marczykowski-Górecki
336754426b
Fix iptables-restore race condition in vif-route-qubes
In rare cases when vif-route-qubes is called simultaneously with some
other iptables-restore instance, it fails because of missing --wait (and
recent iptables-restore defaults to aborting instead of waiting
for lock). That other call may be from qubes-firewall or user script.

Related to QubesOS/qubes-issues#3665
2018-10-15 06:20:25 +02:00
Christopher Laprise
b8783e65e4
Fixes issue #3939 2018-05-31 14:02:15 -04:00
Marek Marczykowski-Górecki
8f6bd245bd
network: use iptables-restore --wait if available
Avoid bailing out early if multiple instances of iptables-restore are
called simultaneously.

Fixes QubesOS/qubes-issues#3665
2018-05-24 17:38:13 +02:00
Marek Marczykowski-Górecki
836bf90e97
network: make sure static NM configuration is created before NM start
Avoid delays caused by default DHCP configuration, which would be used
if no alternative is available at NetworkManager start time.
2018-04-06 01:52:11 +02:00
Marek Marczykowski-Górecki
c281d6454f
network: do not assume IPv6 gateway is a link-local address
If IPv6 gateway address provided by dom0 isn't a link local address, add
a /128 route to it. Also, add this address on backend interfaces (vif*).

This is to allow proper ICMP host unreachable packets forwarding - if
gateway (address on vif* interface) have only fe80: address, it will be
used as a source for ICMP reply. It will be properly delivered to the VM
directly connected there (for example from sys-net to sys-firewall), but
because of being link-local address, it will not be forwarded any
further.
This results timeouts if host doesn't have IPv6 connectivity.
2018-04-02 23:19:31 +02:00
Marek Marczykowski-Górecki
4914eb1437
Merge remote-tracking branch 'qubesos/pr/90'
* qubesos/pr/90:
  Stop Debian templates from forwarding by default.
2018-02-13 04:45:04 +01:00
Marek Marczykowski-Górecki
0639a4b932
network: reload DNS only on "up" event from NetworkManager
NetworkManager reports a bunch of events, reloading DNS at each of them
doesn't make sense and is harmful - systemd have ratelimit on service
restart.

Fixes QubesOS/qubes-issues#3135
2018-02-10 22:12:44 +01:00
unman
d8362aec9e
Stop Debian templates from forwarding by default. 2018-02-06 23:10:28 +00:00
Patrick Schleizer
7fd008b1a8
make apt-get apt-transport-tor broken in Qubes non-networked TemplateVMs
fixes https://github.com/QubesOS/qubes-issues/issues/3403
2017-12-16 19:17:38 +01:00
Marek Marczykowski-Górecki
20d9a0bb61
network: drop unsolicited IPv6 neighbor advertisements by default
It could be used to poison neighbor table...

QubesOS/qubes-issues#718
2017-12-07 01:41:56 +01:00
Marek Marczykowski-Górecki
715693b93d
network: IPv6-enabled firewall
If IPv6 is configured in the VM, and it is providing network to others,
apply IPv6 firewall similar to the IPv4 one (including NAT for outgoing
traffix), instead of blocking everything. Also, enable IP forwarding for
IPv6 in such a case.

Fixes QubesOS/qubes-issues#718
2017-12-07 01:41:55 +01:00
Marek Marczykowski-Górecki
44f8cceb38
network: configure IPv6 when enabled
If dom0 expose IPv6 address settings, configure it on the interface.
Both backend and frontend side. If no IPv6 configuration is provided,
block IPv6 as it was before.

Fixes QubesOS/qubes-issues#718
2017-12-07 01:30:05 +01:00
Marek Marczykowski-Górecki
9293da7329
Merge remote-tracking branch 'qubesos/pr/69'
* qubesos/pr/69:
  Fix the Archlinux template update proxy to work for HTTPS URLs as well
2017-11-20 01:56:35 +01:00
Marek Marczykowski-Górecki
57a3c2d67e
network: have safe fallback in case of qubes-firewall crash/error
When qubes-firewall service is started, modify firewall to have "DROP"
policy, so if something goes wrong, no data got leaked.
But keep default action "ACCEPT" in case of legitimate service stop, or
not starting it at all - because one may choose to not use this service
at all.
Achieve this by adding "DROP" rule at the end of QBS-FIREWALL chain and
keep it there while qubes-firewall service is running.

Fixes QubesOS/qubes-issues#3269
2017-11-20 01:56:14 +01:00
Nedyalko Andreev
9da86cf8c5
Fix the Archlinux template update proxy to work for HTTPS URLs as well 2017-11-13 14:16:10 +02:00
Olivier MEDOC
26659d4e51 archlinux: ensure [options] section is present in all pacman drop-ins
Create an empty [options] dropin by default or pacman will fail
when no dropin is present
2017-10-23 20:22:04 +02:00
Marek Marczykowski-Górecki
2068299126
network: fix rules for network setup on new udev
New udev have `DRIVERS` matcher, instead of `ENV{ID_NET_DRIVER}`. Add
appropriate rule to the file. Without it, network was working
incidentally, because there is a fallback in qubes-misc-post.service,
but dynamic network change was broken.

This applies at least to Debian stretch.

Fixes QubesOS/qubes-issues#3192
2017-10-19 15:10:31 +02:00
Marek Marczykowski-Górecki
bb220ce2eb
network: fix issues found by shellcheck 2017-09-30 04:43:04 +02:00
Marek Marczykowski-Górecki
6139ed59a3
(redo) updates-proxy: explicitly block connection looping back to the proxy IP
Explicitly block something like "curl http://127.0.0.1:8082" and
return error page in this case. This error page is used in Whonix to
detect if the proxy is torrified. If not blocked, it may happen that
empty response is returned instead of error. See linked ticket for
details.

This was previously done for 10.137.255.254, but since migration to
qrexec-based connection, 127.0.0.1 is used instead.

Fixes QubesOS/qubes-issues#1482
2017-09-15 05:00:05 +02:00
Marek Marczykowski-Górecki
b49ae50ad5
Implement qrexec-based connection to updates proxy
Configure package manager to use 127.0.0.1:8082 as proxy instead of
"magic" IP intercepted later. The listen on this port and whenever
new connection arrives, spawn qubes.UpdatesProxy service call (to
default target domain - subject to configuration in dom0) and connect
its stdin/out to the local TCP connection. This part use systemd.socket
unit in case of systemd, and ncat --exec otherwise.

On the other end - in target domain - simply pass stdin/out to updates
proxy (tinyproxy) running locally.

It's important to _not_ configure the same VM to both be updates proxy and
use it. In practice such configuration makes little sense - if VM can
access network (which is required to run updates proxy), package manager
can use it directly. Even if this network access is through some
VPN/Tor. If a single VM would be configured as both proxy provider and
proxy user, connection would loop back to itself. Because of this, proxy
connection redirection (to qrexec service) is disabled when the same VM
also run updates proxy.

Fixes QubesOS/qubes-issues#1854
2017-05-26 05:25:29 +02:00
Marek Marczykowski-Górecki
ce70887a57
Merge branch 'core3-devel' 2017-05-20 14:43:53 +02:00
Marek Marczykowski-Górecki
a6031ca33c
Merge remote-tracking branch 'qubesos/pr/45'
* qubesos/pr/45:
  network: Properly handle comments in NetworkManager.conf (#2584)
2017-04-01 11:58:13 +02:00
Daniel Moerner
93dd8112da
network: Properly handle comments in NetworkManager.conf (#2584)
Qubes-specific options must be added in NetworkManager.conf, even if
those lines are commented out by default. The problem is solved by using
extended regular expressions.
2017-03-28 17:19:12 -04:00
unman
982babb6a2
If there is only 1 DNS server make both DNAT rules point to it 2017-03-19 21:56:34 +00:00
Marek Marczykowski-Górecki
961455657d
Merge remote-tracking branch 'qubesos/pr/38'
* qubesos/pr/38:
  Reset iptables ACCEPT rule for updates proxy if service is running
2017-02-13 00:03:43 +01:00
Gregorio Guidi
1ca110a9fd
Restore functionality of disable-default-route and disable-dns-server. 2017-02-12 23:53:43 +01:00
unman
59b025a652
Reset iptables ACCEPT rule for updates proxy if service is running 2017-02-11 02:11:53 +00:00
Marek Marczykowski-Górecki
24b726a3bf
network: use /32 netmask on internal IPs in NAT providing namespace
Use /32 inside network namespace too. Otherwise inter-VM traffic is
broken - as all VMs seems to be in a single /24 subnet, but in fact are
not.

QubesOS/qubes-issues#1143
2016-11-01 00:22:19 +01:00
Marek Marczykowski-Górecki
c8213ea55a
network: properly handle DNS addresses in vif-qubes-nat.sh
Core3 no longer reuse netvm own IP for primary DNS. At the same time,
disable dropping traffic to netvm itself because it breaks DNS (as one
of blocked things). This allows VM to learn real netvm IP, but:
 - this mechanism is not intended to avoid detection from already
 compromised VM, only about unintentional leaks
 - this can be prevented using vif-qubes-nat.sh on the netvm itself (so
 it will also have hidden its own IP)

QubesOS/qubes-issues#1143
2016-11-01 00:22:08 +01:00
Marek Marczykowski-Górecki
c75b6519c5
network: keep the same MAC on vif interfaces
Even when it's veth pair into network namespace doing NAT.

QubesOS/qubes-issues#1143
2016-11-01 00:13:47 +01:00
Marek Marczykowski-Górecki
1c42a06238
network: integrate vif-route-qubes-nat into vif-route-qubes
Since 'script' xenstore entry no longer allows passing arguments
(actually this always was a side effect, not intended behaviour), we
need to pass additional parameters some other way. Natural choice for
Qubes-specific script is to use QubesDB.
And since those parameters are passed some other way, it is no longer
necessary to keep it as separate script.

Fixes QubesOS/qubes-issues#1143
2016-10-31 00:40:32 +01:00
Marek Marczykowski-Górecki
696a0918d5
Revert "network: disable proxy_arp"
Proxy ARP apparently is still needed for HVMs.
This reverts commit fa8b05a83c.

Fixes QubesOS/qubes-issues#1421
2016-10-30 20:42:00 +01:00
Marek Marczykowski-Górecki
938af2c7fd
network: change vif-route-qubes-nat parameters
Keep "main" IP (the one in xenstore) as the one seen by the netvm, and
pass the "fake" one (the one seen by the VM) as script parameter.

Fixes QubesOS/qubes-issues#1143
2016-10-29 22:28:57 +02:00
Marek Marczykowski-Górecki
be86c7da1f
network: reformat vif-route-qubes-nat
Use 4-space indentation, remove trailing spaces. No functional change.
2016-10-29 14:45:36 +02:00
Marek Marczykowski-Górecki
3131bb6135
Merge remote-tracking branch 'origin/pr/24' into core3-devel
* origin/pr/24:
  network: add vif-route-qubes-nat for IP address anonymization
2016-10-29 14:42:50 +02:00
Manuel Amador (Rudd-O)
59aec8e5eb Clean up early initialization and setup of /rw 2016-10-23 20:19:51 +00:00
Marek Marczykowski-Górecki
a302dd2b29
Merge remote-tracking branch 'origin/pr/83'
* origin/pr/83:
  Configure NetworkManager to keep /etc/resolv.conf as plain file
2016-10-03 11:30:17 +02:00
Marek Marczykowski-Górecki
8afc07c513
network: minor setup-ip fix
Don't exit with non-zero exit code just because custom hook isn't
installed
2016-09-19 01:04:25 +02:00
Marek Marczykowski-Górecki
e73d662bf1
Configure NetworkManager to keep /etc/resolv.conf as plain file
Do not use a symlink there, as it will be left after NetworkManager
shutdown - as a broken link then

Fixes QubesOS/qubes-issues#2320
Reported by Achim Patzner <noses@noses.com>
2016-09-15 01:26:35 +02:00
Marek Marczykowski-Górecki
2c8fe644f3
network: remove qubes-netwatcher
This tool/service is obsolete for a long time (it does nothing on R3.0
and later).
2016-09-12 05:58:26 +02:00
Marek Marczykowski-Górecki
ee0a292b21
network: rewrite qubes-firewall daemon
This rewrite is mainly to adopt new interface for Qubes 4.x.
Main changes:
 - change language from bash to python, introduce qubesagent python package
 - support both nftables (preferred) and iptables
 - new interface (https://qubes-os.org/doc/vm-interface/)
 - IPv6 support
 - unit tests included
 - nftables version support running along with other firewall loaded

Fixes QubesOS/qubes-issues#1815
QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
Marek Marczykowski-Górecki
d99a563542
network: reload NM connection after setting it up
Apparently NM monitor only its main configuration for changes, but not
connection files. Force reloading it.
2016-08-02 02:08:36 +02:00
Marek Marczykowski-Górecki
0eb1f7c679
Merge remote-tracking branch 'origin/pr/77'
* origin/pr/77:
  archlinux: fix update-proxy-configs to use pacman.d drop-ins
  archlinux: ensure repositories are the last pacman.d files included
  archlinux: Setup default package repository
  archlinux: switch to usage of pacman.d drop-ins
2016-07-13 22:25:26 +02:00
Olivier MEDOC
7cea09711a archlinux: fix update-proxy-configs to use pacman.d drop-ins 2016-07-12 11:38:14 +02:00
Marek Marczykowski-Górecki
d4ae97ec2b
Merge remote-tracking branch 'origin/pr/75'
* origin/pr/75:
  add comment
2016-07-10 17:18:47 +02:00
Patrick Schleizer
80e68e90d9 add comment
link to feature request 'implement /etc/PackageKit/conf.d'
2016-07-02 23:40:11 +02:00
Patrick Schleizer
62d5b96355 add comment
link to feature request 'implement /etc/dnf.conf.d drop-in configuration folder'
2016-07-02 23:19:40 +02:00
Patrick Schleizer
3db93cdc87 fix indent 2016-05-19 21:12:16 +02:00
Marek Marczykowski-Górecki
00698173ed
network: run setup-ip only on xen frontend interfaces
Fixes QubesOS/qubes-issues#1882
2016-03-29 12:30:26 +02:00
Marek Marczykowski-Górecki
fb9b3b62c0
network: use qubes-primary-dns QubesDB entry if present
For a long time the DNS address was the same as default gateway. This is
still the case in R3.x, but using `qubes-gateway` configuration
parameter for it is misleading. It should be up to dom0 to provide DNS
address (whether the value is the same as gateway or not).

Fixes QubesOS/qubes-issues#1817
2016-03-07 13:37:45 +01:00
Olivier MEDOC
57e5026963 update-proxy: use curl instead of wget in archlinux in order to limit additional dependencies 2016-01-21 18:23:48 +01:00
Olivier MEDOC
9556931808 implement update proxy support for archlinux 2016-01-16 12:11:06 +01:00
Marek Marczykowski-Górecki
b9e51f9ab3 network: use more strict policy about incoming traffic
Do not allow ICMP from uplink VM (or the outside world). Also do not
send ICMP icmp-host-prohibited to the uplink.

Fixes QubesOS/qubes-issues#1346
2015-12-30 02:09:23 +01:00
Marek Marczykowski-Górecki
4e3076f0b6
updates-proxy: restart on network configuration change to reload DNS
Apparently tinyproxy does not notice /etc/resolv.conf change, so need to
be kicked to reload it.

Fixes QubesOS/qubes-issues#1530
2015-12-19 18:44:32 +01:00
Marek Marczykowski-Górecki
181c15f422
updates-proxy: explicitly block connection looping back to the proxy IP
Explicitly block something like "curl http://10.137.255.254:8082" and
return error page in this case. This error page is used in Whonix to
detect if the proxy is torrified. If not blocked, it may happen that
empty response is returned instead of error. See linked ticket for
details.

Fixes QubesOS/qubes-issues#1482
2015-12-04 14:57:07 +01:00
Marek Marczykowski-Górecki
a11897a1d0
Revert "network: use drop-ins for NetworkManager configuration (#1176)"
Apparently unmanaged devices are loaded only from main
NetworkManager.conf. Exactly the same line pasted (not typed!) to main
NetworkManager.conf works, but in
/etc/NetworkManager/conf.d/30-qubes.conf it doesn't.
BTW There was a typo in option name ("unmanaged_devices" instead of
"unmanaged-devices", but it wasn't the cause).

This reverts commit 6c4831339c.

QubesOS/qubes-issues#1176
2015-11-28 17:43:15 +01:00
Marek Marczykowski-Górecki
fa8b05a83c
network: disable proxy_arp
Since both sides have proper routing tables set, it isn't required to
set it anymore.

Fixes QubesOS/qubes-issues#1421
2015-11-15 04:04:06 +01:00
Marek Marczykowski-Górecki
69bb71bea0
updates-proxy: disable filtering at all
Since this proxy is used only when explicitly configured in application
(package manager), there is no point in worrying about user
_erroneously_ using web browser through this proxy. If the user really
want to access the network from some other application he/she can always
alter firewall rules for that.

Fixes QubesOS/qubes-issues#1188
2015-11-15 03:57:51 +01:00
Marek Marczykowski-Górecki
5377dc50dc
Really fix update-proxy rules for debian security fixes repo
Reported by @adrelanos
Fixes QubesOS/qubes-issues#1422
2015-11-14 00:42:01 +01:00
Marek Marczykowski-Górecki
d23f3d8ddb
network: let NetworkManager configure VM uplink, if enabled
Previously even if NetworkManager was enabled, our script manually
configured network parameters. This apparently have negative effects,
because NetworkManager tries to configure some things differently - for
example use metric 1024 for default gateway.

Fixes QubesOS/qubes-issues#1052
2015-11-13 04:26:23 +01:00
Patrick Schleizer
aeb6d188cc
Improved upgrade notifications sent to QVMM.
Each time some arbitrary package was installed using dpkg or apt-get, the update notification in Qubes VM Manager was cleared.
No matter if there were still updates pending. (Could happen even after the user running `apt-get dist-upgrade` in case of package manager issues.)
No longer clear upgrade notification in QVMM on arbitrary package installation.
Check if upgrades have been actually installed before clearing the notifications.

https://github.com/QubesOS/qubes-issues/issues/1066#issuecomment-150044906
2015-11-11 15:45:00 +00:00
Marek Marczykowski-Górecki
2a589f2c20
updates-proxy: use separate directory for PID file
And also use systemd-tmpfiles for that directory creation.

Fixes QubesOS/qubes-issues#1401
2015-11-11 05:57:57 +01:00
Marek Marczykowski-Górecki
f9c7394c2f
updates-proxy-setup: use temporary file for config snippet
Don't use ${CONF_PATH}.qubes, because it may override some existing
file, and is racy approach (even if not against user, but another script
instance).

QubesOS/qubes-issues#1282
2015-11-11 02:36:56 +01:00
Marek Marczykowski-Górecki
c2596a0435
Setup updates proxy in dnf and PackageKit
DNF doesn't support even including another config file, so all the
settings needs to go into `/etc/dnf/dnf.conf`. The same about
PackageKit, which is needed because it doesn't use `dnf.conf`:
http://lists.freedesktop.org/archives/packagekit/2015-September/026389.html

Because that proxy settings goes to so many places now, create a
separate script for that.

QubesOS/qubes-issues#1282
QubesOS/qubes-issues#1197
2015-10-30 15:13:56 +01:00
Patrick Schleizer
2eb0ed2be1
removed trailing spaces 2015-10-15 04:34:55 +02:00
Marek Marczykowski-Górecki
ce443b2e18
network: forward TCP DNS queries
Fixes QubesOS/qubes-issues#1325
2015-10-12 01:28:05 +02:00
Marek Marczykowski-Górecki
7e321ba63c
Use 'type' instead of 'which' to prevent unnecessary dependency
QubesOS/qubes-issues#1299
2015-10-10 16:23:46 +02:00
Marek Marczykowski-Górecki
580d21acdc
network: fix 'qubes-uplink-eth0' NetworkManager connection (#1280)
According to the specification[1], the setting name is 'addresses', not
'address'.  The later apparently worked on some NetworkManager versions,
but for example not on the one in Debian wheezy. Also fix value
format (IP;netmask;gateway).

[1] htts://developer.gnome.org/NetworkManager/unstable/ref-settings.html

Fixes QubesOS/qubes-issues#1280
2015-10-06 15:29:30 +02:00
Marek Marczykowski-Górecki
6c4831339c
network: use drop-ins for NetworkManager configuration (#1176)
Do not modify main /etc/NetworkManager/NetworkManager.conf as it would
cause conflicts during updates. Use
/etc/NetworkManager/conf.d/30-qubes.conf instead.
Also remove some dead code for dynamically generated parts (no longer
required to "blacklist" eth0 in VMs - we have proper connection
generated for it). It was commented out for some time already

Fixes QubesOS/qubes-issues#1176
2015-10-06 15:15:26 +02:00
Marek Marczykowski-Górecki
a1f696fc07
updates-proxy: Disable 'Via: tinyproxy' header
Fixes QubesOS/qubes-issues#1187
2015-10-05 06:24:30 +02:00
Marek Marczykowski-Górecki
8e497bffc0
Merge branch 'qubes-iptables'
Conflicts:
	debian/control
	rpm_spec/core-vm.spec

QubesOS/qubes-issues#1067
2015-10-05 01:47:01 +02:00
Marek Marczykowski-Górecki
a99e184e3d Fix show-hide-nm-applet.desktop - use OnlyShowIn=X-QUBES 2015-09-03 00:43:54 +02:00
qubesuser
2a15863ccb network: add vif-route-qubes-nat for IP address anonymization 2015-08-30 16:27:14 +02:00
Marek Marczykowski-Górecki
65e9e4c72c
network: use own iptables service instead of repurposing existing one
There were multiple problems with reusing existing one:
 - need to sync with upstream changes (configuration path etc)
 - conflicts resolution on updates
 - lack of iptables --wait, which causes firewall fail to load sometimes

QubesOS/qubes-issues#1067
2015-08-09 20:09:51 +02:00
Jason Mehring
15f1df4947
debian: Renamed incorrect filename: 00notiy-hook -> 00notify-hook 2015-08-02 17:45:21 -04:00
Marek Marczykowski-Górecki
4e44008607 network: disable tx csum offload on vif interfaces
It doesn't work with HVMs - more precisely with (ancient) qemu in
stubdomain.
2015-07-01 04:53:31 +02:00
Marek Marczykowski-Górecki
13c078ddbd network: guard iptables call with manual lock
Apparently even iptables-restore does not handle concurrent firewall
updates. This is especially a problem in case of HVM, which have two
network interfaces (one through stubom and the other direct) added at
the same time.
2015-07-01 01:25:00 +02:00
Marek Marczykowski-Górecki
2bfc6edddc network: use iptables-restore instead of iptables --wait
The later one is present only in latest iptables version - especially
debian does not have it. But we need to handle "Device or resources
busy" problem somehow.
2015-06-27 04:55:56 +02:00
Jason Mehring
15459b0e82
debian: Allow apt-get post hook to fail gracefully (won't work in chroot) 2015-05-01 05:03:14 -04:00
Jason Mehring
293aab9e6a
debian: Only notify dom0 on apt-get post hook; don't update package index
There is a possiblilty of the apt-get post hook getting triggered
more than once for each apt-get session, therefore we only notify
dom0 that there are no updates available and do not perform an
apt-get update.

The qubes-update-check.service will still perform an update so even
if the dist-upgrade failed and there was actually more files to update
the qubes-update-check.serivce would then at some point notify dom0
about those updates being available
2015-05-01 01:35:36 -04:00
Marek Marczykowski-Górecki
04533a8f21 Tag for commit 21d89335fe
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJVO0XmAAoJEBu5sftaTG2tTpsQAJaSV/4vUt1R+HloAxpiAkQQ
 ai6C9r0jXEDOggO+jqeNLhM6ZaFxPOqI7+O09EXoRQXnFjtXPq6V4Yj8vr7urh5Z
 ozg3K2atQ6htvoDjqktSHuMwJLTGCHDCKzHV/uvZlFT0o90XomGLAJ+3RuWqgZu7
 5h+jnzfo+pLxme2jiCFQvFQ+p6Y+yZiphiUc5HbnIs4aTvDJxKmhZHMXVshbFJQe
 wPr1kp4xdefiys5A5agKejPOdQm8z4PVzZfnehfQZholkKlYFSgOLc7s4qJ+WOFl
 Bwl8B0Nm4LqIr0hkyEvPBX7PwmAu8/2aHeEj423rLXCDvHjGbmDWE99LSRvDYFK4
 nuZkrR+dI0kbYqtfkWH8MMfu/YHcC+uHrkVbLpqV4r8F8jT/f6ysyJ/kb76WoVEK
 B2q/nfBjtcHXOb/7GT/Q8MIvIXDsAVNp9jtEiQ/u/Jr8T7t9GtuQbgy1Y+eDOl4G
 Hg5635qfj6SImKtj6e4VqOb968TqeE0qoqBeLFEG2boqyVOjHbfk8gj5IZParp3R
 WfZDAS6OpY95W+gJzH0rBUh0h5fcuB+aN16ak4snaDxwd6gl9NfdPOydt4zQTs4q
 tmKnyuXig5age0IgGFliubdWlAL72GSN8M+uBp+Pe0QoEoJRPN3AiaY63OgUBk9S
 ID6TzMI990IRIxGTQnho
 =nJSZ
 -----END PGP SIGNATURE-----

Merge tag 'jm_21d89335'

Tag for commit 21d89335fe

# gpg: Signature made Sat Apr 25 09:44:38 2015 CEST using RSA key ID 5A4C6DAD
# gpg: Good signature from "Jason Mehring (Qubes OS Signing Key) <nrgaway@gmail.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: E0E3 2283 FDCA C1A5 1007  8F27 1BB9 B1FB 5A4C 6DAD

* tag 'jm_21d89335':
  debian: Update notification now notifies dom0 when an upgrade is completed
2015-04-28 01:27:29 +02:00
Marek Marczykowski-Górecki
7adbc3fd59 Use iptables --wait only when it is supported 2015-04-28 00:51:05 +02:00
Jason Mehring
21d89335fe
debian: Update notification now notifies dom0 when an upgrade is completed 2015-04-25 03:44:28 -04:00
Jason Mehring
4373cda566 Changed location of PROTECTED_FILE_LIST to /etc/qubes/protected-files.d 2015-04-25 02:36:43 +02:00
Jason Mehring
56b0685aaa whonix: Added protected-files file used to prevent scripts from modifying files that need to be protected
A file is created in /var/lib/qubes/protected-files.  Scripts can grep this file before modifying
        known files to be protected and skip any modifications if the file path is within protected-files.

        Usage Example:
            if ! grep -q "^/etc/hostname$" "${PROTECTED_FILE_LIST}" 2>/dev/null; then

        Also cleaned up maintainer scripts removing unneeded systemd status functions and streamlined
        the enable/disable systemd unit files functions
2015-04-25 02:36:43 +02:00
Marek Marczykowski-Górecki
c49d9283f0 network: wait for iptables lock instead of aborting
vif-route-qubes can be called simultaneously, for example in case of:
 - multiple domains startup
 - HVM startup (two interfaces: one to the target domain, second one to
   stubdom)
If that happens, one of calls can fail because of iptables lock.
2015-04-21 04:41:57 +02:00
Marek Marczykowski-Górecki
b655d968c4 updates-proxy: allow xz compressed metadata (fc21) 2015-02-17 14:11:09 +01:00
Marek Marczykowski-Górecki
4dbd9e205c network: fix handling newline in firewall rules
Since the rules are no more directly handed to echo -e, sed needs to
handle all escape sequences used in rules (newline only, but in
different notations).
2015-02-11 14:14:27 +01:00
HW42
dad5bfbd18 remove 'bashisms' or explicit use bash 2015-02-05 05:42:08 +01:00
Marek Marczykowski-Górecki
19a4c6d0dd network: support for not setting DNS and/or default gateway (v2)
This patch introduces two new qvm-services:
 - disable-default-route
 - disable-dns-server
Both disabled by default. You can enable any of them to not set default
route and/or DNS servers in the VM. Those settings have no effect on
NetVM, where such settings are controlled by NetworkManager.

This is based on patch sent by Joonas Lehtonen
<joonas.lehtonen@openmailbox.org>
https://groups.google.com/d/msgid/qubes-devel/54C7FB59.2020603%40openmailbox.org

Conflicts:
	network/setup-ip
	vm-init.d/qubes-core
	vm-systemd/qubes-sysinit.sh
2015-01-30 00:52:31 +01:00
Marek Marczykowski-Górecki
4637735882 network: support for not setting DNS and/or default gateway
This patch introduces two new qvm-services:
 - set-default-route
 - set-dns-server
Both enabled by default. You can disable any of them to not set default
route and/or DNS servers in the VM. Those settings have no effect on
NetVM, where such settings are controlled by NetworkManager.

This is based on patch sent by Joonas Lehtonen
<joonas.lehtonen@openmailbox.org>
https://groups.google.com/d/msgid/qubes-devel/54C39656.3090303%40openmailbox.org

Conflicts:
	network/setup-ip
	vm-init.d/qubes-core
	vm-systemd/qubes-sysinit.sh
2015-01-30 00:48:55 +01:00
Marek Marczykowski-Górecki
0be213200a network: fix NM config preparation
The same variables are reused to configure downlink in ProxyVM, so
create NM config before they got overrided.

Conflicts:
	network/setup-ip
2015-01-30 00:43:29 +01:00
Marek Marczykowski-Górecki
b3429b596d network: set uplink configuration based on MAC (NetworkManager) 2015-01-30 00:39:37 +01:00
Marek Marczykowski-Górecki
5bd3080521 Update update-proxy rules for debian security fixes repo
The name can be "wheezy/updates".
2015-01-30 00:32:56 +01:00
Marek Marczykowski-Górecki
9130636c88 Merge branch 'debian'
Conflicts:
	misc/qubes-r2.list.in
	misc/qubes-trigger-sync-appmenus.sh
	network/30-qubes-external-ip
	network/qubes-firewall
	vm-systemd/network-proxy-setup.sh
	vm-systemd/prepare-dvm.sh
	vm-systemd/qubes-sysinit.sh
2015-01-30 00:30:24 +01:00
Marek Marczykowski
db35abadc8 Use Qubes DB instead of Xenstore 2014-11-19 15:34:33 +01:00
Marek Marczykowski-Górecki
ea4eef7de8 network: fix indentation 2014-11-13 23:19:34 +01:00