Commit Graph

23 Commits

Author SHA1 Message Date
3hhh
adfe982bfd
tests/firewall: added test for /dns/[ip]/[domain] info 2021-05-16 08:09:19 +02:00
3hhh
3230f471b0
tests/firewall: some code refactoring 2021-05-16 08:07:50 +02:00
3hhh
0993115bdc
add some checks for QubesDB /qubes-firewall_handled/[ip] 2021-05-16 07:32:10 +02:00
3hhh
3067e469d3
firewall: adjust tests to the new tuple returned by prepare_rules() 2021-05-15 22:13:01 +02:00
3hhh
dda500b837
mock qubesdb.rm() 2021-05-15 12:33:24 +02:00
Pawel Marczewski
e6eee9f4e0
update_connected_ips: set iptables policy to drop while updating 2020-01-14 11:46:23 +01:00
Pawel Marczewski
a12e72b89c
update_connected_ips: reload nftables using one command
Get rid of race condition between flushing the chains
and adding new rules.
2020-01-14 10:46:51 +01:00
Pawel Marczewski
4aace50313
get_connected_ips: handle empty and missing keys, add tests 2020-01-14 10:23:41 +01:00
Pawel Marczewski
e43fd2fc5a
update_connected_ips: correctly handle byte-string 2020-01-14 10:14:00 +01:00
Pawel Marczewski
860a07166b
Update tests for anti-spoofing, add test for the method itself 2020-01-10 09:19:40 +01:00
Pawel Marczewski
c1d8d7bce1
Update firewall tests 2020-01-09 18:42:14 +01:00
Marek Marczykowski-Górecki
a899adb69e
Convert qubesagent module to python3
This and all files using it.

QubesOS/qubes-issues#5297
2019-09-19 04:57:55 +02:00
Marek Marczykowski-Górecki
ff5e9d0d56
tests: update yum.qubes-os.org IP address
The test rely on some real domain name to be resolved to an IP address.
yum.qubes-os.org recently have changed its IP.
2018-09-28 19:06:16 +02:00
Peter Gerber
7d783b3010
Qubes firewall: correct syntax for icmpv6 rejects
I've run into an issue with incorrectly generated rules for IPv6. I
added some debugging code printing the generated rules and the
resulting error (see below). Turns out "reject with" expects icmpv6
rather than icmp6.

--- generated rule ---

flush chain ip6 qubes-firewall qbs-fd09-24ef-4179--a89-15
table ip6 qubes-firewall {
  chain qbs-fd09-24ef-4179--a89-15 {
    ip6 daddr fc00::/8 reject with icmp6 type admin-prohibited
    ip6 daddr fd00::/8 reject with icmp6 type admin-prohibited
    ip6 daddr fe80::/10 reject with icmp6 type admin-prohibited
    accept
    reject with icmp6 type admin-prohibited
  }
}

--- output ---

/dev/stdin:4:36-40: Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx

                                   ^^^^^
/dev/stdin:5:36-40: Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx

                                   ^^^^^
/dev/stdin:6:37-41: Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx

                                    ^^^^^
/dev/stdin:8:17-21: Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx

                ^^^^^
2018-05-07 22:39:22 +00:00
Marek Marczykowski-Górecki
a026d04c0d
qubes-firewall: reject packets instead of dropping
qubes-firewall service is meant as mistakes mitigation, not a
high-volume external network filter. Providing feedback (ICMP
admin-prohibited error packet) to the VM reduces timeouts and give
immediate connection failure. This is especially useful when some
website tries to load unwanted (not whitelisted) 3rd party elements -
providing error response avoids long site loading time.

Fixes QubesOS/qubes-issues#3607
2018-05-02 04:49:23 +02:00
Marek Marczykowski-Górecki
53c9b45c76
qubes-firewall: handle only traffic originating from VMs
Ignore packets coming from non-vif interfaces early.

Fixes QubesOS/qubes-issues#3644
2018-04-03 02:23:16 +02:00
Marek Marczykowski-Górecki
6b48d79d8c
tests: check if qubes-firewall-user-script is called
QubesOS/qubes-issues#3260
2018-02-05 18:17:29 +01:00
Marek Marczykowski-Górecki
c324b16252
firewall: allow also related traffic
This include ICMP error messages for allowed traffic.

Fixes QubesOS/qubes-issues#3406
2017-12-28 05:34:30 +01:00
Marek Marczykowski-Górecki
4d51ea9387
Fix IPv6 support in qubes-firewall
Chain name in IPv6 cannot be longer than 29 chars, so strip IPv6 prefix
from it.
ICMP on IPv6 is a different protocol than on IPv4 - handle iptables rule
accordingly.

QubesOS/qubes-issues#718
2017-12-07 01:41:56 +01:00
Marek Marczykowski-Górecki
57a3c2d67e
network: have safe fallback in case of qubes-firewall crash/error
When qubes-firewall service is started, modify firewall to have "DROP"
policy, so if something goes wrong, no data got leaked.
But keep default action "ACCEPT" in case of legitimate service stop, or
not starting it at all - because one may choose to not use this service
at all.
Achieve this by adding "DROP" rule at the end of QBS-FIREWALL chain and
keep it there while qubes-firewall service is running.

Fixes QubesOS/qubes-issues#3269
2017-11-20 01:56:14 +01:00
Marek Marczykowski-Górecki
07be216a0d
tests: add run-tests script, plug it into travis
Also, replace subproces.call with a mockup, as notify-send is not
available on travis.
2017-05-20 13:20:08 +02:00
Marek Marczykowski-Górecki
87efe51be0
tests: make firewall tests working regardless of python version
Don't depend on set ordering...
2017-05-20 12:56:23 +02:00
Marek Marczykowski-Górecki
ee0a292b21
network: rewrite qubes-firewall daemon
This rewrite is mainly to adopt new interface for Qubes 4.x.
Main changes:
 - change language from bash to python, introduce qubesagent python package
 - support both nftables (preferred) and iptables
 - new interface (https://qubes-os.org/doc/vm-interface/)
 - IPv6 support
 - unit tests included
 - nftables version support running along with other firewall loaded

Fixes QubesOS/qubes-issues#1815
QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00