core-agent-linux

Qubes/core-agent-linux

Fork 0

Commit Graph

Author	SHA1	Message	Date
Pawel Marczewski	cd19073d50	Update rule priorities for anti-spoofing	2020-01-10 09:19:32 +01:00
Pawel Marczewski	bfe31cfec8	qubes-firewall: add anti-spoofing rules for connected machines qubes-firewall will now blacklist IP addresses from all connected machines on non-vif* interfaces. This prevents spoofing source or target address on packets going over an upstream link, even if a VM in question is powered off at the moment. Depends on QubesOS/qubes-core-admin#303 which makes admin maintain the list of IPs in qubesdb. Fixes QubesOS/qubes-issues#5540.	2020-01-09 18:25:08 +01:00
Marek Marczykowski-Górecki	715693b93d	network: IPv6-enabled firewall If IPv6 is configured in the VM, and it is providing network to others, apply IPv6 firewall similar to the IPv4 one (including NAT for outgoing traffix), instead of blocking everything. Also, enable IP forwarding for IPv6 in such a case. Fixes QubesOS/qubes-issues#718	2017-12-07 01:41:55 +01:00

Author

SHA1

Message

Date

Pawel Marczewski

cd19073d50

Update rule priorities for anti-spoofing

2020-01-10 09:19:32 +01:00

Pawel Marczewski

bfe31cfec8

qubes-firewall: add anti-spoofing rules for connected machines

qubes-firewall will now blacklist IP addresses from all connected
machines on non-vif* interfaces. This prevents spoofing source or
target address on packets going over an upstream link, even if
a VM in question is powered off at the moment.

Depends on QubesOS/qubes-core-admin#303 which makes admin maintain
the list of IPs in qubesdb.

Fixes QubesOS/qubes-issues#5540.

2020-01-09 18:25:08 +01:00

Marek Marczykowski-Górecki

715693b93d

network: IPv6-enabled firewall

If IPv6 is configured in the VM, and it is providing network to others,
apply IPv6 firewall similar to the IPv4 one (including NAT for outgoing
traffix), instead of blocking everything. Also, enable IP forwarding for
IPv6 in such a case.

Fixes QubesOS/qubes-issues#718

2017-12-07 01:41:55 +01:00

3 Commits