Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
2,384 Commits 1 Branch 0 Tags 6.4 MiB
dba1020b4c
Commit Graph

7 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
57a3c2d67e
network: have safe fallback in case of qubes-firewall crash/error 
When qubes-firewall service is started, modify firewall to have "DROP"
policy, so if something goes wrong, no data got leaked.
But keep default action "ACCEPT" in case of legitimate service stop, or
not starting it at all - because one may choose to not use this service
at all.
Achieve this by adding "DROP" rule at the end of QBS-FIREWALL chain and
keep it there while qubes-firewall service is running.

Fixes QubesOS/qubes-issues#3269
 2017-11-20 01:56:14 +01:00
Marek Marczykowski-Górecki
ee0a292b21
network: rewrite qubes-firewall daemon 
This rewrite is mainly to adopt new interface for Qubes 4.x.
Main changes:
 - change language from bash to python, introduce qubesagent python package
 - support both nftables (preferred) and iptables
 - new interface (https://qubes-os.org/doc/vm-interface/)
 - IPv6 support
 - unit tests included
 - nftables version support running along with other firewall loaded

Fixes QubesOS/qubes-issues#1815
QubesOS/qubes-issues#718
 2016-09-12 05:22:53 +02:00
Marek Marczykowski-Górecki
b9e51f9ab3 network: use more strict policy about incoming traffic 
Do not allow ICMP from uplink VM (or the outside world). Also do not
send ICMP icmp-host-prohibited to the uplink.

Fixes QubesOS/qubes-issues#1346
 2015-12-30 02:09:23 +01:00
Marek Marczykowski-Górecki
4c3d5a46c2 firewall: replace deprecated "state" iptables module with "conntrack" 2014-03-28 02:56:43 +01:00
Marek Marczykowski
4b98106732 dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table 
Additional chain for some qubes-related redirections. BTW PR-QBS should be
renamed now to PR-QBS-DNS...
 2012-05-31 03:11:43 +02:00
Marek Marczykowski
b5fff2564f vm/iptables: do not MASQUERADE packets on lo (#416) 
Masquerading packets on lo actually drops them when there is no default route.
This causes problems with commutication between ntpd processes (ntp main
daemon and resolver). And perhaps many more...
 2012-01-13 20:42:31 +01:00
Marek Marczykowski
240d35259f vm(+dom0): major rearrage VM files in repo; merge core-*vm packages 2012-01-06 21:31:12 +01:00