#!/bin/bash set -e PIDFILE=/var/run/qubes/qubes-firewall.pid XENSTORE_IPTABLES=qubes-iptables XENSTORE_IPTABLES_HEADER=qubes-iptables-header XENSTORE_ERROR=qubes-iptables-error OLD_RULES="" # PIDfile handling [[ -e $PIDFILE ]] && kill -s 0 $(<$PIDFILE) 2>/dev/null && exit 0 echo $$ >$PIDFILE trap 'exit 0' SIGTERM FIRST_TIME=yes while true; do echo "1" > /proc/sys/net/ipv4/ip_forward if [ "$FIRST_TIME" ]; then FIRST_TIME= TRIGGER=reload else # Wait for changes in xenstore file /usr/bin/xenstore-watch-qubes $XENSTORE_IPTABLES TRIGGER=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES) fi if ! [ "$TRIGGER" = "reload" ]; then continue ; fi # Disable forwarding to prevent potential "leaks" that might # be bypassing the firewall or some proxy service (e.g. tor) # during the time when the rules are being (re)applied echo "0" > /proc/sys/net/ipv4/ip_forward RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES_HEADER) IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d') OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || true` for i in $(xenstore-list qubes-iptables-domainrules) ; do RULES=$(/usr/bin/xenstore-read qubes-iptables-domainrules/"$i") ERRS=`echo -e "$RULES" | /sbin/iptables-restore -n 2>&1 || true` echo "Failed applying rules for $i: $ERRS" >&2 OUT="$OUT$ERRS" done /usr/bin/xenstore-write $XENSTORE_ERROR "$OUT" if [ "$OUT" ]; then DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || : fi # Check if user didn't define some custom rules to be applied as well... [ -x /rw/config/qubes-firewall-user-script ] && /rw/config/qubes-firewall-user-script # XXX: Backward compatibility [ -x /rw/config/qubes_firewall_user_script ] && /rw/config/qubes_firewall_user_script done