63e915f6d4
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJUTruhAAoJEAY5OLpCz6ck7IcP/i4JXNEMO8vDSgphM50NIIz6
+hLb+kXBGeL9SsQKRlz000BUOcIsg+d2ibwnTsi1kNuq2OgJOAHAp5hHgHGc5ddG
0PLFf/Ddexl7/2cG/hKekXiIpXGcuhqgsIfatqcKB228mVLG8y/kqwViIDbMgg10
X8Aiq1ba0EeHI7xskkPb1hzkszOfLFoEXCRjt+BQsmr+Bll+sAzCS3G9vSbhczFl
wmTtgOiu2fWsPgOB2O6HYeO0PUUX+jGF/jncZYf85pEwMccNqRIWjSJC6ti533zv
5x1bWKWFymBAUcTS+xi00FPeatmQ7b5ywMxTwbqIQkE1Mrt436Dz/B1r0E58q0AH
gu4qG/KPBNdRBD4vPrvLKiyood/XIpvz0+6QqS9rFMKt71OSzmMR1WeLgclCn768
cR510iZyJjmqe9lLQQTCJr+oqvwiVot7sfsgj1XP5PozalTkdIawioIZjeX5Zz4O
+zo+P+jIV+P6QbN+0nD+vrW8kSZlM8vt+OVBPhon/bMFxGKZervs7kFUCNPn6fUK
WNw8lSrKQqJe/a805Ktku8moatVElmexj7XTkII1nnAnEu6/bokJqjCHQ933794l
ERRwitFN+BWm3OBXq/BsdSnCotT+gnlMEDtuHiD0JHQBGwxAZGQtliQhWLF25Ekh
BJkmYBjqgnjCsQFUBMnn
=shGW
-----END PGP SIGNATURE-----
Merge tag 'mm_5d68e2cc' into debian-systemd
Tag for commit 5d68e2cc70
Conflicts:
Makefile
debian/rules
network/qubes-firewall
vm-systemd/misc-post.sh
vm-systemd/qubes-sysinit.sh
59 lines
1.7 KiB
Bash
Executable File
59 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
PIDFILE=/var/run/qubes/qubes-firewall.pid
|
|
XENSTORE_IPTABLES=qubes-iptables
|
|
XENSTORE_IPTABLES_HEADER=qubes-iptables-header
|
|
XENSTORE_ERROR=qubes-iptables-error
|
|
OLD_RULES=""
|
|
# PIDfile handling
|
|
[[ -e $PIDFILE ]] && kill -s 0 $(<$PIDFILE) 2>/dev/null && exit 0
|
|
echo $$ >$PIDFILE
|
|
|
|
trap 'exit 0' SIGTERM
|
|
|
|
FIRST_TIME=yes
|
|
|
|
while true; do
|
|
|
|
echo "1" > /proc/sys/net/ipv4/ip_forward
|
|
|
|
if [ "$FIRST_TIME" ]; then
|
|
FIRST_TIME=
|
|
TRIGGER=reload
|
|
else
|
|
# Wait for changes in xenstore file
|
|
xenstore-watch-qubes $XENSTORE_IPTABLES
|
|
TRIGGER=$(xenstore-read $XENSTORE_IPTABLES)
|
|
fi
|
|
|
|
if ! [ "$TRIGGER" = "reload" ]; then continue ; fi
|
|
|
|
# Disable forwarding to prevent potential "leaks" that might
|
|
# be bypassing the firewall or some proxy service (e.g. tor)
|
|
# during the time when the rules are being (re)applied
|
|
echo "0" > /proc/sys/net/ipv4/ip_forward
|
|
|
|
RULES=$(xenstore-read $XENSTORE_IPTABLES_HEADER)
|
|
IPTABLES_SAVE=$(iptables-save | sed '/^\*filter/,/^COMMIT/d')
|
|
OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | iptables-restore 2>&1 || true`
|
|
|
|
for i in $(xenstore-list qubes-iptables-domainrules) ; do
|
|
RULES=$(xenstore-read qubes-iptables-domainrules/"$i")
|
|
ERRS=`echo -e "$RULES" | /sbin/iptables-restore -n 2>&1 || true`
|
|
if [ -n "$ERRS" ]; then
|
|
echo "Failed applying rules for $i: $ERRS" >&2
|
|
OUT="$OUT$ERRS"
|
|
fi
|
|
done
|
|
xenstore-write $XENSTORE_ERROR "$OUT"
|
|
if [ -n "$OUT" ]; then
|
|
DISPLAY=:0 /usr/bin/notify-send -t 3000 "Firewall loading error ($HOSTNAME)" "$OUT" || :
|
|
fi
|
|
|
|
# Check if user didn't define some custom rules to be applied as well...
|
|
[ -x /rw/config/qubes-firewall-user-script ] && /rw/config/qubes-firewall-user-script
|
|
# XXX: Backward compatibility
|
|
[ -x /rw/config/qubes_firewall_user_script ] && /rw/config/qubes_firewall_user_script
|
|
done
|