c8213ea55a
Core3 no longer reuse netvm own IP for primary DNS. At the same time, disable dropping traffic to netvm itself because it breaks DNS (as one of blocked things). This allows VM to learn real netvm IP, but: - this mechanism is not intended to avoid detection from already compromised VM, only about unintentional leaks - this can be prevented using vif-qubes-nat.sh on the netvm itself (so it will also have hidden its own IP) QubesOS/qubes-issues#1143
103 lines
3.8 KiB
Bash
Executable File
103 lines
3.8 KiB
Bash
Executable File
#!/bin/bash
|
|
#set -x
|
|
|
|
netvm_subnet=/24
|
|
undetectable_netvm_ips=
|
|
|
|
netns="${vif}-nat"
|
|
netvm_if="${vif}"
|
|
netns_netvm_if="${vif}-p"
|
|
netns_appvm_if="${vif}"
|
|
|
|
#
|
|
# .----------------------------------.
|
|
# | NetVM/ProxyVM |
|
|
# .------------.|.------------------. |
|
|
# | AppVM ||| $netns namespace | |
|
|
# | ||| | |
|
|
# | eth0<--------->$netns_appvm_if | |
|
|
# |$appvm_ip ||| $appvm_gw_ip | |
|
|
# |$appvm_gw_ip||| ^ | |
|
|
# '------------'|| |NAT | |
|
|
# || v | |
|
|
# || $netns_netvm_if<--->$netvm_if |
|
|
# || $netvm_ip | $netvm_gw_ip|
|
|
# |'------------------' |
|
|
# '----------------------------------'
|
|
#
|
|
|
|
|
|
function run
|
|
{
|
|
#echo "$@" >> /var/log/qubes-nat.log
|
|
"$@"
|
|
}
|
|
|
|
function netns
|
|
{
|
|
run ip netns exec "$netns" "$@"
|
|
}
|
|
|
|
run ip addr flush dev "$netns_appvm_if"
|
|
run ip netns delete "$netns" || :
|
|
|
|
if test "$command" == online; then
|
|
run ip netns add "$netns"
|
|
run ip link set "$netns_appvm_if" netns "$netns"
|
|
|
|
# keep the same MAC as the real vif interface, so NetworkManager will still
|
|
# ignore it
|
|
run ip link add "$netns_netvm_if" type veth peer name "$netvm_if" address fe:ff:ff:ff:ff:ff
|
|
run ip link set "$netns_netvm_if" netns "$netns"
|
|
|
|
netns ip6tables -t raw -I PREROUTING -j DROP
|
|
netns ip6tables -P INPUT DROP
|
|
netns ip6tables -P FORWARD DROP
|
|
netns ip6tables -P OUTPUT DROP
|
|
|
|
netns sh -c 'echo 1 > /proc/sys/net/ipv4/ip_forward'
|
|
|
|
netns iptables -t raw -I PREROUTING -i "$netns_appvm_if" ! -s "$appvm_ip" -j DROP
|
|
|
|
if test -n "$undetectable_netvm_ips"; then
|
|
# prevent an AppVM connecting to its own ProxyVM IP because that makes the internal IPs detectable even with no firewall rules
|
|
netns iptables -t raw -I PREROUTING -i "$netns_appvm_if" -d "$netvm_ip" -j DROP
|
|
|
|
# same for the gateway/DNS IPs
|
|
netns iptables -t raw -I PREROUTING -i "$netns_appvm_if" -d "$netvm_gw_ip" -j DROP
|
|
netns iptables -t raw -I PREROUTING -i "$netns_appvm_if" -d "$netvm_dns1_ip" -j DROP
|
|
netns iptables -t raw -I PREROUTING -i "$netns_appvm_if" -d "$netvm_dns2_ip" -j DROP
|
|
fi
|
|
|
|
netns iptables -t nat -I PREROUTING -i "$netns_netvm_if" -j DNAT --to-destination "$appvm_ip"
|
|
netns iptables -t nat -I POSTROUTING -o "$netns_netvm_if" -j SNAT --to-source "$netvm_ip"
|
|
|
|
netns iptables -t nat -I PREROUTING -i "$netns_appvm_if" -d "$appvm_gw_ip" -j DNAT --to-destination "$netvm_gw_ip"
|
|
netns iptables -t nat -I POSTROUTING -o "$netns_appvm_if" -s "$netvm_gw_ip" -j SNAT --to-source "$appvm_gw_ip"
|
|
|
|
if test -n "$appvm_dns1_ip"; then
|
|
netns iptables -t nat -I PREROUTING -i "$netns_appvm_if" -d "$appvm_dns1_ip" -j DNAT --to-destination "$netvm_dns1_ip"
|
|
netns iptables -t nat -I POSTROUTING -o "$netns_appvm_if" -s "$netvm_dns1_ip" -j SNAT --to-source "$appvm_dns1_ip"
|
|
fi
|
|
|
|
if test -n "$appvm_dns2_ip"; then
|
|
netns iptables -t nat -I PREROUTING -i "$netns_appvm_if" -d "$appvm_dns2_ip" -j DNAT --to-destination "$netvm_dns2_ip"
|
|
netns iptables -t nat -I POSTROUTING -o "$netns_appvm_if" -s "$netvm_dns2_ip" -j SNAT --to-source "$appvm_dns2_ip"
|
|
fi
|
|
|
|
netns ip addr add "$netvm_ip$netvm_subnet" dev "$netns_netvm_if"
|
|
netns ip addr add "$appvm_gw_ip" dev "$netns_appvm_if"
|
|
|
|
netns ip link set "$netns_netvm_if" up
|
|
netns ip link set "$netns_appvm_if" up
|
|
|
|
netns ip route add "$appvm_ip" dev "$netns_appvm_if" src "$appvm_gw_ip"
|
|
netns ip route add default via "$netvm_gw_ip" dev "$netns_netvm_if" src "$netvm_ip"
|
|
|
|
|
|
#run ip addr add "$netvm_gw_ip" dev "$netvm_if"
|
|
#run ip link set "$netvm_if" up
|
|
#run ip route add "$netvm_ip" dev "$netvm_if" src "$netvm_gw_ip"
|
|
fi
|
|
|