Hi,

Le 7/13/21 à 3:56 PM, Giulio a écrit :

Hi,

Il 29/06/2021 03:31, Marek Marczykowski-Górecki ha scritto:

Yes, preparing rules in firewall.py sounds like a good idea. A new
function is a good idea too. But note that for 'external' rules you need
to apply them at several places (sys-net, sys-firewall etc). They aren't
necessarily will be the same.
I'd recommend getting an example, and writing down all the rules that
should be applied, in all related VMs (specific iptables/nft commands).
You have mostly done this part already.
This part you can also test manually - really add those rules
manually and check if everything works as it should. This way you ensure
the rule set is sufficient.

Then, write down QubesDB entries that describe them - carefully matching
which information in the rule is built from which information in qdb
entry.
With that information, you know what qdb entries you need to produce for
each VM, and should be easier to design this extra function/functions -
especially, you'll see what input data such function needs and how many
different rules it needs to return.

I tried writing a possible implementation to see how it could work and
also to get an initial feedback. Since in the past week I had no access
to my test machine, I just fixed the last things today and seems that
overall the implemented parts are working (up to writing the rules with
the correctly IPs in the appropriate agent databases).

Here are the repositories https://git.lsd.cat/Qubes

Here is a list of what has yet to be done:
1) Lot of testing and writing tests
2) Any modification to the agent (such as applying the rules)
3) "srchost" parameter support
4) GUI
5) Find a way to display the chain of rules in the qvm-firewall of every
VM involved since as of now it is displayed only in the VM for which the
rule was set

Here is a list of what should work:
1) Adding and deleting forward rules, both internal and external, via
qvm-firewall. Also basic checks of the consistency of rules and required
options should be in place
2) Display of forward rules via qvm-firewall
3) Persistence and resume of forward rules in firewall.xml
4) Correct distribution of the required rules in the network chain in net.py


Overall I tried getting the most possible from already existing code in
order not to change the style and introduce as few changes as possible.
Without having you correct the code step by step, before going forward
with the agent I would like to have a feedback if the coding style seems
consistent enough with yours and especially if the implementation in
net.py of the distributions of the rules matches your expectations.

My changes are only in core-admin and core-admin-client for now.

Cheers
Giulio

I will have a look to your work probably in the afternoon.

Just a question, any reason for hosting your work elsewhere than on GitHub? For example, that would be easier for us to review your code directly on GitHub (adding comments, tracking easily progression etc). Also, I've briefly checked, a good practice is to not work on master branch directly. I encourage you to use a separate branch named as you want.

Best regards,
Frédéric