Qubes
/
gsoc


			
				
					
						
						
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354
							<html>
<head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Re: GSoC Port Forwarding</title>
<link rel="important stylesheet" href="">
<style>div.headerdisplayname {font-weight:bold;}
</style></head>
<body>
<table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part1"><tr><td><div class="headerdisplayname" style="display:inline;">Oggetto: </div>Re: GSoC Port Forwarding</td></tr><tr><td><div class="headerdisplayname" style="display:inline;">Mittente: </div>Marek Marczykowski-Górecki &lt;marmarek@invisiblethingslab.com&gt;</td></tr><tr><td><div class="headerdisplayname" style="display:inline;">Data: </div>23/06/2021, 23:11</td></tr></table><table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part2"><tr><td><div class="headerdisplayname" style="display:inline;">A: </div>Giulio <giulio@gmx.com></td></tr><tr><td><div class="headerdisplayname" style="display:inline;">CC: </div>Frédéric Pierret &lt;frederic.pierret@qubes-os.org&gt;</td></tr></table><br>
<div class="moz-text-plain" wrap=true graphical-quote=true style="font-family: -moz-fixed; font-size: 14px;" lang="x-unicode"><pre wrap class="moz-quote-pre">
On Wed, Jun 23, 2021 at 04:37:20PM +0200, Giulio wrote:
</pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
<span class="moz-txt-citetags">&gt; </span>Hello,
<span class="moz-txt-citetags">&gt; </span>thank you again for your time and the explanations, as well as the
<span class="moz-txt-citetags">&gt; </span>network graph. I have now a better understanding of the overall design
<span class="moz-txt-citetags">&gt; </span>and I am moving myself trhough the source code in order to think what to
<span class="moz-txt-citetags">&gt; </span>place where.
<span class="moz-txt-citetags">&gt; </span>
<span class="moz-txt-citetags">&gt; </span>So, in order to translate what we discussed in practice and also check
<span class="moz-txt-citetags">&gt; </span>my understanding of the code so far:
<span class="moz-txt-citetags">&gt; </span>
<span class="moz-txt-citetags">&gt; </span>1) In core-admin-client/qubesadmin/firewall.py firewall.py &gt; The code
<span class="moz-txt-citetags">&gt; </span>needs to support the new options for the rule (action=forward
<span class="moz-txt-citetags">&gt; </span>frowardtype=&lt;internal/external&gt; srcports=443-443 srchosts=0.0.0.0/0
<span class="moz-txt-citetags">&gt; </span>2) In core-admin/qubes/firewall.py -&gt; The code needs to support the same
<span class="moz-txt-citetags">&gt; </span>options as the point above
<span class="moz-txt-citetags">&gt; </span>3) In core-admin/qubes/vm/mix/net.py -&gt; The most important logic goes
<span class="moz-txt-citetags">&gt; </span>here. Here there is the need to resolve the full network chain for
<span class="moz-txt-citetags">&gt; </span>external port forwarding. From here it is possible to add the respective
<span class="moz-txt-citetags">&gt; </span>rules to the QubesDB of each netvm in he chain and trigger a reload event.
<span class="moz-txt-citetags">&gt; </span>4) in core-agent-linux/qubesagent/firewall.py -&gt; Here goes the logic for
<span class="moz-txt-citetags">&gt; </span>building the correct syntax for iptables or nft and the actual execution
<span class="moz-txt-citetags">&gt; </span>
<span class="moz-txt-citetags">&gt; </span>Does it makes sense for you?
</pre></blockquote><pre wrap class="moz-quote-pre">

Yes, I think you got this perfectly correct.

</pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
<span class="moz-txt-citetags">&gt; </span>I now totally understand your doubts, and I think the simplest solution
<span class="moz-txt-citetags">&gt; </span>then would be a time/date picker, so if the user is planning anything
<span class="moz-txt-citetags">&gt; </span>specific he can configure all the set of rules to the same expiration
<span class="moz-txt-citetags">&gt; </span>timewithout  incurring in the synchronization issues you mentioned.
</pre></blockquote><pre wrap class="moz-quote-pre">

Yes, that could work, with some easy way to use the same time for
multiple rules (for example default to the last choice).

<div class="moz-txt-sig">-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
</div></pre></div></body>
</html>
</table></div>