Skip to content
This repository has been archived by the owner on Feb 26, 2021. It is now read-only.

Account for changes in Qubes 4 firewall #14

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Account for changes in Qubes 4 firewall #14

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9e55fdc
Use qubes-firewall.d instead of iphook on Qubes 4
tasket Mar 27, 2018
5653e16
Backup Qubes 3 script when replacing.
tasket Mar 27, 2018
199b2d7
Fix path
tasket Mar 31, 2018
35ab648
Check for bak file
tasket Apr 6, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions src/leap/bitmask/vpn/helpers/linux/bitmask-root
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,11 +158,12 @@ QUBES_PROXY = os.path.exists("/var/run/qubes/this-is-proxyvm")
if os.path.isdir("/etc/qubes"):
QUBES_CFG = "/rw/config/"
QUBES_IPHOOK = QUBES_CFG + "qubes-ip-change-hook"
QUBES_FW_SCRIPT = QUBES_CFG + "qubes-firewall-user-script"
if subprocess.call([IPTABLES, "--list", "QBS-FORWARD"]) == 0:
QUBES_VER = 4
QUBES_FW_SCRIPT = QUBES_CFG + "/qubes-firewall.d/90_tunnel-restrict"
else:
QUBES_VER = 3
QUBES_FW_SCRIPT = QUBES_CFG + "qubes-firewall-user-script"
else:
# not a Qubes system
QUBES_VER = 0
Expand Down Expand Up @@ -741,6 +742,11 @@ def firewall_start(args):
# Must stay on 'top' of chain!
if QUBES_PROXY and QUBES_VER >= 3 and run("grep", \
"installed\ by\ " + SCRIPT, QUBES_FW_SCRIPT, exitcode=True) != 0:
if QUBES_VER == 4 and \
not os.path.isdir(os.path.dirname(QUBES_FW_SCRIPT)):
os.makedirs(os.path.dirname(QUBES_FW_SCRIPT))
if QUBES_VER == 3 and os.path.exists(QUBES_FW_SCRIPT):
os.rename(QUBES_FW_SCRIPT, QUBES_FW_SCRIPT + ".bak")
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't the second run of bitmask going to rewrite the .bak file with the bitmask modified one? Maybe you could check if there is no .bak file and only do the rename if so? Does this make sense? Or am I missing something?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It will overwrite only in the case that the current QUBES_FW_SCRIPT is not bitmask-generated (outer if block). But checking here as you suggest is also a good idea.

with open(QUBES_FW_SCRIPT, mode="w") as qfile:
qfile.write("#!/bin/sh\n")
qfile.write("# Anti-leak rules installed by " + SCRIPT + " " \
Expand All @@ -752,8 +758,6 @@ def firewall_start(args):
qfile.write("iptables --insert INPUT -i tun+ -j DROP\n")
qfile.write("ip6tables --insert INPUT -i tun+ -j DROP\n")
os.chmod(QUBES_FW_SCRIPT, stat.S_IRWXU)
if not os.path.exists(QUBES_IPHOOK):
os.symlink(QUBES_FW_SCRIPT, QUBES_IPHOOK)
if QUBES_VER == 4:
run(QUBES_FW_SCRIPT)
elif QUBES_VER == 3:
Expand Down