Skip to content
This repository was archived by the owner on Feb 26, 2021. It is now read-only.

Account for changes in Qubes 4 firewall #14

Open
tasket wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Account for changes in Qubes 4 firewall #14

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9e55fdc
Use qubes-firewall.d instead of iphook on Qubes 4
tasket Mar 27, 2018
5653e16
Backup Qubes 3 script when replacing.
tasket Mar 27, 2018
199b2d7
Fix path
tasket Mar 31, 2018
35ab648
Check for bak file
tasket Apr 6, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions src/leap/bitmask/vpn/helpers/linux/bitmask-root
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,11 +158,12 @@ QUBES_PROXY = os.path.exists("/var/run/qubes/this-is-proxyvm")
if os.path.isdir("/etc/qubes"):
QUBES_CFG = "/rw/config/"
QUBES_IPHOOK = QUBES_CFG + "qubes-ip-change-hook"
QUBES_FW_SCRIPT = QUBES_CFG + "qubes-firewall-user-script"
if subprocess.call([IPTABLES, "--list", "QBS-FORWARD"]) == 0:
QUBES_VER = 4
QUBES_FW_SCRIPT = QUBES_CFG + "qubes-firewall.d/90_tunnel-restrict"
else:
QUBES_VER = 3
QUBES_FW_SCRIPT = QUBES_CFG + "qubes-firewall-user-script"
else:
# not a Qubes system
QUBES_VER = 0
Expand Down Expand Up @@ -741,6 +742,12 @@ def firewall_start(args):
# Must stay on 'top' of chain!
if QUBES_PROXY and QUBES_VER >= 3 and run("grep", \
"installed\ by\ " + SCRIPT, QUBES_FW_SCRIPT, exitcode=True) != 0:
if QUBES_VER == 4 and \
not os.path.isdir(os.path.dirname(QUBES_FW_SCRIPT)):
os.makedirs(os.path.dirname(QUBES_FW_SCRIPT))
if QUBES_VER == 3 and os.path.exists(QUBES_FW_SCRIPT) \
and not os.path.exists(QUBES_FW_SCRIPT + ".bak"):
os.rename(QUBES_FW_SCRIPT, QUBES_FW_SCRIPT + ".bak")
with open(QUBES_FW_SCRIPT, mode="w") as qfile:
qfile.write("#!/bin/sh\n")
qfile.write("# Anti-leak rules installed by " + SCRIPT + " " \
Expand All @@ -752,8 +759,6 @@ def firewall_start(args):
qfile.write("iptables --insert INPUT -i tun+ -j DROP\n")
qfile.write("ip6tables --insert INPUT -i tun+ -j DROP\n")
os.chmod(QUBES_FW_SCRIPT, stat.S_IRWXU)
if not os.path.exists(QUBES_IPHOOK):
os.symlink(QUBES_FW_SCRIPT, QUBES_IPHOOK)
if QUBES_VER == 4:
run(QUBES_FW_SCRIPT)
elif QUBES_VER == 3:
Expand Down