Message ID | 20240116150810.3477551-1-erik.kapfer@ipfire.org |
---|---|
State | New |
Headers |
Return-Path: <development-bounces@lists.ipfire.org> Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4TDspH3s3Sz3wmD for <patchwork@web04.haj.ipfire.org>; Tue, 16 Jan 2024 15:08:23 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4TDspD4Jttz8kg; Tue, 16 Jan 2024 15:08:20 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4TDspC6KNlz32hM; Tue, 16 Jan 2024 15:08:19 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4TDsp94ywvz2xg5 for <development@lists.ipfire.org>; Tue, 16 Jan 2024 15:08:17 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4TDsp90ZB8z7NM; Tue, 16 Jan 2024 15:08:17 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1705417697; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Q7FPBRFsfVSfYuc1X7z4axYoDVMrUp7GXO/3gIoBSs4=; b=zQd5Graae0lJY12sfoGyfWfrxA9aVk6o5SwDR4hUcPUqjFND/iGEsYIymKrDmqlBDXlWKI 28ZYYw4lr/Bg8yDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1705417697; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Q7FPBRFsfVSfYuc1X7z4axYoDVMrUp7GXO/3gIoBSs4=; b=Tl7PEYK3A5Ixdi72u3yiUz1VCHiKiGsTGrezVMbq8JZ7ft3mxPEtrPjxBRPy2pPqAtINNN qs9hKr+CtNppG/xR4NljIqKObtX8y/A3VDUvtYlY2YY6Dz6z1jUQUBG4FSEtWxz+ss9sFf r2TU0H9EujFCRzxlnQdQVMjdSHWnJbmN21ckoBVajrq9Khd3nGqalwQezf31fQtAM2SrhG Qyevj76hXb+PssVObo72ZY+0ZLLhTbJK/sWn9yHtMosE/wMrMUTewzpp8O31bY0dPDJ6+V 2Sk7Te3XrGBWqzUZsnbUu1dTbkdq7h4tPacN6s+dO7lINqi5ml27YeGPfp53bA== From: Erik Kapfer <erik.kapfer@ipfire.org> To: development@lists.ipfire.org Subject: [PATCH] Firewall initscript: Restore Tor IPTable rules by manual firewall restart Date: Tue, 16 Jan 2024 16:07:52 +0100 Message-ID: <20240116150810.3477551-1-erik.kapfer@ipfire.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: FAUFX4FL6MBVJIPCTUCBOJGXJGQ2Z32V X-Message-ID-Hash: FAUFX4FL6MBVJIPCTUCBOJGXJGQ2Z32V X-MailFrom: erik.kapfer@ipfire.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk <development.lists.ipfire.org> Archived-At: <https://lists.ipfire.org/hyperkitty/list/development@lists.ipfire.org/message/FAUFX4FL6MBVJIPCTUCBOJGXJGQ2Z32V/> List-Archive: <https://lists.ipfire.org/hyperkitty/list/development@lists.ipfire.org/> List-Help: <mailto:development-request@lists.ipfire.org?subject=help> List-Owner: <mailto:development-owner@lists.ipfire.org> List-Post: <mailto:development@lists.ipfire.org> List-Subscribe: <mailto:development-join@lists.ipfire.org> List-Unsubscribe: <mailto:development-leave@lists.ipfire.org> |
Series |
Firewall initscript: Restore Tor IPTable rules by manual firewall restart
|
|
Commit Message
Erik Kapfer
Jan. 16, 2024, 3:07 p.m. UTC
If the firewall will be manually restart via '/etc/init.d/firewall restart',
the IPTable rules for the Tor relay will be deleted since 'iptables_init' only
flushes and creates inbound and unbound chains for Tor but does not restore the
ruleset from Tor initscript.
For reference and tests please see -->
https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
---
src/initscripts/system/firewall | 6 ++++++
1 file changed, 6 insertions(+)
Comments
Hello Erik, Thank you for the patch. > On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer@ipfire.org> wrote: > > If the firewall will be manually restart via '/etc/init.d/firewall restart', > the IPTable rules for the Tor relay will be deleted since 'iptables_init' only > flushes and creates inbound and unbound chains for Tor but does not restore the > ruleset from Tor initscript. > > For reference and tests please see --> > https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697 > > Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org> > --- > src/initscripts/system/firewall | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall > index 50f2b3e02..50a7f2db9 100644 > --- a/src/initscripts/system/firewall > +++ b/src/initscripts/system/firewall > @@ -25,6 +25,7 @@ > eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) > eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) > eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) > +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) Is this file available even when Tor is not installed? We might get an error message here if it does not exist. > IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` > if [ -z $IFACE ]; then > IFACE="red0" > @@ -387,6 +388,11 @@ iptables_init() { > # run captivectrl > /usr/local/bin/captivectrl > > + # If a Tor relay is enabled apply firewall rules > + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then > + /usr/local/bin/torctrl restart 1> /dev/null > + fi > + > # POLICY CHAIN > iptables -N POLICYIN > iptables -A INPUT -j POLICYIN > -- > 2.43.0 >
Hi Michael, Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer: > Hello Erik, > > Thank you for the patch. > > > On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer@ipfire.org> > > wrote: > > > > If the firewall will be manually restart via '/etc/init.d/firewall > > restart', > > the IPTable rules for the Tor relay will be deleted since > > 'iptables_init' only > > flushes and creates inbound and unbound chains for Tor but does not > > restore the > > ruleset from Tor initscript. > > > > For reference and tests please see --> > > https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697 > > > > Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org> > > --- > > src/initscripts/system/firewall | 6 ++++++ > > 1 file changed, 6 insertions(+) > > > > diff --git a/src/initscripts/system/firewall > > b/src/initscripts/system/firewall > > index 50f2b3e02..50a7f2db9 100644 > > --- a/src/initscripts/system/firewall > > +++ b/src/initscripts/system/firewall > > @@ -25,6 +25,7 @@ > > eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) > > eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) > > eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) > > +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) > > Is this file available even when Tor is not installed? > > We might get an error message here if it does not exist. That´s a bad one, you are absolutely right! Since this is the firewall script, which way do you prefere in here ? > > > IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d > > '\012'` > > if [ -z $IFACE ]; then > > IFACE="red0" > > @@ -387,6 +388,11 @@ iptables_init() { > > # run captivectrl > > /usr/local/bin/captivectrl > > > > + # If a Tor relay is enabled apply firewall rules > > + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; > > then > > + /usr/local/bin/torctrl restart 1> /dev/null > > + fi > > + > > # POLICY CHAIN > > iptables -N POLICYIN > > iptables -A INPUT -j POLICYIN > > -- > > 2.43.0 > > >
> On 16 Jan 2024, at 15:16, ummeegge <ummeegge@ipfire.org> wrote: > > Hi Michael, > > Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer: >> Hello Erik, >> >> Thank you for the patch. >> >>> On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer@ipfire.org> >>> wrote: >>> >>> If the firewall will be manually restart via '/etc/init.d/firewall >>> restart', >>> the IPTable rules for the Tor relay will be deleted since >>> 'iptables_init' only >>> flushes and creates inbound and unbound chains for Tor but does not >>> restore the >>> ruleset from Tor initscript. >>> >>> For reference and tests please see --> >>> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697 >>> >>> Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org> >>> --- >>> src/initscripts/system/firewall | 6 ++++++ >>> 1 file changed, 6 insertions(+) >>> >>> diff --git a/src/initscripts/system/firewall >>> b/src/initscripts/system/firewall >>> index 50f2b3e02..50a7f2db9 100644 >>> --- a/src/initscripts/system/firewall >>> +++ b/src/initscripts/system/firewall >>> @@ -25,6 +25,7 @@ >>> eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) >>> eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) >>> eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) >>> +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) >> >> Is this file available even when Tor is not installed? >> >> We might get an error message here if it does not exist. > That´s a bad one, you are absolutely right! Since this is the firewall > script, which way do you prefere in here ? You can simply wrap the line in an if statement checking if the file is readable: if [ -r “/var/ipfire/tor/settings” ]; then eval … fi The rest can stay as is. > > >> >>> IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d >>> '\012'` >>> if [ -z $IFACE ]; then >>> IFACE="red0" >>> @@ -387,6 +388,11 @@ iptables_init() { >>> # run captivectrl >>> /usr/local/bin/captivectrl >>> >>> + # If a Tor relay is enabled apply firewall rules >>> + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; >>> then >>> + /usr/local/bin/torctrl restart 1> /dev/null >>> + fi >>> + >>> # POLICY CHAIN >>> iptables -N POLICYIN >>> iptables -A INPUT -j POLICYIN >>> -- >>> 2.43.0 >>> >> >
Hope it matches all the needs. Best, Erik Am Dienstag, dem 16.01.2024 um 15:17 +0000 schrieb Michael Tremer: > > > > On 16 Jan 2024, at 15:16, ummeegge <ummeegge@ipfire.org> wrote: > > > > Hi Michael, > > > > Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer: > > > Hello Erik, > > > > > > Thank you for the patch. > > > > > > > On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer@ipfire.org> > > > > wrote: > > > > > > > > If the firewall will be manually restart via > > > > '/etc/init.d/firewall > > > > restart', > > > > the IPTable rules for the Tor relay will be deleted since > > > > 'iptables_init' only > > > > flushes and creates inbound and unbound chains for Tor but does > > > > not > > > > restore the > > > > ruleset from Tor initscript. > > > > > > > > For reference and tests please see --> > > > > https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697 > > > > > > > > Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org> > > > > --- > > > > src/initscripts/system/firewall | 6 ++++++ > > > > 1 file changed, 6 insertions(+) > > > > > > > > diff --git a/src/initscripts/system/firewall > > > > b/src/initscripts/system/firewall > > > > index 50f2b3e02..50a7f2db9 100644 > > > > --- a/src/initscripts/system/firewall > > > > +++ b/src/initscripts/system/firewall > > > > @@ -25,6 +25,7 @@ > > > > eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) > > > > eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) > > > > eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) > > > > +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) > > > > > > Is this file available even when Tor is not installed? > > > > > > We might get an error message here if it does not exist. > > That´s a bad one, you are absolutely right! Since this is the > > firewall > > script, which way do you prefere in here ? > > You can simply wrap the line in an if statement checking if the file > is readable: > > if [ -r “/var/ipfire/tor/settings” ]; then > eval … > fi > > The rest can stay as is. > > > > > > > > > > > > IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | > > > > /usr/bin/tr -d > > > > '\012'` > > > > if [ -z $IFACE ]; then > > > > IFACE="red0" > > > > @@ -387,6 +388,11 @@ iptables_init() { > > > > # run captivectrl > > > > /usr/local/bin/captivectrl > > > > > > > > + # If a Tor relay is enabled apply firewall rules > > > > + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" > > > > ]; > > > > then > > > > + /usr/local/bin/torctrl restart 1> /dev/null > > > > + fi > > > > + > > > > # POLICY CHAIN > > > > iptables -N POLICYIN > > > > iptables -A INPUT -j POLICYIN > > > > -- > > > > 2.43.0 > > > > > > > > > >
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..50a7f2db9 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,7 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +388,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl + # If a Tor relay is enabled apply firewall rules + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then + /usr/local/bin/torctrl restart 1> /dev/null + fi + # POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN