diff mbox series

Firewall initscript: Restore Tor IPTable rules by manual firewall restart

Message ID 20240116150810.3477551-1-erik.kapfer@ipfire.org
State New
Headers
Series Firewall initscript: Restore Tor IPTable rules by manual firewall restart |

Commit Message

Erik Kapfer Jan. 16, 2024, 3:07 p.m. UTC 
  If the firewall will be manually restart via '/etc/init.d/firewall restart',
the IPTable rules for the Tor relay will be deleted since 'iptables_init' only
flushes and creates inbound and unbound chains for Tor but does not restore the
ruleset from Tor initscript.

For reference and tests please see -->
https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
---
 src/initscripts/system/firewall | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Michael Tremer Jan. 16, 2024, 3:11 p.m. UTC | #1 
Hello Erik,

Thank you for the patch.

> On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer@ipfire.org> wrote:
> 
> If the firewall will be manually restart via '/etc/init.d/firewall restart',
> the IPTable rules for the Tor relay will be deleted since 'iptables_init' only
> flushes and creates inbound and unbound chains for Tor but does not restore the
> ruleset from Tor initscript.
> 
> For reference and tests please see -->
> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697
> 
> Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
> ---
> src/initscripts/system/firewall | 6 ++++++
> 1 file changed, 6 insertions(+)
> 
> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
> index 50f2b3e02..50a7f2db9 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -25,6 +25,7 @@
> eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
> eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
> eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
> +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)

Is this file available even when Tor is not installed?

We might get an error message here if it does not exist.

> IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
> if [ -z $IFACE ]; then
> IFACE="red0"
> @@ -387,6 +388,11 @@ iptables_init() {
> # run captivectrl
> /usr/local/bin/captivectrl
> 
> + # If a Tor relay is enabled apply firewall rules
> + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then
> + /usr/local/bin/torctrl restart 1> /dev/null
> + fi
> +
> # POLICY CHAIN
> iptables -N POLICYIN
> iptables -A INPUT -j POLICYIN
> -- 
> 2.43.0
>
ummeegge Jan. 16, 2024, 3:16 p.m. UTC | #2 
Hi Michael,

Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer:
> Hello Erik,
> 
> Thank you for the patch.
> 
> > On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer@ipfire.org>
> > wrote:
> > 
> > If the firewall will be manually restart via '/etc/init.d/firewall
> > restart',
> > the IPTable rules for the Tor relay will be deleted since
> > 'iptables_init' only
> > flushes and creates inbound and unbound chains for Tor but does not
> > restore the
> > ruleset from Tor initscript.
> > 
> > For reference and tests please see -->
> > https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697
> > 
> > Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
> > ---
> > src/initscripts/system/firewall | 6 ++++++
> > 1 file changed, 6 insertions(+)
> > 
> > diff --git a/src/initscripts/system/firewall
> > b/src/initscripts/system/firewall
> > index 50f2b3e02..50a7f2db9 100644
> > --- a/src/initscripts/system/firewall
> > +++ b/src/initscripts/system/firewall
> > @@ -25,6 +25,7 @@
> > eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
> > eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
> > eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
> > +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
> 
> Is this file available even when Tor is not installed?
> 
> We might get an error message here if it does not exist.
That´s a bad one, you are absolutely right! Since this is the firewall
script, which way do you prefere in here ?


> 
> > IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d
> > '\012'`
> > if [ -z $IFACE ]; then
> > IFACE="red0"
> > @@ -387,6 +388,11 @@ iptables_init() {
> > # run captivectrl
> > /usr/local/bin/captivectrl
> > 
> > + # If a Tor relay is enabled apply firewall rules
> > + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ];
> > then
> > + /usr/local/bin/torctrl restart 1> /dev/null
> > + fi
> > +
> > # POLICY CHAIN
> > iptables -N POLICYIN
> > iptables -A INPUT -j POLICYIN
> > -- 
> > 2.43.0
> > 
>
Michael Tremer Jan. 16, 2024, 3:17 p.m. UTC | #3 
> On 16 Jan 2024, at 15:16, ummeegge <ummeegge@ipfire.org> wrote:
> 
> Hi Michael,
> 
> Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer:
>> Hello Erik,
>> 
>> Thank you for the patch.
>> 
>>> On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer@ipfire.org>
>>> wrote:
>>> 
>>> If the firewall will be manually restart via '/etc/init.d/firewall
>>> restart',
>>> the IPTable rules for the Tor relay will be deleted since
>>> 'iptables_init' only
>>> flushes and creates inbound and unbound chains for Tor but does not
>>> restore the
>>> ruleset from Tor initscript.
>>> 
>>> For reference and tests please see -->
>>> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697
>>> 
>>> Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
>>> ---
>>> src/initscripts/system/firewall | 6 ++++++
>>> 1 file changed, 6 insertions(+)
>>> 
>>> diff --git a/src/initscripts/system/firewall
>>> b/src/initscripts/system/firewall
>>> index 50f2b3e02..50a7f2db9 100644
>>> --- a/src/initscripts/system/firewall
>>> +++ b/src/initscripts/system/firewall
>>> @@ -25,6 +25,7 @@
>>> eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
>>> eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
>>> eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
>>> +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
>> 
>> Is this file available even when Tor is not installed?
>> 
>> We might get an error message here if it does not exist.
> That´s a bad one, you are absolutely right! Since this is the firewall
> script, which way do you prefere in here ?

You can simply wrap the line in an if statement checking if the file is readable:

  if [ -r “/var/ipfire/tor/settings” ]; then
    eval …
  fi

The rest can stay as is.

> 
> 
>> 
>>> IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d
>>> '\012'`
>>> if [ -z $IFACE ]; then
>>> IFACE="red0"
>>> @@ -387,6 +388,11 @@ iptables_init() {
>>> # run captivectrl
>>> /usr/local/bin/captivectrl
>>> 
>>> + # If a Tor relay is enabled apply firewall rules
>>> + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ];
>>> then
>>> + /usr/local/bin/torctrl restart 1> /dev/null
>>> + fi
>>> +
>>> # POLICY CHAIN
>>> iptables -N POLICYIN
>>> iptables -A INPUT -j POLICYIN
>>> -- 
>>> 2.43.0
>>> 
>> 
>
ummeegge Jan. 16, 2024, 7:47 p.m. UTC | #4 
Hope it matches all the needs.

Best,

Erik

Am Dienstag, dem 16.01.2024 um 15:17 +0000 schrieb Michael Tremer:
> 
> 
> > On 16 Jan 2024, at 15:16, ummeegge <ummeegge@ipfire.org> wrote:
> > 
> > Hi Michael,
> > 
> > Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer:
> > > Hello Erik,
> > > 
> > > Thank you for the patch.
> > > 
> > > > On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer@ipfire.org>
> > > > wrote:
> > > > 
> > > > If the firewall will be manually restart via
> > > > '/etc/init.d/firewall
> > > > restart',
> > > > the IPTable rules for the Tor relay will be deleted since
> > > > 'iptables_init' only
> > > > flushes and creates inbound and unbound chains for Tor but does
> > > > not
> > > > restore the
> > > > ruleset from Tor initscript.
> > > > 
> > > > For reference and tests please see -->
> > > > https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697
> > > > 
> > > > Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
> > > > ---
> > > > src/initscripts/system/firewall | 6 ++++++
> > > > 1 file changed, 6 insertions(+)
> > > > 
> > > > diff --git a/src/initscripts/system/firewall
> > > > b/src/initscripts/system/firewall
> > > > index 50f2b3e02..50a7f2db9 100644
> > > > --- a/src/initscripts/system/firewall
> > > > +++ b/src/initscripts/system/firewall
> > > > @@ -25,6 +25,7 @@
> > > > eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
> > > > eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
> > > > eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
> > > > +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
> > > 
> > > Is this file available even when Tor is not installed?
> > > 
> > > We might get an error message here if it does not exist.
> > That´s a bad one, you are absolutely right! Since this is the
> > firewall
> > script, which way do you prefere in here ?
> 
> You can simply wrap the line in an if statement checking if the file
> is readable:
> 
>   if [ -r “/var/ipfire/tor/settings” ]; then
>     eval …
>   fi
> 
> The rest can stay as is.
> 
> > 
> > 
> > > 
> > > > IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null |
> > > > /usr/bin/tr -d
> > > > '\012'`
> > > > if [ -z $IFACE ]; then
> > > > IFACE="red0"
> > > > @@ -387,6 +388,11 @@ iptables_init() {
> > > > # run captivectrl
> > > > /usr/local/bin/captivectrl
> > > > 
> > > > + # If a Tor relay is enabled apply firewall rules
> > > > + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}"
> > > > ];
> > > > then
> > > > + /usr/local/bin/torctrl restart 1> /dev/null
> > > > + fi
> > > > +
> > > > # POLICY CHAIN
> > > > iptables -N POLICYIN
> > > > iptables -A INPUT -j POLICYIN
> > > > -- 
> > > > 2.43.0
> > > > 
> > > 
> > 
>
diff mbox series

Patch

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 50f2b3e02..50a7f2db9 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -25,6 +25,7 @@ 
 eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
+eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
 IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
 if [ -z $IFACE ]; then
 	IFACE="red0"
@@ -387,6 +388,11 @@  iptables_init() {
 	# run captivectrl
 	/usr/local/bin/captivectrl
 
+	# If a Tor relay is enabled apply firewall rules
+	if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then
+		/usr/local/bin/torctrl restart 1> /dev/null
+	fi
+
 	# POLICY CHAIN
 	iptables -N POLICYIN
 	iptables -A INPUT -j POLICYIN