From patchwork Tue Jan 16 15:07:52 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Erik Kapfer X-Patchwork-Id: 7455 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4TDspH3s3Sz3wmD for ; Tue, 16 Jan 2024 15:08:23 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4TDspD4Jttz8kg; Tue, 16 Jan 2024 15:08:20 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4TDspC6KNlz32hM; Tue, 16 Jan 2024 15:08:19 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4TDsp94ywvz2xg5 for ; Tue, 16 Jan 2024 15:08:17 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4TDsp90ZB8z7NM; Tue, 16 Jan 2024 15:08:17 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1705417697; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Q7FPBRFsfVSfYuc1X7z4axYoDVMrUp7GXO/3gIoBSs4=; b=zQd5Graae0lJY12sfoGyfWfrxA9aVk6o5SwDR4hUcPUqjFND/iGEsYIymKrDmqlBDXlWKI 28ZYYw4lr/Bg8yDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1705417697; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Q7FPBRFsfVSfYuc1X7z4axYoDVMrUp7GXO/3gIoBSs4=; b=Tl7PEYK3A5Ixdi72u3yiUz1VCHiKiGsTGrezVMbq8JZ7ft3mxPEtrPjxBRPy2pPqAtINNN qs9hKr+CtNppG/xR4NljIqKObtX8y/A3VDUvtYlY2YY6Dz6z1jUQUBG4FSEtWxz+ss9sFf r2TU0H9EujFCRzxlnQdQVMjdSHWnJbmN21ckoBVajrq9Khd3nGqalwQezf31fQtAM2SrhG Qyevj76hXb+PssVObo72ZY+0ZLLhTbJK/sWn9yHtMosE/wMrMUTewzpp8O31bY0dPDJ6+V 2Sk7Te3XrGBWqzUZsnbUu1dTbkdq7h4tPacN6s+dO7lINqi5ml27YeGPfp53bA== From: Erik Kapfer To: development@lists.ipfire.org Subject: [PATCH] Firewall initscript: Restore Tor IPTable rules by manual firewall restart Date: Tue, 16 Jan 2024 16:07:52 +0100 Message-ID: <20240116150810.3477551-1-erik.kapfer@ipfire.org> MIME-Version: 1.0 Message-ID-Hash: FAUFX4FL6MBVJIPCTUCBOJGXJGQ2Z32V X-Message-ID-Hash: FAUFX4FL6MBVJIPCTUCBOJGXJGQ2Z32V X-MailFrom: erik.kapfer@ipfire.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: If the firewall will be manually restart via '/etc/init.d/firewall restart', the IPTable rules for the Tor relay will be deleted since 'iptables_init' only flushes and creates inbound and unbound chains for Tor but does not restore the ruleset from Tor initscript. For reference and tests please see --> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697 Signed-off-by: Erik Kapfer --- src/initscripts/system/firewall | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..50a7f2db9 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,7 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +388,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl + # If a Tor relay is enabled apply firewall rules + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then + /usr/local/bin/torctrl restart 1> /dev/null + fi + # POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN