From patchwork Tue Jan 16 15:26:39 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Erik Kapfer X-Patchwork-Id: 7456 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4TDtCx14pYz3wmD for ; Tue, 16 Jan 2024 15:27:09 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4TDtCt5lLDz7Q6; Tue, 16 Jan 2024 15:27:06 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4TDtCt49c0z32j8; Tue, 16 Jan 2024 15:27:06 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4TDtCr2sTLz2xHx for ; Tue, 16 Jan 2024 15:27:04 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4TDtCq5fRfz7Nq; Tue, 16 Jan 2024 15:27:03 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1705418823; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WS8tMaXPK/xOqAlYol4/EjJT0gUp3BgwSRVSEejXgxw=; b=6hW8vd0DLQdeqrUzjtUkyGgyr7gWW1lfKMBBdnmpbSV27uB1cQAGHvQi9XdmRsdX4KrwJ+ 2PdaDlqhFegIIfAw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1705418823; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WS8tMaXPK/xOqAlYol4/EjJT0gUp3BgwSRVSEejXgxw=; b=k03m7KxLbfuXXjWg5wMSkAXBDcXGbLGTE1Lkjt+3Vg9407yHEXkqeru9j8g1zorf/EsjtB pACkTzkm3Dp783okFOLIfCFbib6AN/iAlII6UADscQ5Ea//0iKzXh+DQu88+haSEJR/08o /mow5mBk5TSPgHBMX0hk6FZSkYRAA2MCNfZUlOuGPwe14DMBZh/oIl/rxeDCo1BHBECUI/ iGpa1aiz2LsEVWVblIxadBTzYQbl4W6GYXZXCk2AbVtm5cabO71FPPVYwaLcCIOtqsjXmN XmHddS1sUwly/Y5KJ9146FK4+geHDoVpy6bdLD7HYu+6kbEIiYTzHDcmqZ0BQA== From: Erik Kapfer To: development@lists.ipfire.org Subject: [PATCH v2] Firewall initscript: Restore Tor IPTable rules by manual firewall restart Date: Tue, 16 Jan 2024 16:26:39 +0100 Message-ID: <20240116152650.3478281-1-erik.kapfer@ipfire.org> In-Reply-To: <20240116150810.3477551-1-erik.kapfer@ipfire.org> References: <20240116150810.3477551-1-erik.kapfer@ipfire.org> MIME-Version: 1.0 Message-ID-Hash: EZ4NW6C5753346BAY76ZXYVG5ZD5I4SL X-Message-ID-Hash: EZ4NW6C5753346BAY76ZXYVG5ZD5I4SL X-MailFrom: erik.kapfer@ipfire.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: If the firewall will be manually restart via '/etc/init.d/firewall restart', the IPTable rules for the Tor relay will be deleted since 'iptables_init' only flushes and creates inbound and unbound chains for Tor but does not restore the ruleset from Tor initscript. For reference and tests please see --> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697 Signed-off-by: Erik Kapfer --- src/initscripts/system/firewall | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..3aab7dd75 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,9 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +if [ -r "/var/ipfire/tor/settings" ]; then + eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) +fi IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +390,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl + # If a Tor relay is enabled apply firewall rules + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then + /usr/local/bin/torctrl restart 1> /dev/null + fi + # POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN