fix fail closed mechanism

[phabricator-migrator]

Information

ID: 875
PHID: PHID-TASK-pcanne36xkuf3mgzmcz2
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

i.e. do not start networking if whonix-firewall.service fails to load.

Currently disabled since it breaks networking on whonix-firewall package upgrades.

• GitHub - Whonix/whonix-firewall: https://www.whonix.org/wiki/Imprint
• https://github.com/Whonix/whonix-firewall/blob/master/lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf

Comments

---

madaidan

2019-05-10 16:19:37 UTC

Maybe disable it just for package upgrades?

You could edit [[ https://github.com/Whonix/whonix-firewall/blob/master/usr/lib/whonix-firewall/enable-firewall | whonix-firewall ]] to disable the fail closed mechanism if an apt upgrade is running then after, it could re-enable it.

You’d probably want something like:

disable_fail_closed {
  ## Check if apt is being used to update.
  if ps aux | grep "apt \-\-upgrade"; then

    ## Disables fail closed mechanism.
    sed -i 's/After=whonix-firewall.service/#After=whonix-firewall.service/' /lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf
    sed -i 's/Requires=whonix-firewall.service/#After=whonix-firewall.service/' /lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf
  fi

  ## Checks if apt is not being used to update.
  if ! ps aux | grep "apt \-\-upgrade"; then

    ## Enables fail closed mechanism.
    sed -i 's/#After=whonix-firewall.service/After=whonix-firewall.service/' /lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf
    sed -i 's/#Requires=whonix-firewall.service/After=whonix-firewall.service/' /lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf
  fi
}

Detection of other ways of updating like --dist-upgrade will obviously need to be added.

---

Patrick

2019-05-12 10:55:23 UTC

Seems quite hacky. What’s the root cause for failing?

---

madaidan

2019-05-12 12:14:19 UTC

Seems quite hacky. What’s the root cause for failing?

Probably, when the package is getting updated, it disables the firewall for a minute so it can apply the updates and the fail closed mechanism kicks in.

I can’t think of any other way to fix this.

---

Patrick

2019-06-14 11:21:26 UTC

! In T875#18470, @madaidan wrote:
Seems quite hacky. What’s the root cause for failing?

Probably, when the package is getting updated, it disables the firewall for a minute so it can apply the updates and the fail closed mechanism kicks in.

I don’t think anything Debian does would modify any iptables rules nor Whonix ships any code to disable the firewall. So “disables the firewall for a minute” is non-existing. Would be bad if that happened.

---

madaidan

2019-06-20 20:26:31 UTC

I don’t think anything Debian does would modify any iptables rules nor Whonix ships any code to disable the firewall. So “disables the firewall for a minute” is non-existing. Would be bad if that happened.

Maybe we should ask upstream about this then. I can’t think of any other way this might happen.