qubes-whonix-network.service doesn't provide helpful error message when !CONFIG_DUMMY

phabricator-migrator · February 19, 2024, 5:47pm

Information

ID: 409
PHID: PHID-TASK-33twdtccuyx65j24qxgv
Author: hitithard
Status at Migration Time: invalid
Priority at Migration Time: Wishlist

Description

General background:

github.com/EFForg/https-everywhere

Merge remote-tracking branch 'EFForg/master'

committed 05:00PM - 13 Sep 15 UTC

2d1

+106 -19

Note to @jsha: After communicating to something purporting to be 'the home team…' about 'some other team' and being DDOSed over impossible routes over Tor (10 minutes later) (how is that even possible) I suggest you *seriously* scrutinize *anything* I submit that's not in rulesets/ I can write C and Haskell but I wouldn't subject anyone to it (probably would do more wrong than right) You shouldn't trust anything from git mail address anyway. It's just one massive stream of spear-fishing attempts and token reset warnings. Also, thanks to @QubesOS and grsecurity for saving my life (maybe). Conflicts: src/chrome/content/rules/Federal-Communications-Commission.xml

github.com/EFForg/https-everywhere

Some regexps use `?` quantifiers for look-aheads

opened 10:22AM - 09 Sep 15 UTC

closed 12:25PM - 30 Sep 15 UTC

RReverser

Probably purely a code style issue, but some regular expressions use constructs …like `(?=...)?` which is valid in JavaScript but don't make sense and only complicate expressions. Here's a list of all the found ones: ``` javascript { input: '^http://www\\.heteml\\.jp/[^?]*(?=\\?)?', error: { name: 'RegexSyntaxError', type: 'NothingRepeat', lastIndex: 36, message: 'Nothing to repeat!Repeat after assertion doesn\'t make sense!' } } { input: '^http://store\\.mandriva\\.com/[^?]*(?=\\?.*)?', error: { name: 'RegexSyntaxError', type: 'NothingRepeat', lastIndex: 43, message: 'Nothing to repeat!Repeat after assertion doesn\'t make sense!' } } { input: '^http://soe\\.stanford\\.edu/+(?=\\?.*)?$', error: { name: 'RegexSyntaxError', type: 'NothingRepeat', lastIndex: 37, message: 'Nothing to repeat!Repeat after assertion doesn\'t make sense!' } } { input: '^http://(?:www\\.)?tescofinance\\.com/+(?=\\?.*)?$', error: { name: 'RegexSyntaxError', type: 'NothingRepeat', lastIndex: 46, message: 'Nothing to repeat!Repeat after assertion doesn\'t make sense!' } } { input: '^http://hilfe\\.udmedia\\.de/[^?]*(?=\\?.*)?', error: { name: 'RegexSyntaxError', type: 'NothingRepeat', lastIndex: 41, message: 'Nothing to repeat!Repeat after assertion doesn\'t make sense!' } } { input: '^http://livechat\\.udmedia\\.de/[^?]*(?=\\?.*)?', error: { name: 'RegexSyntaxError', type: 'NothingRepeat', lastIndex: 44, message: 'Nothing to repeat!Repeat after assertion doesn\'t make sense!' } } ```

(The DoS was from Tor’s control port).

There are a few problems that are making me weary of using whonix-gw again, and the first prerequisite is this.

Removing the modprobe line in network-proxy-setup doesn’t fix this.

sys-net, sys-firewall, and whonix-ws all work fine with grsecurity enabled and the rootkit interface disabled.

Comments

Patrick

2015-10-06 11:04:29 UTC

hitithard

2015-10-15 18:17:38 UTC

! In T409#6836, @Patrick wrote:
General background:

Sorry, I don’t understand the general background.
The general background is that ~10 minutes after contacting my own coutry’s intelligence agency about another country’s intelligence agency I recieved a DoS from tor’s control port (whonix-gw on Qubes vanilla kernel) to whonix-ws (using grsecurity). After talking to Peter (pde) at the EFF about the logs, which showed searching for some magic sequence (similar to SYNful ACK, but different), my Qubes machine was wiped overnight.

the rootkit interface disabled

Which rootkit interface?
“rootkit interface” is a sarcastic reference to CONFIG_MODULES, since that is what it serves as.

Please provide steps to reproduce, expected result and actual result.

Sorry, I was wrong. It wasn’t a problem with CONFIG_MODULES, I simply hadn’t tested every combination (kernel recompilation fatigue).

The actual problem was not having DUMMY. I think perhaps there should be a specific error message for that case.

I also noticed that when either ipv6 is disabled or some tables that whonix-gw doesn’t use but does flush aren’t in the kernel, the firewall script fails. I think the firewall script ought to use sysctl to check whether related sysfs entries exist and continue (not fail) if they don’t exist.

Patrick

2015-10-15 19:44:46 UTC

Patrick

2019-02-18 08:37:48 UTC