review /etc/xen/vif-route-qubes impact on Qubes-Whonix Firewall

phabricator-migrator · February 19, 2024, 5:47pm

Information

ID: 426
PHID: PHID-TASK-6fc6nr4zscsqhqpwu6wa
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: High

Description

Do you think there are situations, where /etc/xen/vif-route-qubes’s use of iptables-restore could interfere with Whonix’s firewall?

Comments

marmarek

2015-11-11 22:49:50 UTC

Depending what you mean by “interfere”. In terms of rules itself - as
long as Whonix doesn’t use “raw” table (I guess it doesn’t), it
shouldn’t be a problem. But some race condition making either of
iptables-restore call fail may be possible.
Theoretically iptables-restore is used instead of iptables exactly
to prevent such problem
(/sbin/iptables may return "resource temporarily unavailable" · Issue #42 · QubesOS/qubes-issues · GitHub), but it isn’t clear
to me that it is really effective. We have flock in vif-route-qubes
because of this uncertainty. Maybe iptables --wait would be a better
option - now it is available in Debian too (>=jessie). But according to
iptables sources, I think iptables --wait still could race against
iptables-restore - the later doesn’t use any locking.

What is Debian solution for such problem (different programs/startup
scripts adding iptables rules simultaneously)? The Fedora way is to use
firewalld…

Patrick

2015-11-12 14:27:04 UTC

marmarek (Marek Marczykowski-Górecki):

Depending what you mean by “interfere”.

I mean by “interfere” here:
“Somehow loading firewall rules inappropriate to Whonix that could in
worst case lead to leaks.”

as
long as Whonix doesn’t use “raw” table (I guess it doesn’t)

Whonix doesn’t use the “raw” table indeed.

What is Debian solution for such problem (different programs/startup
scripts adding iptables rules simultaneously)?

Dunno if there is…

Asked on debian-users mailing list:
“Are there packages that modify iptables rules?”
Are there packages that modify iptables rules?

Answer for now:
fail2ban
miniupnpd

Asked a follow up question on debian-users mailing list:
“How do packages that modify iptables rules prevent race conditions?”
How do packages that modify iptables rules prevent race conditions?

marmarek

2015-11-12 17:26:07 UTC

Patrick

2015-11-13 17:44:46 UTC

Patrick

2015-11-13 17:45:54 UTC