Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

info messages to firewall #1

Merged
merged 6 commits into from
Sep 26, 2022
Merged

info messages to firewall #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6e0dd7b
make the main script pass arguments to child
nyxnor Sep 26, 2022
950cdaf
print informational messages
nyxnor Sep 26, 2022
b303e37
always inform SOCKSIFIED if set to '0'
nyxnor Sep 26, 2022
682be4c
double quote "$@"
nyxnor Sep 26, 2022
3c5fd6b
be verbose no port is being opened
nyxnor Sep 26, 2022
5ec6e1f
not opening ports instead of closing, wording
nyxnor Sep 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 59 additions & 1 deletion usr/bin/whonix-gateway-firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,7 @@ variables_defaults() {
[ -n "$FLASHPROXY_PORT" ] || FLASHPROXY_PORT="9000"

if [ ! "$WORKSTATION_ALLOW_SOCKSIFIED" = "1" ]; then
output_cmd "INFO: WORKSTATION_ALLOW_SOCKSIFIED='${WORKSTATION_ALLOW_SOCKSIFIED}', Socks Ports will not be opened"
return 0
fi

Expand Down Expand Up @@ -411,17 +412,24 @@ ipv4_input_rules() {
fi

local local_port_to_open
if [ "${info_enabled}" = "1" ]; then
output_cmd "INFO: Opening External TCP port(s): ${EXTERNAL_OPEN_PORTS:-"NONE"}"
fi
for local_port_to_open in $EXTERNAL_OPEN_PORTS; do
$iptables_cmd -A INPUT -i "$ext_if_item" -p tcp --dport "$local_port_to_open" -j ACCEPT
done

local local_udp_port_to_open
if [ "${info_enabled}" = "1" ]; then
output_cmd "INFO: Opening External UDP port(s): ${EXTERNAL_UDP_OPEN_PORTS:-"NONE"}"
fi
for local_udp_port_to_open in $EXTERNAL_UDP_OPEN_PORTS; do
$iptables_cmd -A INPUT -p udp --dport "$local_udp_port_to_open" -j ACCEPT
done

if [ "$EXTERNAL_OPEN_ALL" = "true" ]; then
$iptables_cmd -A INPUT -j ACCEPT
[ "${info_enabled}" = "1" ] && output_cmd "INFO: EXTERNAL_OPEN_ALL='true', opening all External ports"
$iptables_cmd -A INPUT -j ACCEPT
fi
done

Expand Down Expand Up @@ -480,13 +488,18 @@ ipv4_input_rules() {

## Allow socksified applications.
if [ "$WORKSTATION_ALLOW_SOCKSIFIED" = "1" ]; then
if [ "${info_enabled}" = "1" ]; then
output_cmd "INFO: WORKSTATION_ALLOW_SOCKSIFIED='1', Socks Ports will be reacheable from the Workstation"
output_cmd "INFO: opening Internal TCP port(s): ${INTERNAL_OPEN_PORTS}"
fi
for socks_port in $INTERNAL_OPEN_PORTS; do
true "socks_port: $socks_port"
$iptables_cmd -A INPUT -i "$int_tif_item" -p tcp --dport "$socks_port" -j ACCEPT
done

## Accept ports 9152-9189 prepared for user custom applications.
## See /usr/share/tor/tor-service-defaults-torrc for more comments.
[ "${info_enabled}" = "1" ] && output_cmd "INFO: opening TCP port(s) 9152:9189 for user custom applications"
nyxnor marked this conversation as resolved.
Show resolved Hide resolved
$iptables_cmd -A INPUT -i "$int_tif_item" -p tcp --match multiport --dports 9152:9189 -j ACCEPT
fi
done
Expand Down Expand Up @@ -640,6 +653,9 @@ ipv4_output() {
## Prevent connections to Tor SocksPorts.
## https://phabricator.whonix.org/T533#11025
if [ "$firewall_mode" = "timesync-fail-closed" ]; then
if [ "${info_enabled}" = "1" ]; then
output_cmd "INFO: not opening Internal TCP port(s): ${INTERNAL_OPEN_PORTS}, except 9108 for sdwdate, because firewall_mode=${firewall_mode}"
fi
local socks_port_item
for socks_port_item in $INTERNAL_OPEN_PORTS; do
true "socks_port_item: $socks_port_item"
Expand Down Expand Up @@ -773,10 +789,37 @@ end() {
exit 0
}


variable_list="
WORKSTATION_TRANSPARENT_TCP
WORKSTATION_TRANSPARENT_DNS
WORKSTATION_ALLOW_SOCKSIFIED
CONTROL_PORT_FILTER_PROXY_ENABLE
GATEWAY_ALLOW_INCOMING_DIR_PORT
GATEWAY_ALLOW_INCOMING_OR_PORT
DIR_PORT
OR_PORT
GATEWAY_TRANSPARENT_TCP
GATEWAY_TRANSPARENT_UDP
GATEWAY_TRANSPARENT_DNS
ALLOW_GATEWAY_ROOT_USER
ALLOW_GATEWAY_USER_USER
GATEWAY_ALLOW_INCOMING_SSH
GATEWAY_ALLOW_INCOMING_ICMP
"

print_variables(){
for item in ${variable_list}; do
eval value='$'"${item}"
output_cmd "INFO: ${item}=${value}"
done
}

main() {
init
firewall_mode_detection
variables_defaults
[ "${info_enabled}" = "1" ] && print_variables
ipv4_defaults
ipv4_preparation
ipv4_drop_invalid_incoming_packages
Expand All @@ -793,5 +836,20 @@ main() {
end
}

usage(){
echo "usage: ${0##*/} [options]
-i, --info print informational messages
-h, --help print this help message"
}

while true; do
case $1 in
-i|--info) info_enabled=1; shift 1;;
"") break;;
-h|--help|*) usage; exit 1;;
esac
done


source_config_folder
main
24 changes: 24 additions & 0 deletions usr/bin/whonix-workstation-firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,16 +274,24 @@ ipv4_input_rules() {
true "firewall_mode is $firewall_mode, therefore not opening EXTERNAL_OPEN_PORTS."
else
local local_port_to_open
if [ "${info_enabled}" = "1" ]; then
output_cmd "INFO: Opening External TCP port(s): ${EXTERNAL_OPEN_PORTS:-"NONE"}"
fi
for local_port_to_open in $EXTERNAL_OPEN_PORTS; do
$iptables_cmd -A INPUT -p tcp --dport "$local_port_to_open" -j ACCEPT
done

local local_udp_port_to_open
if [ "${info_enabled}" = "1" ]; then
output_cmd "INFO: Opening External UDP port(s): ${EXTERNAL_UDP_OPEN_PORTS:-"NONE"}"
fi
for local_udp_port_to_open in $EXTERNAL_UDP_OPEN_PORTS; do

$iptables_cmd -A INPUT -p udp --dport "$local_udp_port_to_open" -j ACCEPT
done

if [ "$EXTERNAL_OPEN_ALL" = "true" ]; then
[ "${info_enabled}" = "1" ] && output_cmd "INFO: EXTERNAL_OPEN_ALL='true', all external ports will be opened"
$iptables_cmd -A INPUT -j ACCEPT
fi
fi
Expand Down Expand Up @@ -365,6 +373,7 @@ ipv4_output() {
## https://phabricator.whonix.org/T533#11025
if [ "$firewall_mode" = "timesync-fail-closed" ]; then
local socks_port_item
[ "${info_enabled}" = "1" ] && output_cmd "INFO: not opening Internal TCP ports ${INTERNAL_OPEN_PORTS}, except 9108 for sdwdate, because firewall_mode=$firewall_mode"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually I think this is useful. So useful that I'll drop "${info_enabled}" = "1" after merge. That is because firewall mode timesync-fail-closed will be a challenge usability wise anyhow. Therefore this messages seems helpful and not too verbose.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

great, thanks

for socks_port_item in $INTERNAL_OPEN_PORTS; do
true "socks_port_item: $socks_port_item"
## SOCKS_PORT_SDWDATE
Expand Down Expand Up @@ -634,5 +643,20 @@ main() {
end
}

usage(){
echo "usage: ${0##*/} [options]
-i, --info print informational messages
-h, --help print this help message"
}

while test -n $1; do
case $1 in
-i|--info) info_enabled=1; shift 1;;
"") break;;
-h|--help|*) usage; exit 1;;
esac
done


source_config_folder
main
8 changes: 4 additions & 4 deletions usr/bin/whonix_firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,13 @@
set -e

if [ -f "/run/qubes/this-is-templatevm" ]; then
/usr/bin/whonix-workstation-firewall
whonix-workstation-firewall "$@"
elif [ -f "/usr/share/anon-gw-base-files/gateway" ]; then
/usr/bin/whonix-gateway-firewall
whonix-gateway-firewall "$@"
elif [ -f "/usr/share/anon-ws-base-files/workstation" ]; then
/usr/bin/whonix-workstation-firewall
whonix-workstation-firewall "$@"
elif [ -f "/usr/share/libvirt-dist/marker" ]; then
/usr/bin/whonix-host-firewall
whonix-host-firewall "$@"
else
echo "ERROR: Neither file /usr/share/anon-gw-base-files/gateway nor file /usr/share/anon-ws-base-files/workstation exists! If this is a Whonix-Gateway, package anon-gw-base-files needs to be installed. If this is a Whonix-Workstation, package anon-ws-base-files needs to be installed." >&2
exit 1
Expand Down