From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] Firewall initscript: Restore Tor IPTable rules by manual
 firewall restart
Date: Tue, 16 Jan 2024 15:11:27 +0000
Message-ID: <717E2D7F-41C5-490E-990D-256B754B9E02@ipfire.org>
In-Reply-To: <20240116150810.3477551-1-erik.kapfer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1283449873273856711=="
List-Id: <development.lists.ipfire.org>

--===============1283449873273856711==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello Erik,

Thank you for the patch.

> On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer(a)ipfire.org> wrote:
>=20
> If the firewall will be manually restart via '/etc/init.d/firewall restart',
> the IPTable rules for the Tor relay will be deleted since 'iptables_init' o=
nly
> flushes and creates inbound and unbound chains for Tor but does not restore=
 the
> ruleset from Tor initscript.
>=20
> For reference and tests please see -->
> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or=
-give-an-error-message/10697
>=20
> Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org>
> ---
> src/initscripts/system/firewall | 6 ++++++
> 1 file changed, 6 insertions(+)
>=20
> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firew=
all
> index 50f2b3e02..50a7f2db9 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -25,6 +25,7 @@
> eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
> eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
> eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
> +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)

Is this file available even when Tor is not installed?

We might get an error message here if it does not exist.

> IFACE=3D`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012=
'`
> if [ -z $IFACE ]; then
> IFACE=3D"red0"
> @@ -387,6 +388,11 @@ iptables_init() {
> # run captivectrl
> /usr/local/bin/captivectrl
>=20
> + # If a Tor relay is enabled apply firewall rules
> + if [ "${TOR_RELAY_ENABLED}" =3D "on" -a -n "${TOR_RELAY_PORT}" ]; then
> + /usr/local/bin/torctrl restart 1> /dev/null
> + fi
> +
> # POLICY CHAIN
> iptables -N POLICYIN
> iptables -A INPUT -j POLICYIN
> --=20
> 2.43.0
>=20


--===============1283449873273856711==--