Re: [PATCH] Firewall initscript: Restore Tor IPTable rules by manual firewall restart

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2442 bytes --]



> On 16 Jan 2024, at 15:16, ummeegge <ummeegge(a)ipfire.org> wrote:
> 
> Hi Michael,
> 
> Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer:
>> Hello Erik,
>> 
>> Thank you for the patch.
>> 
>>> On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer(a)ipfire.org>
>>> wrote:
>>> 
>>> If the firewall will be manually restart via '/etc/init.d/firewall
>>> restart',
>>> the IPTable rules for the Tor relay will be deleted since
>>> 'iptables_init' only
>>> flushes and creates inbound and unbound chains for Tor but does not
>>> restore the
>>> ruleset from Tor initscript.
>>> 
>>> For reference and tests please see -->
>>> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697
>>> 
>>> Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org>
>>> ---
>>> src/initscripts/system/firewall | 6 ++++++
>>> 1 file changed, 6 insertions(+)
>>> 
>>> diff --git a/src/initscripts/system/firewall
>>> b/src/initscripts/system/firewall
>>> index 50f2b3e02..50a7f2db9 100644
>>> --- a/src/initscripts/system/firewall
>>> +++ b/src/initscripts/system/firewall
>>> @@ -25,6 +25,7 @@
>>> eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
>>> eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
>>> eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
>>> +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
>> 
>> Is this file available even when Tor is not installed?
>> 
>> We might get an error message here if it does not exist.
> That´s a bad one, you are absolutely right! Since this is the firewall
> script, which way do you prefere in here ?

You can simply wrap the line in an if statement checking if the file is readable:

  if [ -r “/var/ipfire/tor/settings” ]; then
    eval …
  fi

The rest can stay as is.

> 
> 
>> 
>>> IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d
>>> '\012'`
>>> if [ -z $IFACE ]; then
>>> IFACE="red0"
>>> @@ -387,6 +388,11 @@ iptables_init() {
>>> # run captivectrl
>>> /usr/local/bin/captivectrl
>>> 
>>> + # If a Tor relay is enabled apply firewall rules
>>> + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ];
>>> then
>>> + /usr/local/bin/torctrl restart 1> /dev/null
>>> + fi
>>> +
>>> # POLICY CHAIN
>>> iptables -N POLICYIN
>>> iptables -A INPUT -j POLICYIN
>>> -- 
>>> 2.43.0
>>> 
>> 
>