Re: [PATCH] Firewall initscript: Restore Tor IPTable rules by manual firewall restart

[ummeegge <ummeegge@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2882 bytes --]

Hope it matches all the needs.

Best,

Erik

Am Dienstag, dem 16.01.2024 um 15:17 +0000 schrieb Michael Tremer:
> 
> 
> > On 16 Jan 2024, at 15:16, ummeegge <ummeegge(a)ipfire.org> wrote:
> > 
> > Hi Michael,
> > 
> > Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer:
> > > Hello Erik,
> > > 
> > > Thank you for the patch.
> > > 
> > > > On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer(a)ipfire.org>
> > > > wrote:
> > > > 
> > > > If the firewall will be manually restart via
> > > > '/etc/init.d/firewall
> > > > restart',
> > > > the IPTable rules for the Tor relay will be deleted since
> > > > 'iptables_init' only
> > > > flushes and creates inbound and unbound chains for Tor but does
> > > > not
> > > > restore the
> > > > ruleset from Tor initscript.
> > > > 
> > > > For reference and tests please see -->
> > > > https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697
> > > > 
> > > > Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org>
> > > > ---
> > > > src/initscripts/system/firewall | 6 ++++++
> > > > 1 file changed, 6 insertions(+)
> > > > 
> > > > diff --git a/src/initscripts/system/firewall
> > > > b/src/initscripts/system/firewall
> > > > index 50f2b3e02..50a7f2db9 100644
> > > > --- a/src/initscripts/system/firewall
> > > > +++ b/src/initscripts/system/firewall
> > > > @@ -25,6 +25,7 @@
> > > > eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
> > > > eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
> > > > eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
> > > > +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
> > > 
> > > Is this file available even when Tor is not installed?
> > > 
> > > We might get an error message here if it does not exist.
> > That´s a bad one, you are absolutely right! Since this is the
> > firewall
> > script, which way do you prefere in here ?
> 
> You can simply wrap the line in an if statement checking if the file
> is readable:
> 
>   if [ -r “/var/ipfire/tor/settings” ]; then
>     eval …
>   fi
> 
> The rest can stay as is.
> 
> > 
> > 
> > > 
> > > > IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null |
> > > > /usr/bin/tr -d
> > > > '\012'`
> > > > if [ -z $IFACE ]; then
> > > > IFACE="red0"
> > > > @@ -387,6 +388,11 @@ iptables_init() {
> > > > # run captivectrl
> > > > /usr/local/bin/captivectrl
> > > > 
> > > > + # If a Tor relay is enabled apply firewall rules
> > > > + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}"
> > > > ];
> > > > then
> > > > + /usr/local/bin/torctrl restart 1> /dev/null
> > > > + fi
> > > > +
> > > > # POLICY CHAIN
> > > > iptables -N POLICYIN
> > > > iptables -A INPUT -j POLICYIN
> > > > -- 
> > > > 2.43.0
> > > > 
> > > 
> > 
>