/qubes-issues

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

consider disabling proxy arp #1421

Closed
adrelanos opened this Issue Nov 13, 2015 · 23 comments

Comments

Assignees
No one assigned
Labels
Projects
None yet
Milestone
  Release 3.1 updates
4 participants
@adrelanos @marmarek @qubesos-bot @rootkovska
@adrelanos
Member

adrelanos commented Nov 13, 2015

/etc/xen/vif-route-qubes's enables of proxy arp (echo 1 >/proc/sys/net/ipv4/conf/${vif}/proxy_arp)

In T430 @marmarek said:

I think it isn't needed anymore (since each VM have proper routing set).

@adrelanos adrelanos referenced this issue in marmarek/old-qubes-core-agent-linux Nov 15, 2015

Merged

network: add vif-route-qubes-nat for IP address anonymization #24

@marmarek marmarek closed this in marmarek/old-qubes-core-agent-linux@fa8b05a Nov 15, 2015

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Feb 9, 2016

Member

It turned out it was needed: https://groups.google.com/d/msgid/qubes-users/56B9D08F.4080502%40ploing.de
Member

marmarek commented Feb 9, 2016

It turned out it was needed: https://groups.google.com/d/msgid/qubes-users/56B9D08F.4080502%40ploing.de

@marmarek marmarek reopened this Feb 9, 2016

@marmarek marmarek added bug C: core P: major labels Feb 9, 2016

@marmarek marmarek added this to the Release 3.1 milestone Feb 9, 2016

@rootkovska rootkovska modified the milestones: Release 3.1 updates, Release 3.1 Feb 12, 2016

@adrelanos

This comment has been minimized.

Show comment
Hide comment
@adrelanos

adrelanos Mar 16, 2016

Member

Can we avoid re-enabling it? Or use a better mechanism? Or enable it in specific cases only? My original motivation to get rid of it was to simplify the setup so this cannot possibly backfire in the tunneling (vpn / anonymity) use cases and also to avoid these code paths.
Member

adrelanos commented Mar 16, 2016

Can we avoid re-enabling it? Or use a better mechanism? Or enable it in specific cases only? My original motivation to get rid of it was to simplify the setup so this cannot possibly backfire in the tunneling (vpn / anonymity) use cases and also to avoid these code paths.
@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Mar 17, 2016

Member

Does it really matter on vif interfaces for your cases? Proxy ARP is/was enabled only there, not on eth0 or any other interface (like tun0 for OpenVPN or such). This means that (Proxy/Net)VM will respond with own MAC address for ARP queries (originating from connected VM), not only for own IP, but also IPs it know how to route traffic to (in practice - all of them, because it has default gateway set). It happens only after such VM already decided (based on its own routing table) that packet should go to such (Proxy/Net)VM.
Member

marmarek commented Mar 17, 2016

Does it really matter on vif interfaces for your cases? Proxy ARP is/was enabled only there, not on eth0 or any other interface (like tun0 for OpenVPN or such). This means that (Proxy/Net)VM will respond with own MAC address for ARP queries (originating from connected VM), not only for own IP, but also IPs it know how to route traffic to (in practice - all of them, because it has default gateway set). It happens only after such VM already decided (based on its own routing table) that packet should go to such (Proxy/Net)VM.

@marmarek marmarek closed this in marmarek/old-qubes-core-agent-linux@696a091 Oct 31, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 18, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.13-1.fc23 has been pushed to the r3.2 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update
Member

marmarek commented Nov 18, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.13-1.fc23 has been pushed to the r3.2 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

@marmarek marmarek added the r3.2-fc23-cur-test label Nov 18, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 18, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.13-1.fc24 has been pushed to the r3.2 testing repository for the Fedora fc24 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update
Member

marmarek commented Nov 18, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.13-1.fc24 has been pushed to the r3.2 testing repository for the Fedora fc24 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.2-current-testing

Changes included in this update

@marmarek marmarek added the r3.2-fc24-cur-test label Nov 18, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 18, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.2.13-1+deb8u1 has been pushed to the r3.2 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Nov 18, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.2.13-1+deb8u1 has been pushed to the r3.2 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added the r3.2-jessie-cur-test label Nov 18, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 18, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.2.13-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Nov 18, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.2.13-1+deb9u1 has been pushed to the r3.2 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added the r3.2-stretch-cur-test label Nov 18, 2016

marmarek added a commit to QubesOS/qubes-core-agent-linux that referenced this issue Nov 20, 2016

@marmarek
Revert "network: disable proxy_arp" 
Proxy ARP apparently is still needed for HVMs.
This reverts commit fa8b05a.

Fixes QubesOS/qubes-issues#1421

(cherry picked from commit 696a091)
Verified
This commit was signed with a verified signature.
@marmarek marmarek Marek Marczykowski-Górecki
GPG key ID: 063938BA42CFA724 Learn about signing commits
d77e9a7
@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 20, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc21 has been pushed to the r3.1 testing repository for the Fedora fc21 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update
Member

marmarek commented Nov 20, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc21 has been pushed to the r3.1 testing repository for the Fedora fc21 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

@marmarek marmarek added the r3.1-fc21-cur-test label Nov 20, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 20, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc22 has been pushed to the r3.1 testing repository for the Fedora fc22 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update
Member

marmarek commented Nov 20, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc22 has been pushed to the r3.1 testing repository for the Fedora fc22 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

@marmarek marmarek added the r3.1-fc22-cur-test label Nov 20, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 20, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc23 has been pushed to the r3.1 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update
Member

marmarek commented Nov 20, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc23 has been pushed to the r3.1 testing repository for the Fedora fc23 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r3.1-current-testing

Changes included in this update

@marmarek marmarek added the r3.1-fc23-cur-test label Nov 20, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 20, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb8u1 has been pushed to the r3.1 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Nov 20, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb8u1 has been pushed to the r3.1 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added the r3.1-jessie-cur-test label Nov 20, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 20, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb9u1 has been pushed to the r3.1 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Nov 20, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb9u1 has been pushed to the r3.1 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added the r3.1-stretch-cur-test label Nov 20, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Nov 20, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb7u1 has been pushed to the r3.1 testing repository for the Debian wheezy template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing wheezy-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Nov 20, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb7u1 has been pushed to the r3.1 testing repository for the Debian wheezy template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing wheezy-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added the r3.1-wheezy-cur-test label Nov 20, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc21 has been pushed to the r3.1 stable repository for the Fedora fc21 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc21 has been pushed to the r3.1 stable repository for the Fedora fc21 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@marmarek marmarek added r3.1-fc21-stable and removed r3.1-fc21-cur-test labels Dec 4, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.2.13-1+deb8u1 has been pushed to the r3.2 stable repository for the Debian jessie template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.2.13-1+deb8u1 has been pushed to the r3.2 stable repository for the Debian jessie template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added r3.2-jessie-stable and removed r3.2-jessie-cur-test labels Dec 4, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc22 has been pushed to the r3.1 stable repository for the Fedora fc22 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc22 has been pushed to the r3.1 stable repository for the Fedora fc22 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@marmarek marmarek added r3.1-fc22-stable and removed r3.1-fc22-cur-test labels Dec 4, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc23 has been pushed to the r3.1 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.1.19-1.fc23 has been pushed to the r3.1 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@marmarek marmarek added r3.1-fc23-stable and removed r3.1-fc23-cur-test labels Dec 4, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb8u1 has been pushed to the r3.1 stable repository for the Debian jessie template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb8u1 has been pushed to the r3.1 stable repository for the Debian jessie template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added r3.1-jessie-stable and removed r3.1-jessie-cur-test labels Dec 4, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb9u1 has been pushed to the r3.1 stable repository for the Debian stretch template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb9u1 has been pushed to the r3.1 stable repository for the Debian stretch template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added r3.1-stretch-stable and removed r3.1-stretch-cur-test labels Dec 4, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb7u1 has been pushed to the r3.1 stable repository for the Debian wheezy template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.1.19-1+deb7u1 has been pushed to the r3.1 stable repository for the Debian wheezy template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@marmarek marmarek added r3.1-wheezy-stable and removed r3.1-wheezy-cur-test labels Dec 4, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.13-1.fc23 has been pushed to the r3.2 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.13-1.fc23 has been pushed to the r3.2 stable repository for the Fedora fc23 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@marmarek marmarek added r3.2-fc23-stable and removed r3.2-fc23-cur-test labels Dec 4, 2016

@marmarek

This comment has been minimized.

Show comment
Hide comment
@marmarek

marmarek Dec 4, 2016

Member

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.13-1.fc24 has been pushed to the r3.2 stable repository for the Fedora fc24 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update
Member

marmarek commented Dec 4, 2016

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-3.2.13-1.fc24 has been pushed to the r3.2 stable repository for the Fedora fc24 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

@marmarek marmarek added r3.2-fc24-stable and removed r3.2-fc24-cur-test labels Dec 4, 2016

@qubesos-bot

This comment has been minimized.

Show comment
Hide comment
@qubesos-bot

qubesos-bot Dec 19, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.2.13-1+deb9u1 has been pushed to the r3.2 stable repository for the Debian stretch template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

qubesos-bot commented Dec 19, 2016

Automated announcement from builder-github

The package qubes-core-agent_3.2.13-1+deb9u1 has been pushed to the r3.2 stable repository for the Debian stretch template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

@qubesos-bot qubesos-bot added r3.2-stretch-stable and removed r3.2-stretch-cur-test labels Dec 19, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment