qubes-firewall may fail to start without downstream DNS

[3hhh]

Qubes OS version:

4.0rc2

Affected TemplateVMs:

at least debian-8 was tested, probably any

Steps to reproduce the behavior:

1. Create a proxy or firewall VM without downstream network connectivity (let's assume there is a temporary outage).
2. Create a new VM [client] using that proxy VM further upstream.
3. Configure the [client] firewall to allow only access to certain hosts based on DNS hostnames using e.g. qvm-firewall.
4. Start [client]. <-- This might require a racing condition where the [client] firewall rules are provided by dom0 to the proxyVM before the qubes-firewall service is started. It can be tested reliably by shutting down the qubes-firewall service and then starting it after [client]. It takes ~30s on my machine until the service reaches the failed state:

systemctl status qubes-firewall
● qubes-firewall.service - Qubes firewall updater
   Loaded: loaded (/lib/systemd/system/qubes-firewall.service; enabled)
   Active: failed (Result: exit-code) since Fri 2017-11-03 22:14:34 CET; 9min ago
  Process: 2145 ExecStart=/usr/sbin/qubes-firewall (code=exited, status=1/FAILURE)
 Main PID: 2145 (code=exited, status=1/FAILURE)

Nov 03 22:14:34 sys-vpn qubes-firewall[2145]: self.apply_rules(addr, rules)
Nov 03 22:14:34 sys-vpn qubes-firewall[2145]: File "/usr/lib/python2.7/dist-packages/qubesagent/firewall.py", line 337, in apply_rules
Nov 03 22:14:34 sys-vpn qubes-firewall[2145]: self.apply_rules_family(source, rules, 4)
Nov 03 22:14:34 sys-vpn qubes-firewall[2145]: File "/usr/lib/python2.7/dist-packages/qubesagent/firewall.py", line 321, in apply_rules_family
Nov 03 22:14:34 sys-vpn qubes-firewall[2145]: iptables = self.prepare_rules(chain, rules, family)
Nov 03 22:14:34 sys-vpn qubes-firewall[2145]: File "/usr/lib/python2.7/dist-packages/qubesagent/firewall.py", line 249, in prepare_rules
Nov 03 22:14:34 sys-vpn qubes-firewall[2145]: (socket.AF_INET6 if family == 6 else socket.AF_INET))
Nov 03 22:14:34 sys-vpn qubes-firewall[2145]: socket.gaierror: [Errno -3] Temporary failure in name resolution
Nov 03 22:14:34 sys-vpn systemd[1]: qubes-firewall.service: main process exited, code=exited, status=1/FAILURE
Nov 03 22:14:34 sys-vpn systemd[1]: Unit qubes-firewall.service entered failed state.

Actual behavior:

The qubes-firewall service fails to start. This results in some partial iptables rules on [client] and in combination with #3269 effectively disables the qubes-firewall. [client] will have access to whatever it wants once the connectivity is back up.

Expected behavior:

Some fallback, maybe catch the error situation during setup and block all connections on the qubes-firewall as long as there is no downstream DNS connectivity anyway. Resume the setup afterwards. As an alternative one could simply disallow DNS hostnames.

Related issues:

Fixing #3269 will partially fix this one, but still require the user to manually start the qubes-firewall service which entered a failed state.

General notes:

Qubes supports hostnames on qvm-firewall as iptables supports it.

Combining many minor security flaws tends to lead to bigger ones.

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.16-1+deb8u1 has been pushed to the r4.0 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.16-1+deb8u1 has been pushed to the r4.0 testing repository for the Debian jessie template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing jessie-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.16-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.16-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian stretch template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing, then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-4.0.16-1.fc24 has been pushed to the r4.0 testing repository for the Fedora fc24 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-4.0.16-1.fc24 has been pushed to the r4.0 testing repository for the Fedora fc24 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-4.0.16-1.fc25 has been pushed to the r4.0 testing repository for the Fedora fc25 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-4.0.16-1.fc25 has been pushed to the r4.0 testing repository for the Fedora fc25 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-4.0.16-1.fc26 has been pushed to the r4.0 testing repository for the Fedora fc26 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package python2-dnf-plugins-qubes-hooks-4.0.16-1.fc26 has been pushed to the r4.0 testing repository for the Fedora fc26 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.20-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.20-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.20-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.20-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update