VM firewall: option to 'reject' output packets instead of 'drop'

[taradiddles]

Qubes OS version:

R4.x

Proposed enhancement

Implement an option to reject a VM's outgoing packets instead of dropping them, for VMs with "whitelist" firewalls (= "limit connections to..." in the gui).

The rationale behind rejecting out packets instead of dropping them is to avoid:

• having to wait for tcp timeouts to find out that there's no network connectivity to a given address
• breaking functionality of sites that load unwanted (= not whitelisted) third-party sites in a blocking way. When dropping packets the sites become functional only after the tcp/http request timeouts. The 'manager' site of the Linode cloud provider for instance falls into this category: the site tries to load a third-party support site and the login page and other functionality appear only when the http request to the support site timeouts.

Note: rejecting packets means sending icmp unreachable or tcp reset packets from the FirewallVM back to the originating VM ; I don't see how this would increase the attack surface on the FirewallVM (how would the reject packets be different than - say - fragmentation neeeded packets ?). But this should be given some thoughts if the option is to be implemented.

BTW I tried to implement this 'reject' functionality in the various qubes firewall.py files (admin, tests, ...) but I keep on getting errors so I must be missing something.

Workaround: in the VM's network VM (eg. sys-firewall), insert an nft reject rule at the appropriate position. For instance, add a rule for the VM with ip 10.137.0.7 at handle 22 before the catch-all 'drop' target (the handle number is determined by nft list table qubes-firewall -a):

nft insert rule ip qubes-firewall qbs-10-137-0-7 position 22 reject

[adrelanos]

output: I agree. Reject should be preferred over drop. Imo not even an option needed. Reject should be default. This ticket is about output only. input: Drop makes sense to avoid ddos. But this ticket is not about input, so no need to discuss it here.

[adrelanos]

output: I agree. Reject should be preferred over drop. Imo not even an option needed. Reject should be default. This ticket is about output only. input: Drop makes sense to avoid ddos. But this ticket is not about input, so no need to discuss it here.

[marmarek]

👍 for reject on output

[marmarek]

👍 for reject on output

[marmarek]

I wonder if this should be the only option - i.e. replace the current "drop" rule. Or make it configurable?

[marmarek]

I wonder if this should be the only option - i.e. replace the current "drop" rule. Or make it configurable?

[DemiMarie]

@marmarek I think it should. It is much more user-friendly and just as secure.

[DemiMarie]

@marmarek I think it should. It is much more user-friendly and just as secure.

[donob4n]

In my opinion only reject would be fine.

[donob4n]

In my opinion only reject would be fine.

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 testing repository for the CentOS centos7 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.27-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.27-1.fc26) has been pushed to the r4.0 testing repository for the Fedora template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.27-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.27-1+deb9u1 has been pushed to the r4.0 testing repository for the Debian template.
To test this update, first enable the testing repository in /etc/apt/sources.list.d/qubes-*.list by uncommenting the line containing stretch-testing (or appropriate equivalent for your template version), then use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.28-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The component core-agent-linux (including package python2-dnf-plugins-qubes-hooks-4.0.28-1.fc26) has been pushed to the r4.0 stable repository for the Fedora template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.0 stable repository for the Fedora centos7 template.
To install this update, please use the standard update command:

sudo yum update

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.28-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-core-agent_4.0.28-1+deb9u1 has been pushed to the r4.0 stable repository for the Debian template.
To install this update, please use the standard update command:

sudo apt-get update && sudo apt-get dist-upgrade

Changes included in this update