qubes-firewall service can be killed by a bad rule by any attached qube

[icequbes1]

Qubes OS version
R4.0

Affected component(s) or functionality
/usr/sbin/qubes-firewall [qubes-core-agent-networking-4.0.58-1.fc32]

Brief summary
When configuring a qube to limit traffic to certain hosts, a host value of .anything caused qubes-firewall.service to crash within the firewall qube (sys-firewall).

This left sys-firewall without the appropriate nftables rules for that qube, and any firewall configuration performed afterwards for any other qube was then a no-op.

This also meant no network connectivity for qubes that get newly attached to the firewall qube. There is no indication to the user the firewall service was not active.

The rules are parsed by qubes-firewall even when the qube is configured for 'Allow all outgoing connections', and the crash is observed (via logs in sys-firewall) even upon reboot - which meant no network for any qube upon sys-firewall boot.

How Reproducible
Always, for the following 'address'/host values:

• .
• .anything
• anything..
• anything..anything

To Reproduce

Steps to reproduce the behavior:

1. Assume a qube with sys-firewall as netvm has no firewall rules configured ('Allow all')
2. Configure a firewall rule in Qubes Settings for that qube with one of the above 'address' values, such as ..
3. Hit Apply

Expected behavior

1. All traffic should be blocked to match the behavior when a hostname cannot be resolved

Actual behavior
Ideally, the invalid value should be rejected by Qubes Settings/qvm-firewall, but observations:

Traffic is not blocked in this scenario.

Future qubes attached to sys-firewall do not get network (no nft forward chain gets added for the qube since qubes-firewall.service is dead).

Qubes that were already attached to sys-firewall who then have their firewall rules updated do not get the new rules applied - risk: 'Allow all -> Limit' will do nothing.

Additional context

qubes-firewall exception log with a rule containing address of ..:

Dec 16 21:49:08 sys-firewall qubes-firewall[978]: Traceback (most recent call last):
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/lib64/python3.8/encodings/idna.py", line 165, in encode
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     raise UnicodeError("label empty or too long")
Dec 16 21:49:08 sys-firewall qubes-firewall[978]: UnicodeError: label empty or too long
Dec 16 21:49:08 sys-firewall qubes-firewall[978]: The above exception was the direct cause of the following exception:
Dec 16 21:49:08 sys-firewall qubes-firewall[978]: Traceback (most recent call last):
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/sbin/qubes-firewall", line 11, in <module>
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     load_entry_point('qubesagent==4.0.58', 'console_scripts', 'qubes-firewall')()
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/lib/python3.8/site-packages/qubesagent/firewall.py", line 648, in main
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     worker.main()
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/lib/python3.8/site-packages/qubesagent/firewall.py", line 185, in main
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     self.handle_addr(source_addr)
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/lib/python3.8/site-packages/qubesagent/firewall.py", line 138, in handle_addr
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     self.apply_rules(addr, rules)
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/lib/python3.8/site-packages/qubesagent/firewall.py", line 608, in apply_rules
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     self.apply_rules_family(source, rules, 4)
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/lib/python3.8/site-packages/qubesagent/firewall.py", line 602, in apply_rules_family
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     self.run_nft(self.prepare_rules(chain, rules, family))
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/lib/python3.8/site-packages/qubesagent/firewall.py", line 525, in prepare_rules
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     addrinfo = socket.getaddrinfo(rule['dsthost'], None,
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:   File "/usr/lib64/python3.8/socket.py", line 918, in getaddrinfo
Dec 16 21:49:08 sys-firewall qubes-firewall[978]:     for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
Dec 16 21:49:08 sys-firewall qubes-firewall[978]: UnicodeError: encoding with 'idna' codec failed (UnicodeError: label empty or too long)
Dec 16 21:49:08 sys-firewall systemd[1]: qubes-firewall.service: Main process exited, code=exited, status=1/FAILURE
Dec 16 21:49:08 sys-firewall systemd[1]: qubes-firewall.service: Failed with result 'exit-code'.

Related

• Unsafe firewall fallback defaults #3269

[rjt]

Yep, having this problem again.

[icequbes1]

A very long hostname can also cause this error - such as when a subdomain is greater than 64 characters.

[qubesos-bot]

Automated announcement from builder-github

The package core-agent-linux has been pushed to the r4.1 testing repository for the CentOS centos8 template.
To test this update, please install it with the following command:

sudo yum update --enablerepo=qubes-vm-r4.1-current-testing

Changes included in this update