Skip to content

Commit

Permalink
Revise firewalling rules in relation to Tor malfunctions
Browse files Browse the repository at this point in the history
  • Loading branch information
@evilaliv3
evilaliv3 committed Dec 8, 2023
1 parent cb1980a commit 6f613e4
Show file tree
Hide file tree
Showing 3 changed files with 10 additions and 45 deletions.
4 changes: 0 additions & 4 deletions backend/default
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,6 @@ USERNAME=globaleaks
# permits to enable apparmor sandboxing
APPARMOR_SANDBOXING=1

# NETWORK_SANDBOXING = [0/1]
# permits to enable network sandboxing
NETWORK_SANDBOXING=1

# LISTENING_IP = [ip]
# permits to configure an ip on which the platform will listen
LISTENING_IP=::
Expand Down
5 changes: 3 additions & 2 deletions backend/globaleaks/services/tor.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ def init_callback(ret):

try:
from txtorcon.onion import EphemeralOnionService
onion_service = EphemeralOnionService.create(reactor, config, [hs_loc], private_key=key)
onion_service = EphemeralOnionService.create(reactor, config, [hs_loc], private_key=key, version=3)
return onion_service.addCallbacks(init_callback) # pylint: disable=no-member
except:
from txtorcon.torconfig import EphemeralHiddenService
Expand Down Expand Up @@ -126,7 +126,8 @@ def startup_errback(err):
startup_errback(Exception('Unable to access %s; manual permission recheck needed' % self.state.settings.tor_control))
return deferred_sleep(1)

def connect(_):
def connect(tor):
self.tor = tor
build_local_tor_connection(reactor, socket=self.state.settings.tor_control).addCallbacks(startup_callback, startup_errback)

self.tor.addCallback(connect)
Expand Down
46 changes: 7 additions & 39 deletions debian/globaleaks.init
View file
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ network_sandboxing_start()
exit 1
fi

# remove all rules with the comment: "globaleaks-network-sandboxing"
# remove all rules with the comment: "globaleaks"
iptables-save | grep -v "globaleaks" | iptables-restore
ip6tables-save | grep -v "globaleaks" | ip6tables-restore

Expand All @@ -117,7 +117,9 @@ network_sandboxing_start()
return
fi

# OUTBOUND
iptables -m comment --comment "globaleaks" -A INPUT -j DROP
ip6tables -m comment --comment "globaleaks" -A INPUT -j DROP

if [[ "$TOR_SANDBOXING" -eq "1" ]]; then
declare -a PORTS=("80" "443")
for PORT in "${PORTS[@]}"; do
Expand All @@ -126,16 +128,6 @@ network_sandboxing_start()
ip6tables -m comment --comment "globaleaks" -A INPUT -p tcp -d :: --dport $PORT -s ::1 -j ACCEPT
ip6tables -m comment --comment "globaleaks" -A INPUT -p tcp -d :: --dport $PORT -j DROP
done

# All outbound connections from GlobaLeaks goes through Tor except of allowed and enstablished connections.
iptables -m comment --comment "globaleaks" -A OUTPUT -m state --state RELATED,ESTABLISHED -m owner --uid-owner globaleaks -d 127.0.0.1 -j ACCEPT
ip6tables -m comment --comment "globaleaks" -A OUTPUT -m state --state RELATED,ESTABLISHED -m owner --uid-owner globaleaks -d ::1 -j ACCEPT
iptables -m comment --comment "globaleaks" -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner ${USERNAME} -m tcp -j REDIRECT --to-ports 9050
iptables -m comment --comment "globaleaks" -t filter -A OUTPUT -p tcp -m owner --uid-owner ${USERNAME} -m tcp -d 127.0.0.1 --dport 9050 -j ACCEPT
iptables -m comment --comment "globaleaks" -t filter -A OUTPUT ! -o lo -m owner --uid-owner ${USERNAME} -j DROP
ip6tables -m comment --comment "globaleaks" -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner ${USERNAME} -m tcp -j REDIRECT --to-ports 9050
ip6tables -m comment --comment "globaleaks" -t filter -A OUTPUT -p tcp -m owner --uid-owner ${USERNAME} -m tcp -d ::1 --dport 9050 -j ACCEPT
ip6tables -m comment --comment "globaleaks" -t filter -A OUTPUT ! -o lo -m owner --uid-owner ${USERNAME} -j DROP
else
iptables -m comment --comment "globaleaks" -t filter -A INPUT -p tcp --dport 8080 -j ACCEPT
ip6tables -m comment --comment "globaleaks" -t filter -A INPUT -p tcp --dport 8080 -j ACCEPT
Expand All @@ -154,27 +146,8 @@ network_sandboxing_start()

iptables -m comment --comment "globaleaks" -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-port 8443
ip6tables -m comment --comment "globaleaks" -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-port 8443

# Enable enstablished connections, new connections on used tcp and udp ports
iptables -m comment --comment "globaleaks" -A OUTPUT -m state --state RELATED,ESTABLISHED -m owner --uid-owner globaleaks -j ACCEPT
ip6tables -m comment --comment "globaleaks" -A OUTPUT -m state --state RELATED,ESTABLISHED -m owner --uid-owner globaleaks -j ACCEPT

declare -a PORTS=("25" "80" "53" "443" "465" "587" "9050")
for PORT in "${PORTS[@]}"; do
iptables -m comment --comment "globaleaks" -t filter -A OUTPUT -p tcp -m owner --uid-owner ${USERNAME} -m tcp --dport $PORT -j ACCEPT
ip6tables -m comment --comment "globaleaks" -t filter -A OUTPUT -p tcp -m owner --uid-owner ${USERNAME} -m tcp --dport $PORT -j ACCEPT
done

declare -a PORTS=("53")
for PORT in "${PORTS[@]}"; do
iptables -m comment --comment "globaleaks" -t filter -A OUTPUT -p udp -m owner --uid-owner ${USERNAME} -m udp --dport $PORT -j ACCEPT
ip6tables -m comment --comment "globaleaks" -t filter -A OUTPUT -p udp -m owner --uid-owner ${USERNAME} -m udp --dport $PORT -j ACCEPT
done
fi

iptables -m comment --comment "globaleaks" -t filter -A OUTPUT ! -o lo -m owner --uid-owner ${USERNAME} -j DROP
ip6tables -m comment --comment "globaleaks" -t filter -A OUTPUT ! -o lo -m owner --uid-owner ${USERNAME} -j DROP

log_action_end_msg 0
}

Expand All @@ -187,7 +160,7 @@ network_sandboxing_stop()

log_action_begin_msg "Disabling GlobaLeaks Network Sandboxing"

# remove all rules with the comment: "globaleaks-network-sandboxing"
# remove all rules with the comment: "globaleaks"
iptables-save | grep -v "globaleaks" | iptables-restore
ip6tables-save | grep -v "globaleaks" | ip6tables-restore

Expand Down Expand Up @@ -270,20 +243,15 @@ case "$1" in

log_action_begin_msg "Starting $DESC"

if [[ "$NETWORK_SANDBOXING" -eq "1" ]]; then
network_sandboxing_start
fi
network_sandboxing_start

globaleaks_start

;;
stop)
log_action_begin_msg "Stopping $DESC"


if [[ "$NETWORK_SANDBOXING" -eq "1" ]]; then
network_sandboxing_stop
fi
network_sandboxing_stop

globaleaks_stop
;;
Expand Down

0 comments on commit 6f613e4

Please sign in to comment.