Added alternate for dialag (gdialog) so some of Whonix programs run Changed sudo permissions to fix umask and not use QT shared memory Changed whonix to use basic hosts file Added detection if template is active for updating Added startup code for tinyproxy Added code to disable uwt so apt-get can be used as proxy Created a python GUI Message Alert using yaml for messages (internationalization)pull/1/head
Jason Mehring
10 years ago
parent
82a68e9c87
commit
0e53e2954f
@ -0,0 +1,6 @@
|
||||
|
||||
. /usr/lib/whonix/utility_functions
|
||||
|
||||
if [ "${WHONIX}" == "template" -a "${PROXY_SECURE}" == "1" ]; then
|
||||
uwtwrapper["/usr/bin/apt-get"]="0"
|
||||
fi
|
||||
Binary file not shown.
@ -1,92 +0,0 @@
|
||||
#!/bin/bash
|
||||
# vim: set ts=4 sw=4 sts=4 et :
|
||||
|
||||
set -x
|
||||
|
||||
WHONIX_DIR="$(readlink -m .)"
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# Initialize Whonix submodules
|
||||
# --------------------------------------------------------------------------
|
||||
pushd "${WHONIX_DIR}"
|
||||
{
|
||||
sudo git submodule update --init --recursive;
|
||||
}
|
||||
popd
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# Patch Whonix submodules
|
||||
# --------------------------------------------------------------------------
|
||||
|
||||
# Chekout a branch; create a branch first if it does not exist
|
||||
checkout_branch() {
|
||||
branch=$(git symbolic-ref --short -q HEAD)
|
||||
if ! [ "${branch}" == "${1}" ]; then
|
||||
sudo -u "${user_name}" git checkout "${1}" >/dev/null 2>&1 || \
|
||||
{
|
||||
sudo -u "${user_name}" git branch "${1}"
|
||||
sudo -u "${user_name}" git checkout "${1}"
|
||||
}
|
||||
fi
|
||||
}
|
||||
|
||||
# sed search and replace. return 0 if replace happened, otherwise 1
|
||||
search_replace() {
|
||||
local search="${1}"
|
||||
local replace="${2}"
|
||||
local file="${3}"
|
||||
|
||||
sed -i.bak '/'"${search}"'/,${s//'"${replace}"'/;b};$q1' "${file}"
|
||||
}
|
||||
|
||||
# Patch anon-meta-packages to not depend on grub-pc
|
||||
pushd "${WHONIX_DIR}"
|
||||
{
|
||||
search_replace "grub-pc" "" "grml_packages" || :
|
||||
}
|
||||
popd
|
||||
|
||||
pushd "${WHONIX_DIR}/packages/anon-meta-packages/debian"
|
||||
{
|
||||
search1=" grub-pc,";
|
||||
replace="";
|
||||
|
||||
#checkout_branch qubes
|
||||
search_replace "${search1}" "${replace}" control && \
|
||||
{
|
||||
cd "${WHONIX_DIR}/packages/anon-meta-packages";
|
||||
:
|
||||
#sudo -E -u "${user_name}" make deb-pkg || :
|
||||
#su "${user_name}" -c "dpkg-source --commit" || :
|
||||
#git add .
|
||||
#su "${user_name}" -c "git commit -am 'removed grub-pc depend'"
|
||||
} || :
|
||||
}
|
||||
popd
|
||||
|
||||
pushd "${WHONIX_DIR}/packages/anon-shared-build-fix-grub/usr/lib/anon-dist/chroot-scripts-post.d"
|
||||
{
|
||||
search1="update-grub";
|
||||
replace=":";
|
||||
|
||||
#checkout_branch qubes
|
||||
search_replace "${search1}" "${replace}" 85_update_grub && \
|
||||
{
|
||||
cd "${WHONIX_DIR}/packages/anon-shared-build-fix-grub";
|
||||
sudo -E -u "${user_name}" make deb-pkg || :
|
||||
su "${user_name}" -c "EDITOR=/bin/true dpkg-source -q --commit . no_grub";
|
||||
#git add . ;
|
||||
#su "${user_name}" -c "git commit -am 'removed grub-pc depend'"
|
||||
} || :
|
||||
}
|
||||
popd
|
||||
|
||||
pushd "${WHONIX_DIR}/build-steps.d"
|
||||
{
|
||||
search1=" check_for_uncommited_changes";
|
||||
replace=" #check_for_uncommited_changes";
|
||||
|
||||
search_replace "${search1}" "${replace}" 1200_create-debian-packages || :
|
||||
}
|
||||
popd
|
||||
|
||||
@ -1,60 +0,0 @@
|
||||
#!/bin/bash
|
||||
# vim: set ts=4 sw=4 sts=4 et :
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Whonix Post Installation Configurations
|
||||
# ------------------------------------------------------------------------------
|
||||
echo "Post Configuring Whonix System"
|
||||
|
||||
pushd "/etc/network"
|
||||
{
|
||||
rm -f interfaces;
|
||||
ln -s interfaces.backup interfaces;
|
||||
}
|
||||
popd
|
||||
|
||||
pushd "/etc"
|
||||
{
|
||||
rm -f resolv.conf;
|
||||
cp -p resolv.conf.backup resolv.conf;
|
||||
}
|
||||
popd
|
||||
|
||||
# Enable Tor
|
||||
#if [ "${TEMPLATE_FLAVOR}" == "whonix-gateway" ]; then
|
||||
# sed -i 's/#DisableNetwork 0/DisableNetwork 0/g' "/etc/tor/torrc"
|
||||
#fi
|
||||
|
||||
# Fake that whonixsetup was already run
|
||||
#mkdir -p "/var/lib/whonix/do_once"
|
||||
#touch "/var/lib/whonix/do_once/whonixsetup.done"
|
||||
|
||||
# Fake that initializer was already run
|
||||
mkdir -p "/root/.whonix"
|
||||
touch "/root/.whonix/first_run_initializer.done"
|
||||
|
||||
# Prevent whonixcheck error
|
||||
echo 'WHONIXCHECK_NO_EXIT_ON_UNSUPPORTED_VIRTUALIZER="1"' >> "/etc/whonix.d/30_whonixcheck_default"
|
||||
|
||||
# Use gdialog as an alternative for dialog
|
||||
update-alternatives --install /usr/bin/dialog dialog /usr/bin/gdialog 999
|
||||
|
||||
# Disable unwanted applications
|
||||
update-rc.d network-manager disable || :
|
||||
update-rc.d spice-vdagent disable || :
|
||||
update-rc.d swap-file-creator disable || :
|
||||
update-rc.d whonix-initializer disable || :
|
||||
|
||||
service apt-cacher-ng stop || :
|
||||
update-rc.d apt-cacher-ng disable || :
|
||||
|
||||
# Remove apt-cacher-ng
|
||||
DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
|
||||
apt-get.anondist-orig -y --force-yes remove --purge apt-cacher-ng
|
||||
|
||||
# Remove original sources.list
|
||||
rm -f "/etc/apt/sources.list"
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
|
||||
apt-get.anondist-orig update
|
||||
|
||||
@ -1,41 +0,0 @@
|
||||
################################################################################
|
||||
# Pre Fixups
|
||||
sudo mkdir -p /boot/grub2
|
||||
sudo touch /boot/grub2/grub.cfg
|
||||
sudo mkdir -p /boot/grub
|
||||
sudo touch /boot/grub/grub.cfg
|
||||
sudo mkdir --parents --mode=g+rw "/tmp/uwt"
|
||||
|
||||
# Whonix seems to re-install sysvinit even though there is a hold
|
||||
# on the package. Things seem to work anyway. BUT hopfully the
|
||||
# hold on grub* don't get removed
|
||||
sudo apt-mark hold sysvinit
|
||||
sudo apt-mark hold grub-pc grub-pc-bin grub-common grub2-common
|
||||
|
||||
# Whonix expects haveged to be started
|
||||
sudo /etc/init.d/haveged start
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Link our build steps into Whonix build directory
|
||||
# ------------------------------------------------------------------------------
|
||||
#pushd /home/user/Whonix/build-steps.d
|
||||
#cp -pf /home/user/build-steps.d/* .
|
||||
#popd
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Whonix installation
|
||||
# ------------------------------------------------------------------------------
|
||||
export WHONIX_BUILD_UNATTENDED_PKG_INSTALL="1"
|
||||
|
||||
pushd ~/Whonix
|
||||
sudo ~/Whonix/whonix_build \
|
||||
--build $1 \
|
||||
--64bit-linux \
|
||||
--current-sources \
|
||||
--enable-whonix-apt-repository \
|
||||
--whonix-apt-repository-distribution $2 \
|
||||
--install-to-root \
|
||||
--skip-verifiable \
|
||||
--minimal-report \
|
||||
--skip-sanity-tests || { exit 1; }
|
||||
popd
|
||||
@ -1,3 +0,0 @@
|
||||
DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
|
||||
sudo apt-get -y --force-yes remove grub-pc grub-common grub-pc-bin grub2-common
|
||||
sudo apt-mark hold grub-common grub-pc-bin grub2-common
|
||||
@ -0,0 +1,90 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
#
|
||||
# Copyright 2014 Jason Mehring (nrgaway@gmail.com)
|
||||
#
|
||||
|
||||
from PyQt4 import QtGui
|
||||
import locale
|
||||
import yaml
|
||||
|
||||
DEFAULT_LANG = 'en'
|
||||
|
||||
class Messages():
|
||||
filename = None
|
||||
data = None
|
||||
language = DEFAULT_LANG
|
||||
title = None
|
||||
icon = None
|
||||
message = None
|
||||
|
||||
def __init__(self, section, filename):
|
||||
self.filename = filename
|
||||
|
||||
language = locale.getdefaultlocale()[0].split('_')[0]
|
||||
if language:
|
||||
self.language = language
|
||||
|
||||
try:
|
||||
stream = file(filename, 'r')
|
||||
data = yaml.load(stream)
|
||||
|
||||
if section in data.keys():
|
||||
section = data[section]
|
||||
|
||||
self.icon = section.get('icon', None)
|
||||
|
||||
language = section.get(self.language, DEFAULT_LANG)
|
||||
|
||||
self.title = language.get('title', None)
|
||||
self.message = language.get('message', None)
|
||||
|
||||
except (IOError):
|
||||
pass
|
||||
except (yaml.scanner.ScannerError, yaml.parser.ParserError):
|
||||
pass
|
||||
|
||||
class WhonixMessageBox(QtGui.QMessageBox):
|
||||
def __init__(self, message):
|
||||
super(WhonixMessageBox, self).__init__()
|
||||
self.message = message
|
||||
self.initUI()
|
||||
|
||||
def initUI(self):
|
||||
message = self.message
|
||||
|
||||
if message.title:
|
||||
self.setWindowTitle(message.title)
|
||||
|
||||
if message.icon:
|
||||
self.setIcon(getattr(QtGui.QMessageBox, message.icon))
|
||||
|
||||
if message.message:
|
||||
self.setText(message.message)
|
||||
self.exec_()
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description='Display a QT Message Box')
|
||||
|
||||
parser.add_argument('section', help="Message section")
|
||||
parser.add_argument('filename', help="File including full path")
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
if not args.filename and args.section:
|
||||
print parser.usage()
|
||||
sys.exit(1)
|
||||
|
||||
app = QtGui.QApplication(sys.argv)
|
||||
|
||||
message = Messages(args.section, args.filename)
|
||||
dialog = WhonixMessageBox(message)
|
||||
sys.exit()
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@ -0,0 +1,12 @@
|
||||
|
||||
update:
|
||||
icon: Critical
|
||||
en:
|
||||
title: Tor netvm required for updates
|
||||
message: |
|
||||
<p><B>Tor netvm required for updates!</B></p>
|
||||
<p>Please ensure your template vm has a Whonix gateway as it's VM.</p>
|
||||
<p>No updates are possible without an active (running) Whonix gateway VM.</p>
|
||||
<p/>
|
||||
<p><b>Template will now power off</b></p>
|
||||
|
||||
@ -1,23 +1,46 @@
|
||||
#/bin/bash
|
||||
#!/bin/bash
|
||||
|
||||
# XXX: TODO:
|
||||
# - Make sure we can't just run this from setup-ip
|
||||
# - Alternatives? instead of deleting dialog?
|
||||
#
|
||||
# INSTALLATION NOTES:
|
||||
# - Make sure /etc/tor/torrc is disabled initially
|
||||
# - Make sure /var/lib/whonix/do_once/whonixsetup.done does not exist
|
||||
# so repo questions will be asked
|
||||
# - /etc/xdg/autostart/qubes-whonixsetup must be in place
|
||||
# - this file must be in place
|
||||
# - gdialog must have over-written dialog
|
||||
# - patches to setup-ip:
|
||||
# - bring eth1 up
|
||||
# - remove old code that was trying to get setup working
|
||||
. /usr/lib/whonix/utility_functions
|
||||
|
||||
grep "^DisableNetwork 0$" /etc/tor/torrc || {
|
||||
sudo systemctl stop whonixcheck
|
||||
sudo systemctl stop tor
|
||||
sudo /usr/lib/whonix/setup-ip
|
||||
sudo /usr/bin/whonixsetup
|
||||
}
|
||||
if [ "${WHONIX}" == "gateway" ]; then
|
||||
grep "^DisableNetwork 0$" /etc/tor/torrc || {
|
||||
sudo service sdwdate restart
|
||||
sudo service tor stop
|
||||
sudo /usr/bin/whonixsetup && {
|
||||
enable_sysv tor
|
||||
sleep 1
|
||||
enable_sysv sdwdate
|
||||
} || {
|
||||
sed -i 's/^DisableNetwork 0/#DisableNetwork 0/g' "/etc/tor/torrc"
|
||||
disable_sysv tor
|
||||
disable_sysv sdwdate
|
||||
sudo /sbin/poweroff
|
||||
}
|
||||
}
|
||||
|
||||
# Allow whonix-gateway to act as an update-proxy
|
||||
sudo systemctl status qubes-updates-proxy.service || {
|
||||
error_file="/usr/share/tinyproxy/default.html"
|
||||
|
||||
# Search and replace tinyproxy error files so we can inject code that
|
||||
# we can use to identify that its a tor proxy so updates are secure
|
||||
grep -q "${PROXY_META}" "${error_file}" || {
|
||||
sudo sed -i "s/<\/head>/${PROXY_META}\n<\/head>/" "${error_file}"
|
||||
}
|
||||
|
||||
sudo touch /var/run/qubes-service/qubes-updates-proxy
|
||||
sudo iptables -t nat -N PR-QBS-SERVICES
|
||||
sudo systemctl start qubes-updates-proxy.service
|
||||
}
|
||||
|
||||
elif [ "${WHONIX}" == "workstation" ]; then
|
||||
if ! [ -f "/var/lib/whonix/do_once/whonixsetup.done" ]; then
|
||||
enable_sysv sdwdate
|
||||
sudo service sdwdate restart
|
||||
sudo /usr/bin/whonixsetup
|
||||
fi
|
||||
|
||||
elif [ "${WHONIX}" == "template" -a "${PROXY_SECURE}" == "0" ]; then
|
||||
/usr/lib/whonix/alert update /usr/lib/whonix/messages.yaml
|
||||
sudo /sbin/poweroff
|
||||
fi
|
||||
|
||||
@ -1,141 +1,78 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -x /usr/sbin/xenstore-read ]; then
|
||||
XENSTORE_READ="/usr/sbin/xenstore-read"
|
||||
else
|
||||
XENSTORE_READ="/usr/bin/xenstore-read"
|
||||
fi
|
||||
|
||||
INTERFACE="eth1"
|
||||
ip=$(${XENSTORE_READ} qubes-netvm-gateway 2> /dev/null)
|
||||
|
||||
# Create a dummy eth1 interface so tor can bind to it if there
|
||||
# are no DOMU virtual machines connected at the moment
|
||||
ip link show ${INTERFACE} >> /dev/null || {
|
||||
/sbin/ip link add ${INTERFACE} type dummy
|
||||
. /usr/lib/whonix/utility_functions
|
||||
|
||||
# Now, assign it the netvm-gateway IP address
|
||||
if [ x${ip} != x ]; then
|
||||
netmask=$(${XENSTORE_READ} qubes-netvm-netmask)
|
||||
gateway=$(${XENSTORE_READ} qubes-netvm-gateway)
|
||||
/sbin/ifconfig ${INTERFACE} ${ip} netmask 255.255.255.255
|
||||
/sbin/ifconfig ${INTERFACE} up
|
||||
/sbin/ethtool -K ${INTERFACE} sg off
|
||||
/sbin/ethtool -K ${INTERFACE} tx off
|
||||
if [ "${WHONIX}" == "gateway" ]; then
|
||||
if [ -x /usr/sbin/xenstore-read ]; then
|
||||
XENSTORE_READ="/usr/sbin/xenstore-read"
|
||||
else
|
||||
XENSTORE_READ="/usr/bin/xenstore-read"
|
||||
fi
|
||||
|
||||
ip link set ${INTERFACE} up
|
||||
}
|
||||
|
||||
# Files that will have the immutable bit set
|
||||
# since we don't want them modified by other programs
|
||||
IMMUTABLE_FILES=(
|
||||
'/etc/resolv.conf'
|
||||
'/etc/hostname'
|
||||
'/etc/hosts'
|
||||
)
|
||||
|
||||
immutableFilesEnable() {
|
||||
files="${1}"
|
||||
suffix="${2}"
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "${file}" ] && ! [ -L "${file}" ]; then
|
||||
chattr +i "${file}${suffix}"
|
||||
INTERFACE="eth1"
|
||||
ip=$(${XENSTORE_READ} qubes-netvm-gateway 2> /dev/null)
|
||||
|
||||
# Create a dummy eth1 interface so tor can bind to it if there
|
||||
# are no DOMU virtual machines connected at the moment
|
||||
ip link show ${INTERFACE} >> /dev/null || {
|
||||
/sbin/ip link add ${INTERFACE} type dummy
|
||||
|
||||
# Now, assign it the netvm-gateway IP address
|
||||
if [ x${ip} != x ]; then
|
||||
netmask=$(${XENSTORE_READ} qubes-netvm-netmask)
|
||||
gateway=$(${XENSTORE_READ} qubes-netvm-gateway)
|
||||
/sbin/ifconfig ${INTERFACE} ${ip} netmask 255.255.255.255
|
||||
/sbin/ifconfig ${INTERFACE} up
|
||||
/sbin/ethtool -K ${INTERFACE} sg off || true
|
||||
/sbin/ethtool -K ${INTERFACE} tx off || true
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
immutableFilesDisable() {
|
||||
files="${1}"
|
||||
suffix="${2}"
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "${file}" ] && ! [ -L "${file}" ]; then
|
||||
chattr -i "${file}${suffix}"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
copyAnondist() {
|
||||
file="${1}"
|
||||
suffix="${2-.anondist}"
|
||||
|
||||
# Remove any softlinks first
|
||||
if [ -L "${file}" ]; then
|
||||
rm -f "${file}"
|
||||
fi
|
||||
ip link set ${INTERFACE} up
|
||||
}
|
||||
fi
|
||||
|
||||
if [ -f "${file}" ] && [ -n "$(diff ${file} ${file}${suffix})" ]; then
|
||||
chattr -i "${file}"
|
||||
rm -f "${file}"
|
||||
cp -p "${file}${suffix}" "${file}"
|
||||
chattr +i "${file}"
|
||||
elif ! [ -f "${file}" ]; then
|
||||
cp -p "${file}${suffix}" "${file}"
|
||||
chattr +i "${file}"
|
||||
if [ "${WHONIX}" != "template" ]; then
|
||||
# Files that will have the immutable bit set
|
||||
# since we don't want them modified by other programs
|
||||
IMMUTABLE_FILES=(
|
||||
'/etc/resolv.conf'
|
||||
'/etc/hostname'
|
||||
'/etc/hosts'
|
||||
)
|
||||
|
||||
# Make sure all .anondist files in list are immutable
|
||||
immutableFilesEnable "${IMMUTABLE_FILES}"
|
||||
immutableFilesEnable "${IMMUTABLE_FILES}" ".anondist"
|
||||
|
||||
# Make sure we are using a copy of the annondist file and if not
|
||||
# copy the annondist file and set it immutable
|
||||
copyAnondist "/etc/resolv.conf"
|
||||
copyAnondist "/etc/hosts"
|
||||
copyAnondist "/etc/hostname"
|
||||
|
||||
# Replace IP addresses in known configuration files / scripts to
|
||||
# currently discovered one
|
||||
/usr/lib/whonix/replace-ips
|
||||
|
||||
# Make sure hostname is correct
|
||||
/bin/hostname host
|
||||
|
||||
# Start Whonix Firewall
|
||||
if [ "${WHONIX}" == "gateway" ]; then
|
||||
export INT_IF="vif+"
|
||||
export INT_TIF="vif+"
|
||||
fi
|
||||
}
|
||||
|
||||
# Make sure all .anondist files in list are immutable
|
||||
immutableFilesEnable "${IMMUTABLE_FILES}"
|
||||
immutableFilesEnable "${IMMUTABLE_FILES}" ".anondist"
|
||||
|
||||
# Make sure we are using a copy of the annondist file and if not
|
||||
# copy the annondist file and set it immutable
|
||||
copyAnondist "/etc/resolv.conf"
|
||||
copyAnondist "/etc/hosts"
|
||||
copyAnondist "/etc/hostname"
|
||||
|
||||
# Replace IP addresses in known configuration files / scripts to
|
||||
# currently discovered one
|
||||
/usr/lib/whonix/replace-ips
|
||||
|
||||
# Make sure hostname is correct
|
||||
/bin/hostname host
|
||||
|
||||
# Start Whonix Firewall
|
||||
export INT_IF="vif+"
|
||||
export INT_TIF="vif+"
|
||||
/usr/bin/whonix_firewall
|
||||
/usr/bin/whonix_firewall
|
||||
|
||||
# Route any traffic FROM netvm TO netvm BACK-TO localhost
|
||||
# Allows localhost access to tor network
|
||||
iptables -t nat -A OUTPUT -s ${ip} -d ${ip} -j DNAT --to-destination 127.0.0.1
|
||||
|
||||
# Will only enable / disable if service is not already in that state
|
||||
enable_sysv() {
|
||||
servicename=${1}
|
||||
disable=${2-0}
|
||||
|
||||
# Check to see if the service is already enabled and if not, enable it
|
||||
string="/etc/rc$(runlevel | awk '{ print $2 }').d/S[0-9][0-9]${servicename}"
|
||||
|
||||
if [ $(find $string 2>/dev/null | wc -l) -eq ${disable} ] ; then
|
||||
case ${disable} in
|
||||
0)
|
||||
echo "${1} is currently disabled; enabling it"
|
||||
systemctl --quiet enable ${servicename}
|
||||
;;
|
||||
1)
|
||||
echo "${1} is currently enabled; disabling it"
|
||||
systemctl --quiet disable ${servicename}
|
||||
;;
|
||||
esac
|
||||
if [ "${WHONIX}" == "gateway" ]; then
|
||||
# Route any traffic FROM netvm TO netvm BACK-TO localhost
|
||||
# Allows localhost access to tor network
|
||||
iptables -t nat -A OUTPUT -s ${ip} -d ${ip} -j DNAT --to-destination 127.0.0.1
|
||||
fi
|
||||
}
|
||||
|
||||
disable_sysv() {
|
||||
enable_sysv ${1} 1
|
||||
}
|
||||
|
||||
# This would be a really good place to apply any hacks required and remove them
|
||||
# from template build script
|
||||
grep "^DisableNetwork 0$" /etc/tor/torrc && {
|
||||
#enable_sysv tor
|
||||
#enable_sysv whonixcheck
|
||||
#enable_sysv sdwdate
|
||||
:
|
||||
} || {
|
||||
:
|
||||
}
|
||||
# Make sure we remove whonixsetup.done if Tor is not enabled
|
||||
# to allow choice of repo and prevent whonixcheck errors
|
||||
grep "^DisableNetwork 0$" /etc/tor/torrc || {
|
||||
rm -f /var/lib/whonix/do_once/whonixsetup.done
|
||||
}
|
||||
fi
|
||||
|
||||
@ -0,0 +1,95 @@
|
||||
#!/bin/bash
|
||||
|
||||
. /usr/lib/whonix/utility_functions
|
||||
|
||||
#sed -i 's/^DisableNetwork 0/#DisableNetwork 0/g' "/etc/tor/torrc"
|
||||
#disable_sysv tor
|
||||
#disable_sysv sdwdate
|
||||
|
||||
iptables -F
|
||||
iptables -t nat -F
|
||||
|
||||
LOG_IP4=1
|
||||
LOG_IP6=0
|
||||
|
||||
# for IPv4
|
||||
if [ "$LOG_IP4" == "1" ]; then
|
||||
iptables -t raw -A OUTPUT -p icmp -j TRACE
|
||||
iptables -t raw -A PREROUTING -p icmp -j TRACE
|
||||
modprobe ipt_LOG
|
||||
fi
|
||||
|
||||
# for IPv6
|
||||
if [ "$LOG_IP6" == "1" ]; then
|
||||
ip6tables -t raw -A OUTPUT -p icmpv6 --icmpv6-type echo-request -j TRACE
|
||||
ip6tables -t raw -A OUTPUT -p icmpv6 --icmpv6-type echo-reply -j TRACE
|
||||
ip6tables -t raw -A PREROUTING -p icmpv6 --icmpv6-type echo-request -j TRACE
|
||||
ip6tables -t raw -A PREROUTING -p icmpv6 --icmpv6-type echo-reply -j TRACE
|
||||
modprobe ip6t_LOG
|
||||
fi
|
||||
|
||||
sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
iptables -A FORWARD -i eth0 -j ACCEPT
|
||||
iptables -A FORWARD -o eth0 -j ACCEPT
|
||||
iptables -A FORWARD -i lo -j ACCEPT
|
||||
iptables -A FORWARD -o lo -j ACCEPT
|
||||
|
||||
#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||
|
||||
#iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp -s 10.137.255.254 --sport 8082 -j DNAT --to-destination 127.0.0.1:9105
|
||||
#iptables -t nat -A OUTPUT -p tcp -s 10.137.2.1 --sport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp -d 10.137.2.1 --dport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp --dport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp --sport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 10.137.255.254:8082
|
||||
|
||||
|
||||
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 9105 -j DNAT --to 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -i lo -p tcp --dport 9105 -j DNAT --to 10.137.255.254:8082
|
||||
|
||||
#iptables -t nat -A INPUT -i vif+ -p tcp --dport 8082 -j ACCEPT"
|
||||
#iptables -t nat -A PR-QBS-SERVICES -i vif+ -d 10.137.255.254 -p tcp --dport 8082 -j REDIRECT"
|
||||
|
||||
#iptables -t nat -A OUTPUT -o eth0 -p tcp --dport 9105 -j ACCEPT
|
||||
#iptables -t nat -A OUTPUT -o lo -p tcp --dport 9105 -j ACCEPT
|
||||
#iptables -t nat -A PREROUTING -i lo -d 10.137.255.254 -p tcp --dport 8082 -j REDIRECT
|
||||
#iptables -t nat -A PREROUTING -i eth0 -d 10.137.255.254 -p tcp --dport 8082 -j REDIRECT
|
||||
#iptables -t nat -A PREROUTING -i lo -p tcp --dport 9105 -j REDIRECT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -p tcp --dport 8082 -i eth0 -j DNAT --to 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -p tcp -i eth0 -j DNAT --to 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -p tcp -i lo -j DNAT --to 10.137.255.254:8082
|
||||
|
||||
#iptables -t nat -A OUTPUT -p tcp -s 10.137.2.1 --sport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 --dport 8082 -j DNAT --to-destination 10.137.255.254:8082
|
||||
|
||||
#iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 --dport 8082 -j DNAT --to-destination 10.137.255.254
|
||||
#iptables -t nat -A PREROUTING -p tcp -d 10.137.2.21 --dport 8082 -j DNAT --to-destination 10.137.255.254
|
||||
#iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 8082 -j DNAT --to-destination 10.137.255.254
|
||||
#iptables -t nat -A OUTPUT -p tcp -d 10.137.2.21 --dport 8082 -j DNAT --to-destination 10.137.255.254
|
||||
|
||||
# Works
|
||||
# localhost/loopback maps localhost port 8082 to localhost port 8888
|
||||
#iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 8082 -j REDIRECT --to-ports 8888
|
||||
|
||||
# iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 8082 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING --dst 127.0.0.1 -p tcp --dport 8082 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING --dst 10.137.2.1 -p udp --dport 53 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p udp -d 10.137.2.1 --dport 52 -j DNAT --to-destination 10.137.255.254:8082
|
||||
|
||||
# Remap ALL traffic
|
||||
#iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p udp -j DNAT --to-destination 10.137.255.254:8082
|
||||
|
||||
|
||||
#iptables -t nat -A PREROUTING --dst 10.137.2.1 -p udp --dport 53 -j REDIRECT --to-port 9105
|
||||
#iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 53 -j REDIRECT --to-ports 9105
|
||||
#iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 53 -j REDIRECT --to-ports 9105
|
||||
|
||||
#iptables -v -L
|
||||
#iptables -v -t nat -L
|
||||
#telnet 127.0.0.1 9105
|
||||
#telnet 10.137.2.1 8082
|
||||
#telnet 127.0.0.1 8082
|
||||
#tail -100 /var/log/kern.log
|
||||
@ -0,0 +1,94 @@
|
||||
#!/bin/bash
|
||||
|
||||
# /etc/uwt.d/50_uwt_default relies on this in order to allow connection
|
||||
# to proxy for template
|
||||
PROXY_SERVER="http://10.137.255.254:8082/"
|
||||
PROXY_META='<meta name=\"application-name\" content=\"tor proxy\"\/>'
|
||||
|
||||
if [ -f "/var/run/qubes-service/updates-proxy-setup" ]; then
|
||||
WHONIX="template"
|
||||
elif [ -f "/usr/share/anon-gw-base-files/gateway" ]; then
|
||||
WHONIX="gateway"
|
||||
elif [ -f "/usr/share/anon-ws-base-files/workstation" ]; then
|
||||
WHONIX="workstation"
|
||||
else
|
||||
WHONIX="unknown"
|
||||
fi
|
||||
|
||||
if [ "${WHONIX}" == "template" ]; then
|
||||
curl.anondist-orig "${PROXY_SERVER}" | grep -q "${PROXY_META}" && {
|
||||
PROXY_SECURE=1
|
||||
} || {
|
||||
PROXY_SECURE=0
|
||||
}
|
||||
fi
|
||||
|
||||
immutableFilesEnable() {
|
||||
files="${1}"
|
||||
suffix="${2}"
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "${file}" ] && ! [ -L "${file}" ]; then
|
||||
sudo chattr +i "${file}${suffix}"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
immutableFilesDisable() {
|
||||
files="${1}"
|
||||
suffix="${2}"
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "${file}" ] && ! [ -L "${file}" ]; then
|
||||
sudo chattr -i "${file}${suffix}"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
copyAnondist() {
|
||||
file="${1}"
|
||||
suffix="${2-.anondist}"
|
||||
|
||||
# Remove any softlinks first
|
||||
if [ -L "${file}" ]; then
|
||||
sudo rm -f "${file}"
|
||||
fi
|
||||
|
||||
if [ -f "${file}" ] && [ -n "$(diff ${file} ${file}${suffix})" ]; then
|
||||
sudo chattr -i "${file}"
|
||||
sudo rm -f "${file}"
|
||||
sudo cp -p "${file}${suffix}" "${file}"
|
||||
sudo chattr +i "${file}"
|
||||
elif ! [ -f "${file}" ]; then
|
||||
sudo cp -p "${file}${suffix}" "${file}"
|
||||
sudo chattr +i "${file}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Will only enable / disable if service is not already in that state
|
||||
enable_sysv() {
|
||||
servicename=${1}
|
||||
disable=${2-0}
|
||||
|
||||
# Check to see if the service is already enabled and if not, enable it
|
||||
string="/etc/rc$(runlevel | awk '{ print $2 }').d/S[0-9][0-9]${servicename}"
|
||||
|
||||
if [ $(find $string 2>/dev/null | wc -l) -eq ${disable} ] ; then
|
||||
case ${disable} in
|
||||
0)
|
||||
echo "${1} is currently disabled; enabling it"
|
||||
sudo systemctl --quiet enable ${servicename}
|
||||
;;
|
||||
1)
|
||||
echo "${1} is currently enabled; disabling it"
|
||||
sudo service ${servicename} stop
|
||||
sudo systemctl --quiet disable ${servicename}
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
disable_sysv() {
|
||||
enable_sysv ${1} 1
|
||||
}
|
||||
|
||||
@ -0,0 +1,6 @@
|
||||
|
||||
. /usr/lib/whonix/utility_functions
|
||||
|
||||
if [ "${WHONIX}" == "template" -a "${PROXY_SECURE}" == "1" ]; then
|
||||
uwtwrapper["/usr/bin/apt-get"]="0"
|
||||
fi
|
||||
@ -1,41 +0,0 @@
|
||||
################################################################################
|
||||
# Pre Fixups
|
||||
sudo mkdir -p /boot/grub2
|
||||
sudo touch /boot/grub2/grub.cfg
|
||||
sudo mkdir -p /boot/grub
|
||||
sudo touch /boot/grub/grub.cfg
|
||||
sudo mkdir --parents --mode=g+rw "/tmp/uwt"
|
||||
|
||||
# Whonix seems to re-install sysvinit even though there is a hold
|
||||
# on the package. Things seem to work anyway. BUT hopfully the
|
||||
# hold on grub* don't get removed
|
||||
sudo apt-mark hold sysvinit
|
||||
sudo apt-mark hold grub-pc grub-pc-bin grub-common grub2-common
|
||||
|
||||
# Whonix expects haveged to be started
|
||||
sudo /etc/init.d/haveged start
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Link our build steps into Whonix build directory
|
||||
# ------------------------------------------------------------------------------
|
||||
#pushd /home/user/Whonix/build-steps.d
|
||||
#cp -pf /home/user/build-steps.d/* .
|
||||
#popd
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Whonix installation
|
||||
# ------------------------------------------------------------------------------
|
||||
export WHONIX_BUILD_UNATTENDED_PKG_INSTALL="1"
|
||||
|
||||
pushd ~/Whonix
|
||||
sudo ~/Whonix/whonix_build \
|
||||
--build $1 \
|
||||
--64bit-linux \
|
||||
--current-sources \
|
||||
--enable-whonix-apt-repository \
|
||||
--whonix-apt-repository-distribution $2 \
|
||||
--install-to-root \
|
||||
--skip-verifiable \
|
||||
--minimal-report \
|
||||
--skip-sanity-tests || { exit 1; }
|
||||
popd
|
||||
@ -0,0 +1,90 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
#
|
||||
# Copyright 2014 Jason Mehring (nrgaway@gmail.com)
|
||||
#
|
||||
|
||||
from PyQt4 import QtGui
|
||||
import locale
|
||||
import yaml
|
||||
|
||||
DEFAULT_LANG = 'en'
|
||||
|
||||
class Messages():
|
||||
filename = None
|
||||
data = None
|
||||
language = DEFAULT_LANG
|
||||
title = None
|
||||
icon = None
|
||||
message = None
|
||||
|
||||
def __init__(self, section, filename):
|
||||
self.filename = filename
|
||||
|
||||
language = locale.getdefaultlocale()[0].split('_')[0]
|
||||
if language:
|
||||
self.language = language
|
||||
|
||||
try:
|
||||
stream = file(filename, 'r')
|
||||
data = yaml.load(stream)
|
||||
|
||||
if section in data.keys():
|
||||
section = data[section]
|
||||
|
||||
self.icon = section.get('icon', None)
|
||||
|
||||
language = section.get(self.language, DEFAULT_LANG)
|
||||
|
||||
self.title = language.get('title', None)
|
||||
self.message = language.get('message', None)
|
||||
|
||||
except (IOError):
|
||||
pass
|
||||
except (yaml.scanner.ScannerError, yaml.parser.ParserError):
|
||||
pass
|
||||
|
||||
class WhonixMessageBox(QtGui.QMessageBox):
|
||||
def __init__(self, message):
|
||||
super(WhonixMessageBox, self).__init__()
|
||||
self.message = message
|
||||
self.initUI()
|
||||
|
||||
def initUI(self):
|
||||
message = self.message
|
||||
|
||||
if message.title:
|
||||
self.setWindowTitle(message.title)
|
||||
|
||||
if message.icon:
|
||||
self.setIcon(getattr(QtGui.QMessageBox, message.icon))
|
||||
|
||||
if message.message:
|
||||
self.setText(message.message)
|
||||
self.exec_()
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description='Display a QT Message Box')
|
||||
|
||||
parser.add_argument('section', help="Message section")
|
||||
parser.add_argument('filename', help="File including full path")
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
if not args.filename and args.section:
|
||||
print parser.usage()
|
||||
sys.exit(1)
|
||||
|
||||
app = QtGui.QApplication(sys.argv)
|
||||
|
||||
message = Messages(args.section, args.filename)
|
||||
dialog = WhonixMessageBox(message)
|
||||
sys.exit()
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@ -0,0 +1,12 @@
|
||||
|
||||
update:
|
||||
icon: Critical
|
||||
en:
|
||||
title: Tor netvm required for updates
|
||||
message: |
|
||||
<p><B>Tor netvm required for updates!</B></p>
|
||||
<p>Please ensure your template vm has a Whonix gateway as it's VM.</p>
|
||||
<p>No updates are possible without an active (running) Whonix gateway VM.</p>
|
||||
<p/>
|
||||
<p><b>Template will now power off</b></p>
|
||||
|
||||
@ -0,0 +1,46 @@
|
||||
#!/bin/bash
|
||||
|
||||
. /usr/lib/whonix/utility_functions
|
||||
|
||||
if [ "${WHONIX}" == "gateway" ]; then
|
||||
grep "^DisableNetwork 0$" /etc/tor/torrc || {
|
||||
sudo service sdwdate restart
|
||||
sudo service tor stop
|
||||
sudo /usr/bin/whonixsetup && {
|
||||
enable_sysv tor
|
||||
sleep 1
|
||||
enable_sysv sdwdate
|
||||
} || {
|
||||
sed -i 's/^DisableNetwork 0/#DisableNetwork 0/g' "/etc/tor/torrc"
|
||||
disable_sysv tor
|
||||
disable_sysv sdwdate
|
||||
sudo /sbin/poweroff
|
||||
}
|
||||
}
|
||||
|
||||
# Allow whonix-gateway to act as an update-proxy
|
||||
sudo systemctl status qubes-updates-proxy.service || {
|
||||
error_file="/usr/share/tinyproxy/default.html"
|
||||
|
||||
# Search and replace tinyproxy error files so we can inject code that
|
||||
# we can use to identify that its a tor proxy so updates are secure
|
||||
grep -q "${PROXY_META}" "${error_file}" || {
|
||||
sudo sed -i "s/<\/head>/${PROXY_META}\n<\/head>/" "${error_file}"
|
||||
}
|
||||
|
||||
sudo touch /var/run/qubes-service/qubes-updates-proxy
|
||||
sudo iptables -t nat -N PR-QBS-SERVICES
|
||||
sudo systemctl start qubes-updates-proxy.service
|
||||
}
|
||||
|
||||
elif [ "${WHONIX}" == "workstation" ]; then
|
||||
if ! [ -f "/var/lib/whonix/do_once/whonixsetup.done" ]; then
|
||||
enable_sysv sdwdate
|
||||
sudo service sdwdate restart
|
||||
sudo /usr/bin/whonixsetup
|
||||
fi
|
||||
|
||||
elif [ "${WHONIX}" == "template" -a "${PROXY_SECURE}" == "0" ]; then
|
||||
/usr/lib/whonix/alert update /usr/lib/whonix/messages.yaml
|
||||
sudo /sbin/poweroff
|
||||
fi
|
||||
@ -1,70 +1,78 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Files that will have the immutable bit set
|
||||
# since we don't want them modified by other programs
|
||||
IMMUTABLE_FILES=(
|
||||
'/etc/hostname'
|
||||
'/etc/hosts'
|
||||
)
|
||||
. /usr/lib/whonix/utility_functions
|
||||
|
||||
immutableFilesEnable() {
|
||||
files="${1}"
|
||||
suffix="${2}"
|
||||
if [ "${WHONIX}" == "gateway" ]; then
|
||||
if [ -x /usr/sbin/xenstore-read ]; then
|
||||
XENSTORE_READ="/usr/sbin/xenstore-read"
|
||||
else
|
||||
XENSTORE_READ="/usr/bin/xenstore-read"
|
||||
fi
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "${file}" ] && ! [ -L "${file}" ]; then
|
||||
chattr +i "${file}${suffix}"
|
||||
fi
|
||||
done
|
||||
}
|
||||
INTERFACE="eth1"
|
||||
ip=$(${XENSTORE_READ} qubes-netvm-gateway 2> /dev/null)
|
||||
|
||||
immutableFilesDisable() {
|
||||
files="${1}"
|
||||
suffix="${2}"
|
||||
# Create a dummy eth1 interface so tor can bind to it if there
|
||||
# are no DOMU virtual machines connected at the moment
|
||||
ip link show ${INTERFACE} >> /dev/null || {
|
||||
/sbin/ip link add ${INTERFACE} type dummy
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "${file}" ] && ! [ -L "${file}" ]; then
|
||||
chattr -i "${file}${suffix}"
|
||||
# Now, assign it the netvm-gateway IP address
|
||||
if [ x${ip} != x ]; then
|
||||
netmask=$(${XENSTORE_READ} qubes-netvm-netmask)
|
||||
gateway=$(${XENSTORE_READ} qubes-netvm-gateway)
|
||||
/sbin/ifconfig ${INTERFACE} ${ip} netmask 255.255.255.255
|
||||
/sbin/ifconfig ${INTERFACE} up
|
||||
/sbin/ethtool -K ${INTERFACE} sg off || true
|
||||
/sbin/ethtool -K ${INTERFACE} tx off || true
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
copyAnondist() {
|
||||
file="${1}"
|
||||
suffix="${2-.anondist}"
|
||||
ip link set ${INTERFACE} up
|
||||
}
|
||||
fi
|
||||
|
||||
# Remove any softlinks first
|
||||
if [ -L "${file}" ]; then
|
||||
rm -f "${file}"
|
||||
fi
|
||||
if [ "${WHONIX}" != "template" ]; then
|
||||
# Files that will have the immutable bit set
|
||||
# since we don't want them modified by other programs
|
||||
IMMUTABLE_FILES=(
|
||||
'/etc/resolv.conf'
|
||||
'/etc/hostname'
|
||||
'/etc/hosts'
|
||||
)
|
||||
|
||||
if [ -f "${file}" ] && [ -n "$(diff ${file} ${file}${suffix})" ]; then
|
||||
chattr -i "${file}"
|
||||
rm -f "${file}"
|
||||
cp -p "${file}${suffix}" "${file}"
|
||||
chattr +i "${file}"
|
||||
elif ! [ -f "${file}" ]; then
|
||||
cp -p "${file}${suffix}" "${file}"
|
||||
chattr +i "${file}"
|
||||
fi
|
||||
}
|
||||
# Make sure all .anondist files in list are immutable
|
||||
immutableFilesEnable "${IMMUTABLE_FILES}"
|
||||
immutableFilesEnable "${IMMUTABLE_FILES}" ".anondist"
|
||||
|
||||
# Make sure all .anondist files in list are immutable
|
||||
immutableFilesEnable "${IMMUTABLE_FILES}"
|
||||
immutableFilesEnable "${IMMUTABLE_FILES}" ".anondist"
|
||||
# Make sure we are using a copy of the annondist file and if not
|
||||
# copy the annondist file and set it immutable
|
||||
copyAnondist "/etc/resolv.conf"
|
||||
copyAnondist "/etc/hosts"
|
||||
copyAnondist "/etc/hostname"
|
||||
|
||||
# Make sure we are using a copy of the annondist file and if not
|
||||
# copy the annondist file and set it immutable
|
||||
copyAnondist "/etc/hosts"
|
||||
copyAnondist "/etc/hostname"
|
||||
# Replace IP addresses in known configuration files / scripts to
|
||||
# currently discovered one
|
||||
/usr/lib/whonix/replace-ips
|
||||
|
||||
# Replace IP addresses in known configuration files / scripts to
|
||||
# currently discovered one
|
||||
/usr/lib/whonix/replace-ips
|
||||
# Make sure hostname is correct
|
||||
/bin/hostname host
|
||||
|
||||
# Make sure hostname is correct
|
||||
/bin/hostname host
|
||||
# Start Whonix Firewall
|
||||
if [ "${WHONIX}" == "gateway" ]; then
|
||||
export INT_IF="vif+"
|
||||
export INT_TIF="vif+"
|
||||
fi
|
||||
/usr/bin/whonix_firewall
|
||||
|
||||
# Start Whonix Firewall
|
||||
/usr/bin/whonix_firewall
|
||||
if [ "${WHONIX}" == "gateway" ]; then
|
||||
# Route any traffic FROM netvm TO netvm BACK-TO localhost
|
||||
# Allows localhost access to tor network
|
||||
iptables -t nat -A OUTPUT -s ${ip} -d ${ip} -j DNAT --to-destination 127.0.0.1
|
||||
fi
|
||||
|
||||
# Make sure we remove whonixsetup.done if Tor is not enabled
|
||||
# to allow choice of repo and prevent whonixcheck errors
|
||||
grep "^DisableNetwork 0$" /etc/tor/torrc || {
|
||||
rm -f /var/lib/whonix/do_once/whonixsetup.done
|
||||
}
|
||||
fi
|
||||
|
||||
@ -0,0 +1,95 @@
|
||||
#!/bin/bash
|
||||
|
||||
. /usr/lib/whonix/utility_functions
|
||||
|
||||
#sed -i 's/^DisableNetwork 0/#DisableNetwork 0/g' "/etc/tor/torrc"
|
||||
#disable_sysv tor
|
||||
#disable_sysv sdwdate
|
||||
|
||||
iptables -F
|
||||
iptables -t nat -F
|
||||
|
||||
LOG_IP4=1
|
||||
LOG_IP6=0
|
||||
|
||||
# for IPv4
|
||||
if [ "$LOG_IP4" == "1" ]; then
|
||||
iptables -t raw -A OUTPUT -p icmp -j TRACE
|
||||
iptables -t raw -A PREROUTING -p icmp -j TRACE
|
||||
modprobe ipt_LOG
|
||||
fi
|
||||
|
||||
# for IPv6
|
||||
if [ "$LOG_IP6" == "1" ]; then
|
||||
ip6tables -t raw -A OUTPUT -p icmpv6 --icmpv6-type echo-request -j TRACE
|
||||
ip6tables -t raw -A OUTPUT -p icmpv6 --icmpv6-type echo-reply -j TRACE
|
||||
ip6tables -t raw -A PREROUTING -p icmpv6 --icmpv6-type echo-request -j TRACE
|
||||
ip6tables -t raw -A PREROUTING -p icmpv6 --icmpv6-type echo-reply -j TRACE
|
||||
modprobe ip6t_LOG
|
||||
fi
|
||||
|
||||
sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
iptables -A FORWARD -i eth0 -j ACCEPT
|
||||
iptables -A FORWARD -o eth0 -j ACCEPT
|
||||
iptables -A FORWARD -i lo -j ACCEPT
|
||||
iptables -A FORWARD -o lo -j ACCEPT
|
||||
|
||||
#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||
|
||||
#iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp -s 10.137.255.254 --sport 8082 -j DNAT --to-destination 127.0.0.1:9105
|
||||
#iptables -t nat -A OUTPUT -p tcp -s 10.137.2.1 --sport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp -d 10.137.2.1 --dport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp --dport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp --sport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 10.137.255.254:8082
|
||||
|
||||
|
||||
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 9105 -j DNAT --to 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -i lo -p tcp --dport 9105 -j DNAT --to 10.137.255.254:8082
|
||||
|
||||
#iptables -t nat -A INPUT -i vif+ -p tcp --dport 8082 -j ACCEPT"
|
||||
#iptables -t nat -A PR-QBS-SERVICES -i vif+ -d 10.137.255.254 -p tcp --dport 8082 -j REDIRECT"
|
||||
|
||||
#iptables -t nat -A OUTPUT -o eth0 -p tcp --dport 9105 -j ACCEPT
|
||||
#iptables -t nat -A OUTPUT -o lo -p tcp --dport 9105 -j ACCEPT
|
||||
#iptables -t nat -A PREROUTING -i lo -d 10.137.255.254 -p tcp --dport 8082 -j REDIRECT
|
||||
#iptables -t nat -A PREROUTING -i eth0 -d 10.137.255.254 -p tcp --dport 8082 -j REDIRECT
|
||||
#iptables -t nat -A PREROUTING -i lo -p tcp --dport 9105 -j REDIRECT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -p tcp --dport 8082 -i eth0 -j DNAT --to 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -p tcp -i eth0 -j DNAT --to 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -p tcp -i lo -j DNAT --to 10.137.255.254:8082
|
||||
|
||||
#iptables -t nat -A OUTPUT -p tcp -s 10.137.2.1 --sport 9105 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 --dport 8082 -j DNAT --to-destination 10.137.255.254:8082
|
||||
|
||||
#iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 --dport 8082 -j DNAT --to-destination 10.137.255.254
|
||||
#iptables -t nat -A PREROUTING -p tcp -d 10.137.2.21 --dport 8082 -j DNAT --to-destination 10.137.255.254
|
||||
#iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 8082 -j DNAT --to-destination 10.137.255.254
|
||||
#iptables -t nat -A OUTPUT -p tcp -d 10.137.2.21 --dport 8082 -j DNAT --to-destination 10.137.255.254
|
||||
|
||||
# Works
|
||||
# localhost/loopback maps localhost port 8082 to localhost port 8888
|
||||
#iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 8082 -j REDIRECT --to-ports 8888
|
||||
|
||||
# iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 8082 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING --dst 127.0.0.1 -p tcp --dport 8082 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A PREROUTING --dst 10.137.2.1 -p udp --dport 53 -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p udp -d 10.137.2.1 --dport 52 -j DNAT --to-destination 10.137.255.254:8082
|
||||
|
||||
# Remap ALL traffic
|
||||
#iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 10.137.255.254:8082
|
||||
#iptables -t nat -A OUTPUT -p udp -j DNAT --to-destination 10.137.255.254:8082
|
||||
|
||||
|
||||
#iptables -t nat -A PREROUTING --dst 10.137.2.1 -p udp --dport 53 -j REDIRECT --to-port 9105
|
||||
#iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 53 -j REDIRECT --to-ports 9105
|
||||
#iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 53 -j REDIRECT --to-ports 9105
|
||||
|
||||
#iptables -v -L
|
||||
#iptables -v -t nat -L
|
||||
#telnet 127.0.0.1 9105
|
||||
#telnet 10.137.2.1 8082
|
||||
#telnet 127.0.0.1 8082
|
||||
#tail -100 /var/log/kern.log
|
||||
@ -0,0 +1,94 @@
|
||||
#!/bin/bash
|
||||
|
||||
# /etc/uwt.d/50_uwt_default relies on this in order to allow connection
|
||||
# to proxy for template
|
||||
PROXY_SERVER="http://10.137.255.254:8082/"
|
||||
PROXY_META='<meta name=\"application-name\" content=\"tor proxy\"\/>'
|
||||
|
||||
if [ -f "/var/run/qubes-service/updates-proxy-setup" ]; then
|
||||
WHONIX="template"
|
||||
elif [ -f "/usr/share/anon-gw-base-files/gateway" ]; then
|
||||
WHONIX="gateway"
|
||||
elif [ -f "/usr/share/anon-ws-base-files/workstation" ]; then
|
||||
WHONIX="workstation"
|
||||
else
|
||||
WHONIX="unknown"
|
||||
fi
|
||||
|
||||
if [ "${WHONIX}" == "template" ]; then
|
||||
curl.anondist-orig "${PROXY_SERVER}" | grep -q "${PROXY_META}" && {
|
||||
PROXY_SECURE=1
|
||||
} || {
|
||||
PROXY_SECURE=0
|
||||
}
|
||||
fi
|
||||
|
||||
immutableFilesEnable() {
|
||||
files="${1}"
|
||||
suffix="${2}"
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "${file}" ] && ! [ -L "${file}" ]; then
|
||||
sudo chattr +i "${file}${suffix}"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
immutableFilesDisable() {
|
||||
files="${1}"
|
||||
suffix="${2}"
|
||||
|
||||
for file in "${files[@]}"; do
|
||||
if [ -f "${file}" ] && ! [ -L "${file}" ]; then
|
||||
sudo chattr -i "${file}${suffix}"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
copyAnondist() {
|
||||
file="${1}"
|
||||
suffix="${2-.anondist}"
|
||||
|
||||
# Remove any softlinks first
|
||||
if [ -L "${file}" ]; then
|
||||
sudo rm -f "${file}"
|
||||
fi
|
||||
|
||||
if [ -f "${file}" ] && [ -n "$(diff ${file} ${file}${suffix})" ]; then
|
||||
sudo chattr -i "${file}"
|
||||
sudo rm -f "${file}"
|
||||
sudo cp -p "${file}${suffix}" "${file}"
|
||||
sudo chattr +i "${file}"
|
||||
elif ! [ -f "${file}" ]; then
|
||||
sudo cp -p "${file}${suffix}" "${file}"
|
||||
sudo chattr +i "${file}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Will only enable / disable if service is not already in that state
|
||||
enable_sysv() {
|
||||
servicename=${1}
|
||||
disable=${2-0}
|
||||
|
||||
# Check to see if the service is already enabled and if not, enable it
|
||||
string="/etc/rc$(runlevel | awk '{ print $2 }').d/S[0-9][0-9]${servicename}"
|
||||
|
||||
if [ $(find $string 2>/dev/null | wc -l) -eq ${disable} ] ; then
|
||||
case ${disable} in
|
||||
0)
|
||||
echo "${1} is currently disabled; enabling it"
|
||||
sudo systemctl --quiet enable ${servicename}
|
||||
;;
|
||||
1)
|
||||
echo "${1} is currently enabled; disabling it"
|
||||
sudo service ${servicename} stop
|
||||
sudo systemctl --quiet disable ${servicename}
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
disable_sysv() {
|
||||
enable_sysv ${1} 1
|
||||
}
|
||||
|
||||
Loading…
Reference in new issue