laantungir/fips_setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Hammered fips bugs

Browse Source
This commit is contained in:
Laan Tungir
2026-04-11 20:40:01 -04:00
parent a351883b67
commit a09c87ef10
10 changed files with 1214 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/02-install-fips.sh
+1 -1
View File
@@ -25,7 +25,7 @@ echo "Installing system dependencies..."
apt-get update -qq
apt-get install -y --no-install-recommends \
iproute2 iputils-ping dnsutils \
dnsmasq iptables \
dnsmasq iptables nftables \
curl python3 jq \
openssh-server openssh-client \
iperf3 2>/dev/null || {
scripts/06-configure-dns.sh
+73 -1
View File
@@ -5,6 +5,9 @@
# Configure dnsmasq in sys-fips so .fips queries are forwarded to local
# FIPS DNS resolver on 127.0.0.1:5354, and all other DNS goes upstream.
#
# Also applies Qubes-specific nftables DNS interception so AppVM DNS queries
# are forced to local dnsmasq in sys-fips.
#
# Usage:
# sudo bash 06-configure-dns.sh
# ==============================================================================
@@ -18,6 +21,23 @@ if [ "$(id -u)" -ne 0 ]; then
exit 1
fi
ensure_nft_rule() {
local table="$1"
local chain="$2"
local rule="$3"
if ! nft list chain "$table" "$chain" >/dev/null 2>&1; then
echo " WARN: nft chain $table $chain not found; skipping: $rule"
return 0
fi
if nft list chain "$table" "$chain" | grep -F -- "$rule" >/dev/null 2>&1; then
return 0
fi
nft add rule "$table" "$chain" $rule
}
systemctl stop dnsmasq 2>/dev/null || true
killall dnsmasq 2>/dev/null || true
@@ -61,7 +81,9 @@ fi
# which can reject DNS queries from downstream AppVMs in this topology.
DNSMASQ_HELPER="/usr/share/dnsmasq/systemd-helper"
if [ -f "$DNSMASQ_HELPER" ] && grep -q -- '--local-service' "$DNSMASQ_HELPER"; then
cp "$DNSMASQ_HELPER" "${DNSMASQ_HELPER}.bak"
if [ ! -f "${DNSMASQ_HELPER}.bak" ]; then
cp "$DNSMASQ_HELPER" "${DNSMASQ_HELPER}.bak"
fi
sed -i 's/--local-service//g' "$DNSMASQ_HELPER"
echo " Patched dnsmasq helper: removed --local-service for Qubes /32 compatibility"
fi
@@ -74,6 +96,56 @@ if ! pgrep -x dnsmasq >/dev/null 2>&1; then
dnsmasq
fi
echo "Applying Qubes nftables DNS interception rules..."
ensure_nft_rule ip qubes dnat-dns 'iifname "vif*" udp dport 53 dnat to 10.139.1.1:53'
ensure_nft_rule ip qubes dnat-dns 'iifname "vif*" tcp dport 53 dnat to 10.139.1.1:53'
ensure_nft_rule ip qubes custom-input 'iifname "vif*" ip daddr 10.139.1.1 udp dport 53 accept'
ensure_nft_rule ip qubes custom-input 'iifname "vif*" ip daddr 10.139.1.1 tcp dport 53 accept'
echo " nftables DNS interception ensured"
RCLOCAL="/rw/config/rc.local"
MARK_START="# === SYS-FIPS DNS START ==="
MARK_END="# === SYS-FIPS DNS END ==="
if [ ! -f "$RCLOCAL" ]; then
mkdir -p /rw/config
cat > "$RCLOCAL" << 'EOF'
#!/bin/sh
EOF
fi
sed -i "/$MARK_START/,/$MARK_END/d" "$RCLOCAL"
cat >> "$RCLOCAL" << 'EOF'
# === SYS-FIPS DNS START ===
# Keep dnsmasq alive with .fips forwarding
if [ -f /usr/share/dnsmasq/systemd-helper ]; then
sed -i 's/--local-service//g' /usr/share/dnsmasq/systemd-helper
fi
systemctl restart dnsmasq >/dev/null 2>&1 || true
pgrep -x dnsmasq >/dev/null 2>&1 || dnsmasq >/dev/null 2>&1 || true
# Qubes DNS interception for downstream AppVMs
nft list chain ip qubes dnat-dns >/dev/null 2>&1 && \
nft list chain ip qubes dnat-dns | grep -F 'iifname "vif*" udp dport 53 dnat to 10.139.1.1:53' >/dev/null 2>&1 || \
nft add rule ip qubes dnat-dns iifname "vif*" udp dport 53 dnat to 10.139.1.1:53 >/dev/null 2>&1 || true
nft list chain ip qubes dnat-dns >/dev/null 2>&1 && \
nft list chain ip qubes dnat-dns | grep -F 'iifname "vif*" tcp dport 53 dnat to 10.139.1.1:53' >/dev/null 2>&1 || \
nft add rule ip qubes dnat-dns iifname "vif*" tcp dport 53 dnat to 10.139.1.1:53 >/dev/null 2>&1 || true
nft list chain ip qubes custom-input >/dev/null 2>&1 && \
nft list chain ip qubes custom-input | grep -F 'iifname "vif*" ip daddr 10.139.1.1 udp dport 53 accept' >/dev/null 2>&1 || \
nft add rule ip qubes custom-input iifname "vif*" ip daddr 10.139.1.1 udp dport 53 accept >/dev/null 2>&1 || true
nft list chain ip qubes custom-input >/dev/null 2>&1 && \
nft list chain ip qubes custom-input | grep -F 'iifname "vif*" ip daddr 10.139.1.1 tcp dport 53 accept' >/dev/null 2>&1 || \
nft add rule ip qubes custom-input iifname "vif*" ip daddr 10.139.1.1 tcp dport 53 accept >/dev/null 2>&1 || true
# === SYS-FIPS DNS END ===
EOF
chmod +x "$RCLOCAL"
echo ""
echo "Verifying DNS..."
if dig @127.0.0.1 google.com A +short +time=2 >/dev/null 2>&1; then
scripts/07-route-appvms.sh
+56 -15
View File
@@ -2,7 +2,7 @@
# ==============================================================================
# 07-route-appvms.sh
#
# Configure IPv6 forwarding and ip6tables rules in sys-fips so AppVMs routed
# Configure IPv6 forwarding and firewall rules in sys-fips so AppVMs routed
# through sys-fips can reach FIPS fd00::/8 addresses via fips0.
#
# Usage:
@@ -18,6 +18,23 @@ if [ "$(id -u)" -ne 0 ]; then
exit 1
fi
ensure_nft_rule() {
local table="$1"
local chain="$2"
local rule="$3"
if ! nft list chain "$table" "$chain" >/dev/null 2>&1; then
echo " WARN: nft chain $table $chain not found; skipping: $rule"
return 0
fi
if nft list chain "$table" "$chain" | grep -F -- "$rule" >/dev/null 2>&1; then
return 0
fi
nft add rule "$table" "$chain" $rule
}
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null
sysctl -w net.ipv6.conf.all.proxy_ndp=1 >/dev/null 2>&1 || true
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1 || true
@@ -30,32 +47,56 @@ fi
ip -6 route replace fd00::/8 dev fips0 2>/dev/null || true
echo " route: fd00::/8 -> fips0"
# idempotent rule refresh
ip6tables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
ip6tables -D FORWARD -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null || true
ip6tables -D FORWARD -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null || true
# Prefer nftables (Qubes-native firewall stack)
echo " ensuring nftables forward rules"
ensure_nft_rule ip6 qubes-firewall forward 'iifname "vif*" ip6 daddr fd00::/8 accept'
ensure_nft_rule ip6 qubes-firewall forward 'iifname "fips0" ip6 saddr fd00::/8 accept'
ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT
ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT
echo " ip6tables forwarding rules installed"
# Keep ip6tables fallback for templates where FORWARD policy still depends on it.
if command -v ip6tables >/dev/null 2>&1; then
ip6tables -C FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -C FORWARD -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null || \
ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT
ip6tables -C FORWARD -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null || \
ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT
echo " ip6tables forwarding fallback ensured"
fi
RCLOCAL="/rw/config/rc.local"
MARK_START="# === SYS-FIPS ROUTING START ==="
MARK_END="# === SYS-FIPS ROUTING END ==="
if [ -f "$RCLOCAL" ]; then
sed -i "/$MARK_START/,/$MARK_END/d" "$RCLOCAL"
if [ ! -f "$RCLOCAL" ]; then
mkdir -p /rw/config
cat > "$RCLOCAL" << 'EOF'
#!/bin/sh
EOF
fi
sed -i "/$MARK_START/,/$MARK_END/d" "$RCLOCAL"
cat >> "$RCLOCAL" << 'EOF'
# === SYS-FIPS ROUTING START ===
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null 2>&1
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1
ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null
ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null
ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null
ip -6 route replace fd00::/8 dev fips0 >/dev/null 2>&1 || true
# nftables forward allow rules for AppVM <-> fips0 traffic
nft list chain ip6 qubes-firewall forward >/dev/null 2>&1 && \
nft list chain ip6 qubes-firewall forward | grep -F 'iifname "vif*" ip6 daddr fd00::/8 accept' >/dev/null 2>&1 || \
nft add rule ip6 qubes-firewall forward iifname "vif*" ip6 daddr fd00::/8 accept >/dev/null 2>&1 || true
nft list chain ip6 qubes-firewall forward >/dev/null 2>&1 && \
nft list chain ip6 qubes-firewall forward | grep -F 'iifname "fips0" ip6 saddr fd00::/8 accept' >/dev/null 2>&1 || \
nft add rule ip6 qubes-firewall forward iifname "fips0" ip6 saddr fd00::/8 accept >/dev/null 2>&1 || true
# ip6tables fallback
if command -v ip6tables >/dev/null 2>&1; then
ip6tables -C FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -C FORWARD -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT
ip6tables -C FORWARD -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT
fi
# === SYS-FIPS ROUTING END ===
EOF
scripts/test-connectivity.sh
+36
View File
@@ -70,6 +70,42 @@ run_local_tests() {
fail "dnsmasq not running"
fi
if command -v nft >/dev/null 2>&1; then
if nft list chain ip qubes dnat-dns >/dev/null 2>&1; then
pass "nft chain exists: ip qubes dnat-dns"
if nft list chain ip qubes dnat-dns | grep -F 'iifname "vif*" udp dport 53 dnat to 10.139.1.1:53' >/dev/null 2>&1; then
pass "nft DNS DNAT rule present (UDP 53)"
else
fail "nft DNS DNAT rule missing (UDP 53)"
fi
if nft list chain ip qubes dnat-dns | grep -F 'iifname "vif*" tcp dport 53 dnat to 10.139.1.1:53' >/dev/null 2>&1; then
pass "nft DNS DNAT rule present (TCP 53)"
else
fail "nft DNS DNAT rule missing (TCP 53)"
fi
else
skip "nft chain missing: ip qubes dnat-dns"
fi
if nft list chain ip6 qubes-firewall forward >/dev/null 2>&1; then
pass "nft chain exists: ip6 qubes-firewall forward"
if nft list chain ip6 qubes-firewall forward | grep -F 'iifname "vif*" ip6 daddr fd00::/8 accept' >/dev/null 2>&1; then
pass "nft forward rule present (vif* -> fd00::/8)"
else
fail "nft forward rule missing (vif* -> fd00::/8)"
fi
if nft list chain ip6 qubes-firewall forward | grep -F 'iifname "fips0" ip6 saddr fd00::/8 accept' >/dev/null 2>&1; then
pass "nft forward rule present (fips0 -> fd00::/8)"
else
fail "nft forward rule missing (fips0 -> fd00::/8)"
fi
else
skip "nft chain missing: ip6 qubes-firewall forward"
fi
else
skip "nft not installed"
fi
if dig @127.0.0.1 test.fips AAAA +time=2 >/dev/null 2>&1; then
pass ".fips DNS query path reachable"
else