mirror of
https://github.com/mirage/qubes-mirage-firewall.git
synced 2024-07-03 09:31:22 +00:00
a7001a70d2
We previously assumed that Qubes would always give clients IP addresses on a particular network. However, it is not required to do this and in fact uses a different network for disposable VMs. With this change: - We no longer reject clients with unknown IP addresses - The `Unknown_client` classification is gone; we have no way to tell the difference between a client that isn't connected and an external address. - We now consider every client to be on a point-to-point link and do not answer ARP requests on behalf of other clients. Clients should assume their netmask is 255.255.255.255 (and ignore /qubes-netmask). This is a partial fix for #9. It allows disposable VMs to connect to the firewall but for some reason they don't process any frames we send them (we get their ARP requests but they don't get our replies). Taking eth0 down in the disp VM, then bringing it back up (and re-adding the routes) allows it to work.
31 lines
1014 B
OCaml
31 lines
1014 B
OCaml
(* Copyright (C) 2015, Thomas Leonard <thomas.leonard@unikernel.com>
|
|
See the README file for details. *)
|
|
|
|
(** Wrapper for XenStore and QubesDB databases. *)
|
|
|
|
open Utils
|
|
|
|
type client_vif = {
|
|
domid : int;
|
|
device_id : int;
|
|
client_ip : Ipaddr.V4.t;
|
|
}
|
|
|
|
val watch_clients : (IntSet.t -> unit) -> 'a Lwt.t
|
|
(** [watch_clients fn] calls [fn clients] with the current set of backend client domain IDs
|
|
in XenStore, and again each time the set changes. *)
|
|
|
|
val client_vifs : int -> client_vif list Lwt.t
|
|
(** [client_vif domid] is the list of network interfaces to the client VM [domid]. *)
|
|
|
|
type network_config = {
|
|
uplink_netvm_ip : Ipaddr.V4.t; (* The IP address of NetVM (our gateway) *)
|
|
uplink_our_ip : Ipaddr.V4.t; (* The IP address of our interface to NetVM *)
|
|
|
|
clients_our_ip : Ipaddr.V4.t; (* The IP address of our interface to our client VMs (their gateway) *)
|
|
}
|
|
|
|
val read_network_config : Qubes.DB.t -> network_config
|
|
|
|
val set_iptables_error : Qubes.DB.t -> string -> unit Lwt.t
|