114 lines
4.1 KiB
Bash
Executable File
114 lines
4.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================
|
|
# 07-route-appvms.sh
|
|
#
|
|
# Configure IPv6 forwarding and firewall rules in sys-fips so AppVMs routed
|
|
# through sys-fips can reach FIPS fd00::/8 addresses via fips0.
|
|
#
|
|
# Usage:
|
|
# sudo bash 07-route-appvms.sh
|
|
# ==============================================================================
|
|
set -euo pipefail
|
|
|
|
echo "=== sys-fips AppVM Routing Configuration ==="
|
|
echo ""
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "✗ This script must be run as root (sudo)"
|
|
exit 1
|
|
fi
|
|
|
|
ensure_nft_rule() {
|
|
local table="$1"
|
|
local chain="$2"
|
|
local rule="$3"
|
|
|
|
if ! nft list chain "$table" "$chain" >/dev/null 2>&1; then
|
|
echo " WARN: nft chain $table $chain not found; skipping: $rule"
|
|
return 0
|
|
fi
|
|
|
|
if nft list chain "$table" "$chain" | grep -F -- "$rule" >/dev/null 2>&1; then
|
|
return 0
|
|
fi
|
|
|
|
nft add rule "$table" "$chain" $rule
|
|
}
|
|
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null
|
|
sysctl -w net.ipv6.conf.all.proxy_ndp=1 >/dev/null 2>&1 || true
|
|
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1 || true
|
|
echo " IPv6 forwarding enabled"
|
|
|
|
if ! ip link show fips0 >/dev/null 2>&1; then
|
|
echo " WARNING: fips0 not found (start fips first)"
|
|
fi
|
|
|
|
ip -6 route replace fd00::/8 dev fips0 2>/dev/null || true
|
|
echo " route: fd00::/8 -> fips0"
|
|
|
|
# Prefer nftables (Qubes-native firewall stack)
|
|
echo " ensuring nftables forward rules"
|
|
ensure_nft_rule ip6 qubes-firewall forward 'iifname "vif*" ip6 daddr fd00::/8 accept'
|
|
ensure_nft_rule ip6 qubes-firewall forward 'iifname "fips0" ip6 saddr fd00::/8 accept'
|
|
|
|
# Keep ip6tables fallback for templates where FORWARD policy still depends on it.
|
|
if command -v ip6tables >/dev/null 2>&1; then
|
|
ip6tables -C FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
|
|
ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
ip6tables -C FORWARD -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null || \
|
|
ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT
|
|
ip6tables -C FORWARD -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null || \
|
|
ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT
|
|
echo " ip6tables forwarding fallback ensured"
|
|
fi
|
|
|
|
RCLOCAL="/rw/config/rc.local"
|
|
MARK_START="# === SYS-FIPS ROUTING START ==="
|
|
MARK_END="# === SYS-FIPS ROUTING END ==="
|
|
|
|
if [ ! -f "$RCLOCAL" ]; then
|
|
mkdir -p /rw/config
|
|
cat > "$RCLOCAL" << 'EOF'
|
|
#!/bin/sh
|
|
EOF
|
|
fi
|
|
|
|
sed -i "/$MARK_START/,/$MARK_END/d" "$RCLOCAL"
|
|
|
|
cat >> "$RCLOCAL" << 'EOF'
|
|
# === SYS-FIPS ROUTING START ===
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null 2>&1
|
|
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1
|
|
ip -6 route replace fd00::/8 dev fips0 >/dev/null 2>&1 || true
|
|
|
|
# nftables forward allow rules for AppVM <-> fips0 traffic
|
|
nft list chain ip6 qubes-firewall forward >/dev/null 2>&1 && \
|
|
nft list chain ip6 qubes-firewall forward | grep -F 'iifname "vif*" ip6 daddr fd00::/8 accept' >/dev/null 2>&1 || \
|
|
nft add rule ip6 qubes-firewall forward iifname "vif*" ip6 daddr fd00::/8 accept >/dev/null 2>&1 || true
|
|
|
|
nft list chain ip6 qubes-firewall forward >/dev/null 2>&1 && \
|
|
nft list chain ip6 qubes-firewall forward | grep -F 'iifname "fips0" ip6 saddr fd00::/8 accept' >/dev/null 2>&1 || \
|
|
nft add rule ip6 qubes-firewall forward iifname "fips0" ip6 saddr fd00::/8 accept >/dev/null 2>&1 || true
|
|
|
|
# ip6tables fallback
|
|
if command -v ip6tables >/dev/null 2>&1; then
|
|
ip6tables -C FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
ip6tables -C FORWARD -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT
|
|
ip6tables -C FORWARD -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null || ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT
|
|
fi
|
|
# === SYS-FIPS ROUTING END ===
|
|
EOF
|
|
|
|
chmod +x "$RCLOCAL"
|
|
|
|
echo ""
|
|
echo "Current fd00 routes:"
|
|
ip -6 route show | grep fd00 || true
|
|
|
|
echo ""
|
|
echo "✓ AppVM routing configured"
|
|
echo ""
|
|
echo "In dom0, point an AppVM at sys-fips:"
|
|
echo " qvm-prefs <appvm-name> netvm sys-fips"
|