Test and document hooking TCP connection into qrexec using socat

[andrewdavidwong]

On 2016-07-03 11:29, Marek Marczykowski-Górecki wrote:

It should be easy to hook any TCP connection into qrexec using socat.

Something like this (untested):

source VM: launch this somewhere (/rw/config/rc.local?)

socat TCP-LISTEN:4444,fork EXEC:"qrexec-client-vm target-vm my-tcp-service"

target VM: /usr/local/etc/qubes-rpc/my-tcp-service (this is stored in /rw):

socat STDIO TCP:localhost:4444

dom0: /etc/qubes-rpc/policy/my-tcp-service

source-vm target-vm allow

[andrewdavidwong]

(This could become a tool instead of just documentation steps.)

[Joeviocoe]

https://gist.github.com/Joeviocoe/90ec9fd9a0769b4671a8ae9c87584187

[andrewdavidwong]

@Joeviocoe: Please consider submitting this as a PR to the appropriate repo. I'm afraid it'll be overlooked as just a comment with a link to a gist.

[tlaurion]

@Joeviocoe: It would be awesome if this could be merged into the Qubes Network Server project, instead of pushing files manually into qubes.

@Rudd-O made it in such way that the Firewall GUI supported an additional "from-" prepending addresses and ports. His code was applied for each machines that had assigned static ips, making a generalist solution, both interesting for UDP and TCP.

[marmarek]

Documented at https://www.qubes-os.org/doc/firewall/#opening-a-single-tcp-port-to-other-network-isolated-qube already