core-agent-linux/network/qubes-netwatcher

#!/bin/sh
set -e

PIDFILE=/var/run/qubes/qubes-netwatcher.pid
CURR_NETCFG=""

# PIDfile handling
[ -e "$PIDFILE" ] && kill -s 0 $(cat "$PIDFILE") 2>/dev/null && exit 0
echo $$ >$PIDFILE

trap 'exit 0' TERM

while true; do
	NET_DOMID=$(xenstore-read qubes-netvm-domid || :)
	if [ -n "$NET_DOMID" ] && [ $NET_DOMID -gt 0 ]; then
		UNTRUSTED_NETCFG=$(xenstore-read /local/domain/$NET_DOMID/qubes-netvm-external-ip || :)
		# UNTRUSTED_NETCFG is not parsed in any way
		# thus, no sanitization ready
		# but be careful when passing it to other shell scripts
		if [ "$UNTRUSTED_NETCFG" != "$CURR_NETCFG" ]; then
			/sbin/service qubes-firewall stop
			/sbin/service qubes-firewall start
			CURR_NETCFG="$UNTRUSTED_NETCFG"
			xenstore-write qubes-netvm-external-ip "$CURR_NETCFG"
		fi

		xenstore-watch -n 3 /local/domain/$NET_DOMID/qubes-netvm-external-ip qubes-netvm-domid
	else
		xenstore-watch -n 2 qubes-netvm-domid
	fi
done