34 lines
793 B
Plaintext
34 lines
793 B
Plaintext
|
#!/bin/bash
|
||
|
|
set -e
|
||
|
|
|
||
|
|
PIDFILE=/var/run/qubes/qubes_firewall.pid
|
||
|
|
XENSTORE_IPTABLES=qubes_iptables
|
||
|
|
XENSTORE_ERROR=qubes_iptables_error
|
||
|
|
OLD_RULES=""
|
||
|
|
|
||
|
|
# PIDfile handling
|
||
|
|
[[ -e $PIDFILE ]] && kill -s 0 $(<$PIDFILE) 2>/dev/null && exit 0
|
||
|
|
echo $$ >$PIDFILE
|
||
|
|
|
||
|
|
trap 'exit 0' SIGTERM
|
||
|
|
|
||
|
|
while true; do
|
||
|
|
RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES)
|
||
|
|
|
||
|
|
if [[ "$RULES" != "$OLD_RULES" ]]; then
|
||
|
|
IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d')
|
||
|
|
OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || :`
|
||
|
|
/usr/bin/xenstore-write $XENSTORE_ERROR "$OUT"
|
||
|
|
|
||
|
|
if [[ -z "$OUT" ]]; then
|
||
|
|
# If OK save it for later
|
||
|
|
/sbin/service iptables save >/dev/null
|
||
|
|
fi
|
||
|
|
|
||
|
|
OLD_RULES="$RULES"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Wait for changes in xenstore file
|
||
|
|
/usr/bin/xenstore-watch $XENSTORE_IPTABLES
|
||
|
|
done
|