From 8a7906a01698ef43c5f4eb6c3fe714b9e2f6e153 Mon Sep 17 00:00:00 2001
From: Marek Marczykowski <marmarek@invisiblethingslab.com>
Date: Thu, 8 Mar 2012 14:56:39 +0100
Subject: [PATCH 1/2] vm/network: really place anti-spoof rules in 'raw' table

This fixes commit:
4d68998 vm/network: place anti-spoof rules in 'raw' table
---
 network/vif-route-qubes | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/network/vif-route-qubes b/network/vif-route-qubes
index 385b665..597e284 100755
--- a/network/vif-route-qubes
+++ b/network/vif-route-qubes
@@ -48,7 +48,7 @@ if [ "${ip}" ] ; then
 		${cmdprefix} ip route ${ipcmd} ${addr} dev ${vif} || true
 	done
 		echo ${cmdprefix} iptables -t raw $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
-		${cmdprefix} iptables $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
+		${cmdprefix} iptables -t raw $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
 fi
 
 log debug "Successful vif-route-qubes $command for $vif."

From 2b3939ab640318dc0a152f3e6eeba2e922caaaa1 Mon Sep 17 00:00:00 2001
From: Marek Marczykowski <marmarek@invisiblethingslab.com>
Date: Thu, 8 Mar 2012 14:57:10 +0100
Subject: [PATCH 2/2] vm/network: use metric to allow multiple routes to same
 VM

This is required when VM has multiple interfaces (eg HVM: PV and stubdom).
Prefer the later one.
---
 network/vif-route-qubes | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/network/vif-route-qubes b/network/vif-route-qubes
index 597e284..c807017 100755
--- a/network/vif-route-qubes
+++ b/network/vif-route-qubes
@@ -29,7 +29,7 @@ case "$command" in
 	online)
 		ifconfig ${vif} up
 		echo 1 >/proc/sys/net/ipv4/conf/${vif}/proxy_arp
-		ipcmd='replace'
+		ipcmd='add'
 		iptables_cmd='-I PREROUTING 1'
 		cmdprefix=''
 		;;
@@ -41,11 +41,17 @@ case "$command" in
 		;;
 esac
 
+domid=${vif/vif/}
+domid=${domid/.*/}
+# metric must be possitive, but prefer later interface
+#  32752 is max XID aka domid
+metric=$[ 32752 - $domid ]
+
 if [ "${ip}" ] ; then
 	# If we've been given a list of IP addresses, then add routes from dom0 to
 	# the guest using those addresses.
 	for addr in ${ip} ; do
-		${cmdprefix} ip route ${ipcmd} ${addr} dev ${vif} || true
+		${cmdprefix} ip route ${ipcmd} ${addr} dev ${vif} metric $metric
 	done
 		echo ${cmdprefix} iptables -t raw $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
 		${cmdprefix} iptables -t raw $iptables_cmd -i ${vif} \! -s ${ip} -j DROP