Merge branch 'master' of ssh://git.qubes-os.org/var/lib/qubes/git/smoku/core

Conflicts:
	dom0/qvm-core/qubes.py

appvm/Makefile

@@ -1,11 +1,14 @@
 CC=gcc
 CFLAGS=-Wall
-all:	qubes_penctl qubes_add_pendrive_script qvm-open-in-dvm
+all:	qubes_penctl qubes_add_pendrive_script qvm-open-in-dvm xenstore-watch
 qubes_penctl: qubes_penctl.o
 	$(CC) -o qubes_penctl qubes_penctl.o -lxenstore
 qubes_add_pendrive_script: qubes_add_pendrive_script.o
 	$(CC) -o qubes_add_pendrive_script qubes_add_pendrive_script.o -lxenstore
 qvm-open-in-dvm: qvm-open-in-dvm.o
 	 $(CC) -o qvm-open-in-dvm qvm-open-in-dvm.o -lxenstore
+xenstore-watch: xenstore-watch.o
+	$(CC) -o xenstore-watch xenstore-watch.o -lxenstore
+
 clean:
-	rm -f qubes_penctl qubes_add_pendrive_script qvm-open-in-dvm *.o *~
+	rm -f qubes_penctl qubes_add_pendrive_script qvm-open-in-dvm xenstore-watch *.o *~

appvm/xenstore-watch.c

@@ -0,0 +1,28 @@
+#include <sys/types.h>
+#include <xs.h>
+#include <stdio.h>
+#include <stdlib.h>
+main(int argc, char **argv)
+{
+	struct xs_handle *xs;
+	unsigned int count;
+	char **vec;
+	char dummy;
+	if (argc != 2) {
+		fprintf(stderr, "usage: %s xenstore_path\n", argv[0]);
+		exit(1);
+	}
+	xs = xs_domain_open();
+	if (!xs) {
+		perror("xs_domain_open");
+		exit(1);
+	}
+	if (!xs_watch(xs, argv[1], &dummy)) {
+		perror("xs_watch");
+		exit(1);
+	}
+	vec = xs_read_watch(xs, &count);
+	free(vec);
+	vec = xs_read_watch(xs, &count);
+	free(vec);
+}

fwvm/bin/qubes_firewall

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -e
+
+PIDFILE=/var/run/qubes/qubes_firewall.pid
+XENSTORE_IPTABLES=qubes_iptables
+XENSTORE_ERROR=qubes_iptables_error
+OLD_RULES=""
+
+# PIDfile handling
+[[ -e $PIDFILE ]] && kill -s 0 $(<$PIDFILE) 2>/dev/null && exit 0
+echo $$ >$PIDFILE
+
+trap 'exit 0' SIGTERM
+
+while true; do
+	RULES=$(/usr/bin/xenstore-read $XENSTORE_IPTABLES)
+
+	if [[ "$RULES" != "$OLD_RULES" ]]; then
+		IPTABLES_SAVE=$(/sbin/iptables-save | sed '/^\*filter/,/^COMMIT/d')
+		OUT=`echo -e "$RULES\n$IPTABLES_SAVE" | /sbin/iptables-restore 2>&1 || :`
+		/usr/bin/xenstore-write $XENSTORE_ERROR "$OUT"
+
+		if [[ -z "$OUT" ]]; then
+			# If OK save it for later
+			/sbin/service iptables save >/dev/null
+		fi
+
+		OLD_RULES="$RULES"
+	fi
+
+	# Wait for changes in xenstore file
+	/usr/bin/xenstore-watch $XENSTORE_IPTABLES
+done

fwvm/init.d/qubes_core

@@ -0,0 +1,67 @@
+#!/bin/sh
+#
+# chkconfig: 345 90 90
+# description: Executes Qubes core scripts at VM boot
+#
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+start()
+{
+	echo -n $"Executing Qubes Core scripts FirewallVM:"
+
+	if ! [ -x /usr/bin/xenstore-read ] ; then
+		echo "ERROR: /usr/bin/xenstore-read not found!"
+		exit 1
+	fi
+
+	name=$(/usr/bin/xenstore-read name)
+	hostname $name
+
+	# Setup gateway for all the VMs this netVM is serviceing...
+	modprobe netbk
+	gateway=$(/usr/bin/xenstore-read qubes_netvm_gateway)
+	netmask=$(/usr/bin/xenstore-read qubes_netvm_netmask)
+	network=$(/usr/bin/xenstore-read qubes_netvm_network)
+	secondary_dns=$(/usr/bin/xenstore-read qubes_netvm_secondary_dns)
+	echo "NS1=$gateway" > /var/run/qubes/qubes_ns
+	echo "NS2=$secondary_dns" >> /var/run/qubes/qubes_ns
+	/usr/lib/qubes/qubes_setup_dnat_to_ns
+	echo "1" > /proc/sys/net/ipv4/ip_forward
+
+	# Now setup "AppVM" part of FirewallVM
+	ip=$(/usr/bin/xenstore-read qubes_ip)
+	netmask=$(/usr/bin/xenstore-read qubes_netmask)
+	gateway=$(/usr/bin/xenstore-read qubes_gateway)
+	secondary_dns=$(/usr/bin/xenstore-read qubes_secondary_dns)
+	if [ x$ip != x ]; then
+		/sbin/ifconfig eth0 $ip netmask 255.255.255.255 up
+		/sbin/route add default dev eth0
+		echo "nameserver $gateway" > /etc/resolv.conf
+		echo "nameserver $secondary_dns" >> /etc/resolv.conf
+	fi
+
+	success
+	echo ""
+	return 0
+}
+
+stop()
+{
+	return 0
+}
+
+case "$1" in
+  start)
+	start
+	;;
+  stop)
+	stop
+	;;
+  *)
+	echo $"Usage: $0 {start|stop}"
+	exit 3
+	;;
+esac
+
+exit $RETVAL

fwvm/init.d/qubes_firewall

@@ -0,0 +1,42 @@
+#!/bin/sh
+#
+# chkconfig: 345 91 91
+# description: Starts Qubes Firewall monitor
+#
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+PIDFILE=/var/run/qubes/qubes_firewall.pid
+
+start()
+{
+	echo -n $"Starting Qubes Firewall monitor:"
+	/sbin/ethtool -K eth0 sg off
+	/usr/bin/qubes_firewall &
+	success
+	echo ""
+	return 0
+}
+
+stop()
+{
+	echo -n "Stopping Qubes Firewall monitor:"
+	kill $(cat $PIDFILE) 2>/dev/null  && success || failure
+	echo ""
+	return 0
+}
+
+case "$1" in
+  start)
+	start
+	;;
+  stop)
+	stop
+	;;
+  *)
+	echo $"Usage: $0 {start|stop}"
+	exit 3
+	;;
+esac
+
+exit $RETVAL

netvm/30-qubes_external_ip

@@ -0,0 +1,8 @@
+#!/bin/sh
+if [ x$2 == xup ]; then
+	INET=$(/sbin/ip addr show dev $1 | /bin/grep inet)
+	/usr/bin/xenstore-write qubes_netvm_external_ip "$INET"
+fi
+if [ x$2 == xdown ]; then
+	/usr/bin/xenstore-write qubes_netvm_external_ip ""
+fi

rpm_spec/core-netvm.spec

@@ -67,6 +67,7 @@ mkdir -p $RPM_BUILD_ROOT/etc/dhclient.d
 ln -s /usr/lib/qubes/qubes_setup_dnat_to_ns $RPM_BUILD_ROOT/etc/dhclient.d/qubes_setup_dnat_to_ns.sh 
 mkdir -p $RPM_BUILD_ROOT/etc/NetworkManager/dispatcher.d/
 cp ../common/qubes_nmhook $RPM_BUILD_ROOT/etc/NetworkManager/dispatcher.d/
+cp ../netvm/30-qubes_external_ip $RPM_BUILD_ROOT/etc/NetworkManager/dispatcher.d/
 mkdir -p $RPM_BUILD_ROOT/etc/yum.repos.d
 cp ../netvm/qubes.repo $RPM_BUILD_ROOT/etc/yum.repos.d
 mkdir -p $RPM_BUILD_ROOT/sbin