From 73ed5e85fce1133eaa7a0bd55677fb5fd3ce14d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Pierret=20=28fepitre=29?=
 <frederic.pierret@qubes-os.org>
Date: Tue, 28 May 2019 18:56:44 +0200
Subject: [PATCH] Handle network hooks located in /rw/config/network-hooks.d

Example:
/rw/config/network-hooks.d/test.sh
\#!/bin/bash

command="$1"
vif="$2"
ip="$3"

if [ "$ip" == '10.137.0.100' ]; then
    case "$command" in
        online)
            ip route add 192.168.0.100 via 10.137.0.100
            ;;
        offline)
            ip route del 192.168.0.100
            ;;
    esac
fi
---
 network/vif-route-qubes | 51 ++++++++++++++++++++++++-----------------
 1 file changed, 30 insertions(+), 21 deletions(-)

diff --git a/network/vif-route-qubes b/network/vif-route-qubes
index c72d8a0..72b950a 100755
--- a/network/vif-route-qubes
+++ b/network/vif-route-qubes
@@ -74,19 +74,19 @@ fi
 
 # shellcheck disable=SC2154
 case "$command" in
-	online)
-		ifconfig "${vif}" up
-		echo 1 >"/proc/sys/net/ipv4/conf/${vif}/proxy_arp"
-		ipcmd='add'
-		iptables_cmd='-I PREROUTING 1'
-		cmdprefix=''
-		;;
-	offline)
-		do_without_error ifdown "${vif}"
-		ipcmd='del'
-		iptables_cmd='-D PREROUTING'
-		cmdprefix='do_without_error'
-		;;
+    online)
+        ifconfig "${vif}" up
+        echo 1 >"/proc/sys/net/ipv4/conf/${vif}/proxy_arp"
+        ipcmd='add'
+        iptables_cmd='-I PREROUTING 1'
+        cmdprefix=''
+        ;;
+    offline)
+        do_without_error ifdown "${vif}"
+        ipcmd='del'
+        iptables_cmd='-D PREROUTING'
+        cmdprefix='do_without_error'
+        ;;
 esac
 
 domid=${vif/vif/}
@@ -95,11 +95,12 @@ domid=${domid/.*/}
 #  32752 is max XID aka domid
 metric=$(( 32752 - domid ))
 
-if [ "${ip}" ] ; then
-	# If we've been given a list of IP addresses, then add routes from dom0 to
-	# the guest using those addresses.
-	for addr in ${ip} ; do
-		${cmdprefix} ip route "${ipcmd}" "${addr}" dev "${vif}" metric "$metric"
+if [ "${ip}" ]; then
+    # If we've been given a list of IP addresses, then add routes from dom0 to
+    # the guest using those addresses.
+    for addr in ${ip};
+    do
+        ${cmdprefix} ip route "${ipcmd}" "${addr}" dev "${vif}" metric "$metric"
         if [[ "$addr" = *:* ]]; then
             ipt=ip6tables-restore
         else
@@ -107,7 +108,16 @@ if [ "${ip}" ] ; then
         fi
         echo -e "*raw\\n$iptables_cmd -i ${vif} ! -s ${addr} -j DROP\\nCOMMIT" | \
             ${cmdprefix} $ipt --noflush $ipt_arg
-	done
+
+        # Network Hooks for triggering supplementary actions on AppVM connect
+        if [ -d /rw/config/network-hooks.d ]; then
+            for hook in /rw/config/network-hooks.d/*
+            do
+                log debug "Executing network-hook $(basename "$hook")..."
+                do_without_error "${hook}" "${command}" "${vif}" "${addr}"
+            done
+        fi
+    done
     # if no IPv6 is assigned, block all IPv6 traffic on that interface
     if ! [[ "$ip" = *:* ]]; then
         echo -e "*raw\\n$iptables_cmd -i ${vif} -j DROP\\nCOMMIT" | \
@@ -120,8 +130,7 @@ if [ "${ip}" ] ; then
 fi
 
 log debug "Successful vif-route-qubes $command for $vif."
-if [ "$command" = "online" ]
-then
+if [ "$command" = "online" ]; then
   # disable tx checksumming offload, apparently it doesn't work with our ancient qemu in stubdom
   do_without_error ethtool -K "$vif" tx off
   success