Handle network hooks located in /rw/config/network-hooks.d
Example: /rw/config/network-hooks.d/test.sh \#!/bin/bash command="$1" vif="$2" ip="$3" if [ "$ip" == '10.137.0.100' ]; then case "$command" in online) ip route add 192.168.0.100 via 10.137.0.100 ;; offline) ip route del 192.168.0.100 ;; esac fi
This commit is contained in:
parent
da33d87c23
commit
73ed5e85fc
@ -74,19 +74,19 @@ fi
|
|||||||
|
|
||||||
# shellcheck disable=SC2154
|
# shellcheck disable=SC2154
|
||||||
case "$command" in
|
case "$command" in
|
||||||
online)
|
online)
|
||||||
ifconfig "${vif}" up
|
ifconfig "${vif}" up
|
||||||
echo 1 >"/proc/sys/net/ipv4/conf/${vif}/proxy_arp"
|
echo 1 >"/proc/sys/net/ipv4/conf/${vif}/proxy_arp"
|
||||||
ipcmd='add'
|
ipcmd='add'
|
||||||
iptables_cmd='-I PREROUTING 1'
|
iptables_cmd='-I PREROUTING 1'
|
||||||
cmdprefix=''
|
cmdprefix=''
|
||||||
;;
|
;;
|
||||||
offline)
|
offline)
|
||||||
do_without_error ifdown "${vif}"
|
do_without_error ifdown "${vif}"
|
||||||
ipcmd='del'
|
ipcmd='del'
|
||||||
iptables_cmd='-D PREROUTING'
|
iptables_cmd='-D PREROUTING'
|
||||||
cmdprefix='do_without_error'
|
cmdprefix='do_without_error'
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
|
|
||||||
domid=${vif/vif/}
|
domid=${vif/vif/}
|
||||||
@ -95,11 +95,12 @@ domid=${domid/.*/}
|
|||||||
# 32752 is max XID aka domid
|
# 32752 is max XID aka domid
|
||||||
metric=$(( 32752 - domid ))
|
metric=$(( 32752 - domid ))
|
||||||
|
|
||||||
if [ "${ip}" ] ; then
|
if [ "${ip}" ]; then
|
||||||
# If we've been given a list of IP addresses, then add routes from dom0 to
|
# If we've been given a list of IP addresses, then add routes from dom0 to
|
||||||
# the guest using those addresses.
|
# the guest using those addresses.
|
||||||
for addr in ${ip} ; do
|
for addr in ${ip};
|
||||||
${cmdprefix} ip route "${ipcmd}" "${addr}" dev "${vif}" metric "$metric"
|
do
|
||||||
|
${cmdprefix} ip route "${ipcmd}" "${addr}" dev "${vif}" metric "$metric"
|
||||||
if [[ "$addr" = *:* ]]; then
|
if [[ "$addr" = *:* ]]; then
|
||||||
ipt=ip6tables-restore
|
ipt=ip6tables-restore
|
||||||
else
|
else
|
||||||
@ -107,7 +108,16 @@ if [ "${ip}" ] ; then
|
|||||||
fi
|
fi
|
||||||
echo -e "*raw\\n$iptables_cmd -i ${vif} ! -s ${addr} -j DROP\\nCOMMIT" | \
|
echo -e "*raw\\n$iptables_cmd -i ${vif} ! -s ${addr} -j DROP\\nCOMMIT" | \
|
||||||
${cmdprefix} $ipt --noflush $ipt_arg
|
${cmdprefix} $ipt --noflush $ipt_arg
|
||||||
done
|
|
||||||
|
# Network Hooks for triggering supplementary actions on AppVM connect
|
||||||
|
if [ -d /rw/config/network-hooks.d ]; then
|
||||||
|
for hook in /rw/config/network-hooks.d/*
|
||||||
|
do
|
||||||
|
log debug "Executing network-hook $(basename "$hook")..."
|
||||||
|
do_without_error "${hook}" "${command}" "${vif}" "${addr}"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
done
|
||||||
# if no IPv6 is assigned, block all IPv6 traffic on that interface
|
# if no IPv6 is assigned, block all IPv6 traffic on that interface
|
||||||
if ! [[ "$ip" = *:* ]]; then
|
if ! [[ "$ip" = *:* ]]; then
|
||||||
echo -e "*raw\\n$iptables_cmd -i ${vif} -j DROP\\nCOMMIT" | \
|
echo -e "*raw\\n$iptables_cmd -i ${vif} -j DROP\\nCOMMIT" | \
|
||||||
@ -120,8 +130,7 @@ if [ "${ip}" ] ; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
log debug "Successful vif-route-qubes $command for $vif."
|
log debug "Successful vif-route-qubes $command for $vif."
|
||||||
if [ "$command" = "online" ]
|
if [ "$command" = "online" ]; then
|
||||||
then
|
|
||||||
# disable tx checksumming offload, apparently it doesn't work with our ancient qemu in stubdom
|
# disable tx checksumming offload, apparently it doesn't work with our ancient qemu in stubdom
|
||||||
do_without_error ethtool -K "$vif" tx off
|
do_without_error ethtool -K "$vif" tx off
|
||||||
success
|
success
|
||||||
|
Loading…
Reference in New Issue
Block a user