Merge remote-tracking branch 'qubesos/pr/159'

* qubesos/pr/159: setup-ip: handle default conf if /qubes-mac returns empty value setup-ip: only assign IP configuration of Qubes managed iface Handle default value for get_iface_from_mac Handle default value for get_qubes_managed_iface Make ShellCheck happy Handle non-default 'eth0' Qubes managed interface
2019-05-25 22:46:28 +02:00 · 2019-05-25 22:46:28 +02:00 · da33d87c23
commit da33d87c23
parent 0c3421cfa8 27fddadc22
6 changed files with 134 additions and 87 deletions
--- a/init/functions
+++ b/init/functions
@ -128,6 +128,36 @@ umount_retry() {
    return 0
 }

+get_mac_from_iface() {
+    local iface="$1"
+    local mac
+    if [ "x$iface" != "x" ]; then
+        mac="$(cat "/sys/class/net/$iface/address")"
+    fi
+    echo "$mac"
+}
+
+get_iface_from_mac() {
+    local mac="$1"
+    local iface
+    if [ "x$mac" != "x" ]; then
+        iface="$(ip -o link | grep -i "$mac" | awk '{print $2}' | cut -d ':' -f1)"
+    fi
+    echo "$iface"
+}
+
+get_qubes_managed_iface() {
+    local mac
+    local qubes_iface
+    mac="$(qubesdb-read /qubes-mac)"
+    qubes_iface="$(get_iface_from_mac "$mac")"
+    if [ "x$qubes_iface" != "x" ]; then
+        echo "$qubes_iface"
+    else
+        echo eth0
+    fi
+}
+
 initialize_home() {
    local home_root
    local mode
--- a/network/network-manager-prepare-conf-dir
+++ b/network/network-manager-prepare-conf-dir
@ -1,5 +1,9 @@
 #!/bin/sh

+# Source Qubes library.
+# shellcheck source=init/functions
+. /usr/lib/qubes/init/functions
+
 NM_CONFIG_DIR=/etc/NetworkManager/system-connections
 if [ -d $NM_CONFIG_DIR ] && [ ! -h $NM_CONFIG_DIR ]; then
    mkdir -p /rw/config/NM-system-connections
@ -20,10 +24,11 @@ sed -r -i -e "s/^#?plugins=.*/plugins=keyfile/" /etc/NetworkManager/NetworkManag
 # starting NetworkManager, otherwise it will try default DHCP configuration
 # first and only after a timeout fallback to static one - introducing delay in
 # network connectivity
-export INTERFACE=eth0
+INTERFACE="$(get_qubes_managed_iface)"
+export INTERFACE
 if qubesdb-read /qubes-ip >/dev/null 2>/dev/null &&
-        [ -e /sys/class/net/$INTERFACE ] &&
-        [ ! -r /etc/NetworkManager/system-connections/qubes-uplink-$INTERFACE ]; then
+        [ -e "/sys/class/net/$INTERFACE" ] &&
+        [ ! -r "/etc/NetworkManager/system-connections/qubes-uplink-$INTERFACE" ]; then
    /usr/lib/qubes/setup-ip
 fi

--- a/network/setup-ip
+++ b/network/setup-ip
@ -6,20 +6,24 @@

 have_qubesdb || exit 0

-ip=$(/usr/bin/qubesdb-read /qubes-ip 2> /dev/null)
-ip6=$(/usr/bin/qubesdb-read /qubes-ip6 2> /dev/null)
-if [ "x$ip" != x ]; then
-    #netmask=$(/usr/bin/qubesdb-read /qubes-netmask)
-    gateway=$(/usr/bin/qubesdb-read /qubes-gateway)
-    gateway6=$(/usr/bin/qubesdb-read /qubes-gateway6)
-    primary_dns=$(/usr/bin/qubesdb-read /qubes-primary-dns 2>/dev/null || echo "$gateway")
-    secondary_dns=$(/usr/bin/qubesdb-read /qubes-secondary-dns)
-    /sbin/ethtool -K "$INTERFACE" sg off
-    /sbin/ethtool -K "$INTERFACE" tx off
-    # If NetworkManager is enabled, let it configure the network
-    if qsvc network-manager ; then
-        nm_config=/etc/NetworkManager/system-connections/qubes-uplink-$INTERFACE
-        cat > "$nm_config" <<__EOF__
+mac="$(/usr/bin/qubesdb-read /qubes-mac 2> /dev/null)"
+current_mac="$(get_mac_from_iface "$INTERFACE")"
+
+if [ "$mac" = "$current_mac" ] || [ "x$mac" = "x" ] ; then
+    ip="$(/usr/bin/qubesdb-read /qubes-ip 2> /dev/null)"
+    ip6="$(/usr/bin/qubesdb-read /qubes-ip6 2> /dev/null)"
+    if [ "x$ip" != x ]; then
+        #netmask=$(/usr/bin/qubesdb-read /qubes-netmask)
+        gateway=$(/usr/bin/qubesdb-read /qubes-gateway)
+        gateway6=$(/usr/bin/qubesdb-read /qubes-gateway6)
+        primary_dns=$(/usr/bin/qubesdb-read /qubes-primary-dns 2>/dev/null || echo "$gateway")
+        secondary_dns=$(/usr/bin/qubesdb-read /qubes-secondary-dns)
+        /sbin/ethtool -K "$INTERFACE" sg off
+        /sbin/ethtool -K "$INTERFACE" tx off
+        # If NetworkManager is enabled, let it configure the network
+        if qsvc network-manager ; then
+            nm_config="/etc/NetworkManager/system-connections/qubes-uplink-$INTERFACE"
+            cat > "$nm_config" <<__EOF__
 [802-3-ethernet]
 duplex=full

@ -31,100 +35,101 @@ id=VM uplink $INTERFACE
 uuid=de85f79b-8c3d-405f-a652-cb4c10b4f9ef
 type=802-3-ethernet
 __EOF__
-        ip4_nm_config=""
-        ip6_nm_config=""
-        if ! qsvc disable-dns-server ; then
-            ip4_nm_config="${ip4_nm_config}
+            ip4_nm_config=""
+            ip6_nm_config=""
+            if ! qsvc disable-dns-server ; then
+                ip4_nm_config="${ip4_nm_config}
 dns=${primary_dns};${secondary_dns}"
-        fi
-        if ! qsvc disable-default-route ; then
-            ip4_nm_config="${ip4_nm_config}
+            fi
+            if ! qsvc disable-default-route ; then
+                ip4_nm_config="${ip4_nm_config}
 addresses1=$ip;32;$gateway"
-            if [ -n "$ip6" ]; then
-                ip6_nm_config="${ip6_nm_config}
+                if [ -n "$ip6" ]; then
+                    ip6_nm_config="${ip6_nm_config}
 addresses1=$ip6;128;$gateway6"
-            fi
-        else
-            ip4_nm_config="${ip4_nm_config}
+                fi
+            else
+                ip4_nm_config="${ip4_nm_config}
 addresses1=$ip;32"
-            if [ -n "$ip6" ]; then
-                ip6_nm_config="${ip6_nm_config}
+                if [ -n "$ip6" ]; then
+                    ip6_nm_config="${ip6_nm_config}
 addresses1=$ip6;128"
+                fi
            fi
-        fi
-        if [ -n "$ip4_nm_config" ]; then
-            cat >> "$nm_config" <<__EOF__
+            if [ -n "$ip4_nm_config" ]; then
+                cat >> "$nm_config" <<__EOF__
 [ipv4]
 method=manual
 may-fail=false
 $ip4_nm_config
 __EOF__
-        else
-            cat >> "$nm_config" <<__EOF__
+            else
+                cat >> "$nm_config" <<__EOF__
 [ipv4]
 method=ignore
 __EOF__
-        fi
+            fi

-        if [ -n "$ip6_nm_config" ]; then
-            cat >> "$nm_config" <<__EOF__
+            if [ -n "$ip6_nm_config" ]; then
+                cat >> "$nm_config" <<__EOF__
 [ipv6]
 method=manual
 may-fail=false
 $ip6_nm_config
 __EOF__
-        else
-            cat >> "$nm_config" <<__EOF__
+            else
+                cat >> "$nm_config" <<__EOF__
 [ipv6]
 method=ignore
 __EOF__
-        fi
+            fi

-        chmod 600 "$nm_config"
-        # reload connection
-        nmcli connection load "$nm_config" || :
-    else
-        # No NetworkManager enabled, configure the network manually
-        /sbin/ifconfig "$INTERFACE" "$ip" netmask 255.255.255.255
-        if [ -n "$ip6" ]; then
-            /sbin/ifconfig "$INTERFACE" add "$ip6"/128
-        fi
-        /sbin/ifconfig "$INTERFACE" up
-        /sbin/route add -host "$gateway" dev "$INTERFACE"
-        if [ -n "$gateway6" ] && ! echo "$gateway6" | grep -q "^fe80:"; then
-            /sbin/route -6 add "$gateway6/128" dev "$INTERFACE"
-        fi
-        if ! qsvc disable-default-route ; then
-            /sbin/route add default gw "$gateway"
-            if [ -n "$gateway6" ]; then
-                /sbin/route -6 add default gw "$gateway6" dev "$INTERFACE"
+            chmod 600 "$nm_config"
+            # reload connection
+            nmcli connection load "$nm_config" || :
+        else
+            # No NetworkManager enabled, configure the network manually
+            /sbin/ifconfig "$INTERFACE" "$ip" netmask 255.255.255.255
+            if [ -n "$ip6" ]; then
+                /sbin/ifconfig "$INTERFACE" add "$ip6"/128
+            fi
+            /sbin/ifconfig "$INTERFACE" up
+            /sbin/route add -host "$gateway" dev "$INTERFACE"
+            if [ -n "$gateway6" ] && ! echo "$gateway6" | grep -q "^fe80:"; then
+                /sbin/route -6 add "$gateway6/128" dev "$INTERFACE"
+            fi
+            if ! qsvc disable-default-route ; then
+                /sbin/route add default gw "$gateway"
+                if [ -n "$gateway6" ]; then
+                    /sbin/route -6 add default gw "$gateway6" dev "$INTERFACE"
+                fi
+            fi
+            if ! is_protected_file /etc/resolv.conf ; then
+                echo > /etc/resolv.conf
+                if ! qsvc disable-dns-server ; then
+                    echo "nameserver $primary_dns" > /etc/resolv.conf
+                    echo "nameserver $secondary_dns" >> /etc/resolv.conf
+                fi
            fi
        fi
-        if ! is_protected_file /etc/resolv.conf ; then
-            echo > /etc/resolv.conf
-            if ! qsvc disable-dns-server ; then
-                echo "nameserver $primary_dns" > /etc/resolv.conf
-                echo "nameserver $secondary_dns" >> /etc/resolv.conf
+        network=$(qubesdb-read /qubes-netvm-network 2>/dev/null)
+        if [ "x$network" != "x" ] && ! qsvc disable-dns-server ; then
+            gateway=$(qubesdb-read /qubes-netvm-gateway)
+            #netmask=$(qubesdb-read /qubes-netvm-netmask)
+            primary_dns=$(qubesdb-read /qubes-netvm-primary-dns 2>/dev/null || echo "$gateway")
+            secondary_dns=$(qubesdb-read /qubes-netvm-secondary-dns)
+            echo "NS1=$primary_dns" > /var/run/qubes/qubes-ns
+            echo "NS2=$secondary_dns" >> /var/run/qubes/qubes-ns
+            /usr/lib/qubes/qubes-setup-dnat-to-ns
+        fi
+        if [ "x$network" != "x" ]; then
+            if [ -x /rw/config/qubes-ip-change-hook ]; then
+                /rw/config/qubes-ip-change-hook
+            fi
+            # XXX: Backward compatibility
+            if [ -x /rw/config/qubes_ip_change_hook ]; then
+                /rw/config/qubes_ip_change_hook
            fi
-        fi
-    fi
-    network=$(qubesdb-read /qubes-netvm-network 2>/dev/null)
-    if [ "x$network" != "x" ] && ! qsvc disable-dns-server ; then
-        gateway=$(qubesdb-read /qubes-netvm-gateway)
-        #netmask=$(qubesdb-read /qubes-netvm-netmask)
-        primary_dns=$(qubesdb-read /qubes-netvm-primary-dns 2>/dev/null || echo "$gateway")
-        secondary_dns=$(qubesdb-read /qubes-netvm-secondary-dns)
-        echo "NS1=$primary_dns" > /var/run/qubes/qubes-ns
-        echo "NS2=$secondary_dns" >> /var/run/qubes/qubes-ns
-        /usr/lib/qubes/qubes-setup-dnat-to-ns
-    fi
-    if [ "x$network" != "x" ]; then
-        if [ -x /rw/config/qubes-ip-change-hook ]; then
-            /rw/config/qubes-ip-change-hook
-        fi
-        # XXX: Backward compatibility
-        if [ -x /rw/config/qubes_ip_change_hook ]; then
-            /rw/config/qubes_ip_change_hook
        fi
    fi
 fi
--- a/vm-init.d/qubes-firewall
+++ b/vm-init.d/qubes-firewall
@ -19,7 +19,7 @@ start()

    if qsvc qubes-firewall ; then
        echo -n $"Starting Qubes Firewall monitor:"
-        /sbin/ethtool -K eth0 sg off
+        /sbin/ethtool -K "$(get_qubes_managed_iface)" sg off
        /usr/sbin/qubes-firewall &
        success
        echo ""
--- a/vm-systemd/misc-post.sh
+++ b/vm-systemd/misc-post.sh
@ -15,7 +15,10 @@ fi
 # DispVM (to override DispVM-template IP) and in case when qubes-ip was
 # called by udev before loading evtchn kernel module - in which case
 # qubesdb-read fails
-INTERFACE=eth0 /usr/lib/qubes/setup-ip
+QUBES_MANAGED_IFACE="$(get_qubes_managed_iface)"
+if [ "x$QUBES_MANAGED_IFACE" != "x" ]; then
+INTERFACE="$QUBES_MANAGED_IFACE" /usr/lib/qubes/setup-ip
+fi

 if [ -x /rw/config/rc.local ] ; then
    /rw/config/rc.local
--- a/vm-systemd/network-proxy-setup.sh
+++ b/vm-systemd/network-proxy-setup.sh
@ -1,5 +1,9 @@
 #!/bin/sh

+# Source Qubes library.
+# shellcheck source=init/functions
+. /usr/lib/qubes/init/functions
+
 # Setup gateway for all the VMs this netVM is serviceing...
 network=$(qubesdb-read /qubes-netvm-network 2>/dev/null)
 if [ "x$network" != "x" ]; then
@ -24,5 +28,5 @@ if [ "x$network" != "x" ]; then
    if [ -n "$gateway6" ]; then
        echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
    fi
-    /sbin/ethtool -K eth0 sg off || true
+    /sbin/ethtool -K "$(get_qubes_managed_iface)" sg off || true
 fi