core-agent-linux/network/qubes-netwatcher

#!/bin/bash
set -e

PIDFILE=/var/run/qubes/qubes-netwatcher.pid
CURR_NETCFG=""

# PIDfile handling
[[ -e $PIDFILE ]] && kill -s 0 $(<$PIDFILE) 2>/dev/null && exit 0
echo $$ >$PIDFILE

trap 'exit 0' SIGTERM

while true; do
	NET_DOMID=$(xenstore-read qubes-netvm-domid || :)
	if [[ -n "$NET_DOMID" ]] && [[ $NET_DOMID -gt 0 ]]; then
		UNTRUSTED_NETCFG=$(xenstore-read /local/domain/$NET_DOMID/qubes-netvm-external-ip || :)
		# UNTRUSTED_NETCFG is not parsed in any way
		# thus, no sanitization ready
		# but be careful when passing it to other shell scripts
		if [[ "$UNTRUSTED_NETCFG" != "$CURR_NETCFG" ]]; then
			/sbin/service qubes-firewall stop
			/sbin/service qubes-firewall start
			CURR_NETCFG="$UNTRUSTED_NETCFG"
			xenstore-write qubes-netvm-external-ip "$CURR_NETCFG"
		fi

		xenstore-watch -n 3 /local/domain/$NET_DOMID/qubes-netvm-external-ip qubes-netvm-domid
	else
		xenstore-watch -n 2 qubes-netvm-domid
	fi
done