setup-ip 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225
  1. #!/bin/bash
  2. # Source Qubes library.
  3. # shellcheck disable=SC1091
  4. . /usr/lib/qubes/init/functions
  5. configure_network() {
  6. local MAC="$1"
  7. local INTERFACE="$2"
  8. local ip="$3"
  9. local ip6="$4"
  10. local netmask="$5"
  11. local netmask6="$6"
  12. local gateway="$7"
  13. local gateway6="$8"
  14. local primary_dns="$9"
  15. local secondary_dns="${10}"
  16. /sbin/ifconfig "$INTERFACE" "$ip" netmask "$netmask"
  17. if [ -n "$ip6" ]; then
  18. /sbin/ifconfig "$INTERFACE" add "$ip6/$netmask6"
  19. fi
  20. /sbin/ifconfig "$INTERFACE" up
  21. if [ -n "$gateway" ]; then
  22. /sbin/route add -host "$gateway" dev "$INTERFACE"
  23. if [ -n "$gateway6" ] && ! echo "$gateway6" | grep -q "^fe80:"; then
  24. /sbin/route -6 add "$gateway6/$netmask6" dev "$INTERFACE"
  25. fi
  26. if ! qsvc disable-default-route ; then
  27. /sbin/route add default gw "$gateway"
  28. if [ -n "$gateway6" ]; then
  29. /sbin/route -6 add default gw "$gateway6" dev "$INTERFACE"
  30. fi
  31. fi
  32. fi
  33. if [ -z "$primary_dns" ] && [ -n "$gateway" ]; then
  34. primary_dns="$gateway"
  35. fi
  36. if ! is_protected_file /etc/resolv.conf ; then
  37. echo > /etc/resolv.conf
  38. if ! qsvc disable-dns-server ; then
  39. echo "nameserver $primary_dns" > /etc/resolv.conf
  40. echo "nameserver $secondary_dns" >> /etc/resolv.conf
  41. fi
  42. fi
  43. }
  44. configure_network_nm() {
  45. local MAC="$1"
  46. local INTERFACE="$2"
  47. local ip="$3"
  48. local ip6="$4"
  49. local netmask="$5"
  50. local netmask6="$6"
  51. local gateway="$7"
  52. local gateway6="$8"
  53. local primary_dns="$9"
  54. local secondary_dns="${10}"
  55. local prefix
  56. local prefix6
  57. local nm_config
  58. local ip4_nm_config
  59. local ip6_nm_config
  60. local uuid
  61. prefix="$(get_prefix_from_subnet "$netmask")"
  62. prefix6="$netmask6"
  63. uuid="de85f79b-8c3d-405f-a652-${MAC//:/}"
  64. nm_config="/etc/NetworkManager/system-connections/qubes-uplink-$INTERFACE"
  65. cat > "$nm_config" <<__EOF__
  66. [802-3-ethernet]
  67. duplex=full
  68. [ethernet]
  69. mac-address=$MAC
  70. [connection]
  71. id=VM uplink $INTERFACE
  72. uuid=$uuid
  73. type=802-3-ethernet
  74. __EOF__
  75. ip4_nm_config=""
  76. ip6_nm_config=""
  77. if ! qsvc disable-dns-server ; then
  78. ip4_nm_config="${ip4_nm_config}
  79. dns=${primary_dns};${secondary_dns}"
  80. fi
  81. if ! qsvc disable-default-route ; then
  82. ip4_nm_config="${ip4_nm_config}
  83. addresses1=$ip;$prefix;$gateway"
  84. if [ -n "$ip6" ]; then
  85. ip6_nm_config="${ip6_nm_config}
  86. addresses1=$ip6;$prefix6;$gateway6"
  87. fi
  88. else
  89. ip4_nm_config="${ip4_nm_config}
  90. addresses1=$ip;$prefix"
  91. if [ -n "$ip6" ]; then
  92. ip6_nm_config="${ip6_nm_config}
  93. addresses1=$ip6;$prefix6"
  94. fi
  95. fi
  96. if [ -n "$ip4_nm_config" ]; then
  97. cat >> "$nm_config" <<__EOF__
  98. [ipv4]
  99. method=manual
  100. may-fail=false
  101. $ip4_nm_config
  102. __EOF__
  103. else
  104. cat >> "$nm_config" <<__EOF__
  105. [ipv4]
  106. method=ignore
  107. __EOF__
  108. fi
  109. if [ -n "$ip6_nm_config" ]; then
  110. cat >> "$nm_config" <<__EOF__
  111. [ipv6]
  112. method=manual
  113. may-fail=false
  114. $ip6_nm_config
  115. __EOF__
  116. else
  117. cat >> "$nm_config" <<__EOF__
  118. [ipv6]
  119. method=ignore
  120. __EOF__
  121. fi
  122. chmod 600 "$nm_config"
  123. # reload connection
  124. nmcli connection load "$nm_config" || :
  125. }
  126. configure_qubes_ns() {
  127. gateway=$(qubesdb-read /qubes-netvm-gateway)
  128. #netmask=$(qubesdb-read /qubes-netvm-netmask)
  129. primary_dns=$(qubesdb-read /qubes-netvm-primary-dns 2>/dev/null || echo "$gateway")
  130. secondary_dns=$(qubesdb-read /qubes-netvm-secondary-dns)
  131. echo "NS1=$primary_dns" > /var/run/qubes/qubes-ns
  132. echo "NS2=$secondary_dns" >> /var/run/qubes/qubes-ns
  133. /usr/lib/qubes/qubes-setup-dnat-to-ns
  134. }
  135. qubes_ip_change_hook() {
  136. if [ -x /rw/config/qubes-ip-change-hook ]; then
  137. /rw/config/qubes-ip-change-hook
  138. fi
  139. # XXX: Backward compatibility
  140. if [ -x /rw/config/qubes_ip_change_hook ]; then
  141. /rw/config/qubes_ip_change_hook
  142. fi
  143. }
  144. have_qubesdb || exit 0
  145. if [ -n "$INTERFACE" ]; then
  146. if [ "$ACTION" == "add" ]; then
  147. MAC="$(get_mac_from_iface "$INTERFACE")"
  148. if [ -n "$MAC" ]; then
  149. ip="$(/usr/bin/qubesdb-read "/net-config/$MAC/ip" 2> /dev/null)"
  150. ip6="$(/usr/bin/qubesdb-read "/net-config/$MAC/ip6" 2> /dev/null)"
  151. netmask="$(/usr/bin/qubesdb-read "/net-config/$MAC/netmask" 2> /dev/null)"
  152. netmask6="$(/usr/bin/qubesdb-read "/net-config/$MAC/netmask6" 2> /dev/null)"
  153. gateway="$(/usr/bin/qubesdb-read "/net-config/$MAC/gateway" 2> /dev/null)"
  154. gateway6="$(/usr/bin/qubesdb-read "/net-config/$MAC/gateway6" 2> /dev/null)"
  155. # Handle legacy values
  156. LEGACY_MAC="$(/usr/bin/qubesdb-read /qubes-mac 2> /dev/null)"
  157. if [ "$MAC" == "$LEGACY_MAC" ] || [ -z "$LEGACY_MAC" ]; then
  158. if [ -z "$ip" ]; then
  159. ip="$(/usr/bin/qubesdb-read /qubes-ip 2> /dev/null)"
  160. fi
  161. if [ -z "$ip6" ]; then
  162. ip6="$(/usr/bin/qubesdb-read /qubes-ip6 2> /dev/null)"
  163. fi
  164. if [ -z "$gateway" ]; then
  165. gateway="$(/usr/bin/qubesdb-read /qubes-gateway 2> /dev/null)"
  166. fi
  167. if [ -z "$gateway6" ]; then
  168. gateway6="$(/usr/bin/qubesdb-read /qubes-gateway6 2> /dev/null)"
  169. fi
  170. fi
  171. if [ -z "$netmask" ]; then
  172. netmask="255.255.255.255"
  173. fi
  174. if [ -z "$netmask6" ]; then
  175. netmask6="128"
  176. fi
  177. primary_dns=$(/usr/bin/qubesdb-read /qubes-primary-dns 2>/dev/null)
  178. secondary_dns=$(/usr/bin/qubesdb-read /qubes-secondary-dns 2>/dev/null)
  179. if [ -n "$ip" ]; then
  180. /sbin/ethtool -K "$INTERFACE" sg off
  181. /sbin/ethtool -K "$INTERFACE" tx off
  182. # If NetworkManager is enabled, let it configure the network
  183. if qsvc network-manager ; then
  184. configure_network_nm "$MAC" "$INTERFACE" "$ip" "$ip6" "$netmask" "$netmask6" "$gateway" "$gateway6" "$primary_dns" "$secondary_dns"
  185. else
  186. configure_network "$MAC" "$INTERFACE" "$ip" "$ip6" "$netmask" "$netmask6" "$gateway" "$gateway6" "$primary_dns" "$secondary_dns"
  187. fi
  188. network=$(qubesdb-read /qubes-netvm-network 2>/dev/null)
  189. if [ -n "$network" ]; then
  190. if ! qsvc disable-dns-server; then
  191. configure_qubes_ns
  192. fi
  193. qubes_ip_change_hook
  194. fi
  195. fi
  196. fi
  197. elif [ "$ACTION" == "remove" ]; then
  198. # If exists, we delete NetworkManager configuration file to prevent duplicate entries
  199. nm_config="/etc/NetworkManager/system-connections/qubes-uplink-$INTERFACE"
  200. rm -rf "$nm_config"
  201. fi
  202. fi