setup-ip 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239
  1. #!/bin/bash
  2. # Source Qubes library.
  3. # shellcheck disable=SC1091
  4. . /usr/lib/qubes/init/functions
  5. set -uo pipefail
  6. add_host_route () {
  7. /sbin/ip -- route replace to unicast "$1" dev "$2" onlink scope host
  8. }
  9. add_default_route () {
  10. /sbin/ip -- route replace to unicast default via "$1" dev "$2" onlink
  11. }
  12. configure_network() {
  13. local MAC="$1"
  14. local INTERFACE="$2"
  15. local ip="$3"
  16. local ip6="$4"
  17. local netmask="$5"
  18. local netmask6="$6"
  19. local gateway="$7"
  20. local gateway6="$8"
  21. local primary_dns="$9"
  22. local secondary_dns="${10}"
  23. local netvm_mac=fe:ff:ff:ff:ff:ff
  24. /sbin/ifconfig "$INTERFACE" "$ip" netmask "$netmask"
  25. /sbin/ip -- neighbour replace to "$gateway" dev "$INTERFACE" \
  26. lladdr "$netvm_mac" nud permanent
  27. if [ -n "$ip6" ]; then
  28. /sbin/ifconfig "$INTERFACE" add "$ip6/$netmask6"
  29. /sbin/ip -- neighbour replace to "$gateway6" dev "$INTERFACE" \
  30. lladdr "$netvm_mac" nud permanent
  31. fi
  32. /sbin/ifconfig "$INTERFACE" up
  33. if [ -n "$gateway" ]; then
  34. add_host_route "$gateway" "$INTERFACE"
  35. if [ -n "$gateway6" ] && ! echo "$gateway6" | grep -q "^fe80:"; then
  36. add_host_route "$gateway6/$netmask6" "$INTERFACE"
  37. fi
  38. if ! qsvc disable-default-route ; then
  39. add_default_route "$gateway" "$INTERFACE"
  40. if [ -n "$gateway6" ]; then
  41. add_default_route "$gateway6" "$INTERFACE"
  42. fi
  43. fi
  44. fi
  45. if [ -z "$primary_dns" ] && [ -n "$gateway" ]; then
  46. primary_dns="$gateway"
  47. fi
  48. if ! is_protected_file /etc/resolv.conf ; then
  49. echo > /etc/resolv.conf
  50. if ! qsvc disable-dns-server ; then
  51. echo "nameserver $primary_dns" > /etc/resolv.conf
  52. echo "nameserver $secondary_dns" >> /etc/resolv.conf
  53. fi
  54. fi
  55. }
  56. configure_network_nm() {
  57. local MAC="$1"
  58. local INTERFACE="$2"
  59. local ip="$3"
  60. local ip6="$4"
  61. local netmask="$5"
  62. local netmask6="$6"
  63. local gateway="$7"
  64. local gateway6="$8"
  65. local primary_dns="$9"
  66. local secondary_dns="${10}"
  67. local prefix
  68. local prefix6
  69. local nm_config
  70. local ip4_nm_config
  71. local ip6_nm_config
  72. local uuid
  73. prefix="$(get_prefix_from_subnet "$netmask")"
  74. prefix6="$netmask6"
  75. uuid="de85f79b-8c3d-405f-a652-${MAC//:/}"
  76. nm_config="/etc/NetworkManager/system-connections/qubes-uplink-$INTERFACE"
  77. cat > "$nm_config" <<__EOF__
  78. [802-3-ethernet]
  79. duplex=full
  80. [ethernet]
  81. mac-address=$MAC
  82. [connection]
  83. id=VM uplink $INTERFACE
  84. uuid=$uuid
  85. type=802-3-ethernet
  86. __EOF__
  87. ip4_nm_config=""
  88. ip6_nm_config=""
  89. if ! qsvc disable-dns-server ; then
  90. ip4_nm_config="${ip4_nm_config}
  91. dns=${primary_dns};${secondary_dns}"
  92. fi
  93. if ! qsvc disable-default-route ; then
  94. ip4_nm_config="${ip4_nm_config}
  95. addresses1=$ip;$prefix;$gateway"
  96. if [ -n "$ip6" ]; then
  97. ip6_nm_config="${ip6_nm_config}
  98. addresses1=$ip6;$prefix6;$gateway6"
  99. fi
  100. else
  101. ip4_nm_config="${ip4_nm_config}
  102. addresses1=$ip;$prefix"
  103. if [ -n "$ip6" ]; then
  104. ip6_nm_config="${ip6_nm_config}
  105. addresses1=$ip6;$prefix6"
  106. fi
  107. fi
  108. if [ -n "$ip4_nm_config" ]; then
  109. cat >> "$nm_config" <<__EOF__
  110. [ipv4]
  111. method=manual
  112. may-fail=false
  113. $ip4_nm_config
  114. __EOF__
  115. else
  116. cat >> "$nm_config" <<__EOF__
  117. [ipv4]
  118. method=ignore
  119. __EOF__
  120. fi
  121. if [ -n "$ip6_nm_config" ]; then
  122. cat >> "$nm_config" <<__EOF__
  123. [ipv6]
  124. method=manual
  125. may-fail=false
  126. $ip6_nm_config
  127. __EOF__
  128. else
  129. cat >> "$nm_config" <<__EOF__
  130. [ipv6]
  131. method=ignore
  132. __EOF__
  133. fi
  134. chmod 600 "$nm_config"
  135. # reload connection
  136. nmcli connection load "$nm_config" || :
  137. }
  138. configure_qubes_ns() {
  139. gateway=$(qubesdb-read /qubes-netvm-gateway)
  140. #netmask=$(qubesdb-read /qubes-netvm-netmask)
  141. primary_dns=$(qubesdb-read /qubes-netvm-primary-dns 2>/dev/null || echo "$gateway")
  142. secondary_dns=$(qubesdb-read /qubes-netvm-secondary-dns)
  143. echo "NS1=$primary_dns" > /var/run/qubes/qubes-ns
  144. echo "NS2=$secondary_dns" >> /var/run/qubes/qubes-ns
  145. /usr/lib/qubes/qubes-setup-dnat-to-ns
  146. }
  147. qubes_ip_change_hook() {
  148. if [ -x /rw/config/qubes-ip-change-hook ]; then
  149. /rw/config/qubes-ip-change-hook
  150. fi
  151. # XXX: Backward compatibility
  152. if [ -x /rw/config/qubes_ip_change_hook ]; then
  153. /rw/config/qubes_ip_change_hook
  154. fi
  155. }
  156. have_qubesdb || exit 0
  157. if [ -n "$INTERFACE" ]; then
  158. if [ "$ACTION" == "add" ]; then
  159. MAC="$(get_mac_from_iface "$INTERFACE")"
  160. if [ -n "$MAC" ]; then
  161. ip="$(/usr/bin/qubesdb-read "/net-config/$MAC/ip" 2> /dev/null)" || ip=
  162. ip6="$(/usr/bin/qubesdb-read "/net-config/$MAC/ip6" 2> /dev/null)" || ip6=
  163. netmask="$(/usr/bin/qubesdb-read "/net-config/$MAC/netmask" 2> /dev/null)" || netmask=
  164. netmask6="$(/usr/bin/qubesdb-read "/net-config/$MAC/netmask6" 2> /dev/null)" || netmask6=
  165. gateway="$(/usr/bin/qubesdb-read "/net-config/$MAC/gateway" 2> /dev/null)" || gateway=
  166. gateway6="$(/usr/bin/qubesdb-read "/net-config/$MAC/gateway6" 2> /dev/null)" || gateway6=
  167. # Handle legacy values
  168. LEGACY_MAC="$(/usr/bin/qubesdb-read /qubes-mac 2> /dev/null)" || LEGACY_MAC=
  169. if [ "$MAC" == "$LEGACY_MAC" ] || [ -z "$LEGACY_MAC" ]; then
  170. if [ -z "$ip" ]; then
  171. ip="$(/usr/bin/qubesdb-read /qubes-ip 2> /dev/null)" || ip=
  172. fi
  173. if [ -z "$ip6" ]; then
  174. ip6="$(/usr/bin/qubesdb-read /qubes-ip6 2> /dev/null)" || ip6=
  175. fi
  176. if [ -z "$gateway" ]; then
  177. gateway="$(/usr/bin/qubesdb-read /qubes-gateway 2> /dev/null)" || gateway=
  178. fi
  179. if [ -z "$gateway6" ]; then
  180. gateway6="$(/usr/bin/qubesdb-read /qubes-gateway6 2> /dev/null)" || gateway6=
  181. fi
  182. fi
  183. if [ -z "$netmask" ]; then
  184. netmask="255.255.255.255"
  185. fi
  186. if [ -z "$netmask6" ]; then
  187. netmask6="128"
  188. fi
  189. primary_dns=$(/usr/bin/qubesdb-read /qubes-primary-dns 2>/dev/null) || primary_dns=
  190. secondary_dns=$(/usr/bin/qubesdb-read /qubes-secondary-dns 2>/dev/null) || secondary_dns=
  191. if [ -n "$ip" ]; then
  192. /sbin/ethtool -K "$INTERFACE" sg off
  193. /sbin/ethtool -K "$INTERFACE" tx off
  194. # If NetworkManager is enabled, let it configure the network
  195. if qsvc network-manager && [ -e /usr/bin/nmcli ]; then
  196. configure_network_nm "$MAC" "$INTERFACE" "$ip" "$ip6" "$netmask" "$netmask6" "$gateway" "$gateway6" "$primary_dns" "$secondary_dns"
  197. else
  198. configure_network "$MAC" "$INTERFACE" "$ip" "$ip6" "$netmask" "$netmask6" "$gateway" "$gateway6" "$primary_dns" "$secondary_dns"
  199. fi
  200. network=$(qubesdb-read /qubes-netvm-network 2>/dev/null) || network=
  201. if [ -n "$network" ]; then
  202. if ! qsvc disable-dns-server; then
  203. configure_qubes_ns
  204. fi
  205. qubes_ip_change_hook
  206. fi
  207. fi
  208. fi
  209. elif [ "$ACTION" == "remove" ]; then
  210. # If exists, we delete NetworkManager configuration file to prevent duplicate entries
  211. nm_config="/etc/NetworkManager/system-connections/qubes-uplink-$INTERFACE"
  212. rm -rf "$nm_config"
  213. fi
  214. fi