From 5923741c83471ce06050c8ba38764b35019aef43 Mon Sep 17 00:00:00 2001 From: Rafal Wojtczuk Date: Mon, 9 May 2011 16:23:52 +0200 Subject: [PATCH] qubes_netwatcher: add a note about NETCFG untrusted origin --- proxyvm/bin/qubes_netwatcher | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/proxyvm/bin/qubes_netwatcher b/proxyvm/bin/qubes_netwatcher index a256807..42ee4a1 100755 --- a/proxyvm/bin/qubes_netwatcher +++ b/proxyvm/bin/qubes_netwatcher @@ -13,11 +13,12 @@ trap 'exit 0' SIGTERM while true; do NET_DOMID=$(/usr/bin/xenstore-read qubes_netvm_domid) if [[ -n "$NET_DOMID" ]] && [[ $NET_DOMID -gt 0 ]]; then - NETCFG=$(/usr/bin/xenstore-read /local/domain/$NET_DOMID/qubes_netvm_external_ip) - if [[ "$NETCFG" != "$CURR_NETCFG" ]]; then + UNTRUSTED_NETCFG=$(/usr/bin/xenstore-read /local/domain/$NET_DOMID/qubes_netvm_external_ip) + # UNTRUSTED_NETCFG is not parsed in any way + if [[ "$UNTRUSTED_NETCFG" != "$CURR_NETCFG" ]]; then /sbin/service qubes_firewall stop /sbin/service qubes_firewall start - CURR_NETCFG="$NETCFG" + CURR_NETCFG="$UNTRUSTED_NETCFG" /usr/bin/xenstore-write qubes_netvm_external_ip "$CURR_NETCFG" fi