suzanne.soy/qubes-core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

network: support for not setting DNS and/or default gateway (v2)

Browse Source 
This patch introduces two new qvm-services:
 - disable-default-route
 - disable-dns-server
Both disabled by default. You can enable any of them to not set default
route and/or DNS servers in the VM. Those settings have no effect on
NetVM, where such settings are controlled by NetworkManager.

This is based on patch sent by Joonas Lehtonen
<joonas.lehtonen@openmailbox.org>
https://groups.google.com/d/msgid/qubes-devel/54C7FB59.2020603%40openmailbox.org
This commit is contained in:
Marek Marczykowski-Górecki 2015-01-29 01:10:34 +01:00
parent cbf77fd005
commit a714162dfe
3 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
network/setup-ip
View File

@ -6,6 +6,12 @@ else
XENSTORE_READ="/usr/bin/xenstore-read"
fi
# setup-ip is potentially invoked before qubes-sysinit.sh is done, therefore
# we perform our xenstore reads here instead of relying on qvm-service
# files under /var/run/qubes-service/
disablegw=`$XENSTORE_READ qubes-service/disable-default-route 2> /dev/null`
disabledns=`$XENSTORE_READ qubes-service/disable-dns-server 2> /dev/null`
ip=`$XENSTORE_READ qubes-ip 2> /dev/null`
if [ x$ip != x ]; then
netmask=`$XENSTORE_READ qubes-netmask`
@ -14,13 +20,13 @@ if [ x$ip != x ]; then
/sbin/ifconfig $INTERFACE $ip netmask 255.255.255.255
/sbin/ifconfig $INTERFACE up
/sbin/route add -host $gateway dev $INTERFACE
if [ -f /var/run/qubes-service/set-default-route ]; then
if [ "x$disablegw" != "x1" ]; then
/sbin/route add default gw $gateway
fi
/sbin/ethtool -K $INTERFACE sg off
/sbin/ethtool -K $INTERFACE tx off
echo > /etc/resolv.conf
if [ -f /var/run/qubes-service/set-dns-server ]; then
if [ "x$disabledns" != "x1" ]; then
echo "nameserver $gateway" > /etc/resolv.conf
echo "nameserver $secondary_dns" >> /etc/resolv.conf
fi
@ -45,10 +51,10 @@ method=ignore
method=manual
may-fail=false
__EOF__
if [ -f /var/run/qubes-service/set-dns-server ]; then
if [ "x$disabledns" != "x1" ]; then
echo "dns=$gateway;$secondary_dns" >> $nm_config
fi
if [ -f /var/run/qubes-service/set-default-route ]; then
if [ "x$disablegw" != "x1" ]; then
echo "address1=$ip/32,$gateway" >> $nm_config
else
echo "address1=$ip/32" >> $nm_config
@ -56,7 +62,7 @@ __EOF__
chmod 600 $nm_config
fi
network=$($XENSTORE_READ qubes-netvm-network 2>/dev/null)
if [ "x$network" != "x" ] && [ -f /var/run/qubes-service/set-dns-server ]; then
if [ "x$network" != "x" ] && [ "x$disabledns" != "x1" ]; then
gateway=$($XENSTORE_READ qubes-netvm-gateway)
netmask=$($XENSTORE_READ qubes-netvm-netmask)
secondary_dns=$($XENSTORE_READ qubes-netvm-secondary-dns)

2
vm-init.d/qubes-core
View File

@ -38,8 +38,6 @@ start()
echo "ZONE=\"$timezone\"" >> /etc/sysconfig/clock
fi
touch /var/run/qubes-service/set-default-route
touch /var/run/qubes-service/set-dns-server
yum_proxy_setup=$(/usr/bin/xenstore-read qubes-service/yum-proxy-setup 2> /dev/null || /usr/bin/xenstore-read qubes-service/updates-proxy-setup 2>/dev/null )
type=$(/usr/bin/xenstore-read qubes-vm-type)
if [ "$yum_proxy_setup" != "0" ] || [ -z "$yum_proxy_setup" -a "$type" == "TemplateVM" ]; then

9
vm-systemd/qubes-sysinit.sh
View File

@ -1,12 +1,11 @@
#!/bin/bash
# List of services enabled by default (in case of absence of xenstore entry)
DEFAULT_ENABLED_ALL="set-default-route set-dns-server"
DEFAULT_ENABLED_NETVM="$DEFAULT_ENABLED_ALL network-manager qubes-network qubes-update-check qubes-updates-proxy"
DEFAULT_ENABLED_PROXYVM="$DEFAULT_ENABLED_ALL meminfo-writer qubes-network qubes-firewall qubes-netwatcher qubes-update-check"
DEFAULT_ENABLED_APPVM="$DEFAULT_ENABLED_ALL meminfo-writer cups qubes-update-check"
DEFAULT_ENABLED_NETVM="network-manager qubes-network qubes-update-check qubes-updates-proxy"
DEFAULT_ENABLED_PROXYVM="meminfo-writer qubes-network qubes-firewall qubes-netwatcher qubes-update-check"
DEFAULT_ENABLED_APPVM="meminfo-writer cups qubes-update-check"
DEFAULT_ENABLED_TEMPLATEVM="$DEFAULT_ENABLED_APPVM updates-proxy-setup"
DEFAULT_ENABLED="$DEFAULT_ENABLED_ALL meminfo-writer"
DEFAULT_ENABLED="meminfo-writer"
XS_READ=/usr/bin/xenstore-read
[ -x /usr/sbin/xenstore-read ] && XS_READ=/usr/sbin/xenstore-read