#!/usr/bin/bash --
#============================================================================
# /etc/xen/vif-route-qubes
#
# Script for configuring a vif in routed mode.
# The hotplugging system will call this script if it is specified either in
# the device configuration given to Xend, or the default Xend configuration
# in /etc/xen/xend-config.sxp.  If the script is specified in neither of those
# places, then vif-bridge is the default.
#
# Usage:
# vif-route (add|remove|online|offline)
#
# Environment vars:
# vif         vif interface name (required).
# XENBUS_PATH path to this device's details in the XenStore (required).
#
# Read from the store:
# ip      list of IP networks for the vif, space-separated (default given in
#         this script).
#============================================================================

set -e
dir=$(dirname "$0") || exit
# shellcheck disable=SC1091,SC1090
. "$dir/vif-common.sh"

set -o pipefail
#main_ip=$(dom0_ip)

# Network Hooks for triggering supplementary actions on AppVM connect
network_hooks() {
    local command="$1"
    local vif="$2"
    local addr="$3"

    local vif_type
    vif_type="$(xenstore-read "${XENBUS_PATH}/type")"

    if [ -d /rw/config/network-hooks.d ]; then
        for hook in /rw/config/network-hooks.d/*
        do
            if [ -x "$hook" ]; then
                log debug "Executing network-hook $(basename "$hook")..."
                do_without_error "${hook}" "${command}" "${vif}" "${vif_type}" "${addr}"
            fi
        done
    fi
}

conntrack_purge () {
    local n output deleted msg
    n='(0|[1-9][0-9]*)' msg='flow entries have been deleted\.$'
    deleted="^conntrack v$n\\.$n\\.$n \\(conntrack-tools\\): $n $msg"
    output=$(LC_ALL=C exec conntrack -D "$@" 2>&1 >/dev/null) || :
    [[ "$output" =~ $deleted ]]
}

# shellcheck disable=SC2154
if [ "${ip}" ]; then
    # get first IPv4 and first IPv6
    for addr in ${ip}; do
        if [ -z "$ip4" ] && [[ "$addr" = *.* ]]; then
            ip4="$addr"
        elif [ -z "$ip6" ] && [[ "$addr" = *:* ]]; then
            ip6="$addr"
        fi
    done
    # IPs as seen by this VM
    netvm_ip="$ip4"
    netvm_gw_ip=$(qubesdb-read /qubes-netvm-gateway)
    netvm_gw_ip6=$(qubesdb-read /qubes-netvm-gateway6 || :)
    netvm_dns1_ip=$(qubesdb-read /qubes-netvm-primary-dns)
    netvm_dns2_ip=$(qubesdb-read /qubes-netvm-secondary-dns)

    back_ip="$netvm_gw_ip"
    back_ip6="$netvm_gw_ip6"

    # IPs as seen by the VM - if other than $netvm_ip
    appvm_gw_ip="$(qubesdb-read "/mapped-ip/$ip4/visible-gateway" 2>/dev/null || :)"
    appvm_ip="$(qubesdb-read "/mapped-ip/$ip4/visible-ip" 2>/dev/null || :)"
fi

readonly max_domid=32752

# This comment used to say, “if domid is 0 something is seriously wrong, so
# don’t check for that case”.  Indeed, dom0 should never have an Ethernet
# connection in a production QubesOS system.
#
# However, giving dom0 an Ethernet connection can be extremely useful in
# insecure test environments, where there is simply no data worth compromising.
# In fact, some test setups, including OpenQA, actually do this.  Therefore, we
# now handle this case correctly, even though it is by definition a security
# risk.
if ! [[ $vif =~ ^vif(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
    printf 'Bad interface name %q\n' "$vif">&2
    exit 1
fi

domid=${BASH_REMATCH[1]}

# metric must be positive, but prefer later interface
#  32752 is max XID aka domid
#  the length check ensures there is no overflow
if (( "${#domid}" > "${#max_domid}" || domid > max_domid )); then
    printf %s\\n "domid $domid too large"
    exit 1
fi
metric=$(( max_domid - domid ))

# shellcheck disable=SC2154
case "$command" in
    online)
        echo 1 >"/proc/sys/net/ipv4/conf/${vif}/proxy_arp"
        ipcmd='add'
        nftables_cmd=add
        cmdprefix=''
        read -r ipv6_disabled < "/proc/sys/net/ipv6/conf/$vif/disable_ipv6" || ipv6_disabled=1
        interfaces=''
        separator=''

        for i in /proc/sys/net/ipv4/conf/*; do
            i=${i:24}
            case $i in (all|default|*[!A-Za-z0-9._]*) continue;; esac
            interfaces+="$separator$i"
            separator=', '
        done
        if [[ -n "$separator" ]]; then
            nft "
add table inet qubes-nat-accel
delete table inet qubes-nat-accel
table inet qubes-nat-accel {
   flowtable qubes-accel {
      hook ingress priority filter
      devices = { $interfaces }
   }
   chain qubes-accel {
      # run after other filter hooks
      type filter hook forward priority filter + 5; policy accept;
      meta l4proto { tcp, udp } iifgroup 2 oifgroup 1 flow add @qubes-accel
      counter
   }
}"
        fi
        ;;
    offline)
        if [ -e /sys/class/net/"$vif" ]; then
            do_without_error ifdown "${vif}"
        fi
        ipcmd='del'
        nftables_cmd=delete
        cmdprefix='do_without_error'
        # cleanup IPv6 config even if _now_ it is disabled
        ipv6_disabled=0
        ;;
esac

# Apply NAT if IP visible from the VM is different than the "real" one
# See vif-qubes-nat.sh for details
# XXX: supported only for the first IPv4 address, IPv6 is dropped if this
# feature is enabled
if [ -n "$appvm_ip" ] && [ -n "$appvm_gw_ip" ] && [ "$appvm_ip" != "$netvm_ip" ]; then
    # shellcheck source=network/vif-qubes-nat.sh
    . "$dir/vif-qubes-nat.sh"
fi

case $- in
(*e*) :;;
(*) echo '-e not set'>&2; exit 1;;
esac

qubesdb_read_bool () {
    local value status=0
    value=$(qubesdb-read -- "$1" 2>/dev/null) || status=$?
    case $status in
    (0) if test -n "$value"; then return 0; else return 1; fi;;
    (2) return "$2";;
    (*) fatal "unexpected return value $status from qubesdb-read";;
    esac
}

# Harden against various attacks if requested
if [[ "$command" = 'online' ]] &&
    qubesdb_read_bool /qubes-service/harden-network-interfaces 1; then
    /usr/lib/systemd/systemd-sysctl \
        "--prefix=/net/ipv4/conf/all" \
        "--prefix=/net/ipv4/neigh/all" \
        "--prefix=/net/ipv6/conf/all" \
        "--prefix=/net/ipv6/neigh/all" \
        "--prefix=/net/ipv4/conf/$vif" \
        "--prefix=/net/ipv4/neigh/$vif" \
        "--prefix=/net/ipv6/conf/$vif" \
        "--prefix=/net/ipv6/neigh/$vif" \
        -- \
        /etc/sysctl.d/81-qubes.conf.optional
fi

# add anti-spoofing rules before enabling the interface
if [ "${ip}" ]; then
    peer_mac=$(xenstore-read -- "$XENBUS_PATH/mac") ||
        fatal 'cannot obtain peer MAC from Xenstore'
    readonly peer_mac
    [[ "$peer_mac" =~ ^[0-9a-f]{2}(:[0-9a-f]{2}){5}$ ]] ||
        fatal "bad mac address $peer_mac"

    # If we’ve been given a list of IP addresses, then add routes from us to
    # the VMs we serve using those addresses.
    for addr in ${ip};
    do
        if [[ "$addr" = *:* ]]; then
            ipt=ip6
        else
            ipt=ip
        fi
        if ! conntrack_purge -s "$addr" || ! conntrack_purge -d "$addr"; then
            printf 'Cannot purge stale conntrack entries for %q\n' "$addr">&2
            exit 1
        fi
        # Add neighbour entries
        if [[ "$command" = 'online' ]]; then
            ip -- neighbour add to "$addr" \
                dev "$vif" lladdr "$peer_mac" nud permanent
        fi
        nft "$nftables_cmd element $ipt qubes allowed { \"$vif\" . $addr }
$nftables_cmd element $ipt qubes downstream { $addr }"
    done
    # if no IPv6 is assigned, IPv6 traffic on the interface is
    # implicitly considered spoofed as there is no entry in the
    # "allowed" map
fi

if [[ "$command" = "online" ]]; then
    ip link set dev "${vif}" group 2 up
fi

if [ "${ip}" ]; then
    # If we've been given a list of IP addresses, then add routes from dom0 to
    # the guest using those addresses.
    for addr in ${ip};
    do
        if [[ "$addr" = *:* ]] && [[ "$ipv6_disabled" != '0' ]]; then
            log error "Cannot set IPv6 route to ${addr}, IPv6 disabled in the kernel"
            continue
        fi
        if [ "$ipcmd" = "add" ] || [ -e /sys/class/net/"$vif" ]; then
            ${cmdprefix} ip route "${ipcmd}" "${addr}" dev "${vif}" metric "$metric"
        fi

        network_hooks "${command}" "${vif}" "${addr}"
    done
    if [ "$ipcmd" = "add" ] || [ -e /sys/class/net/"$vif" ]; then
        ${cmdprefix} ip addr "${ipcmd}" "${back_ip}/32" dev "${vif}"
    fi
    if [[ -n "${back_ip6}" ]] && [[ "${back_ip6}" != "fe80:"* ]] && [[ "$ipv6_disabled" = '0' ]]; then
        if [ "$ipcmd" = "add" ] || [ -e /sys/class/net/"$vif" ]; then
            ${cmdprefix} ip addr "${ipcmd}" "${back_ip6}/128" dev "${vif}"
            echo 1 >"/proc/sys/net/ipv6/conf/${vif}/proxy_ndp"
        fi
    fi
else
    network_hooks "${command}" "${vif}"
fi

log debug "Successful vif-route-qubes $command for $vif."
if [[ "$command" = "online" ]]; then
  success
fi
