What scripts / hooks are triggered in a netvm when a network-client VM starts / shuts down?

[apparatus]

• In NetVMs/ProxyVMs, scripts placed in /rw/config/network-hooks.d will be ran when configuring Qubes interfaces. For each script, the command, vif, vif_type and ip is passed as arguments (see /etc/xen/scripts/vif-route-qubes). For example, consider a PV app qube work with IP 10.137.0.100 and sys-firewall as NetVM. Assuming it’s Xen domain id is arbitrary 12 then, the following script located at /rw/config/network-hooks.d/hook-100.sh in sys-firewall:

  #!/bin/bash

  command="$1"
  vif="$2"
  vif_type="$3"
  ip="$4"

  if [ "$ip" == '10.137.0.100' ]; then
      case "$command" in
          online)
              ip route add 192.168.0.100 via 10.137.0.100
              ;;
          offline)
              ip route del 192.168.0.100
              ;;
      esac
  fi

will be executed with arguments online vif12.0 vif 10.137.0.100 when starting work. Please note that in case of an HVM, the script will be called twice - once with vif_type vif, then with vif_type vif_ioemu (and different interface names). As long as the ioemu interface exists, it should be preferred (up to the hook script). When the VM decides to use a PV interface (vif_type vif), the ioemu one will be unplugged.

Config files

@tannerlambert

associate those nic’s to the client VMs (if that information is only available in dom0 thats ok)

You can create a script in dom0 that will create the associated list “IP address - qube name” and pass it to your custom firewall VM.
You can also add a custom Qubes RPC service that could be called from sys-custom-fw qube script in /rw/config/network-hooks.d on new qube connect/disconnect event to request the dom0 to update the connected qubes associated list:

Qrexec: secure communication across domains

You can use QubesDB to pass the list to your custom firewall VM, e.g:
In dom0:

qubesdb-write -d sys-custom-fw /connected_qubes_list/10.138.30.88 myqube1

Then read the list in sys-custom-fw:

# get the list of IP addresses of qubes
qubesdb-list /connected_qubes_list/
# read the qube name associated with this IP address
qubesdb-read /connected_qubes_list/10.138.30.88