remove duplicate documentation, improve synopsis

[newns] / newns

diff --git a/newns b/newns
index 31f1b528c80bdab325c17631adf5c6245c745895..dbe6598c19f3642b29e698c9d75111fb7a369359 100755 (executable)
--- a/newns
+++ b/newns
@@ -37,15 +37,18 @@ fi
 
 usage() {
     cat <<EOF
 
 usage() {
     cat <<EOF

-usage: ${0##*/} [OPTS] start|stop NETNS_NAME
-Setup new or systemd created network namespace with nat and mount namespace
+usage: ${0##*/} [OPTS] start|stop NS_NAME
+Setup & optionally create, a network namespace with nat and a mount namespace

 
 

--c, --create    Create network namespace. For running outside systemd private net.
+-c, --create    Create a named network namespace. When running from
+                the same network namespace as pid 1, this is set automatically.
+                This is the case when running outside a systemd created
+                private network.

 -h, --help      Show this help and exit.
 
 -h, --help      Show this help and exit.
 

-From within systemd network namespace, nat it to the outside. If given
--c, or if in the default network namespace, create a named network
-namepace natted to the current netns.
+From within a systemd network namespace, nat it to the outside. This
+would be called from ExecStartPre, and or subsequent units called with
+JoinsNamespaceOf= and PrivateNetwork=true.

 
 Uses /24 network, finding the first locally unused one starting at
 10.173.0.
 
 Uses /24 network, finding the first locally unused one starting at
 10.173.0.


@@ -54,7 +57,7 @@ Also create a named mount namespace under /root/mount_namespaces, so we
 can alter some system config for this namespace. Subsequent systemd
 command lines would be prefixed with:
 
 can alter some system config for this namespace. Subsequent systemd
 command lines would be prefixed with:
 

-/usr/bin/nsenter --mount=/root/mount_namespaces/NETNS_NAME
+/usr/bin/nsenter --mount=/root/mount_namespaces/NS_NAME

 
 Note, this means that they can't run as unpriveledged users, but once
 systemd 233 comes out, it will have a bind mount option from within unit
 
 Note, this means that they can't run as unpriveledged users, but once
 systemd 233 comes out, it will have a bind mount option from within unit


@@ -68,8 +71,16 @@ https://iankelling.org/git/?p=errhandle, set ERRHANDLE_PATH, or put it
 in a directory adjacent to the absolute, resolved directory this file is
 in.
 
 in a directory adjacent to the absolute, resolved directory this file is
 in.
 

-Background: "ip netns new ..." also does a mount namespace, then bind
-mounts each file/dir in /etc/netns/NETNS_NAME to /etc/NETNS_NAME. Note,
+Background:
+
+This script does not make the namespace be named like ip does, because
+the naming is not necessary, although it could have been done with some
+more work. For debugging and joining the namespace with a bash shell, I
+use nsenter -n -m -t $(pgrep PROCESS_IN_NAMESPACE) bash.  Note: if I
+knew how to easily ask systemd what pid a unit has, i would do that.
+
+"ip netns new ..." also does a mount namespace, then bind
+mounts each file/dir in /etc/netns/NS_NAME to /etc/NS_NAME. Note,

 for openvpn having it's own resolv.conf by using it's user script which
 calls resolvconf, this doesn't help much. What we actually want to do is
 copy /run/resolvconf somehwere then bind mount it on top of
 for openvpn having it's own resolv.conf by using it's user script which
 calls resolvconf, this doesn't help much. What we actually want to do is
 copy /run/resolvconf somehwere then bind mount it on top of


@@ -82,7 +93,7 @@ EOF
 }
 
 
 }
 
 

-## begin arg parsing ##
+#### begin arg parsing ####

 create=false
 temp=$(getopt -l help,create hc "$@") || usage 1
 eval set -- "$temp"
 create=false
 temp=$(getopt -l help,create hc "$@") || usage 1
 eval set -- "$temp"


@@ -99,11 +110,10 @@ if (( $# != 2 )); then
 fi
 
 action=$1
 fi
 
 action=$1

-nn=$2 # network namespace / namespace name
-## end arg parsing ##
-
-## begin sanity checking ##
+nn=$2 # namespace name
+#### end arg parsing ####

 
 

+#### begin sanity checking ####

 install_error=false
 if ! type -p ip &>/dev/null; then
     echo "please install the iproute2 package"
 install_error=false
 if ! type -p ip &>/dev/null; then
     echo "please install the iproute2 package"


@@ -116,8 +126,7 @@ fi
 if $install_error; then
     exit 1
 fi
 if $install_error; then
     exit 1
 fi

-
-##   end sanity checking ##
+####   end sanity checking ####

 
 
 v0=veth0-$nn
 
 
 v0=veth0-$nn


@@ -128,10 +137,10 @@ if ! $create && [[ $(readlink /proc/self/ns/net) == "$(readlink /proc/1/ns/net)"
     create=true
 fi
 
     create=true
 fi
 

+# make the default network namespace be named

 target=/run/netns/default
 if [[ ! -e $target && ! -L $target ]]; then
     mkdir -p /run/netns
 target=/run/netns/default
 if [[ ! -e $target && ! -L $target ]]; then
     mkdir -p /run/netns

-    # make the default network namespace be named

     ln -s /proc/1/ns/net $target
 fi
 
     ln -s /proc/1/ns/net $target
 fi
 


@@ -146,7 +155,7 @@ fi
 dexec() { ip netns exec default "$@"; }
 
 
 dexec() { ip netns exec default "$@"; }
 
 

-# head -n1 is defensive. Not sure if there is some weird feature
+# background: head -n1 is defensive. Not sure if there is some weird feature

 # for 2 routes to be 0/0.
 gateway_if=$(ipd route list exact 0/0 | head -n1| sed -r 's/.*\s(\S+)\s*$/\1/')
 nat() { dexec iptables -t nat $1 POSTROUTING -o $gateway_if -j MASQUERADE \
 # for 2 routes to be 0/0.
 gateway_if=$(ipd route list exact 0/0 | head -n1| sed -r 's/.*\s(\S+)\s*$/\1/')
 nat() { dexec iptables -t nat $1 POSTROUTING -o $gateway_if -j MASQUERADE \


@@ -168,13 +177,13 @@ find_network() {
 }
 
 start() {
 }
 
 start() {

-

     find_network
     if ! $found; then
         echo "$0: error: no open network found"
         exit 1
     fi
 
     find_network
     if ! $found; then
         echo "$0: error: no open network found"
         exit 1
     fi
 

+    #### begin mount namespace setup ####

     mkdir -p /root/mount_namespaces
     if ! mountpoint /root/mount_namespaces >/dev/null; then
         mount --bind /root/mount_namespaces /root/mount_namespaces
     mkdir -p /root/mount_namespaces
     if ! mountpoint /root/mount_namespaces >/dev/null; then
         mount --bind /root/mount_namespaces /root/mount_namespaces


@@ -186,6 +195,7 @@ start() {
     if ! mountpoint /root/mount_namespaces/$nn >/dev/null; then
         unshare --mount=/root/mount_namespaces/$nn
     fi
     if ! mountpoint /root/mount_namespaces/$nn >/dev/null; then
         unshare --mount=/root/mount_namespaces/$nn
     fi

+    ####   end mount namespace setup ####

 
 
     if $create; then
 
 
     if $create; then


@@ -193,8 +203,6 @@ start() {
         ip -n $nn link set dev lo up
     fi
 
         ip -n $nn link set dev lo up
     fi
 

-
-

     echo 1 | dexec dd of=/proc/sys/net/ipv4/ip_forward 2>/dev/null
 
     _errcatch_cleanup=stop
     echo 1 | dexec dd of=/proc/sys/net/ipv4/ip_forward 2>/dev/null
 
     _errcatch_cleanup=stop