X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=newns;h=e4d1f8622c971fe7a6882f54b3783fd9057ca5e8;hb=8448af56da3cdaf6e50b075b322031e8edeb9760;hp=2896cf21d942162ccfe4d2472af2e962450ad937;hpb=b4463d1e1bfd7d54451005aff0f6ae1f649042d1;p=newns

diff --git a/newns b/newns
index 2896cf2..e4d1f86 100755
--- a/newns
+++ b/newns
@@ -38,12 +38,14 @@ fi
 usage() {
     cat <<EOF
 usage: ${0##*/} [OPTS] start|stop NS_NAME
-Nat a network namespace. create a mount ns. systemd friendly
+Nat a network namespace. systemd friendly
+
+Also creates a mount namespace with a cloned /run/resolvconf.
 
 -c, --create    Create a named network namespace. When running from
                 the same network namespace as pid 1, this is set automatically.
-                This is the case when running outside a systemd created
-                private network.
+                A systemd created private network is in a network namespace
+                different than pid 1.
 -n NETWORK      x.x.x /24 private network to use. If not specified, uses
                 the first one starting at 10.173.1
 -h, --help      Show this help and exit.
@@ -85,6 +87,8 @@ calls resolvconf, this doesn't help much. What we actually want to do is
 copy /run/resolvconf somehwere then bind mount it on top of
 /run/resolvconf.
 
+Note: for debugging, adding set -x is a pretty good option.
+
 Please email me if you have a patches, bugs, feedback, or republish this
 somewhere else: Ian Kelling <ian@iankelling.org>.
 EOF
@@ -147,17 +151,22 @@ fi
 
 ipd() { ip -n default "$@"; }
 if $create; then
+    # run ip in the network namespace
     ipnn() { ip -n $nn "$@"; }
 else
     # we are already in the network namespace and it's unnamed.
+    # run ip in the network namespace
     ipnn() { ip "$@"; }
 fi
+# default network namespace exec
 dexec() { ip netns exec default "$@"; }
+# mount namespace exec
+mexec() { /usr/bin/nsenter --mount=/root/mount_namespaces/$nn "$@"; }
 
 
 # background: head -n1 is defensive. Not sure if there is some weird feature
 # for 2 routes to be 0/0.
-gateway_if=$(ipd route list exact 0/0 | head -n1| sed -r 's/.*\s(\S+)\s*$/\1/')
+gateway_if=$(ipd route list exact 0/0 | head -n1| sed -r 's/.*dev\s+(\S+).*/\1/')
 nat() { dexec iptables -t nat $1 POSTROUTING -o $gateway_if -j MASQUERADE \
               -m comment --comment "systemd network namespace nat"; }
 
@@ -190,14 +199,28 @@ start() {
     mkdir -p /root/mount_namespaces
     if ! mountpoint /root/mount_namespaces >/dev/null; then
         mount --bind /root/mount_namespaces /root/mount_namespaces
-        mount --make-private /root/mount_namespaces
     fi
+    # note: This is outside the mount condition because I've mysteriously
+    # had this become shared instead of private, perhaps it
+    # got remounted somehow and lost the setting.
+    mount --make-private /root/mount_namespaces
     if [[ ! -e /root/mount_namespaces/$nn ]]; then
         touch /root/mount_namespaces/$nn
     fi
     if ! mountpoint /root/mount_namespaces/$nn >/dev/null; then
-        unshare --mount=/root/mount_namespaces/$nn
+        # documentation on propagation is a bit weird because it
+        # confusingly talks about binds, namespaces, and mirrors (which
+        # seems to be just another name for bind), shared subtrees
+        # (which seems to a term for binds and namespaces), and does not
+        # properly specify whether the documentation applies to binds,
+        # namespaces, or both. Notably, propagation for binds is marked
+        # on the original mount point, and propagation for a mount
+        # namespace is marked on mounts within the namespace.  Here, we
+        # specify that we want mount changes propagated to us, but not
+        # back.
+        unshare --propagation slave --mount=/root/mount_namespaces/$nn /bin/true
     fi
+
     ####   end mount namespace setup ####
 
 
@@ -208,6 +231,11 @@ start() {
 
     echo 1 | dexec dd of=/proc/sys/net/ipv4/ip_forward 2>/dev/null
 
+    # docker helpfully changes the default FORWARD to drop...
+    if ! dexec iptables -C FORWARD -i $v0 -j ACCEPT &>/dev/null; then
+        dexec iptables -A FORWARD -i $v0 -j ACCEPT
+    fi
+
     _errcatch_cleanup=stop
     ipnn link add $v0 type veth peer name $v1
     ipnn link set $v0 netns default
@@ -218,6 +246,33 @@ start() {
     ipnn link set $v1 up
     ipnn route add default via $network.1
 
+    ###### begin setup resolvconf
+    resolv_copy=/root/resolvconf-$nn
+
+    # this condition should never happen, just coding defensively
+    if mexec mountpoint /run/resolvconf &>/dev/null; then
+        mexec umount /run/resolvconf
+    fi
+    cp -aT /run/resolvconf $resolv_copy
+    if ! mexec mount -o bind $resolv_copy /run/resolvconf; then
+        echo "error: resolv-conf bindmount failed"
+        exit 1
+    fi
+    # if running dnsmasq, we have 127.0.0.1 for dns, but it can't listen on the loopback
+    # in the network namespace, so adjust the address.
+    if mexec [ -s /run/resolvconf/interface/lo.dnsmasq ]; then
+        mexec sed --follow-symlinks -i "s/nameserver 127\..*/nameserver $network.1/" /run/resolvconf/interface/lo.dnsmasq
+        mexec resolvconf -u
+    fi
+    # background: if we did this in openvpn's resolv-conf script, we could guard it in
+    # if capsh --print|grep '\bcap_sys_admin\b' &>/dev/null
+    # and we could get $nn by
+    # config_basename=${config%%.*}
+    # config_basename=${config_basename##*/}
+    # but dnsmasq forces us to do it earlier.
+    ######  end setup resolvconf
+
+
 }
 
 stop() {
@@ -229,9 +284,16 @@ stop() {
     if ! $existing; then
         if nat -C &>/dev/null; then nat -D; fi
     fi
+    dexec iptables -D FORWARD -i $v0 -j ACCEPT ||:
     if $create; then
         ip netns del $nn
     fi
+
+    # not sure this is necessary since we are tearing down the mount namespace
+    if mexec mountpoint /run/resolvconf &>/dev/null; then
+        mexec umount /run/resolvconf
+    fi
+
     if mountpoint /root/mount_namespaces/$nn >/dev/null; then
         umount /root/mount_namespaces/$nn
     fi