iankelling.org Git - newns/blob - newns

   1 #!/bin/bash
   2 # Copyright (C) 2017 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16
  17 [[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
  18
  19 if [[ ! $ERRHANDLE_PATH ]]; then
  20     ERRHANDLE_PATH=$(readlink -f "${BASH_SOURCE}")
  21     ERRHANDLE_PATH=$(readlink -f ${ERRHANDLE_PATH%/*}/../errhandle)
  22 fi
  23 err_sourced=true
  24 for p in $ERRHANDLE_PATH/{errcatch-function,bash-trace-function}; do
  25     if [[ -e $p ]]; then
  26         source $p
  27     else
  28         err_sourced=false
  29     fi
  30 done
  31 if $err_sourced; then
  32     errcatch
  33 else
  34     set -eE -o pipefail
  35     trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  36 fi
  37
  38 usage() {
  39     cat <<EOF
  40 usage: ${0##*/} [OPTS] start|stop NS_NAME
  41 Setup new or systemd created network namespace with nat and mount namespace
  42
  43 -c, --create    Create network namespace. For running outside systemd private net.
  44 -h, --help      Show this help and exit.
  45
  46 From within a systemd network namespace, nat it to the outside. This
  47 would be called from ExecStartPre, and or subsequent units called with
  48 JoinsNamespaceOf= and PrivateNetwork=true.
  49
  50 If given -c, or if in the default network namespace, create a named
  51 network namepace natted to the current netns.
  52
  53 Uses /24 network, finding the first locally unused one starting at
  54 10.173.0.
  55
  56 Also create a named mount namespace under /root/mount_namespaces, so we
  57 can alter some system config for this namespace. Subsequent systemd
  58 command lines would be prefixed with:
  59
  60 /usr/bin/nsenter --mount=/root/mount_namespaces/NS_NAME
  61
  62 Note, this means that they can't run as unpriveledged users, but once
  63 systemd 233 comes out, it will have a bind mount option from within unit
  64 files, so the mount namespace won't be needed for most use cases, and I
  65 will update the script to that the mount namespace not created unless a
  66 flag is passed in. Patch welcome to add that flag before then.
  67
  68 A recommmended dependency of this script is my other repo named "errhandle",
  69 which prints stack trace on error, and calls a cleanup function:
  70 https://iankelling.org/git/?p=errhandle, set ERRHANDLE_PATH, or put it
  71 in a directory adjacent to the absolute, resolved directory this file is
  72 in.
  73
  74 Background: "ip netns new ..." also does a mount namespace, then bind
  75 mounts each file/dir in /etc/netns/NS_NAME to /etc/NS_NAME. Note,
  76 for openvpn having it's own resolv.conf by using it's user script which
  77 calls resolvconf, this doesn't help much. What we actually want to do is
  78 copy /run/resolvconf somehwere then bind mount it on top of
  79 /run/resolvconf.
  80
  81 Please email me if you have a patches, bugs, feedback, or republish this
  82 somewhere else: Ian Kelling <ian@iankelling.org>.
  83 EOF
  84     exit ${1:-0}
  85 }
  86
  87
  88 #### begin arg parsing ####
  89 create=false
  90 temp=$(getopt -l help,create hc "$@") || usage 1
  91 eval set -- "$temp"
  92 while true; do
  93     case $1 in
  94         -c|--create) create=true; shift ;;
  95         -h|--help) usage ;;
  96         --) shift; break ;;
  97         *) echo "$0: Internal error!" ; exit 1 ;;
  98     esac
  99 done
 100 if (( $# != 2 )); then
 101     usage 1
 102 fi
 103
 104 action=$1
 105 nn=$2 # namespace name
 106 #### end arg parsing ####
 107
 108 #### begin sanity checking ####
 109 install_error=false
 110 if ! type -p ip &>/dev/null; then
 111     echo "please install the iproute2 package"
 112     install_error=true
 113 fi
 114 if ! type -p iptables &>/dev/null; then
 115     echo "please install the iptables package"
 116     install_error=true
 117 fi
 118 if $install_error; then
 119     exit 1
 120 fi
 121 ####   end sanity checking ####
 122
 123
 124 v0=veth0-$nn
 125 v1=veth1-$nn
 126 ip_base=10.173
 127
 128 if ! $create && [[ $(readlink /proc/self/ns/net) == "$(readlink /proc/1/ns/net)" ]]; then
 129     create=true
 130 fi
 131
 132 # make the default network namespace be named
 133 target=/run/netns/default
 134 if [[ ! -e $target && ! -L $target ]]; then
 135     mkdir -p /run/netns
 136     ln -s /proc/1/ns/net $target
 137 fi
 138
 139
 140 ipd() { ip -n default "$@"; }
 141 if $create; then
 142     ipnn() { ip -n $nn "$@"; }
 143 else
 144     # we are already in the network namespace and it's unnamed.
 145     ipnn() { ip "$@"; }
 146 fi
 147 dexec() { ip netns exec default "$@"; }
 148
 149
 150 # background: head -n1 is defensive. Not sure if there is some weird feature
 151 # for 2 routes to be 0/0.
 152 gateway_if=$(ipd route list exact 0/0 | head -n1| sed -r 's/.*\s(\S+)\s*$/\1/')
 153 nat() { dexec iptables -t nat $1 POSTROUTING -o $gateway_if -j MASQUERADE \
 154               -m comment --comment "systemd network namespace nat"; }
 155
 156 find_network() {
 157     found=false
 158     existing=false
 159     ips="$(ipd addr show | awk '$1 == "inet" {print $2}')"
 160     for ((i=0; i <= 254; i++)); do
 161         network=$ip_base.$i
 162         if printf "%s\n" "$ips" | grep "^${network//./\\.}" >/dev/null; then
 163             existing=true
 164         else
 165             found=true
 166             break
 167         fi
 168     done
 169 }
 170
 171 start() {
 172     find_network
 173     if ! $found; then
 174         echo "$0: error: no open network found"
 175         exit 1
 176     fi
 177
 178     #### begin mount namespace setup ####
 179     mkdir -p /root/mount_namespaces
 180     if ! mountpoint /root/mount_namespaces >/dev/null; then
 181         mount --bind /root/mount_namespaces /root/mount_namespaces
 182         mount --make-private /root/mount_namespaces
 183     fi
 184     if [[ ! -e /root/mount_namespaces/$nn ]]; then
 185         touch /root/mount_namespaces/$nn
 186     fi
 187     if ! mountpoint /root/mount_namespaces/$nn >/dev/null; then
 188         unshare --mount=/root/mount_namespaces/$nn
 189     fi
 190     ####   end mount namespace setup ####
 191
 192
 193     if $create; then
 194         ip netns add $nn
 195         ip -n $nn link set dev lo up
 196     fi
 197
 198     echo 1 | dexec dd of=/proc/sys/net/ipv4/ip_forward 2>/dev/null
 199
 200     _errcatch_cleanup=stop
 201     ipnn link add $v0 type veth peer name $v1
 202     ipnn link set $v0 netns default
 203     ipd addr add $network.1/24 dev $v0
 204     ipd link set $v0 up
 205     nat -C &>/dev/null || nat -A
 206     ipnn addr add $network.2/24 dev $v1
 207     ipnn link set $v1 up
 208     ipnn route add default via $network.1
 209
 210 }
 211
 212 stop() {
 213     if ipd link list $v0 &>/dev/null; then
 214         # this also deletes $v1 and the route we added.
 215         ipd link del $v0
 216     fi
 217     find_network
 218     if ! $existing; then
 219         if nat -C &>/dev/null; then nat -D; fi
 220     fi
 221     if $create; then
 222         ip netns del $nn
 223     fi
 224     if mountpoint /root/mount_namespaces/$nn >/dev/null; then
 225         umount /root/mount_namespaces/$nn
 226     fi
 227 }
 228
 229 case $action in
 230     start|stop)
 231         $action
 232         ;;
 233     *)
 234         echo "$0: error: unsupported action"
 235         exit 1
 236         ;;
 237 esac