2 # Copyright (C) 2017 Ian Kelling
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
8 # http://www.apache.org/licenses/LICENSE-2.0
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
17 [[ $EUID == 0 ]] ||
exec sudo
-E "$BASH_SOURCE" "$@"
19 if [[ ! $ERRHANDLE_PATH ]]; then
20 ERRHANDLE_PATH
=$
(readlink
-f "${BASH_SOURCE}")
21 ERRHANDLE_PATH
=$
(readlink
-f ${ERRHANDLE_PATH%/*}/..
/errhandle
)
24 for p
in $ERRHANDLE_PATH/{errcatch-function
,bash-trace-function
}; do
35 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
40 usage: ${0##*/} [OPTS] start|stop NS_NAME
41 Nat a network namespace. systemd friendly
43 Also creates a mount namespace with a cloned /run/resolvconf.
45 -c, --create Create a named network namespace. When running from
46 the same network namespace as pid 1, this is set automatically.
47 A systemd created private network is in a network namespace
49 -n NETWORK x.x.x /24 private network to use. If not specified, uses
50 the first one starting at 10.173.1
51 -h, --help Show this help and exit.
53 From within a systemd network namespace, nat it to the outside. This
54 would be called from ExecStartPre, and or subsequent units called with
55 JoinsNamespaceOf= and PrivateNetwork=true.
57 Also create a named mount namespace under /root/mount_namespaces, so we
58 can alter some system config for this namespace. Subsequent systemd
59 command lines would be prefixed with:
61 /usr/bin/nsenter --mount=/root/mount_namespaces/NS_NAME
63 Note, this means that they can't run as unpriveledged users, but once
64 systemd 233 comes out, it will have a bind mount option from within unit
65 files, so the mount namespace won't be needed for most use cases, and I
66 will update the script to that the mount namespace not created unless a
67 flag is passed in. Patch welcome to add that flag before then.
69 A recommmended dependency of this script is my other repo named "errhandle",
70 which prints stack trace on error, and calls a cleanup function:
71 https://iankelling.org/git/?p=errhandle, set ERRHANDLE_PATH, or put it
72 in a directory adjacent to the absolute, resolved directory this file is
77 This script does not make the namespace be named like ip does, because
78 the naming is not necessary, although it could have been done with some
79 more work. For debugging and joining the namespace with a bash shell, I
80 use nsenter -n -m -t \$(pgrep PROCESS_IN_NAMESPACE) bash. Note: if I
81 knew how to easily ask systemd what pid a unit has, i would do that.
83 "ip netns new ..." also does a mount namespace, then bind
84 mounts each file/dir in /etc/netns/NS_NAME to /etc/NS_NAME. Note,
85 for openvpn having it's own resolv.conf by using it's user script which
86 calls resolvconf, this doesn't help much. What we actually want to do is
87 copy /run/resolvconf somehwere then bind mount it on top of
90 Note: for debugging, adding set -x is a pretty good option.
92 Please email me if you have a patches, bugs, feedback, or republish this
93 somewhere else: Ian Kelling <ian@iankelling.org>.
99 #### begin arg parsing ####
101 temp
=$
(getopt
-l help,create hcn
: "$@") || usage
1
105 -c|
--create) create
=true
; shift ;;
106 -n) network
=$2; shift 2 ;;
109 *) echo "$0: Internal error!" ; exit 1 ;;
112 if (( $# != 2 )); then
117 nn
=$2 # namespace name
118 #### end arg parsing ####
120 #### begin sanity checking ####
122 if ! type -p ip
&>/dev
/null
; then
123 echo "please install the iproute2 package"
126 if ! type -p iptables
&>/dev
/null
; then
127 echo "please install the iptables package"
130 if $install_error; then
133 #### end sanity checking ####
140 if ! $create && [[ $
(readlink
/proc
/self
/ns
/net
) == "$(readlink /proc/1/ns/net)" ]]; then
144 # make the default network namespace be named
145 target
=/run
/netns
/default
146 if [[ ! -e $target && ! -L $target ]]; then
148 ln -s /proc
/1/ns
/net
$target
152 ipd
() { ip
-n default
"$@"; }
154 # run ip in the network namespace
155 ipnn
() { ip
-n $nn "$@"; }
157 # we are already in the network namespace and it's unnamed.
158 # run ip in the network namespace
161 # default network namespace exec
162 dexec
() { ip netns
exec default
"$@"; }
163 # mount namespace exec
164 mexec
() { /usr
/bin
/nsenter
--mount=/root
/mount_namespaces
/$nn "$@"; }
167 # background: head -n1 is defensive. Not sure if there is some weird feature
168 # for 2 routes to be 0/0.
169 gateway_if
=$
(ipd route list exact
0/0 |
head -n1|
sed -r 's/.*dev\s+(\S+).*/\1/')
170 nat
() { dexec iptables
-t nat
$1 POSTROUTING
-o $gateway_if -j MASQUERADE \
171 -m comment
--comment "systemd network namespace nat"; }
174 if [[ $network ]]; then
179 ips
="$(ipd addr show | awk '$1 == "inet
" {print $2}')"
180 for ((i
=1; i
<= 254; i
++)); do
182 if printf "%s\n" "$ips" |
grep "^${network//./\\.}" >/dev
/null
; then
194 echo "$0: error: no open network found"
198 #### begin mount namespace setup ####
199 mkdir
-p /root
/mount_namespaces
200 if ! mountpoint
/root
/mount_namespaces
>/dev
/null
; then
201 mount
--bind /root
/mount_namespaces
/root
/mount_namespaces
203 # note: This is outside the mount condition because I've mysteriously
204 # had this become shared instead of private, perhaps it
205 # got remounted somehow and lost the setting.
206 mount
--make-private /root
/mount_namespaces
207 if [[ ! -e /root
/mount_namespaces
/$nn ]]; then
208 touch /root
/mount_namespaces
/$nn
210 if ! mountpoint
/root
/mount_namespaces
/$nn >/dev
/null
; then
211 # documentation on propagation is a bit weird because it
212 # confusingly talks about binds, namespaces, and mirrors (which
213 # seems to be just another name for bind), shared subtrees
214 # (which seems to a term for binds and namespaces), and does not
215 # properly specify whether the documentation applies to binds,
216 # namespaces, or both. Notably, propagation for binds is marked
217 # on the original mount point, and propagation for a mount
218 # namespace is marked on mounts within the namespace. Here, we
219 # specify that we want mount changes propagated to us, but not
221 unshare
--propagation slave
--mount=/root
/mount_namespaces
/$nn /bin
/true
224 #### end mount namespace setup ####
229 ip
-n $nn link
set dev lo up
232 echo 1 | dexec
dd of
=/proc
/sys
/net
/ipv
4/ip_forward
2>/dev
/null
234 # docker helpfully changes the default FORWARD to drop...
235 if ! dexec iptables
-C FORWARD
-i $v0 -j ACCEPT
&>/dev
/null
; then
236 dexec iptables
-A FORWARD
-i $v0 -j ACCEPT
239 _errcatch_cleanup
=stop
240 ipnn link add
$v0 type veth peer name
$v1
241 ipnn link
set $v0 netns default
242 ipd addr add
$network.1/24 dev
$v0
244 nat
-C &>/dev
/null || nat
-A
245 ipnn addr add
$network.2/24 dev
$v1
247 ipnn route add default via
$network.1
249 ###### begin setup resolvconf
250 resolv_copy
=/root
/resolvconf-
$nn
252 # this condition should never happen, just coding defensively
253 if mexec mountpoint
/run
/resolvconf
&>/dev
/null
; then
254 mexec umount
/run
/resolvconf
256 cp -aT /run
/resolvconf
$resolv_copy
257 if ! mexec mount
-o bind $resolv_copy /run
/resolvconf
; then
258 echo "error: resolv-conf bindmount failed"
261 # if running dnsmasq, we have 127.0.0.1 for dns, but it can't listen on the loopback
262 # in the network namespace, so adjust the address.
263 if mexec
[ -s /run
/resolvconf
/interface
/lo.dnsmasq
]; then
264 mexec
sed --follow-symlinks -i "s/nameserver 127\..*/nameserver $network.1/" /run
/resolvconf
/interface
/lo.dnsmasq
267 # background: if we did this in openvpn's resolv-conf script, we could guard it in
268 # if capsh --print|grep '\bcap_sys_admin\b' &>/dev/null
269 # and we could get $nn by
270 # config_basename=${config%%.*}
271 # config_basename=${config_basename##*/}
272 # but dnsmasq forces us to do it earlier.
273 ###### end setup resolvconf
279 if ipd link list
$v0 &>/dev
/null
; then
280 # this also deletes $v1 and the route we added.
285 if nat
-C &>/dev
/null
; then nat
-D; fi
287 dexec iptables
-D FORWARD
-i $v0 -j ACCEPT ||
:
292 # not sure this is necessary since we are tearing down the mount namespace
293 if mexec mountpoint
/run
/resolvconf
&>/dev
/null
; then
294 mexec umount
/run
/resolvconf
297 if mountpoint
/root
/mount_namespaces
/$nn >/dev
/null
; then
298 umount
/root
/mount_namespaces
/$nn
307 echo "$0: error: unsupported action"