From e5001f82b104366e8e7e8d77075aaad4a60d57b9 Mon Sep 17 00:00:00 2001 From: Ian Kelling Date: Tue, 12 Mar 2019 17:09:19 -0400 Subject: [PATCH] handle multiple gateways --- newns | 346 +++++++++++++++++++++++++++++----------------------------- 1 file changed, 175 insertions(+), 171 deletions(-) diff --git a/newns b/newns index cdf7e7d..e1f3944 100755 --- a/newns +++ b/newns @@ -17,26 +17,26 @@ [[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" if [[ ! $ERRHANDLE_PATH ]]; then - ERRHANDLE_PATH=$(readlink -f "${BASH_SOURCE}") - ERRHANDLE_PATH=$(readlink -f ${ERRHANDLE_PATH%/*}/../errhandle) + ERRHANDLE_PATH=$(readlink -f "${BASH_SOURCE}") + ERRHANDLE_PATH=$(readlink -f ${ERRHANDLE_PATH%/*}/../errhandle) fi err_sourced=true for p in $ERRHANDLE_PATH/{errcatch-function,bash-trace-function}; do - if [[ -e $p ]]; then - source $p - else - err_sourced=false - fi + if [[ -e $p ]]; then + source $p + else + err_sourced=false + fi done if $err_sourced; then - errcatch + errcatch else - set -eE -o pipefail - trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR + set -eE -o pipefail + trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR fi usage() { - cat <. EOF - exit ${1:-0} + exit ${1:-0} } @@ -105,16 +105,16 @@ create=false temp=$(getopt -l help,create hcn: "$@") || usage 1 eval set -- "$temp" while true; do - case $1 in - -c|--create) create=true; shift ;; - -n) network=$2; shift 2 ;; - -h|--help) usage ;; - --) shift; break ;; - *) echo "$0: Internal error!" ; exit 1 ;; - esac + case $1 in + -c|--create) create=true; shift ;; + -n) network=$2; shift 2 ;; + -h|--help) usage ;; + --) shift; break ;; + *) echo "$0: Internal error!" ; exit 1 ;; + esac done if (( $# != 2 )); then - usage 1 + usage 1 fi action=$1 @@ -124,15 +124,15 @@ nn=$2 # namespace name #### begin sanity checking #### install_error=false if ! type -p ip &>/dev/null; then - echo "please install the iproute2 package" - install_error=true + echo "please install the iproute2 package" + install_error=true fi if ! type -p iptables &>/dev/null; then - echo "please install the iptables package" - install_error=true + echo "please install the iptables package" + install_error=true fi if $install_error; then - exit 1 + exit 1 fi #### end sanity checking #### @@ -142,25 +142,25 @@ v1=veth1-$nn ip_base=10.173 if ! $create && [[ $(readlink /proc/self/ns/net) == "$(readlink /proc/1/ns/net)" ]]; then - create=true + create=true fi # make the default network namespace be named target=/run/netns/default if [[ ! -e $target && ! -L $target ]]; then - mkdir -p /run/netns - ln -s /proc/1/ns/net $target + mkdir -p /run/netns + ln -s /proc/1/ns/net $target fi ipd() { ip -n default "$@"; } if $create; then - # run ip in the network namespace - ipnn() { ip -n $nn "$@"; } + # run ip in the network namespace + ipnn() { ip -n $nn "$@"; } else - # we are already in the network namespace and it's unnamed. - # run ip in the network namespace - ipnn() { ip "$@"; } + # we are already in the network namespace and it's unnamed. + # run ip in the network namespace + ipnn() { ip "$@"; } fi # default network namespace exec dexec() { ip netns exec default "$@"; } @@ -170,168 +170,172 @@ mexec() { /usr/bin/nsenter --mount=/root/mount_namespaces/$nn "$@"; } # background: head -n1 is defensive. Not sure if there is some weird feature # for 2 routes to be 0/0. -gateway_if=$(ipd route list exact 0/0 | head -n1| sed -r 's/.*dev\s+(\S+).*/\1/') +gateway_ifs=($(ipd route list exact 0/0 | head -n1| sed -r 's/.*dev\s+(\S+).*/\1/')) -if [[ ! $gateway_if ]]; then - cat >&2 <&2 </dev/null; then - dexec iptables -I "$@" - fi + if ! dexec iptables -C "$@" &>/dev/null; then + dexec iptables -I "$@" + fi } find_network() { - if [[ $network ]]; then - return + if [[ $network ]]; then + return + fi + found=false + existing=false + ips="$(ipd addr show | awk '$1 == "inet" {print $2}')" + for ((i=1; i <= 254; i++)); do + network=$ip_base.$i + if printf "%s\n" "$ips" | grep "^${network//./\\.}" >/dev/null; then + existing=true + else + found=true + break fi - found=false - existing=false - ips="$(ipd addr show | awk '$1 == "inet" {print $2}')" - for ((i=1; i <= 254; i++)); do - network=$ip_base.$i - if printf "%s\n" "$ips" | grep "^${network//./\\.}" >/dev/null; then - existing=true - else - found=true - break - fi - done + done } start() { - find_network - if ! $found; then - echo "$0: error: no open network found" - exit 1 - fi - - #### begin mount namespace setup #### - mkdir -p /root/mount_namespaces - if ! mountpoint /root/mount_namespaces >/dev/null; then - mount --bind /root/mount_namespaces /root/mount_namespaces - fi - # note: This is outside the mount condition because I've mysteriously - # had this become shared instead of private, perhaps it - # got remounted somehow and lost the setting. - mount --make-private /root/mount_namespaces - if [[ ! -e /root/mount_namespaces/$nn ]]; then - touch /root/mount_namespaces/$nn - fi - if ! mountpoint /root/mount_namespaces/$nn >/dev/null; then - # Here, we specify that we only want mount changes changes under - # this mountpoint to be propagated into the bind, but changes - # from within the bind do not propagate to outside the bind. - # - # slave is documented in. - # /usr/share/doc/linux-doc-4.9/Documentation/filesystems/sharedsubtree.txt.gz - # documentation on propagation is a bit weird because it - # confusingly talks about binds, namespaces, and mirrors (which - # seems to be just another name for bind), shared subtrees - # (which seems to a term for binds and namespaces), and does not - # properly specify whether the documentation applies to binds, - # namespaces, or both. Notably, propagation for binds is marked - # on the original mount point, and propagation for a mount - # namespace is marked on mounts within the namespace. - unshare --propagation slave --mount=/root/mount_namespaces/$nn /bin/true - fi - - #### end mount namespace setup #### - - - if $create; then - ip netns add $nn - ip -n $nn link set dev lo up - fi - - echo 1 | dexec dd of=/proc/sys/net/ipv4/ip_forward 2>/dev/null - - # docker helpfully changes the default FORWARD to drop... - diptables-add FORWARD -i $v0 -j ACCEPT - diptables-add FORWARD -o $v0 -j ACCEPT - - - _errcatch_cleanup=stop - ipnn link add $v0 type veth peer name $v1 - ipnn link set $v0 netns default - ipd addr add $network.1/24 dev $v0 - ipd link set $v0 up - nat -C &>/dev/null || nat -A - ipnn addr add $network.2/24 dev $v1 - ipnn link set $v1 up - ipnn route add default via $network.1 - - ###### begin setup resolvconf - resolv_copy=/root/resolvconf-$nn - - # this condition should never happen, just coding defensively - if mexec mountpoint /run/resolvconf &>/dev/null; then - mexec umount /run/resolvconf - fi - cp -aT /run/resolvconf $resolv_copy - if ! mexec mount -o bind $resolv_copy /run/resolvconf; then - echo "error: resolv-conf bindmount failed" - exit 1 - fi - # if running dnsmasq, we have 127.0.0.1 for dns, but it can't listen on the loopback - # in the network namespace, so adjust the address. - if mexec [ -s /run/resolvconf/interface/lo.dnsmasq ]; then - mexec sed --follow-symlinks -i "s/nameserver 127\..*/nameserver $network.1/" /run/resolvconf/interface/lo.dnsmasq - mexec resolvconf -u - fi - # background: if we did this in openvpn's resolv-conf script, we could guard it in - # if capsh --print|grep '\bcap_sys_admin\b' &>/dev/null - # and we could get $nn by - # config_basename=${config%%.*} - # config_basename=${config_basename##*/} - # but dnsmasq forces us to do it earlier. - ###### end setup resolvconf + find_network + if ! $found; then + echo "$0: error: no open network found" + exit 1 + fi + + #### begin mount namespace setup #### + mkdir -p /root/mount_namespaces + if ! mountpoint /root/mount_namespaces >/dev/null; then + mount --bind /root/mount_namespaces /root/mount_namespaces + fi + # note: This is outside the mount condition because I've mysteriously + # had this become shared instead of private, perhaps it + # got remounted somehow and lost the setting. + mount --make-private /root/mount_namespaces + if [[ ! -e /root/mount_namespaces/$nn ]]; then + touch /root/mount_namespaces/$nn + fi + if ! mountpoint /root/mount_namespaces/$nn >/dev/null; then + # Here, we specify that we only want mount changes changes under + # this mountpoint to be propagated into the bind, but changes + # from within the bind do not propagate to outside the bind. + # + # slave is documented in. + # /usr/share/doc/linux-doc-4.9/Documentation/filesystems/sharedsubtree.txt.gz + # documentation on propagation is a bit weird because it + # confusingly talks about binds, namespaces, and mirrors (which + # seems to be just another name for bind), shared subtrees + # (which seems to a term for binds and namespaces), and does not + # properly specify whether the documentation applies to binds, + # namespaces, or both. Notably, propagation for binds is marked + # on the original mount point, and propagation for a mount + # namespace is marked on mounts within the namespace. + unshare --propagation slave --mount=/root/mount_namespaces/$nn /bin/true + fi + + #### end mount namespace setup #### + + + if $create; then + ip netns add $nn + ip -n $nn link set dev lo up + fi + + echo 1 | dexec dd of=/proc/sys/net/ipv4/ip_forward 2>/dev/null + + # docker helpfully changes the default FORWARD to drop... + diptables-add FORWARD -i $v0 -j ACCEPT + diptables-add FORWARD -o $v0 -j ACCEPT + + + _errcatch_cleanup=stop + ipnn link add $v0 type veth peer name $v1 + ipnn link set $v0 netns default + ipd addr add $network.1/24 dev $v0 + ipd link set $v0 up + nat -C &>/dev/null || nat -A + ipnn addr add $network.2/24 dev $v1 + ipnn link set $v1 up + ipnn route add default via $network.1 + + ###### begin setup resolvconf + resolv_copy=/root/resolvconf-$nn + + # this condition should never happen, just coding defensively + if mexec mountpoint /run/resolvconf &>/dev/null; then + mexec umount /run/resolvconf + fi + cp -aT /run/resolvconf $resolv_copy + if ! mexec mount -o bind $resolv_copy /run/resolvconf; then + echo "error: resolv-conf bindmount failed" + exit 1 + fi + # if running dnsmasq, we have 127.0.0.1 for dns, but it can't listen on the loopback + # in the network namespace, so adjust the address. + if mexec [ -s /run/resolvconf/interface/lo.dnsmasq ]; then + mexec sed --follow-symlinks -i "s/nameserver 127\..*/nameserver $network.1/" /run/resolvconf/interface/lo.dnsmasq + mexec resolvconf -u + fi + # background: if we did this in openvpn's resolv-conf script, we could guard it in + # if capsh --print|grep '\bcap_sys_admin\b' &>/dev/null + # and we could get $nn by + # config_basename=${config%%.*} + # config_basename=${config_basename##*/} + # but dnsmasq forces us to do it earlier. + ###### end setup resolvconf } stop() { - if ipd link list $v0 &>/dev/null; then - # this also deletes $v1 and the route we added. - ipd link del $v0 - fi - find_network - if ! $existing; then - if nat -C &>/dev/null; then nat -D; fi - fi - dexec iptables -D FORWARD -i $v0 -j ACCEPT ||: - if $create && [[ -e /var/run/netns/client ]]; then - ip netns del $nn - fi - - # not sure this is necessary since we are tearing down the mount namespace - if mexec mountpoint /run/resolvconf &>/dev/null; then - mexec umount /run/resolvconf - fi - - if mountpoint /root/mount_namespaces/$nn >/dev/null; then - umount /root/mount_namespaces/$nn - fi + if ipd link list $v0 &>/dev/null; then + # this also deletes $v1 and the route we added. + ipd link del $v0 + fi + find_network + if ! $existing; then + if nat -C &>/dev/null; then nat -D; fi + fi + dexec iptables -D FORWARD -i $v0 -j ACCEPT ||: + if $create && [[ -e /var/run/netns/client ]]; then + ip netns del $nn + fi + + # not sure this is necessary since we are tearing down the mount namespace + if mexec mountpoint /run/resolvconf &>/dev/null; then + mexec umount /run/resolvconf + fi + + if mountpoint /root/mount_namespaces/$nn >/dev/null; then + umount /root/mount_namespaces/$nn + fi } case $action in - start|stop) - $action - ;; - *) - echo "$0: error: unsupported action" - exit 1 - ;; + start|stop) + $action + ;; + *) + echo "$0: error: unsupported action" + exit 1 + ;; esac -- 2.30.2