ip/ipnetns.c

   1 #define _ATFILE_SOURCE
   2 #include <sys/types.h>
   3 #include <sys/stat.h>
   4 #include <sys/wait.h>
   5 #include <sys/inotify.h>
   6 #include <sys/mount.h>
   7 #include <sys/param.h>
   8 #include <sys/syscall.h>
   9 #include <stdio.h>
  10 #include <string.h>
  11 #include <sched.h>
  12 #include <fcntl.h>
  13 #include <dirent.h>
  14 #include <errno.h>
  15 #include <unistd.h>
  16 #include <ctype.h>
  17
  18 #include "utils.h"
  19 #include "ip_common.h"
  20
  21 #define NETNS_RUN_DIR "/var/run/netns"
  22 #define NETNS_ETC_DIR "/etc/netns"
  23
  24 #ifndef CLONE_NEWNET
  25 #define CLONE_NEWNET 0x40000000 /* New network namespace (lo, device, names sockets, etc) */
  26 #endif
  27
  28 #ifndef MNT_DETACH
  29 #define MNT_DETACH      0x00000002      /* Just detach from the tree */
  30 #endif /* MNT_DETACH */
  31
  32 /* sys/mount.h may be out too old to have these */
  33 #ifndef MS_REC
  34 #define MS_REC          16384
  35 #endif
  36
  37 #ifndef MS_SLAVE
  38 #define MS_SLAVE        (1 << 19)
  39 #endif
  40
  41 #ifndef MS_SHARED
  42 #define MS_SHARED       (1 << 20)
  43 #endif
  44
  45
  46 #ifndef HAVE_SETNS
  47 static int setns(int fd, int nstype)
  48 {
  49 #ifdef __NR_setns
  50         return syscall(__NR_setns, fd, nstype);
  51 #else
  52         errno = ENOSYS;
  53         return -1;
  54 #endif
  55 }
  56 #endif /* HAVE_SETNS */
  57
  58 static int usage(void)
  59 {
  60         fprintf(stderr, "Usage: ip netns list\n");
  61         fprintf(stderr, "       ip netns add NAME\n");
  62         fprintf(stderr, "       ip netns delete NAME\n");
  63         fprintf(stderr, "       ip netns identify PID\n");
  64         fprintf(stderr, "       ip netns pids NAME\n");
  65         fprintf(stderr, "       ip netns exec NAME cmd ...\n");
  66         fprintf(stderr, "       ip netns monitor\n");
  67         return EXIT_FAILURE;
  68 }
  69
  70 int get_netns_fd(const char *name)
  71 {
  72         char pathbuf[MAXPATHLEN];
  73         const char *path, *ptr;
  74
  75         path = name;
  76         ptr = strchr(name, '/');
  77         if (!ptr) {
  78                 snprintf(pathbuf, sizeof(pathbuf), "%s/%s",
  79                         NETNS_RUN_DIR, name );
  80                 path = pathbuf;
  81         }
  82         return open(path, O_RDONLY);
  83 }
  84
  85 static int netns_list(int argc, char **argv)
  86 {
  87         struct dirent *entry;
  88         DIR *dir;
  89
  90         dir = opendir(NETNS_RUN_DIR);
  91         if (!dir)
  92                 return EXIT_SUCCESS;
  93
  94         while ((entry = readdir(dir)) != NULL) {
  95                 if (strcmp(entry->d_name, ".") == 0)
  96                         continue;
  97                 if (strcmp(entry->d_name, "..") == 0)
  98                         continue;
  99                 printf("%s\n", entry->d_name);
 100         }
 101         closedir(dir);
 102         return EXIT_SUCCESS;
 103 }
 104
 105 static void bind_etc(const char *name)
 106 {
 107         char etc_netns_path[MAXPATHLEN];
 108         char netns_name[MAXPATHLEN];
 109         char etc_name[MAXPATHLEN];
 110         struct dirent *entry;
 111         DIR *dir;
 112
 113         snprintf(etc_netns_path, sizeof(etc_netns_path), "%s/%s", NETNS_ETC_DIR, name);
 114         dir = opendir(etc_netns_path);
 115         if (!dir)
 116                 return;
 117
 118         while ((entry = readdir(dir)) != NULL) {
 119                 if (strcmp(entry->d_name, ".") == 0)
 120                         continue;
 121                 if (strcmp(entry->d_name, "..") == 0)
 122                         continue;
 123                 snprintf(netns_name, sizeof(netns_name), "%s/%s", etc_netns_path, entry->d_name);
 124                 snprintf(etc_name, sizeof(etc_name), "/etc/%s", entry->d_name);
 125                 if (mount(netns_name, etc_name, "none", MS_BIND, NULL) < 0) {
 126                         fprintf(stderr, "Bind %s -> %s failed: %s\n",
 127                                 netns_name, etc_name, strerror(errno));
 128                 }
 129         }
 130         closedir(dir);
 131 }
 132
 133 static int netns_exec(int argc, char **argv)
 134 {
 135         /* Setup the proper environment for apps that are not netns
 136          * aware, and execute a program in that environment.
 137          */
 138         const char *name, *cmd;
 139         char net_path[MAXPATHLEN];
 140         int netns;
 141
 142         if (argc < 1) {
 143                 fprintf(stderr, "No netns name specified\n");
 144                 return EXIT_FAILURE;
 145         }
 146         if (argc < 2) {
 147                 fprintf(stderr, "No command specified\n");
 148                 return EXIT_FAILURE;
 149         }
 150         name = argv[0];
 151         cmd = argv[1];
 152         snprintf(net_path, sizeof(net_path), "%s/%s", NETNS_RUN_DIR, name);
 153         netns = open(net_path, O_RDONLY | O_CLOEXEC);
 154         if (netns < 0) {
 155                 fprintf(stderr, "Cannot open network namespace \"%s\": %s\n",
 156                         name, strerror(errno));
 157                 return EXIT_FAILURE;
 158         }
 159         if (setns(netns, CLONE_NEWNET) < 0) {
 160                 fprintf(stderr, "seting the network namespace \"%s\" failed: %s\n",
 161                         name, strerror(errno));
 162                 return EXIT_FAILURE;
 163         }
 164
 165         if (unshare(CLONE_NEWNS) < 0) {
 166                 fprintf(stderr, "unshare failed: %s\n", strerror(errno));
 167                 return EXIT_FAILURE;
 168         }
 169         /* Don't let any mounts propogate back to the parent */
 170         if (mount("", "/", "none", MS_SLAVE | MS_REC, NULL)) {
 171                 fprintf(stderr, "\"mount --make-rslave /\" failed: %s\n",
 172                         strerror(errno));
 173                 return EXIT_FAILURE;
 174         }
 175         /* Mount a version of /sys that describes the network namespace */
 176         if (umount2("/sys", MNT_DETACH) < 0) {
 177                 fprintf(stderr, "umount of /sys failed: %s\n", strerror(errno));
 178                 return EXIT_FAILURE;
 179         }
 180         if (mount(name, "/sys", "sysfs", 0, NULL) < 0) {
 181                 fprintf(stderr, "mount of /sys failed: %s\n",strerror(errno));
 182                 return EXIT_FAILURE;
 183         }
 184
 185         /* Setup bind mounts for config files in /etc */
 186         bind_etc(name);
 187
 188         if (execvp(cmd, argv + 1)  < 0)
 189                 fprintf(stderr, "exec of \"%s\" failed: %s\n",
 190                         cmd, strerror(errno));
 191         return EXIT_FAILURE;
 192 }
 193
 194 static int is_pid(const char *str)
 195 {
 196         int ch;
 197         for (; (ch = *str); str++) {
 198                 if (!isdigit(ch))
 199                         return 0;
 200         }
 201         return 1;
 202 }
 203
 204 static int netns_pids(int argc, char **argv)
 205 {
 206         const char *name;
 207         char net_path[MAXPATHLEN];
 208         int netns;
 209         struct stat netst;
 210         DIR *dir;
 211         struct dirent *entry;
 212
 213         if (argc < 1) {
 214                 fprintf(stderr, "No netns name specified\n");
 215                 return EXIT_FAILURE;
 216         }
 217         if (argc > 1) {
 218                 fprintf(stderr, "extra arguments specified\n");
 219                 return EXIT_FAILURE;
 220         }
 221
 222         name = argv[0];
 223         snprintf(net_path, sizeof(net_path), "%s/%s", NETNS_RUN_DIR, name);
 224         netns = open(net_path, O_RDONLY);
 225         if (netns < 0) {
 226                 fprintf(stderr, "Cannot open network namespace: %s\n",
 227                         strerror(errno));
 228                 return EXIT_FAILURE;
 229         }
 230         if (fstat(netns, &netst) < 0) {
 231                 fprintf(stderr, "Stat of netns failed: %s\n",
 232                         strerror(errno));
 233                 return EXIT_FAILURE;
 234         }
 235         dir = opendir("/proc/");
 236         if (!dir) {
 237                 fprintf(stderr, "Open of /proc failed: %s\n",
 238                         strerror(errno));
 239                 return EXIT_FAILURE;
 240         }
 241         while((entry = readdir(dir))) {
 242                 char pid_net_path[MAXPATHLEN];
 243                 struct stat st;
 244                 if (!is_pid(entry->d_name))
 245                         continue;
 246                 snprintf(pid_net_path, sizeof(pid_net_path), "/proc/%s/ns/net",
 247                         entry->d_name);
 248                 if (stat(pid_net_path, &st) != 0)
 249                         continue;
 250                 if ((st.st_dev == netst.st_dev) &&
 251                     (st.st_ino == netst.st_ino)) {
 252                         printf("%s\n", entry->d_name);
 253                 }
 254         }
 255         closedir(dir);
 256         return EXIT_SUCCESS;
 257
 258 }
 259
 260 static int netns_identify(int argc, char **argv)
 261 {
 262         const char *pidstr;
 263         char net_path[MAXPATHLEN];
 264         int netns;
 265         struct stat netst;
 266         DIR *dir;
 267         struct dirent *entry;
 268
 269         if (argc < 1) {
 270                 fprintf(stderr, "No pid specified\n");
 271                 return EXIT_FAILURE;
 272         }
 273         if (argc > 1) {
 274                 fprintf(stderr, "extra arguments specified\n");
 275                 return EXIT_FAILURE;
 276         }
 277         pidstr = argv[0];
 278
 279         if (!is_pid(pidstr)) {
 280                 fprintf(stderr, "Specified string '%s' is not a pid\n",
 281                         pidstr);
 282                 return EXIT_FAILURE;
 283         }
 284
 285         snprintf(net_path, sizeof(net_path), "/proc/%s/ns/net", pidstr);
 286         netns = open(net_path, O_RDONLY);
 287         if (netns < 0) {
 288                 fprintf(stderr, "Cannot open network namespace: %s\n",
 289                         strerror(errno));
 290                 return EXIT_FAILURE;
 291         }
 292         if (fstat(netns, &netst) < 0) {
 293                 fprintf(stderr, "Stat of netns failed: %s\n",
 294                         strerror(errno));
 295                 return EXIT_FAILURE;
 296         }
 297         dir = opendir(NETNS_RUN_DIR);
 298         if (!dir) {
 299                 /* Succeed treat a missing directory as an empty directory */
 300                 if (errno == ENOENT)
 301                         return EXIT_SUCCESS;
 302
 303                 fprintf(stderr, "Failed to open directory %s:%s\n",
 304                         NETNS_RUN_DIR, strerror(errno));
 305                 return EXIT_FAILURE;
 306         }
 307
 308         while((entry = readdir(dir))) {
 309                 char name_path[MAXPATHLEN];
 310                 struct stat st;
 311
 312                 if (strcmp(entry->d_name, ".") == 0)
 313                         continue;
 314                 if (strcmp(entry->d_name, "..") == 0)
 315                         continue;
 316
 317                 snprintf(name_path, sizeof(name_path), "%s/%s", NETNS_RUN_DIR,
 318                         entry->d_name);
 319
 320                 if (stat(name_path, &st) != 0)
 321                         continue;
 322
 323                 if ((st.st_dev == netst.st_dev) &&
 324                     (st.st_ino == netst.st_ino)) {
 325                         printf("%s\n", entry->d_name);
 326                 }
 327         }
 328         closedir(dir);
 329         return EXIT_SUCCESS;
 330
 331 }
 332
 333 static int netns_delete(int argc, char **argv)
 334 {
 335         const char *name;
 336         char netns_path[MAXPATHLEN];
 337
 338         if (argc < 1) {
 339                 fprintf(stderr, "No netns name specified\n");
 340                 return EXIT_FAILURE;
 341         }
 342
 343         name = argv[0];
 344         snprintf(netns_path, sizeof(netns_path), "%s/%s", NETNS_RUN_DIR, name);
 345         umount2(netns_path, MNT_DETACH);
 346         if (unlink(netns_path) < 0) {
 347                 fprintf(stderr, "Cannot remove namespace file \"%s\": %s\n",
 348                         netns_path, strerror(errno));
 349                 return EXIT_FAILURE;
 350         }
 351         return EXIT_SUCCESS;
 352 }
 353
 354 static int netns_add(int argc, char **argv)
 355 {
 356         /* This function creates a new network namespace and
 357          * a new mount namespace and bind them into a well known
 358          * location in the filesystem based on the name provided.
 359          *
 360          * The mount namespace is created so that any necessary
 361          * userspace tweaks like remounting /sys, or bind mounting
 362          * a new /etc/resolv.conf can be shared between uers.
 363          */
 364         char netns_path[MAXPATHLEN];
 365         const char *name;
 366         int fd;
 367         int made_netns_run_dir_mount = 0;
 368
 369         if (argc < 1) {
 370                 fprintf(stderr, "No netns name specified\n");
 371                 return EXIT_FAILURE;
 372         }
 373         name = argv[0];
 374
 375         snprintf(netns_path, sizeof(netns_path), "%s/%s", NETNS_RUN_DIR, name);
 376
 377         /* Create the base netns directory if it doesn't exist */
 378         mkdir(NETNS_RUN_DIR, S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH);
 379
 380         /* Make it possible for network namespace mounts to propogate between
 381          * mount namespaces.  This makes it likely that a unmounting a network
 382          * namespace file in one namespace will unmount the network namespace
 383          * file in all namespaces allowing the network namespace to be freed
 384          * sooner.
 385          */
 386         while (mount("", NETNS_RUN_DIR, "none", MS_SHARED | MS_REC, NULL)) {
 387                 /* Fail unless we need to make the mount point */
 388                 if (errno != EINVAL || made_netns_run_dir_mount) {
 389                         fprintf(stderr, "mount --make-shared %s failed: %s\n",
 390                                 NETNS_RUN_DIR, strerror(errno));
 391                         return EXIT_FAILURE;
 392                 }
 393
 394                 /* Upgrade NETNS_RUN_DIR to a mount point */
 395                 if (mount(NETNS_RUN_DIR, NETNS_RUN_DIR, "none", MS_BIND, NULL)) {
 396                         fprintf(stderr, "mount --bind %s %s failed: %s\n",
 397                                 NETNS_RUN_DIR, NETNS_RUN_DIR, strerror(errno));
 398                         return EXIT_FAILURE;
 399                 }
 400                 made_netns_run_dir_mount = 1;
 401         }
 402
 403         /* Create the filesystem state */
 404         fd = open(netns_path, O_RDONLY|O_CREAT|O_EXCL, 0);
 405         if (fd < 0) {
 406                 fprintf(stderr, "Cannot not create namespace file \"%s\": %s\n",
 407                         netns_path, strerror(errno));
 408                 return EXIT_FAILURE;
 409         }
 410         close(fd);
 411         if (unshare(CLONE_NEWNET) < 0) {
 412                 fprintf(stderr, "Failed to create a new network namespace \"%s\": %s\n",
 413                         name, strerror(errno));
 414                 goto out_delete;
 415         }
 416
 417         /* Bind the netns last so I can watch for it */
 418         if (mount("/proc/self/ns/net", netns_path, "none", MS_BIND, NULL) < 0) {
 419                 fprintf(stderr, "Bind /proc/self/ns/net -> %s failed: %s\n",
 420                         netns_path, strerror(errno));
 421                 goto out_delete;
 422         }
 423         return EXIT_SUCCESS;
 424 out_delete:
 425         netns_delete(argc, argv);
 426         return EXIT_FAILURE;
 427 }
 428
 429
 430 static int netns_monitor(int argc, char **argv)
 431 {
 432         char buf[4096];
 433         struct inotify_event *event;
 434         int fd;
 435         fd = inotify_init();
 436         if (fd < 0) {
 437                 fprintf(stderr, "inotify_init failed: %s\n",
 438                         strerror(errno));
 439                 return EXIT_FAILURE;
 440         }
 441         if (inotify_add_watch(fd, NETNS_RUN_DIR, IN_CREATE | IN_DELETE) < 0) {
 442                 fprintf(stderr, "inotify_add_watch failed: %s\n",
 443                         strerror(errno));
 444                 return EXIT_FAILURE;
 445         }
 446         for(;;) {
 447                 ssize_t len = read(fd, buf, sizeof(buf));
 448                 if (len < 0) {
 449                         fprintf(stderr, "read failed: %s\n",
 450                                 strerror(errno));
 451                         return EXIT_FAILURE;
 452                 }
 453                 for (event = (struct inotify_event *)buf;
 454                      (char *)event < &buf[len];
 455                      event = (struct inotify_event *)((char *)event + sizeof(*event) + event->len)) {
 456                         if (event->mask & IN_CREATE)
 457                                 printf("add %s\n", event->name);
 458                         if (event->mask & IN_DELETE)
 459                                 printf("delete %s\n", event->name);
 460                 }
 461         }
 462         return EXIT_SUCCESS;
 463 }
 464
 465 int do_netns(int argc, char **argv)
 466 {
 467         if (argc < 1)
 468                 return netns_list(0, NULL);
 469
 470         if ((matches(*argv, "list") == 0) || (matches(*argv, "show") == 0) ||
 471             (matches(*argv, "lst") == 0))
 472                 return netns_list(argc-1, argv+1);
 473
 474         if (matches(*argv, "help") == 0)
 475                 return usage();
 476
 477         if (matches(*argv, "add") == 0)
 478                 return netns_add(argc-1, argv+1);
 479
 480         if (matches(*argv, "delete") == 0)
 481                 return netns_delete(argc-1, argv+1);
 482
 483         if (matches(*argv, "identify") == 0)
 484                 return netns_identify(argc-1, argv+1);
 485
 486         if (matches(*argv, "pids") == 0)
 487                 return netns_pids(argc-1, argv+1);
 488
 489         if (matches(*argv, "exec") == 0)
 490                 return netns_exec(argc-1, argv+1);
 491
 492         if (matches(*argv, "monitor") == 0)
 493                 return netns_monitor(argc-1, argv+1);
 494
 495         fprintf(stderr, "Command \"%s\" is unknown, try \"ip netns help\".\n", *argv);
 496         return EXIT_FAILURE;
 497 }