scripts/anbox-net.sh

   1 #!/bin/sh -
   2
   3 varrun="/run/anbox-lxc"
   4 varlib="/var/lib"
   5
   6 USE_LXC_BRIDGE="true"
   7 LXC_BRIDGE="anbox0"
   8 LXC_BRIDGE_MAC="00:16:3e:00:00:01"
   9 LXC_ADDR="192.168.250.1"
  10 LXC_NETMASK="255.255.255.0"
  11 LXC_NETWORK="192.168.250.0/24"
  12 LXC_DHCP_RANGE="192.168.250.2,192.168.250.254"
  13 LXC_DHCP_MAX="253"
  14 LXC_DHCP_CONFILE=""
  15 LXC_DHCP_PING="true"
  16 LXC_DOMAIN=""
  17 LXC_USE_NFT="true"
  18
  19 LXC_IPV6_ADDR=""
  20 LXC_IPV6_MASK=""
  21 LXC_IPV6_NETWORK=""
  22 LXC_IPV6_NAT="false"
  23
  24 use_nft() {
  25     [ -n "$NFT" ] && nft list ruleset > /dev/null 2>&1 && [ "$LXC_USE_NFT" = "true" ]
  26 }
  27
  28 NFT="$(which nft)"
  29 if ! use_nft; then
  30     use_iptables_lock="-w"
  31     iptables -w -L -n > /dev/null 2>&1 || use_iptables_lock=""
  32 fi
  33
  34 _netmask2cidr ()
  35 {
  36     # Assumes there's no "255." after a non-255 byte in the mask
  37     local x=${1##*255.}
  38     set -- 0^^^128^192^224^240^248^252^254^ $(( (${#1} - ${#x})*2 )) ${x%%.*}
  39     x=${1%%$3*}
  40     echo $(( $2 + (${#x}/4) ))
  41 }
  42
  43 _ifdown() {
  44     ip addr flush dev ${LXC_BRIDGE}
  45     ip link set dev ${LXC_BRIDGE} down
  46 }
  47
  48 _ifup() {
  49     MASK=`_netmask2cidr ${LXC_NETMASK}`
  50     CIDR_ADDR="${LXC_ADDR}/${MASK}"
  51     ip addr add ${CIDR_ADDR} broadcast + dev ${LXC_BRIDGE}
  52     ip link set dev ${LXC_BRIDGE} address $LXC_BRIDGE_MAC
  53     ip link set dev ${LXC_BRIDGE} up
  54 }
  55
  56 start_ipv6() {
  57     LXC_IPV6_ARG=""
  58     if [ -n "$LXC_IPV6_ADDR" ] && [ -n "$LXC_IPV6_MASK" ] && [ -n "$LXC_IPV6_NETWORK" ]; then
  59         echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  60         echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/autoconf
  61         ip -6 addr add dev ${LXC_BRIDGE} ${LXC_IPV6_ADDR}/${LXC_IPV6_MASK}
  62         LXC_IPV6_ARG="--dhcp-range=${LXC_IPV6_ADDR},ra-only --listen-address ${LXC_IPV6_ADDR}"
  63     fi
  64 }
  65
  66 start_iptables() {
  67     start_ipv6
  68     if [ -n "$LXC_IPV6_ARG" ] && [ "$LXC_IPV6_NAT" = "true" ]; then
  69         ip6tables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
  70     fi
  71     iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
  72     iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
  73     iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
  74     iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
  75     iptables $use_iptables_lock -I FORWARD -i ${LXC_BRIDGE} -j ACCEPT
  76     iptables $use_iptables_lock -I FORWARD -o ${LXC_BRIDGE} -j ACCEPT
  77     iptables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
  78     iptables $use_iptables_lock -t mangle -A POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
  79 }
  80
  81 start_nftables() {
  82     start_ipv6
  83     NFT_RULESET=""
  84     if [ -n "$LXC_IPV6_ARG" ] && [ "$LXC_IPV6_NAT" = "true" ]; then
  85         NFT_RULESET="${NFT_RULESET}
  86 add table ip6 lxc;
  87 flush table ip6 lxc;
  88 add chain ip6 lxc postrouting { type nat hook postrouting priority 100; };
  89 add rule ip6 lxc postrouting ip saddr ${LXC_IPV6_NETWORK} ip daddr != ${LXC_IPV6_NETWORK} counter masquerade;
  90 "
  91     fi
  92     NFT_RULESET="${NFT_RULESET};
  93 add table inet lxc;
  94 flush table inet lxc;
  95 add chain inet lxc input { type filter hook input priority 0; };
  96 add rule inet lxc input iifname ${LXC_BRIDGE} udp dport { 53, 67 } accept;
  97 add rule inet lxc input iifname ${LXC_BRIDGE} tcp dport { 53, 67 } accept;
  98 add chain inet lxc forward { type filter hook forward priority 0; };
  99 add rule inet lxc forward iifname ${LXC_BRIDGE} accept;
 100 add rule inet lxc forward oifname ${LXC_BRIDGE} accept;
 101 add table ip lxc;
 102 flush table ip lxc;
 103 add chain ip lxc postrouting { type nat hook postrouting priority 100; };
 104 add rule ip lxc postrouting ip saddr ${LXC_NETWORK} ip daddr != ${LXC_NETWORK} counter masquerade"
 105     nft "${NFT_RULESET}"
 106 }
 107
 108 start() {
 109     [ "x$USE_LXC_BRIDGE" = "xtrue" ] || { exit 0; }
 110
 111     [ ! -f "${varrun}/network_up" ] || { echo "anbox-net is already running"; exit 1; }
 112
 113     if [ -d /sys/class/net/${LXC_BRIDGE} ]; then
 114         stop force || true
 115     fi
 116
 117     FAILED=1
 118
 119     cleanup() {
 120         set +e
 121         if [ "$FAILED" = "1" ]; then
 122             echo "Failed to setup anbox-net." >&2
 123             stop force
 124             exit 1
 125         fi
 126     }
 127
 128     trap cleanup EXIT HUP INT TERM
 129     set -e
 130
 131     # set up the lxc network
 132     [ ! -d /sys/class/net/${LXC_BRIDGE} ] && ip link add dev ${LXC_BRIDGE} type bridge
 133     echo 1 > /proc/sys/net/ipv4/ip_forward
 134     echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/accept_dad || true
 135
 136     # if we are run from systemd on a system with selinux enabled,
 137     # the mkdir will create /run/lxc as init_var_run_t which dnsmasq
 138     # can't write its pid into, so we restorecon it (to var_run_t)
 139     if [ ! -d "${varrun}" ]; then
 140         mkdir -p "${varrun}"
 141         if which restorecon >/dev/null 2>&1; then
 142             restorecon "${varrun}"
 143         fi
 144     fi
 145
 146     _ifup
 147
 148     if use_nft; then
 149         start_nftables
 150     else
 151         start_iptables
 152     fi
 153
 154     LXC_DOMAIN_ARG=""
 155     if [ -n "$LXC_DOMAIN" ]; then
 156         LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
 157     fi
 158
 159     # lxc's dnsmasq should be hermetic and not read `/etc/dnsmasq.conf` (which
 160     # it does by default if `--conf-file` is not present
 161     LXC_DHCP_CONFILE_ARG="--conf-file=${LXC_DHCP_CONFILE:-/dev/null}"
 162
 163     # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
 164     for DNSMASQ_USER in lxc-dnsmasq dnsmasq nobody
 165     do
 166         if getent passwd ${DNSMASQ_USER} >/dev/null; then
 167             break
 168         fi
 169     done
 170
 171     LXC_DHCP_PING_ARG=""
 172     if [ "x$LXC_DHCP_PING" = "xfalse" ]; then
 173         LXC_DHCP_PING_ARG="--no-ping"
 174     fi
 175
 176     dnsmasq $LXC_DHCP_CONFILE_ARG $LXC_DOMAIN_ARG $LXC_DHCP_PING_ARG -u ${DNSMASQ_USER} \
 177             --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid \
 178             --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} \
 179             --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override \
 180             --except-interface=lo --interface=${LXC_BRIDGE} \
 181             --dhcp-leasefile="${varlib}"/misc/dnsmasq.${LXC_BRIDGE}.leases \
 182             --dhcp-authoritative $LXC_IPV6_ARG || cleanup
 183
 184     touch "${varrun}"/network_up
 185     FAILED=0
 186 }
 187
 188 stop_iptables() {
 189     iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
 190     iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
 191     iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
 192     iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
 193     iptables $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j ACCEPT
 194     iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
 195     iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
 196     iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
 197     if [ "$LXC_IPV6_NAT" = "true" ]; then
 198         ip6tables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
 199     fi
 200 }
 201
 202 stop_nftables() {
 203     # Adding table before removing them is just to avoid
 204     # delete error for non-existent table
 205     NFT_RULESET="add table inet lxc;
 206 delete table inet lxc;
 207 add table ip lxc;
 208 delete table ip lxc;
 209 "
 210     if [ "$LXC_IPV6_NAT" = "true" ]; then
 211         NFT_RULESET="${NFT_RULESET};
 212 add table ip6 lxc;
 213 delete table ip6 lxc;"
 214     fi
 215     nft "${NFT_RULESET}"
 216 }
 217
 218 stop() {
 219     [ "x$USE_LXC_BRIDGE" = "xtrue" ] || { exit 0; }
 220
 221     [ -f "${varrun}/network_up" ] || [ "$1" = "force" ] || { echo "anbox-net isn't running"; exit 1; }
 222
 223     if [ -d /sys/class/net/${LXC_BRIDGE} ]; then
 224         _ifdown
 225         if use_nft; then
 226             stop_nftables
 227         else
 228             stop_iptables
 229         fi
 230
 231         pid=`cat "${varrun}"/dnsmasq.pid 2>/dev/null` && kill -9 $pid
 232         rm -f "${varrun}"/dnsmasq.pid
 233         # if $LXC_BRIDGE has attached interfaces, don't destroy the bridge
 234         ls /sys/class/net/${LXC_BRIDGE}/brif/* > /dev/null 2>&1 || ip link delete ${LXC_BRIDGE}
 235     fi
 236
 237     rm -f "${varrun}"/network_up
 238 }
 239
 240 # See how we were called.
 241 case "$1" in
 242     start)
 243         start
 244     ;;
 245
 246     stop)
 247         stop
 248     ;;
 249
 250     restart|reload|force-reload)
 251         $0 stop
 252         $0 start
 253     ;;
 254
 255     *)
 256         echo "Usage: $0 {start|stop|restart|reload|force-reload}"
 257         exit 2
 258 esac
 259
 260 exit $?