data/scripts/waydroid-net.sh

   1 #!/bin/sh -
   2
   3 varrun="/run/waydroid-lxc"
   4 varlib="/var/lib"
   5
   6 USE_LXC_BRIDGE="true"
   7 LXC_BRIDGE="waydroid0"
   8 LXC_BRIDGE_MAC="00:16:3e:00:00:01"
   9 LXC_ADDR="192.168.250.1"
  10 LXC_NETMASK="255.255.255.0"
  11 LXC_NETWORK="192.168.250.0/24"
  12 LXC_DHCP_RANGE="192.168.250.2,192.168.250.254"
  13 LXC_DHCP_MAX="253"
  14 LXC_DHCP_CONFILE=""
  15 LXC_DHCP_PING="true"
  16 LXC_DOMAIN=""
  17 LXC_USE_NFT="true"
  18
  19 LXC_IPV6_ADDR=""
  20 LXC_IPV6_MASK=""
  21 LXC_IPV6_NETWORK=""
  22 LXC_IPV6_NAT="false"
  23
  24 IPTABLES_BIN="$(which iptables-legacy)"
  25 if [ ! -n "$IPTABLES_BIN" ]; then
  26     IPTABLES_BIN="$(which iptables)"
  27 fi
  28 IP6TABLES_BIN="$(which ip6tables-legacy)"
  29 if [ ! -n "$IP6TABLES_BIN" ]; then
  30     IP6TABLES_BIN="$(which ip6tables)"
  31 fi
  32
  33 use_nft() {
  34     [ -n "$NFT" ] && nft list ruleset > /dev/null 2>&1 && [ "$LXC_USE_NFT" = "true" ]
  35 }
  36
  37 NFT="$(which nft)"
  38 if ! use_nft; then
  39     use_iptables_lock="-w"
  40     $IPTABLES_BIN -w -L -n > /dev/null 2>&1 || use_iptables_lock=""
  41 fi
  42
  43 _netmask2cidr ()
  44 {
  45     # Assumes there's no "255." after a non-255 byte in the mask
  46     local x=${1##*255.}
  47     set -- 0^^^128^192^224^240^248^252^254^ $(( (${#1} - ${#x})*2 )) ${x%%.*}
  48     x=${1%%$3*}
  49     echo $(( $2 + (${#x}/4) ))
  50 }
  51
  52 _ifdown() {
  53     ip addr flush dev ${LXC_BRIDGE}
  54     ip link set dev ${LXC_BRIDGE} down
  55 }
  56
  57 _ifup() {
  58     MASK=`_netmask2cidr ${LXC_NETMASK}`
  59     CIDR_ADDR="${LXC_ADDR}/${MASK}"
  60     ip addr add ${CIDR_ADDR} broadcast + dev ${LXC_BRIDGE}
  61     ip link set dev ${LXC_BRIDGE} address $LXC_BRIDGE_MAC
  62     ip link set dev ${LXC_BRIDGE} up
  63 }
  64
  65 start_ipv6() {
  66     LXC_IPV6_ARG=""
  67     if [ -n "$LXC_IPV6_ADDR" ] && [ -n "$LXC_IPV6_MASK" ] && [ -n "$LXC_IPV6_NETWORK" ]; then
  68         echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  69         echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/autoconf
  70         ip -6 addr add dev ${LXC_BRIDGE} ${LXC_IPV6_ADDR}/${LXC_IPV6_MASK}
  71         LXC_IPV6_ARG="--dhcp-range=${LXC_IPV6_ADDR},ra-only --listen-address ${LXC_IPV6_ADDR}"
  72     fi
  73 }
  74
  75 start_iptables() {
  76     start_ipv6
  77     if [ -n "$LXC_IPV6_ARG" ] && [ "$LXC_IPV6_NAT" = "true" ]; then
  78         $IP6TABLES_BIN $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
  79     fi
  80     $IPTABLES_BIN $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
  81     $IPTABLES_BIN $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
  82     $IPTABLES_BIN $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
  83     $IPTABLES_BIN $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
  84     $IPTABLES_BIN $use_iptables_lock -I FORWARD -i ${LXC_BRIDGE} -j ACCEPT
  85     $IPTABLES_BIN $use_iptables_lock -I FORWARD -o ${LXC_BRIDGE} -j ACCEPT
  86     $IPTABLES_BIN $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
  87     $IPTABLES_BIN $use_iptables_lock -t mangle -A POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
  88 }
  89
  90 start_nftables() {
  91     start_ipv6
  92     NFT_RULESET=""
  93     if [ -n "$LXC_IPV6_ARG" ] && [ "$LXC_IPV6_NAT" = "true" ]; then
  94         NFT_RULESET="${NFT_RULESET}
  95 add table ip6 lxc;
  96 flush table ip6 lxc;
  97 add chain ip6 lxc postrouting { type nat hook postrouting priority 100; };
  98 add rule ip6 lxc postrouting ip saddr ${LXC_IPV6_NETWORK} ip daddr != ${LXC_IPV6_NETWORK} counter masquerade;
  99 "
 100     fi
 101     NFT_RULESET="${NFT_RULESET};
 102 add table inet lxc;
 103 flush table inet lxc;
 104 add chain inet lxc input { type filter hook input priority 0; };
 105 add rule inet lxc input iifname ${LXC_BRIDGE} udp dport { 53, 67 } accept;
 106 add rule inet lxc input iifname ${LXC_BRIDGE} tcp dport { 53, 67 } accept;
 107 add chain inet lxc forward { type filter hook forward priority 0; };
 108 add rule inet lxc forward iifname ${LXC_BRIDGE} accept;
 109 add rule inet lxc forward oifname ${LXC_BRIDGE} accept;
 110 add table ip lxc;
 111 flush table ip lxc;
 112 add chain ip lxc postrouting { type nat hook postrouting priority 100; };
 113 add rule ip lxc postrouting ip saddr ${LXC_NETWORK} ip daddr != ${LXC_NETWORK} counter masquerade"
 114     nft "${NFT_RULESET}"
 115 }
 116
 117 start() {
 118     [ "x$USE_LXC_BRIDGE" = "xtrue" ] || { exit 0; }
 119
 120     [ ! -f "${varrun}/network_up" ] || { echo "waydroid-net is already running"; exit 1; }
 121
 122     if [ -d /sys/class/net/${LXC_BRIDGE} ]; then
 123         stop force || true
 124     fi
 125
 126     FAILED=1
 127
 128     cleanup() {
 129         set +e
 130         if [ "$FAILED" = "1" ]; then
 131             echo "Failed to setup waydroid-net." >&2
 132             stop force
 133             exit 1
 134         fi
 135     }
 136
 137     trap cleanup EXIT HUP INT TERM
 138     set -e
 139
 140     # set up the lxc network
 141     [ ! -d /sys/class/net/${LXC_BRIDGE} ] && ip link add dev ${LXC_BRIDGE} type bridge
 142     echo 1 > /proc/sys/net/ipv4/ip_forward
 143     echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/accept_dad || true
 144
 145     # if we are run from systemd on a system with selinux enabled,
 146     # the mkdir will create /run/lxc as init_var_run_t which dnsmasq
 147     # can't write its pid into, so we restorecon it (to var_run_t)
 148     if [ ! -d "${varrun}" ]; then
 149         mkdir -p "${varrun}"
 150         if which restorecon >/dev/null 2>&1; then
 151             restorecon "${varrun}"
 152         fi
 153     fi
 154
 155     _ifup
 156
 157     if use_nft; then
 158         start_nftables
 159     else
 160         start_iptables
 161     fi
 162
 163     LXC_DOMAIN_ARG=""
 164     if [ -n "$LXC_DOMAIN" ]; then
 165         LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
 166     fi
 167
 168     # lxc's dnsmasq should be hermetic and not read `/etc/dnsmasq.conf` (which
 169     # it does by default if `--conf-file` is not present
 170     LXC_DHCP_CONFILE_ARG="--conf-file=${LXC_DHCP_CONFILE:-/dev/null}"
 171
 172     # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
 173     for DNSMASQ_USER in lxc-dnsmasq dnsmasq nobody
 174     do
 175         if getent passwd ${DNSMASQ_USER} >/dev/null; then
 176             break
 177         fi
 178     done
 179
 180     LXC_DHCP_PING_ARG=""
 181     if [ "x$LXC_DHCP_PING" = "xfalse" ]; then
 182         LXC_DHCP_PING_ARG="--no-ping"
 183     fi
 184
 185     dnsmasq $LXC_DHCP_CONFILE_ARG $LXC_DOMAIN_ARG $LXC_DHCP_PING_ARG -u ${DNSMASQ_USER} \
 186             --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid \
 187             --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} \
 188             --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override \
 189             --except-interface=lo --interface=${LXC_BRIDGE} \
 190             --dhcp-leasefile="${varlib}"/misc/dnsmasq.${LXC_BRIDGE}.leases \
 191             --dhcp-authoritative $LXC_IPV6_ARG || cleanup
 192
 193     touch "${varrun}"/network_up
 194     FAILED=0
 195 }
 196
 197 stop_iptables() {
 198     $IPTABLES_BIN $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
 199     $IPTABLES_BIN $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
 200     $IPTABLES_BIN $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
 201     $IPTABLES_BIN $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
 202     $IPTABLES_BIN $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j ACCEPT
 203     $IPTABLES_BIN $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
 204     $IPTABLES_BIN $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
 205     $IPTABLES_BIN $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
 206     if [ "$LXC_IPV6_NAT" = "true" ]; then
 207         $IP6TABLES_BIN $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
 208     fi
 209 }
 210
 211 stop_nftables() {
 212     # Adding table before removing them is just to avoid
 213     # delete error for non-existent table
 214     NFT_RULESET="add table inet lxc;
 215 delete table inet lxc;
 216 add table ip lxc;
 217 delete table ip lxc;
 218 "
 219     if [ "$LXC_IPV6_NAT" = "true" ]; then
 220         NFT_RULESET="${NFT_RULESET};
 221 add table ip6 lxc;
 222 delete table ip6 lxc;"
 223     fi
 224     nft "${NFT_RULESET}"
 225 }
 226
 227 stop() {
 228     [ "x$USE_LXC_BRIDGE" = "xtrue" ] || { exit 0; }
 229
 230     [ -f "${varrun}/network_up" ] || [ "$1" = "force" ] || { echo "waydroid-net isn't running"; exit 1; }
 231
 232     if [ -d /sys/class/net/${LXC_BRIDGE} ]; then
 233         _ifdown
 234         if use_nft; then
 235             stop_nftables
 236         else
 237             stop_iptables
 238         fi
 239
 240         pid=`cat "${varrun}"/dnsmasq.pid 2>/dev/null` && kill -9 $pid
 241         rm -f "${varrun}"/dnsmasq.pid
 242         # if $LXC_BRIDGE has attached interfaces, don't destroy the bridge
 243         ls /sys/class/net/${LXC_BRIDGE}/brif/* > /dev/null 2>&1 || ip link delete ${LXC_BRIDGE}
 244     fi
 245
 246     rm -f "${varrun}"/network_up
 247 }
 248
 249 # See how we were called.
 250 case "$1" in
 251     start)
 252         start
 253     ;;
 254
 255     stop)
 256         stop
 257     ;;
 258
 259     restart|reload|force-reload)
 260         $0 stop
 261         $0 start
 262     ;;
 263
 264     *)
 265         echo "Usage: $0 {start|stop|restart|reload|force-reload}"
 266         exit 2
 267 esac
 268
 269 exit $?