data/scripts/waydroid-net.sh

   1 #!/bin/sh -
   2
   3 varrun="/run/waydroid-lxc"
   4 varlib="/var/lib"
   5 net_link_key="lxc.net.0.link"
   6 case "$(lxc-info --version)" in [012].*) net_link_key="lxc.network.link" ;; esac
   7 vnic=$(awk "\$1 == \"$net_link_key\" {print \$3}" /var/lib/waydroid/lxc/waydroid/config)
   8 : ${vnic:=waydroid0}
   9
  10 if [ "$vnic" != "waydroid0" ]; then
  11     echo "vnic is $vnic, bailing out"
  12     exit 0
  13 else
  14     echo "vnic is waydroid0"
  15 fi
  16
  17 USE_LXC_BRIDGE="true"
  18 LXC_BRIDGE="${vnic}"
  19 LXC_BRIDGE_MAC="00:16:3e:00:00:01"
  20 LXC_ADDR="192.168.240.1"
  21 LXC_NETMASK="255.255.255.0"
  22 LXC_NETWORK="192.168.240.0/24"
  23 LXC_DHCP_RANGE="192.168.240.2,192.168.240.254"
  24 LXC_DHCP_MAX="253"
  25 LXC_DHCP_CONFILE=""
  26 LXC_DHCP_PING="true"
  27 LXC_DOMAIN=""
  28 LXC_USE_NFT="false"
  29
  30 LXC_IPV6_ADDR=""
  31 LXC_IPV6_MASK=""
  32 LXC_IPV6_NETWORK=""
  33 LXC_IPV6_NAT="false"
  34
  35 IPTABLES_BIN="$(which iptables-legacy)"
  36 if [ ! -n "$IPTABLES_BIN" ]; then
  37     IPTABLES_BIN="$(which iptables)"
  38 fi
  39 IP6TABLES_BIN="$(which ip6tables-legacy)"
  40 if [ ! -n "$IP6TABLES_BIN" ]; then
  41     IP6TABLES_BIN="$(which ip6tables)"
  42 fi
  43
  44 use_nft() {
  45     [ -n "$NFT" ] && nft list ruleset > /dev/null 2>&1 && [ "$LXC_USE_NFT" = "true" ]
  46 }
  47
  48 NFT="$(which nft)"
  49 if ! use_nft; then
  50     use_iptables_lock="-w"
  51     $IPTABLES_BIN -w -L -n > /dev/null 2>&1 || use_iptables_lock=""
  52 fi
  53
  54 _netmask2cidr ()
  55 {
  56     # Assumes there's no "255." after a non-255 byte in the mask
  57     local x=${1##*255.}
  58     set -- 0^^^128^192^224^240^248^252^254^ $(( (${#1} - ${#x})*2 )) ${x%%.*}
  59     x=${1%%$3*}
  60     echo $(( $2 + (${#x}/4) ))
  61 }
  62
  63 _ifdown() {
  64     ip addr flush dev ${LXC_BRIDGE}
  65     ip link set dev ${LXC_BRIDGE} down
  66 }
  67
  68 _ifup() {
  69     MASK=`_netmask2cidr ${LXC_NETMASK}`
  70     CIDR_ADDR="${LXC_ADDR}/${MASK}"
  71     ip addr add ${CIDR_ADDR} broadcast + dev ${LXC_BRIDGE}
  72     ip link set dev ${LXC_BRIDGE} address $LXC_BRIDGE_MAC
  73     ip link set dev ${LXC_BRIDGE} up
  74 }
  75
  76 start_ipv6() {
  77     LXC_IPV6_ARG=""
  78     if [ -n "$LXC_IPV6_ADDR" ] && [ -n "$LXC_IPV6_MASK" ] && [ -n "$LXC_IPV6_NETWORK" ]; then
  79         echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  80         echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/autoconf
  81         ip -6 addr add dev ${LXC_BRIDGE} ${LXC_IPV6_ADDR}/${LXC_IPV6_MASK}
  82         LXC_IPV6_ARG="--dhcp-range=${LXC_IPV6_ADDR},ra-only --listen-address ${LXC_IPV6_ADDR}"
  83     fi
  84 }
  85
  86 start_iptables() {
  87     start_ipv6
  88     if [ -n "$LXC_IPV6_ARG" ] && [ "$LXC_IPV6_NAT" = "true" ]; then
  89         $IP6TABLES_BIN $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
  90     fi
  91     $IPTABLES_BIN $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
  92     $IPTABLES_BIN $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
  93     $IPTABLES_BIN $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
  94     $IPTABLES_BIN $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
  95     $IPTABLES_BIN $use_iptables_lock -I FORWARD -i ${LXC_BRIDGE} -j ACCEPT
  96     $IPTABLES_BIN $use_iptables_lock -I FORWARD -o ${LXC_BRIDGE} -j ACCEPT
  97     $IPTABLES_BIN $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
  98     $IPTABLES_BIN $use_iptables_lock -t mangle -A POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
  99 }
 100
 101 start_nftables() {
 102     start_ipv6
 103     NFT_RULESET=""
 104     if [ -n "$LXC_IPV6_ARG" ] && [ "$LXC_IPV6_NAT" = "true" ]; then
 105         NFT_RULESET="${NFT_RULESET}
 106 add table ip6 lxc;
 107 flush table ip6 lxc;
 108 add chain ip6 lxc postrouting { type nat hook postrouting priority 100; };
 109 add rule ip6 lxc postrouting ip saddr ${LXC_IPV6_NETWORK} ip daddr != ${LXC_IPV6_NETWORK} counter masquerade;
 110 "
 111     fi
 112     NFT_RULESET="${NFT_RULESET};
 113 add table inet lxc;
 114 flush table inet lxc;
 115 add chain inet lxc input { type filter hook input priority 0; };
 116 add rule inet lxc input iifname ${LXC_BRIDGE} udp dport { 53, 67 } accept;
 117 add rule inet lxc input iifname ${LXC_BRIDGE} tcp dport { 53, 67 } accept;
 118 add chain inet lxc forward { type filter hook forward priority 0; };
 119 add rule inet lxc forward iifname ${LXC_BRIDGE} accept;
 120 add rule inet lxc forward oifname ${LXC_BRIDGE} accept;
 121 add table ip lxc;
 122 flush table ip lxc;
 123 add chain ip lxc postrouting { type nat hook postrouting priority 100; };
 124 add rule ip lxc postrouting ip saddr ${LXC_NETWORK} ip daddr != ${LXC_NETWORK} counter masquerade"
 125     nft "${NFT_RULESET}"
 126 }
 127
 128 start() {
 129     [ "x$USE_LXC_BRIDGE" = "xtrue" ] || { exit 0; }
 130
 131     [ ! -f "${varrun}/network_up" ] || { echo "waydroid-net is already running"; exit 0; }
 132
 133     if [ -d /sys/class/net/${LXC_BRIDGE} ]; then
 134         stop force || true
 135     fi
 136
 137     FAILED=1
 138
 139     cleanup() {
 140         set +e
 141         if [ "$FAILED" = "1" ]; then
 142             echo "Failed to setup waydroid-net." >&2
 143             stop force
 144             exit 1
 145         fi
 146     }
 147
 148     trap cleanup EXIT HUP INT TERM
 149     set -e
 150
 151     # set up the lxc network
 152     [ ! -d /sys/class/net/${LXC_BRIDGE} ] && ip link add dev ${LXC_BRIDGE} type bridge
 153     echo 1 > /proc/sys/net/ipv4/ip_forward
 154     echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/accept_dad || true
 155
 156     # if we are run from systemd on a system with selinux enabled,
 157     # the mkdir will create /run/lxc as init_var_run_t which dnsmasq
 158     # can't write its pid into, so we restorecon it (to var_run_t)
 159     if [ ! -d "${varrun}" ]; then
 160         mkdir -p "${varrun}"
 161         if which restorecon >/dev/null 2>&1; then
 162             restorecon "${varrun}"
 163         fi
 164     fi
 165
 166     _ifup
 167
 168     if use_nft; then
 169         start_nftables
 170     else
 171         start_iptables
 172     fi
 173
 174     LXC_DOMAIN_ARG=""
 175     if [ -n "$LXC_DOMAIN" ]; then
 176         LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
 177     fi
 178
 179     # lxc's dnsmasq should be hermetic and not read `/etc/dnsmasq.conf` (which
 180     # it does by default if `--conf-file` is not present
 181     LXC_DHCP_CONFILE_ARG="--conf-file=${LXC_DHCP_CONFILE:-/dev/null}"
 182
 183     # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
 184     for DNSMASQ_USER in lxc-dnsmasq dnsmasq nobody
 185     do
 186         if getent passwd ${DNSMASQ_USER} >/dev/null; then
 187             break
 188         fi
 189     done
 190
 191     LXC_DHCP_PING_ARG=""
 192     if [ "x$LXC_DHCP_PING" = "xfalse" ]; then
 193         LXC_DHCP_PING_ARG="--no-ping"
 194     fi
 195
 196     if [ ! -d "${varlib}"/misc ]; then
 197         mkdir "${varlib}"/misc
 198     fi
 199
 200     dnsmasq $LXC_DHCP_CONFILE_ARG $LXC_DOMAIN_ARG $LXC_DHCP_PING_ARG -u ${DNSMASQ_USER} \
 201             --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid \
 202             --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} \
 203             --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override \
 204             --except-interface=lo --interface=${LXC_BRIDGE} \
 205             --dhcp-leasefile="${varlib}"/misc/dnsmasq.${LXC_BRIDGE}.leases \
 206             --dhcp-authoritative $LXC_IPV6_ARG || cleanup
 207
 208     touch "${varrun}"/network_up
 209     FAILED=0
 210 }
 211
 212 stop_iptables() {
 213     $IPTABLES_BIN $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
 214     $IPTABLES_BIN $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
 215     $IPTABLES_BIN $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
 216     $IPTABLES_BIN $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
 217     $IPTABLES_BIN $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j ACCEPT
 218     $IPTABLES_BIN $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
 219     $IPTABLES_BIN $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
 220     $IPTABLES_BIN $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
 221     if [ "$LXC_IPV6_NAT" = "true" ]; then
 222         $IP6TABLES_BIN $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
 223     fi
 224 }
 225
 226 stop_nftables() {
 227     # Adding table before removing them is just to avoid
 228     # delete error for non-existent table
 229     NFT_RULESET="add table inet lxc;
 230 delete table inet lxc;
 231 add table ip lxc;
 232 delete table ip lxc;
 233 "
 234     if [ "$LXC_IPV6_NAT" = "true" ]; then
 235         NFT_RULESET="${NFT_RULESET};
 236 add table ip6 lxc;
 237 delete table ip6 lxc;"
 238     fi
 239     nft "${NFT_RULESET}"
 240 }
 241
 242 stop() {
 243     [ "x$USE_LXC_BRIDGE" = "xtrue" ] || { exit 0; }
 244
 245     [ -f "${varrun}/network_up" ] || [ "$1" = "force" ] || { echo "waydroid-net isn't running"; exit 1; }
 246
 247     if [ -d /sys/class/net/${LXC_BRIDGE} ]; then
 248         _ifdown
 249         if use_nft; then
 250             stop_nftables
 251         else
 252             stop_iptables
 253         fi
 254
 255         pid=`cat "${varrun}"/dnsmasq.pid 2>/dev/null` && kill -9 $pid
 256         rm -f "${varrun}"/dnsmasq.pid
 257         # if $LXC_BRIDGE has attached interfaces, don't destroy the bridge
 258         ls /sys/class/net/${LXC_BRIDGE}/brif/* > /dev/null 2>&1 || ip link delete ${LXC_BRIDGE}
 259     fi
 260
 261     rm -f "${varrun}"/network_up
 262 }
 263
 264 # See how we were called.
 265 case "$1" in
 266     start)
 267         start
 268     ;;
 269
 270     stop)
 271         stop
 272     ;;
 273
 274     restart|reload|force-reload)
 275         $0 stop
 276         $0 start
 277     ;;
 278
 279     *)
 280         echo "Usage: $0 {start|stop|restart|reload|force-reload}"
 281         exit 2
 282 esac
 283
 284 exit $?