scripts/anbox-net.sh

   1 #!/bin/sh -
   2
   3 distrosysconfdir="@LXC_DISTRO_SYSCONF@"
   4 varrun="@RUNTIME_PATH@/lxc"
   5 varlib="@LOCALSTATEDIR@/lib"
   6
   7 # These can be overridden in @LXC_DISTRO_SYSCONF@/lxc
   8 #   or in @LXC_DISTRO_SYSCONF@/lxc-net
   9
  10 USE_LXC_BRIDGE="true"
  11 LXC_BRIDGE="lxcbr0"
  12 LXC_BRIDGE_MAC="00:16:3e:00:00:00"
  13 LXC_ADDR="10.0.3.1"
  14 LXC_NETMASK="255.255.255.0"
  15 LXC_NETWORK="10.0.3.0/24"
  16 LXC_DHCP_RANGE="10.0.3.2,10.0.3.254"
  17 LXC_DHCP_MAX="253"
  18 LXC_DHCP_CONFILE=""
  19 LXC_DHCP_PING="true"
  20 LXC_DOMAIN=""
  21 LXC_USE_NFT="true"
  22
  23 LXC_IPV6_ADDR=""
  24 LXC_IPV6_MASK=""
  25 LXC_IPV6_NETWORK=""
  26 LXC_IPV6_NAT="false"
  27
  28 [ ! -f $distrosysconfdir/lxc ] || . $distrosysconfdir/lxc
  29
  30 use_nft() {
  31     [ -n "$NFT" ] && nft list ruleset > /dev/null 2>&1 && [ "$LXC_USE_NFT" = "true" ]
  32 }
  33
  34 NFT="$(which nft)"
  35 if ! use_nft; then
  36     use_iptables_lock="-w"
  37     iptables -w -L -n > /dev/null 2>&1 || use_iptables_lock=""
  38 fi
  39
  40 _netmask2cidr ()
  41 {
  42     # Assumes there's no "255." after a non-255 byte in the mask
  43     local x=${1##*255.}
  44     set -- 0^^^128^192^224^240^248^252^254^ $(( (${#1} - ${#x})*2 )) ${x%%.*}
  45     x=${1%%$3*}
  46     echo $(( $2 + (${#x}/4) ))
  47 }
  48
  49 _ifdown() {
  50     ip addr flush dev ${LXC_BRIDGE}
  51     ip link set dev ${LXC_BRIDGE} down
  52 }
  53
  54 _ifup() {
  55     MASK=`_netmask2cidr ${LXC_NETMASK}`
  56     CIDR_ADDR="${LXC_ADDR}/${MASK}"
  57     ip addr add ${CIDR_ADDR} broadcast + dev ${LXC_BRIDGE}
  58     ip link set dev ${LXC_BRIDGE} address $LXC_BRIDGE_MAC
  59     ip link set dev ${LXC_BRIDGE} up
  60 }
  61
  62 start_ipv6() {
  63     LXC_IPV6_ARG=""
  64     if [ -n "$LXC_IPV6_ADDR" ] && [ -n "$LXC_IPV6_MASK" ] && [ -n "$LXC_IPV6_NETWORK" ]; then
  65         echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  66         echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/autoconf
  67         ip -6 addr add dev ${LXC_BRIDGE} ${LXC_IPV6_ADDR}/${LXC_IPV6_MASK}
  68         LXC_IPV6_ARG="--dhcp-range=${LXC_IPV6_ADDR},ra-only --listen-address ${LXC_IPV6_ADDR}"
  69     fi
  70 }
  71
  72 start_iptables() {
  73     start_ipv6
  74     if [ -n "$LXC_IPV6_ARG" ] && [ "$LXC_IPV6_NAT" = "true" ]; then
  75         ip6tables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
  76     fi
  77     iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
  78     iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
  79     iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
  80     iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
  81     iptables $use_iptables_lock -I FORWARD -i ${LXC_BRIDGE} -j ACCEPT
  82     iptables $use_iptables_lock -I FORWARD -o ${LXC_BRIDGE} -j ACCEPT
  83     iptables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
  84     iptables $use_iptables_lock -t mangle -A POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
  85 }
  86
  87 start_nftables() {
  88     start_ipv6
  89     NFT_RULESET=""
  90     if [ -n "$LXC_IPV6_ARG" ] && [ "$LXC_IPV6_NAT" = "true" ]; then
  91         NFT_RULESET="${NFT_RULESET}
  92 add table ip6 lxc;
  93 flush table ip6 lxc;
  94 add chain ip6 lxc postrouting { type nat hook postrouting priority 100; };
  95 add rule ip6 lxc postrouting ip saddr ${LXC_IPV6_NETWORK} ip daddr != ${LXC_IPV6_NETWORK} counter masquerade;
  96 "
  97     fi
  98     NFT_RULESET="${NFT_RULESET};
  99 add table inet lxc;
 100 flush table inet lxc;
 101 add chain inet lxc input { type filter hook input priority 0; };
 102 add rule inet lxc input iifname ${LXC_BRIDGE} udp dport { 53, 67 } accept;
 103 add rule inet lxc input iifname ${LXC_BRIDGE} tcp dport { 53, 67 } accept;
 104 add chain inet lxc forward { type filter hook forward priority 0; };
 105 add rule inet lxc forward iifname ${LXC_BRIDGE} accept;
 106 add rule inet lxc forward oifname ${LXC_BRIDGE} accept;
 107 add table ip lxc;
 108 flush table ip lxc;
 109 add chain ip lxc postrouting { type nat hook postrouting priority 100; };
 110 add rule ip lxc postrouting ip saddr ${LXC_NETWORK} ip daddr != ${LXC_NETWORK} counter masquerade"
 111     nft "${NFT_RULESET}"
 112 }
 113
 114 start() {
 115     [ "x$USE_LXC_BRIDGE" = "xtrue" ] || { exit 0; }
 116
 117     [ ! -f "${varrun}/network_up" ] || { echo "lxc-net is already running"; exit 1; }
 118
 119     if [ -d /sys/class/net/${LXC_BRIDGE} ]; then
 120         stop force || true
 121     fi
 122
 123     FAILED=1
 124
 125     cleanup() {
 126         set +e
 127         if [ "$FAILED" = "1" ]; then
 128             echo "Failed to setup lxc-net." >&2
 129             stop force
 130             exit 1
 131         fi
 132     }
 133
 134     trap cleanup EXIT HUP INT TERM
 135     set -e
 136
 137     # set up the lxc network
 138     [ ! -d /sys/class/net/${LXC_BRIDGE} ] && ip link add dev ${LXC_BRIDGE} type bridge
 139     echo 1 > /proc/sys/net/ipv4/ip_forward
 140     echo 0 > /proc/sys/net/ipv6/conf/${LXC_BRIDGE}/accept_dad || true
 141
 142     # if we are run from systemd on a system with selinux enabled,
 143     # the mkdir will create /run/lxc as init_var_run_t which dnsmasq
 144     # can't write its pid into, so we restorecon it (to var_run_t)
 145     if [ ! -d "${varrun}" ]; then
 146         mkdir -p "${varrun}"
 147         if which restorecon >/dev/null 2>&1; then
 148             restorecon "${varrun}"
 149         fi
 150     fi
 151
 152     _ifup
 153
 154     if use_nft; then
 155         start_nftables
 156     else
 157         start_iptables
 158     fi
 159
 160     LXC_DOMAIN_ARG=""
 161     if [ -n "$LXC_DOMAIN" ]; then
 162         LXC_DOMAIN_ARG="-s $LXC_DOMAIN -S /$LXC_DOMAIN/"
 163     fi
 164
 165     # lxc's dnsmasq should be hermetic and not read `/etc/dnsmasq.conf` (which
 166     # it does by default if `--conf-file` is not present
 167     LXC_DHCP_CONFILE_ARG="--conf-file=${LXC_DHCP_CONFILE:-/dev/null}"
 168
 169     # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html
 170     for DNSMASQ_USER in lxc-dnsmasq dnsmasq nobody
 171     do
 172         if getent passwd ${DNSMASQ_USER} >/dev/null; then
 173             break
 174         fi
 175     done
 176
 177     LXC_DHCP_PING_ARG=""
 178     if [ "x$LXC_DHCP_PING" = "xfalse" ]; then
 179         LXC_DHCP_PING_ARG="--no-ping"
 180     fi
 181
 182     dnsmasq $LXC_DHCP_CONFILE_ARG $LXC_DOMAIN_ARG $LXC_DHCP_PING_ARG -u ${DNSMASQ_USER} \
 183             --strict-order --bind-interfaces --pid-file="${varrun}"/dnsmasq.pid \
 184             --listen-address ${LXC_ADDR} --dhcp-range ${LXC_DHCP_RANGE} \
 185             --dhcp-lease-max=${LXC_DHCP_MAX} --dhcp-no-override \
 186             --except-interface=lo --interface=${LXC_BRIDGE} \
 187             --dhcp-leasefile="${varlib}"/misc/dnsmasq.${LXC_BRIDGE}.leases \
 188             --dhcp-authoritative $LXC_IPV6_ARG || cleanup
 189
 190     touch "${varrun}"/network_up
 191     FAILED=0
 192 }
 193
 194 stop_iptables() {
 195     iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 67 -j ACCEPT
 196     iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
 197     iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
 198     iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
 199     iptables $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j ACCEPT
 200     iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
 201     iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
 202     iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
 203     if [ "$LXC_IPV6_NAT" = "true" ]; then
 204         ip6tables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_IPV6_NETWORK} ! -d ${LXC_IPV6_NETWORK} -j MASQUERADE
 205     fi
 206 }
 207
 208 stop_nftables() {
 209     # Adding table before removing them is just to avoid
 210     # delete error for non-existent table
 211     NFT_RULESET="add table inet lxc;
 212 delete table inet lxc;
 213 add table ip lxc;
 214 delete table ip lxc;
 215 "
 216     if [ "$LXC_IPV6_NAT" = "true" ]; then
 217         NFT_RULESET="${NFT_RULESET};
 218 add table ip6 lxc;
 219 delete table ip6 lxc;"
 220     fi
 221     nft "${NFT_RULESET}"
 222 }
 223
 224 stop() {
 225     [ "x$USE_LXC_BRIDGE" = "xtrue" ] || { exit 0; }
 226
 227     [ -f "${varrun}/network_up" ] || [ "$1" = "force" ] || { echo "lxc-net isn't running"; exit 1; }
 228
 229     if [ -d /sys/class/net/${LXC_BRIDGE} ]; then
 230         _ifdown
 231         if use_nft; then
 232             stop_nftables
 233         else
 234             stop_iptables
 235         fi
 236
 237         pid=`cat "${varrun}"/dnsmasq.pid 2>/dev/null` && kill -9 $pid
 238         rm -f "${varrun}"/dnsmasq.pid
 239         # if $LXC_BRIDGE has attached interfaces, don't destroy the bridge
 240         ls /sys/class/net/${LXC_BRIDGE}/brif/* > /dev/null 2>&1 || ip link delete ${LXC_BRIDGE}
 241     fi
 242
 243     rm -f "${varrun}"/network_up
 244 }
 245
 246 # See how we were called.
 247 case "$1" in
 248     start)
 249         start
 250     ;;
 251
 252     stop)
 253         stop
 254     ;;
 255
 256     restart|reload|force-reload)
 257         $0 stop
 258         $0 start
 259     ;;
 260
 261     *)
 262         echo "Usage: $0 {start|stop|restart|reload|force-reload}"
 263         exit 2
 264 esac
 265
 266 exit $?