- moved global netjail methods to its own header file.dev/t3ss/tng

- added configuration by string in test skript instead of config file.
- moved netjail scripts to contrib/netjail and install them into
the share/gnunet directory.

6 files changed, 544 insertions, 0 deletions

diff --git a/contrib/Makefile.am b/contrib/Makefile.am
index 464016ee8..44b0ff76d 100644
--- a/contrib/Makefile.am
+++ b/contrib/Makefile.am
@@ -24,6 +24,10 @@ dist_pkgdata_DATA = \
   branding/logo/gnunet-logo-big.png \
   branding/logo/gnunet-logo.pdf \
   testing_hostkeys.ecc \
+  netjail/netjail_core.sh \
+  netjail/netjail_start.sh \
+  netjail/netjail_stop.sh \
+  netjail/topo.sh \
   $(BUILDCOMMON_SHLIB_FILES)
 
 INITD_FILES = \
@@ -240,4 +244,11 @@ aclocaldir = $(datadir)/aclocal
 aclocal_DATA = \
   gnunet.m4
 
+install-data-hook:
+        chmod o+x $(pkgdatadir)/netjail_core.sh
+        chmod o+x $(pkgdatadir)/netjail_start.sh
+        chmod o+x $(pkgdatadir)/netjail_stop.sh
+        chmod o+x $(pkgdatadir)/netjail_exec.sh
+        chmod o+x $(pkgdatadir)/topo.sh
+
 ## EOF
diff --git a/contrib/netjail/netjail_core.sh b/contrib/netjail/netjail_core.sh
new file mode 100755
index 000000000..ed363cf35
--- /dev/null
+++ b/contrib/netjail/netjail_core.sh
@@ -0,0 +1,260 @@
+#!/bin/sh
+# 
+
+
+PREFIX=${PPID:?must run from a parent process}
+
+# running with `sudo` is required to be
+# able running the actual commands as the
+# original user.
+
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+export RESULT=
+export NAMESPACE_NUM=0
+export INTERFACE_NUM=0
+
+netjail_next_namespace() {
+        local NUM=$NAMESPACE_NUM
+        NAMESPACE_NUM=$(($NAMESPACE_NUM + 1))
+        RESULT=$NUM
+}
+
+netjail_next_interface() {
+        local NUM=$INTERFACE_NUM
+        INTERFACE_NUM=$(($INTERFACE_NUM + 1))
+        RESULT=$NUM
+}
+
+netjail_opt() {
+        local OPT=$1
+        shift 1
+
+        INDEX=1
+
+        while [ $# -gt 0 ]; do
+                if [ "$1" = "$OPT" ]; then
+                        RESULT=$INDEX
+                        return
+                fi
+
+                INDEX=$(($INDEX + 1))
+                shift 1
+        done
+
+        RESULT=0
+}
+
+netjail_opts() {
+        local OPT=$1
+        local DEF=$2
+        shift 2
+        
+        while [ $# -gt 0 ]; do
+                if [ "$1" = "$OPT" ]; then
+                        printf "$2"
+                        return
+                fi
+
+                shift 1
+        done
+        
+        RESULT="$DEF"
+}
+
+netjail_check() {
+        local NODE_COUNT=$1
+        local FD_COUNT=$(($(ls /proc/self/fd | wc -w) - 4))
+
+        # quit if `$FD_COUNT < ($LOCAL_M * $GLOBAL_N * 2)`:
+        # the script also requires `sudo -C ($FD_COUNT + 4)`
+        # so you need 'Defaults closefrom_override' in the
+        # sudoers file.
+
+        if [ $FD_COUNT -lt $(($NODE_COUNT * 2)) ]; then
+                echo "File descriptors do not match requirements!" >&2
+                exit 1
+        fi
+}
+
+netjail_check_bin() {
+        local PROGRAM=$1
+        local MATCH=$(ls $(echo $PATH | tr ":" "\n") | grep "^$PROGRAM\$" | tr "\n" " " | awk '{ print $1 }')
+
+        # quit if the required binary $PROGRAM can not be
+        # found in the used $PATH.
+
+        if [ "$MATCH" != "$PROGRAM" ]; then
+                echo "Required binary not found: $PROGRAM" >&2
+                exit 1
+        fi
+}
+
+netjail_bridge() {
+        netjail_next_interface
+        local NUM=$RESULT
+        local BRIDGE=$(printf "%06x-%08x" $PREFIX $NUM)
+
+        ip link add $BRIDGE type bridge
+        ip link set dev $BRIDGE up
+        
+        RESULT=$BRIDGE
+}
+
+netjail_bridge_name() {
+        netjail_next_interface
+        local NUM=$RESULT
+        local BRIDGE=$(printf "%06x-%08x" $PREFIX $NUM)
+        
+        RESULT=$BRIDGE
+}
+
+netjail_bridge_clear() {
+        local BRIDGE=$1
+
+        ip link delete $BRIDGE
+}
+
+netjail_node() {
+        netjail_next_namespace
+        local NUM=$RESULT
+        local NODE=$(printf "%06x-%08x" $PREFIX $NUM)
+
+        ip netns add $NODE
+        
+        RESULT=$NODE
+}
+
+netjail_node_name() {
+        netjail_next_namespace
+        local NUM=$RESULT
+        local NODE=$(printf "%06x-%08x" $PREFIX $NUM)
+        
+        RESULT=$NODE
+}
+
+netjail_node_clear() {
+        local NODE=$1
+
+        ip netns delete $NODE
+}
+
+netjail_node_link_bridge() {
+        local NODE=$1
+        local BRIDGE=$2
+        local ADDRESS=$3
+        local MASK=$4
+        
+        netjail_next_interface
+        local NUM_IF=$RESULT
+        netjail_next_interface
+        local NUM_BR=$RESULT
+        
+        local LINK_IF=$(printf "%06x-%08x" $PREFIX $NUM_IF)
+        local LINK_BR=$(printf "%06x-%08x" $PREFIX $NUM_BR)
+
+        ip link add $LINK_IF type veth peer name $LINK_BR
+        ip link set $LINK_IF netns $NODE
+        ip link set $LINK_BR master $BRIDGE
+
+        ip -n $NODE addr add "$ADDRESS/$MASK" broadcast + dev $LINK_IF
+        ip -n $NODE link set $LINK_IF up
+        ip -n $NODE link set up dev lo
+
+        ip link set $LINK_BR up
+        
+        RESULT=$LINK_BR
+}
+
+netjail_node_link_bridge_name() {
+        
+        netjail_next_interface
+        netjail_next_interface
+        local NUM_BR=$RESULT
+        
+        local LINK_BR=$(printf "%06x-%08x" $PREFIX $NUM_BR)
+        
+        RESULT=$LINK_BR
+}
+
+netjail_node_unlink_bridge() {
+        local LINK_BR=$1
+
+        ip link delete $LINK_BR
+}
+
+netjail_node_add_nat() {
+        local NODE=$1
+        local ADDRESS=$2
+        local MASK=$3
+
+        ip netns exec $NODE iptables -t nat -A POSTROUTING -s "$ADDRESS/$MASK" -j MASQUERADE
+}
+
+netjail_node_add_default() {
+        local NODE=$1
+        local ADDRESS=$2
+
+        ip -n $NODE route add default via $ADDRESS
+}
+
+netjail_node_exec() {
+    JAILOR=${SUDO_USER:?must run in sudo}
+        local NODE=$1
+        local FD_IN=$2
+        local FD_OUT=$3
+        shift 3
+
+        ip netns exec $NODE sudo -u $JAILOR -- $@ 1>& $FD_OUT 0<& $FD_IN
+}
+
+netjail_node_exec_without_fds() {
+    JAILOR=${SUDO_USER:?must run in sudo}
+        NODE=$1
+        shift 1
+
+        ip netns exec $NODE sudo -u $JAILOR -- $@
+}
+
+netjail_node_exec_without_fds_and_sudo() {
+        NODE=$1
+        shift 1
+
+        ip netns exec $NODE $@
+}
+
+netjail_kill() {
+        local PID=$1
+        local MATCH=$(ps --pid $PID | awk "{ if ( \$1 == $PID ) { print \$1 } }" | wc -l)
+
+        if [ $MATCH -gt 0 ]; then
+                kill -n 19 $PID
+
+                for CHILD in $(ps -o pid,ppid -ax | awk "{ if ( \$2 == $PID ) { print \$1 } }"); do
+                        netjail_kill $CHILD
+                done
+
+                kill $PID
+        fi
+}
+
+netjail_killall() {
+        if [ $# -gt 0 ]; then
+                local PIDS=$1
+
+                for PID in $PIDS; do
+                        netjail_kill $PID
+                done
+        fi
+}
+
+netjail_waitall() {
+        if [ $# -gt 0 ]; then
+                local PIDS=$1
+
+                for PID in $PIDS; do
+                        wait $PID
+                done
+        fi
+}
+
diff --git a/contrib/netjail/netjail_exec.sh b/contrib/netjail/netjail_exec.sh
new file mode 100755
index 000000000..ab4aad5b8
--- /dev/null
+++ b/contrib/netjail/netjail_exec.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+. "$(dirname $0)/netjail_core.sh"
+
+set -eu
+set -x
+
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+M=$1
+N=$2
+
+NODE=$6
+
+netjail_node_exec_without_fds_and_sudo $NODE $3 $4 $5 $1 $2 $7 $8
diff --git a/contrib/netjail/netjail_start.sh b/contrib/netjail/netjail_start.sh
new file mode 100755
index 000000000..997ad0a95
--- /dev/null
+++ b/contrib/netjail/netjail_start.sh
@@ -0,0 +1,81 @@
+#!/bin/bash
+. "$(dirname $0)/netjail_core.sh"
+. "$(dirname $0)/topo.sh"
+
+set -eu
+set -x
+
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+filename=$1
+PREFIX=$2
+readfile=$3
+
+if [ $readfile -eq 0 ]
+then
+    read_topology_string "$filename"
+else
+    echo read file
+    read_topology $filename
+fi
+
+shift 2
+
+LOCAL_GROUP="192.168.15"
+GLOBAL_GROUP="92.68.150"
+KNOWN_GROUP="92.68.151"
+
+
+echo "Start [local: $LOCAL_GROUP.0/24, global: $GLOBAL_GROUP.0/16]"
+
+netjail_bridge
+NETWORK_NET=$RESULT
+
+for X in $(seq $KNOWN); do
+        netjail_node
+        KNOWN_NODES[$X]=$RESULT
+        netjail_node_link_bridge ${KNOWN_NODES[$X]} $NETWORK_NET "$KNOWN_GROUP.$X" 16
+        KNOWN_LINKS[$X]=$RESULT
+done
+
+declare -A NODES
+declare -A NODE_LINKS
+
+for N in $(seq $GLOBAL_N); do
+        netjail_node
+        ROUTERS[$N]=$RESULT
+        netjail_node_link_bridge ${ROUTERS[$N]} $NETWORK_NET "$GLOBAL_GROUP.$N" 16
+        NETWORK_LINKS[$N]=$RESULT
+        netjail_bridge
+        ROUTER_NETS[$N]=$RESULT
+        
+        for M in $(seq $LOCAL_M); do
+                netjail_node
+                NODES[$N,$M]=$RESULT
+                netjail_node_link_bridge ${NODES[$N,$M]} ${ROUTER_NETS[$N]} "$LOCAL_GROUP.$M" 24
+                NODE_LINKS[$N,$M]=$RESULT
+        done
+
+        ROUTER_ADDR="$LOCAL_GROUP.$(($LOCAL_M+1))"
+        netjail_node_link_bridge ${ROUTERS[$N]} ${ROUTER_NETS[$N]} $ROUTER_ADDR 24
+        ROUTER_LINKS[$N]=$RESULT
+        
+        netjail_node_add_nat ${ROUTERS[$N]} $ROUTER_ADDR 24
+        
+        for M in $(seq $LOCAL_M); do
+                netjail_node_add_default ${NODES[$N,$M]} $ROUTER_ADDR
+        done
+
+    # TODO Topology configuration must be enhanced to configure forwarding to more than one subnet node via different ports.
+    
+    if [ "1" == "${R_TCP[$N]}" ]
+    then
+        ip netns exec ${ROUTERS[$N]} iptables -t nat -A PREROUTING -p tcp -d $GLOBAL_GROUP.$N --dport 60002 -j DNAT --to $LOCAL_GROUP.1
+        ip netns exec ${ROUTERS[$N]} iptables -A FORWARD -d $LOCAL_GROUP.1  -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
+    fi
+    if [ "1" == "${R_UDP[$N]}" ]
+    then
+        ip netns exec ${ROUTERS[$N]} iptables -t nat -A PREROUTING -p udp -d $GLOBAL_GROUP.$N --dport 60002 -j DNAT --to $LOCAL_GROUP.1
+        ip netns exec ${ROUTERS[$N]} iptables -A FORWARD -d $LOCAL_GROUP.1  -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
+    fi
+done
diff --git a/contrib/netjail/netjail_stop.sh b/contrib/netjail/netjail_stop.sh
new file mode 100755
index 000000000..c8739dc94
--- /dev/null
+++ b/contrib/netjail/netjail_stop.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+. "$(dirname $0)/netjail_core.sh"
+. "$(dirname $0)/topo.sh"
+
+set -eu
+set -x
+
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+filename=$1
+PREFIX=$2
+readfile=$3
+
+if [ $readfile -eq 0 ]
+then
+    read_topology_string $filename
+else
+    read_topology $filename
+fi
+
+declare -A NODES
+declare -A NODE_LINKS
+
+netjail_bridge_name
+NETWORK_NET=$RESULT
+
+for X in $(seq $KNOWN); do
+    netjail_node_name
+        KNOWN_NODES[$X]=$RESULT
+    netjail_node_link_bridge_name
+    KNOWN_LINKS[$X]=$RESULT
+    netjail_node_unlink_bridge ${KNOWN_LINKS[$X]}
+        netjail_node_clear ${KNOWN_NODES[$X]}
+done
+
+for N in $(seq $GLOBAL_N); do
+    netjail_node_name
+        ROUTERS[$N]=$RESULT
+    netjail_node_link_bridge_name
+    NETWORK_LINKS[$N]=$RESULT
+    netjail_bridge_name
+    ROUTER_NETS[$N]=$RESULT
+    netjail_node_link_bridge_name
+    ROUTER_LINKS[$N]=$RESULT
+
+    netjail_node_unlink_bridge ${ROUTER_LINKS[$N]}
+    
+        for M in $(seq $LOCAL_M); do
+        netjail_node_name
+                NODES[$N,$M]=$RESULT
+        netjail_node_link_bridge_name
+        NODE_LINKS[$N,$M]=$RESULT
+                netjail_node_unlink_bridge ${NODE_LINKS[$N,$M]}
+                netjail_node_clear ${NODES[$N,$M]}
+        done
+
+        
+        netjail_bridge_clear ${ROUTER_NETS[$N]}
+        netjail_node_unlink_bridge ${NETWORK_LINKS[$N]}
+        netjail_node_clear ${ROUTERS[$N]}
+done
+
+netjail_bridge_clear $NETWORK_NET
+
+echo "Done"
diff --git a/contrib/netjail/topo.sh b/contrib/netjail/topo.sh
new file mode 100755
index 000000000..9af017ff0
--- /dev/null
+++ b/contrib/netjail/topo.sh
@@ -0,0 +1,113 @@
+#!/bin/bash
+
+declare -A K_PLUGIN
+declare -A R_TCP
+declare -A R_UDP
+declare -A P_PLUGIN
+
+extract_attributes()
+{
+    line_key=$1
+    line=$2
+    
+    if [ "$line_key" = "P" ]
+    then
+        n=$(echo $line|cut -d \| -f 1|awk -F: '{print $2}')
+        echo $n
+        m=$(echo $line|cut -d \| -f 1|awk -F: '{print $3}')
+        echo $m
+    else
+        number=$(echo $line|cut -d \| -f 1| cut -c 2-|cut -d : -f 2 )
+        echo $number
+    fi
+
+    nf=$(echo $line|awk -F: '{print NF}')
+    for ((i=2;i<=$nf;i++))
+    do
+        entry=$(echo $line |awk -v i=$i -F\| '{print $i}')
+        key=$(echo $entry|cut -d { -f 2|cut -d } -f 1|cut -d : -f 1)
+        value=$(echo $entry|cut -d { -f 2|cut -d } -f 1|cut -d : -f 2)
+        if [ "$key" = "tcp_port" ]
+        then
+            echo tcp port: $value
+            R_TCP[$number]=$value
+        elif [ "$key" = "udp_port" ]
+        then
+            echo udp port: $value
+            R_UDP[$number]=$value
+        elif [ "$key" = "plugin" ]
+        then
+            echo plugin: $value
+            echo $line_key
+            if [ "$line_key" = "P" ]
+            then
+                P_PLUGIN[$n,$m]=$value
+                echo $n $m ${P_PLUGIN[$n,$m]}
+            elif [ "$line_key" = "K" ]
+            then
+                K_PLUGIN[$number]=$value
+            fi
+        fi
+    done
+}
+
+parse_line(){
+    line=$1
+    echo $line
+    key=$(cut -c -1 <<< $line)
+    if [ "$key" = "M" ]
+    then
+        LOCAL_M=$(cut -d : -f 2 <<< $line)
+        echo $LOCAL_M
+    elif [ "$key" = "N" ]
+    then
+        GLOBAL_N=$(cut -d : -f 2 <<< $line)
+        echo $GLOBAL_N
+    for ((i=1;i<=$GLOBAL_N;i++))
+    do
+        R_TCP[$i]=0
+        R_UDP[$i]=0
+    done    
+    elif [ "$key" = "X" ]
+    then
+        KNOWN=$(cut -d : -f 2 <<< $line)
+        echo $KNOWN
+    elif [ "$key" = "T" ]
+    then
+        PLUGIN=$(cut -d : -f 2 <<< $line)
+        echo $PLUGIN
+    elif [ "$key" = "K" ]
+    then
+        echo know node
+        extract_attributes $key $line
+    elif [ "$key" = "R" ]
+    then
+        echo router
+        extract_attributes $key $line
+    elif [ "$key" = "P" ]
+    then
+        echo node
+        extract_attributes $key $line
+    fi
+}
+
+read_topology_string(){
+    string=$1
+    IFS=' ' read -r -a array <<< $string
+    for element in "${array[@]}"
+    do
+        echo $element
+        parse_line $element
+    done
+}
+
+read_topology(){
+    local filename=$1
+    while read line; do
+        # reading each line
+        parse_line $line
+    done < $filename
+}
+
+
+