aboutsummaryrefslogtreecommitdiff
path: root/contrib/scripts/netjail/netjail_core.sh
diff options
context:
space:
mode:
Diffstat (limited to 'contrib/scripts/netjail/netjail_core.sh')
-rwxr-xr-xcontrib/scripts/netjail/netjail_core.sh57
1 files changed, 41 insertions, 16 deletions
diff --git a/contrib/scripts/netjail/netjail_core.sh b/contrib/scripts/netjail/netjail_core.sh
index d070f7220..d53315052 100755
--- a/contrib/scripts/netjail/netjail_core.sh
+++ b/contrib/scripts/netjail/netjail_core.sh
@@ -2,6 +2,7 @@
2# 2#
3 3
4JAILOR=${SUDO_USER:?must run in sudo} 4JAILOR=${SUDO_USER:?must run in sudo}
5PREFIX=${PPID:?must run from a parent process}
5 6
6# running with `sudo` is required to be 7# running with `sudo` is required to be
7# able running the actual commands as the 8# able running the actual commands as the
@@ -9,6 +10,22 @@ JAILOR=${SUDO_USER:?must run in sudo}
9 10
10export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" 11export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
11 12
13export RESULT=
14export NAMESPACE_NUM=0
15export INTERFACE_NUM=0
16
17netjail_next_namespace() {
18 local NUM=$NAMESPACE_NUM
19 NAMESPACE_NUM=$(($NAMESPACE_NUM + 1))
20 RESULT=$NUM
21}
22
23netjail_next_interface() {
24 local NUM=$INTERFACE_NUM
25 INTERFACE_NUM=$(($INTERFACE_NUM + 1))
26 RESULT=$NUM
27}
28
12netjail_opt() { 29netjail_opt() {
13 local OPT=$1 30 local OPT=$1
14 shift 1 31 shift 1
@@ -17,7 +34,7 @@ netjail_opt() {
17 34
18 while [ $# -gt 0 ]; do 35 while [ $# -gt 0 ]; do
19 if [ "$1" = "$OPT" ]; then 36 if [ "$1" = "$OPT" ]; then
20 printf "%d" $INDEX 37 RESULT=$INDEX
21 return 38 return
22 fi 39 fi
23 40
@@ -25,7 +42,7 @@ netjail_opt() {
25 shift 1 42 shift 1
26 done 43 done
27 44
28 printf "%d" 0 45 RESULT=0
29} 46}
30 47
31netjail_opts() { 48netjail_opts() {
@@ -42,7 +59,7 @@ netjail_opts() {
42 shift 1 59 shift 1
43 done 60 done
44 61
45 printf "$DEF" 62 RESULT="$DEF"
46} 63}
47 64
48netjail_check() { 65netjail_check() {
@@ -73,15 +90,15 @@ netjail_check_bin() {
73 fi 90 fi
74} 91}
75 92
76netjail_print_name() {
77 printf "%s%02x%02x" $1 $2 ${3:-0}
78}
79
80netjail_bridge() { 93netjail_bridge() {
81 local BRIDGE=$1 94 netjail_next_interface
95 local NUM=$RESULT
96 local BRIDGE=$(printf "%06x-%08x" $PREFIX $NUM)
82 97
83 ip link add $BRIDGE type bridge 98 ip link add $BRIDGE type bridge
84 ip link set dev $BRIDGE up 99 ip link set dev $BRIDGE up
100
101 RESULT=$BRIDGE
85} 102}
86 103
87netjail_bridge_clear() { 104netjail_bridge_clear() {
@@ -91,9 +108,13 @@ netjail_bridge_clear() {
91} 108}
92 109
93netjail_node() { 110netjail_node() {
94 local NODE=$1 111 netjail_next_namespace
112 local NUM=$RESULT
113 local NODE=$(printf "%06x-%08x" $PREFIX $NUM)
95 114
96 ip netns add $NODE 115 ip netns add $NODE
116
117 RESULT=$NODE
97} 118}
98 119
99netjail_node_clear() { 120netjail_node_clear() {
@@ -108,8 +129,13 @@ netjail_node_link_bridge() {
108 local ADDRESS=$3 129 local ADDRESS=$3
109 local MASK=$4 130 local MASK=$4
110 131
111 local LINK_IF="$NODE-$BRIDGE-0" 132 netjail_next_interface
112 local LINK_BR="$NODE-$BRIDGE-1" 133 local NUM_IF=$RESULT
134 netjail_next_interface
135 local NUM_BR=$RESULT
136
137 local LINK_IF=$(printf "%06x-%08x" $PREFIX $NUM_IF)
138 local LINK_BR=$(printf "%06x-%08x" $PREFIX $NUM_BR)
113 139
114 ip link add $LINK_IF type veth peer name $LINK_BR 140 ip link add $LINK_IF type veth peer name $LINK_BR
115 ip link set $LINK_IF netns $NODE 141 ip link set $LINK_IF netns $NODE
@@ -120,13 +146,12 @@ netjail_node_link_bridge() {
120 ip -n $NODE link set up dev lo 146 ip -n $NODE link set up dev lo
121 147
122 ip link set $LINK_BR up 148 ip link set $LINK_BR up
149
150 RESULT=$LINK_BR
123} 151}
124 152
125netjail_node_unlink_bridge() { 153netjail_node_unlink_bridge() {
126 local NODE=$1 154 local LINK_BR=$1
127 local BRIDGE=$2
128
129 local LINK_BR="$NODE-$BRIDGE-1"
130 155
131 ip link delete $LINK_BR 156 ip link delete $LINK_BR
132} 157}
@@ -152,7 +177,7 @@ netjail_node_exec() {
152 local FD_OUT=$3 177 local FD_OUT=$3
153 shift 3 178 shift 3
154 179
155 unshare -fp --kill-child -- ip netns exec $NODE sudo -u $JAILOR -- $@ 1>& $FD_OUT 0<& $FD_IN 180 ip netns exec $NODE sudo -u $JAILOR -- $@ 1>& $FD_OUT 0<& $FD_IN
156} 181}
157 182
158netjail_kill() { 183netjail_kill() {