From 2d831f1b50ef82c068098393f748ff44715a965c Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Tue, 2 Mar 2021 12:30:24 +0100 Subject: [PATCH] Add osmo-gbproxy-latest container Change-Id: I285cb51da03b793eab994ff3c00de16097e3f992 --- osmo-gbproxy-latest/Dockerfile | 63 +++ osmo-gbproxy-latest/Makefile | 3 + osmo-gbproxy-latest/Release.key | 20 + osmo-gbproxy-latest/docker-entrypoint.sh | 9 + osmo-gbproxy-latest/osmo-gbproxy.cfg | 33 ++ osmo-gbproxy-latest/pipework | 489 +++++++++++++++++++++++ 6 files changed, 617 insertions(+) create mode 100644 osmo-gbproxy-latest/Dockerfile create mode 100644 osmo-gbproxy-latest/Makefile create mode 100644 osmo-gbproxy-latest/Release.key create mode 100755 osmo-gbproxy-latest/docker-entrypoint.sh create mode 100644 osmo-gbproxy-latest/osmo-gbproxy.cfg create mode 100755 osmo-gbproxy-latest/pipework diff --git a/osmo-gbproxy-latest/Dockerfile b/osmo-gbproxy-latest/Dockerfile new file mode 100644 index 00000000..1e531133 --- /dev/null +++ b/osmo-gbproxy-latest/Dockerfile @@ -0,0 +1,63 @@ +ARG REGISTRY=docker.io +ARG UPSTREAM_DISTRO=debian:stretch +FROM ${REGISTRY}/${UPSTREAM_DISTRO} +# Arguments used after FROM must be specified again +ARG OSMOCOM_REPO_MIRROR="http://download.opensuse.org" +ARG DISTRO + +MAINTAINER Harald Welte + +ARG OSMOCOM_REPO="$OSMOCOM_REPO_MIRROR/repositories/network:/osmocom:/latest/Debian_9.0/" + +COPY Release.key /tmp/Release.key + +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + gnupg + +RUN case "$DISTRO" in \ + debian*) \ + apt-key add /tmp/Release.key && \ + rm /tmp/Release.key && \ + echo "deb " $OSMOCOM_REPO " ./" > /etc/apt/sources.list.d/osmocom-latest.list \ + ;; \ + esac + +# we need to add this to invalidate the cache once the repository is updated. +# unfortunately Dockerfiles don't support a conditional ARG, so we need to add both DPKG + RPM +ADD $OSMOCOM_REPO/Release /tmp/Release +ADD $OSMOCOM_REPO_MIRROR/repositories/network:/osmocom:/latest/CentOS_8/repodata/repomd.xml /tmp/repomd.xml +RUN case "$DISTRO" in \ + debian*) \ + apt-get update && \ + apt-get install -y --no-install-recommends \ + osmo-gbproxy \ + telnet \ + && \ + apt-get clean \ + ;; \ + centos*) \ + dnf install -y \ + osmo-gbproxy \ + telnet \ + ;; \ + *) \ + echo "Unsupported distribution $DISTRO" \ + exit 23 \ + ;; \ + esac + +WORKDIR /data + +VOLUME /data + +COPY osmo-gbproxy.cfg /data/osmo-gbproxy.cfg + +# work-around for stupid docker not being able to properly deal with host netdevices or start +# containers in pre-existing netns +COPY pipework /usr/bin/pipework +COPY docker-entrypoint.sh /docker-entrypoint.sh + +CMD ["/docker-entrypoint.sh"] + +EXPOSE 23000/udp 4246/tcp 4263/tcp diff --git a/osmo-gbproxy-latest/Makefile b/osmo-gbproxy-latest/Makefile new file mode 100644 index 00000000..9e5fb05f --- /dev/null +++ b/osmo-gbproxy-latest/Makefile @@ -0,0 +1,3 @@ +RUN_ARGS?=--rm --network sigtran --ip 172.18.0.22 -v gbproxy-vol:/data + +include ../make/Makefile diff --git a/osmo-gbproxy-latest/Release.key b/osmo-gbproxy-latest/Release.key new file mode 100644 index 00000000..a737316d --- /dev/null +++ b/osmo-gbproxy-latest/Release.key @@ -0,0 +1,20 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.5 (GNU/Linux) + +mQENBFJBt/wBCADAht3d/ilNuyzaXYw/QwTRvmjyoDvfXw+H/3Fvk1zlDZoiKPPc +a1wCVBINUZl7vYM2OXqbJwYa++JP2Q48xKSvC6thbRc/YLievkbcvTemf7IaREfl +CTjoYpoqXHa9kHMw1aALDm8CNU88jZmnV7v9L6hKkbYDxie+jpoj7D6B9JlxgNJ4 +5dQyRNsFGVcIl4Vplt1HyGc5Q5nQI/VgS2rlF/IOXmhRQBc4LEDdU8R2IKnkU4ee +S7TWanAigGAQhxGuCkS39/CWzc1DhLhjlNhBl/+RTPejkqJtAy00ZLps3+RqUN1Y +CU/Fsr7aRlYVGqQ/BlptwV0XQ2VVYJX2oEBBABEBAAG0MG5ldHdvcmsgT0JTIFBy +b2plY3QgPG5ldHdvcmtAYnVpbGQub3BlbnN1c2Uub3JnPokBPAQTAQIAJgUCXm/4 +pgIbAwUJEEzwqgYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJEGLrGgkXKA3f/1AH +/A7WVSpfM4wV/DMqZPTsSjChB4JyDotxpV7qHZzBC5aaP2dINZyi9PayIwZWbvCY +VKvt+Fw8oCGC9F9mdh10Xe+ElHeVNSihzABPuu1RkRkb1nvkymScy0yxydodYOBi +K4WQ+BhpijXWmYvOekIwbS5Hi9BHpfgK4TinK0xsvh1bVLeQJ8YjrnNFIAR2CnBa +X7Y72Up/kKL08DdQzuS+mKrJtAQlGMtIsukWC2ajYQMkNwm8Gvhpn8za113dCkBW +XAFnlQqQobKwC7b19QgEtJI/YpGSrRc6WaZxPyAjscbWQlFEAB900sVj4BWT55ig +7O2uSdsCVhTuU7T0ztwsgvmIRgQTEQIABgUCUkG3/AAKCRA7MBG3a51lIzhdAJ9v +d6XPffMZRcCGgDEY5OaTn/MsCQCgrXbeZpFJgnirSrc8rRonvzYFiF4= +=/Tek +-----END PGP PUBLIC KEY BLOCK----- diff --git a/osmo-gbproxy-latest/docker-entrypoint.sh b/osmo-gbproxy-latest/docker-entrypoint.sh new file mode 100755 index 00000000..d166207a --- /dev/null +++ b/osmo-gbproxy-latest/docker-entrypoint.sh @@ -0,0 +1,9 @@ +#!/bin/bash +set -e +set -x + +if [[ -n ${WAIT_FOR_NETDEV:-} ]]; then + /usr/bin/pipework --wait -i ${WAIT_FOR_NETDEV} +fi + +/usr/bin/osmo-gbproxy -c /data/osmo-gbproxy.cfg >/data/osmo-gbproxy.log 2>&1 diff --git a/osmo-gbproxy-latest/osmo-gbproxy.cfg b/osmo-gbproxy-latest/osmo-gbproxy.cfg new file mode 100644 index 00000000..dec06089 --- /dev/null +++ b/osmo-gbproxy-latest/osmo-gbproxy.cfg @@ -0,0 +1,33 @@ +! +! Osmocom Gb Proxy (0.9.0.404-6463) configuration saved from vty +!! +! +log stderr + logging filter all 1 + logging color 1 + logging print category 1 + logging print category-hex 0 + logging timestamp 1 + logging print file 1 + logging level lns debug + logging level lbssgp debug + logging level gprs debug +line vty + no login + bind 0.0.0.0 +! +sgsn nsei 101 + name main +ns + bind udp local + listen 0.0.0.0 23000 + accept-ipaccess + nse 101 + nsvc ipa local 172.18.0.21 23000 nsvci 2342 + timer tns-block 3 + timer tns-block-retries 3 + timer tns-reset 3 + timer tns-reset-retries 3 + timer tns-test 30 + timer tns-alive 3 + timer tns-alive-retries 10 diff --git a/osmo-gbproxy-latest/pipework b/osmo-gbproxy-latest/pipework new file mode 100755 index 00000000..97ce66b5 --- /dev/null +++ b/osmo-gbproxy-latest/pipework @@ -0,0 +1,489 @@ +#!/bin/sh +# This code should (try to) follow Google's Shell Style Guide +# (https://google.github.io/styleguide/shell.xml) +set -e + +case "$1" in + --wait) + WAIT=1 + ;; + --direct-phys) + DIRECT_PHYS=1 + shift + ;; +esac + +IFNAME=$1 + +# default value set further down if not set here +CONTAINER_IFNAME= +if [ "$2" = "-i" ]; then + CONTAINER_IFNAME=$3 + shift 2 +fi + +if [ "$2" = "-l" ]; then + LOCAL_IFNAME=$3 + shift 2 +fi + +#inet or inet6 +FAMILY_FLAG="-4" +if [ "$2" = "-a" ]; then + FAMILY_FLAG="-$3" + shift 2 +fi + +GUESTNAME=$2 +IPADDR=$3 +MACADDR=$4 + +case "$MACADDR" in + *@*) + VLAN="${MACADDR#*@}" + VLAN="${VLAN%%@*}" + MACADDR="${MACADDR%%@*}" + ;; + *) + VLAN= + ;; +esac + +# did they ask to generate a custom MACADDR? +# generate the unique string +case "$MACADDR" in + U:*) + macunique="${MACADDR#*:}" + # now generate a 48-bit hash string from $macunique + MACADDR=$(echo $macunique|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/') + ;; +esac + + +[ "$IPADDR" ] || [ "$WAIT" ] || { + echo "Syntax:" + echo "pipework [-i containerinterface] [-l localinterfacename] [-a addressfamily] /[@default_gateway] [macaddr][@vlan]" + echo "pipework [-i containerinterface] [-l localinterfacename] dhcp [macaddr][@vlan]" + echo "pipework mac: [-i containerinterface] [-l localinterfacename] [-a addressfamily] /[@default_gateway] [macaddr][@vlan]" + echo "pipework mac: [-i containerinterface] [-l localinterfacename] dhcp [macaddr][@vlan]" + echo "pipework route " + echo "pipework rule " + echo "pipework tc " + echo "pipework --wait [-i containerinterface]" + exit 1 +} + +# Succeed if the given utility is installed. Fail otherwise. +# For explanations about `which` vs `type` vs `command`, see: +# http://stackoverflow.com/questions/592620/check-if-a-program-exists-from-a-bash-script/677212#677212 +# (Thanks to @chenhanxiao for pointing this out!) +installed () { + command -v "$1" >/dev/null 2>&1 +} + +# Google Styleguide says error messages should go to standard error. +warn () { + echo "$@" >&2 +} +die () { + status="$1" + shift + warn "$@" + exit "$status" +} + +if echo $IFNAME | grep -q '^mac:'; then + mac_address=$(echo $IFNAME | cut -c5-) + ifmatch= + for iftest in /sys/class/net/*; do + if [ -f $iftest/address ] && [ "$mac_address" = "$(cat $iftest/address)" ]; then + ifmatch="$(basename $iftest)" + break + fi + done + + if [ -z "$ifmatch" ]; then + die 1 "Mac address $mac_address specified for interface but no host interface matched." + else + IFNAME=$ifmatch + fi +fi + +# First step: determine type of first argument (bridge, physical interface...), +# Unless "--wait" is set (then skip the whole section) +if [ -z "$WAIT" ]; then + if [ -d "/sys/class/net/$IFNAME" ] + then + if [ -d "/sys/class/net/$IFNAME/bridge" ]; then + IFTYPE=bridge + BRTYPE=linux + elif installed ovs-vsctl && ovs-vsctl list-br|grep -q "^${IFNAME}$"; then + IFTYPE=bridge + BRTYPE=openvswitch + elif [ "$(cat "/sys/class/net/$IFNAME/type")" -eq 32 ]; then # InfiniBand IPoIB interface type 32 + IFTYPE=ipoib + # The IPoIB kernel module is fussy, set device name to ib0 if not overridden + CONTAINER_IFNAME=${CONTAINER_IFNAME:-ib0} + PKEY=$VLAN + else IFTYPE=phys + fi + else + case "$IFNAME" in + br*) + IFTYPE=bridge + BRTYPE=linux + ;; + ovs*) + if ! installed ovs-vsctl; then + die 1 "Need OVS installed on the system to create an ovs bridge" + fi + IFTYPE=bridge + BRTYPE=openvswitch + ;; + route*) + IFTYPE=route + ;; + rule*) + IFTYPE=rule + ;; + tc*) + IFTYPE=tc + ;; + dummy*) + IFTYPE=dummy + ;; + *) die 1 "I do not know how to setup interface $IFNAME." ;; + esac + fi +fi + +# Set the default container interface name to eth1 if not already set +CONTAINER_IFNAME=${CONTAINER_IFNAME:-eth1} + +[ "$WAIT" ] && { + while true; do + # This first method works even without `ip` or `ifconfig` installed, + # but doesn't work on older kernels (e.g. CentOS 6.X). See #128. + grep -q '^1$' "/sys/class/net/$CONTAINER_IFNAME/carrier" && break + # This method hopefully works on those older kernels. + ip link ls dev "$CONTAINER_IFNAME" && break + sleep 1 + done > /dev/null 2>&1 + exit 0 +} + +[ "$IFTYPE" = bridge ] && [ "$BRTYPE" = linux ] && [ "$VLAN" ] && { + die 1 "VLAN configuration currently unsupported for Linux bridge." +} + +[ "$IFTYPE" = ipoib ] && [ "$MACADDR" ] && { + die 1 "MACADDR configuration unsupported for IPoIB interfaces." +} + +# Second step: find the guest (for now, we only support LXC containers) +while read _ mnt fstype options _; do + [ "$fstype" != "cgroup" ] && continue + echo "$options" | grep -qw devices || continue + CGROUPMNT=$mnt +done < /proc/mounts + +[ "$CGROUPMNT" ] || { + die 1 "Could not locate cgroup mount point." +} + +# Try to find a cgroup matching exactly the provided name. +M=$(find "$CGROUPMNT" -name "$GUESTNAME") +N=$(echo "$M" | wc -l) +if [ -z "$M" ] ; then + N=0 +fi +case "$N" in + 0) + # If we didn't find anything, try to lookup the container with Docker. + if installed docker; then + RETRIES=3 + while [ "$RETRIES" -gt 0 ]; do + DOCKERPID=$(docker inspect --format='{{ .State.Pid }}' "$GUESTNAME") + DOCKERCID=$(docker inspect --format='{{ .ID }}' "$GUESTNAME") + DOCKERCNAME=$(docker inspect --format='{{ .Name }}' "$GUESTNAME") + + [ "$DOCKERPID" != 0 ] && break + sleep 1 + RETRIES=$((RETRIES - 1)) + done + + [ "$DOCKERPID" = 0 ] && { + die 1 "Docker inspect returned invalid PID 0" + } + + [ "$DOCKERPID" = "" ] && { + die 1 "Container $GUESTNAME not found, and unknown to Docker." + } + else + die 1 "Container $GUESTNAME not found, and Docker not installed." + fi + ;; + 1) true ;; + 2) # LXC >=3.1.0 returns two entries from the cgroups mount instead of one. + echo "$M" | grep -q "lxc\.monitor" || die 1 "Found more than one container matching $GUESTNAME." + ;; + *) die 1 "Found more than one container matching $GUESTNAME." ;; +esac + +# only check IPADDR if we are not in a route mode +[ "$IFTYPE" != route ] && [ "$IFTYPE" != rule ] && [ "$IFTYPE" != tc ] && { + case "$IPADDR" in + # Let's check first if the user asked for DHCP allocation. + dhcp|dhcp:*) + # Use Docker-specific strategy to run the DHCP client + # from the busybox image, in the network namespace of + # the container. + if ! [ "$DOCKERPID" ]; then + warn "You asked for a Docker-specific DHCP method." + warn "However, $GUESTNAME doesn't seem to be a Docker container." + warn "Try to replace 'dhcp' with another option?" + die 1 "Aborting." + fi + DHCP_CLIENT=${IPADDR%%:*} + ;; + udhcpc|udhcpc:*|udhcpc-f|udhcpc-f:*|dhcpcd|dhcpcd:*|dhclient|dhclient:*|dhclient-f|dhclient-f:*) + DHCP_CLIENT=${IPADDR%%:*} + # did they ask for the client to remain? + DHCP_FOREGROUND= + [ "${DHCP_CLIENT%-f}" != "${DHCP_CLIENT}" ] && { + DHCP_FOREGROUND=true + } + DHCP_CLIENT=${DHCP_CLIENT%-f} + if ! installed "$DHCP_CLIENT"; then + die 1 "You asked for DHCP client $DHCP_CLIENT, but I can't find it." + fi + ;; + # Alright, no DHCP? Then let's see if we have a subnet *and* gateway. + */*@*) + GATEWAY="${IPADDR#*@}" GATEWAY="${GATEWAY%%@*}" + IPADDR="${IPADDR%%@*}" + ;; + # No gateway? We need at least a subnet, anyway! + */*) : ;; + # ... No? Then stop right here. + *) + warn "The IP address should include a netmask." + die 1 "Maybe you meant $IPADDR/24 ?" + ;; + esac +} + +# If a DHCP method was specified, extract the DHCP options. +if [ "$DHCP_CLIENT" ]; then + case "$IPADDR" in + *:*) DHCP_OPTIONS="${IPADDR#*:}" ;; + esac +fi + +if [ "$DOCKERPID" ]; then + NSPID=$DOCKERPID +else + NSPID=$(head -n 1 "$(find "$CGROUPMNT" -name "$GUESTNAME" | head -n 1)/tasks") + [ "$NSPID" ] || { + # it is an alternative way to get the pid + NSPID=$(lxc-info -n "$GUESTNAME" | grep PID | grep -Eo '[0-9]+') + [ "$NSPID" ] || { + die 1 "Could not find a process inside container $GUESTNAME." + } + } +fi + +# Check if an incompatible VLAN device already exists +[ "$IFTYPE" = phys ] && [ "$VLAN" ] && [ -d "/sys/class/net/$IFNAME.VLAN" ] && { + ip -d link show "$IFNAME.$VLAN" | grep -q "vlan.*id $VLAN" || { + die 1 "$IFNAME.VLAN already exists but is not a VLAN device for tag $VLAN" + } +} + +[ ! -d /var/run/netns ] && mkdir -p /var/run/netns +rm -f "/var/run/netns/$NSPID" +ln -s "/proc/$NSPID/ns/net" "/var/run/netns/$NSPID" + +# Check if we need to create a bridge. +[ "$IFTYPE" = bridge ] && [ ! -d "/sys/class/net/$IFNAME" ] && { + [ "$BRTYPE" = linux ] && { + (ip link add dev "$IFNAME" type bridge > /dev/null 2>&1) || (brctl addbr "$IFNAME") + ip link set "$IFNAME" up + } + [ "$BRTYPE" = openvswitch ] && { + ovs-vsctl add-br "$IFNAME" + } +} + +[ "$IFTYPE" != "route" ] && [ "$IFTYPE" != "dummy" ] && [ "$IFTYPE" != "rule" ] && [ "$IFTYPE" != "tc" ] && MTU=$(ip link show "$IFNAME" | awk '{print $5}') + +# If it's a bridge, we need to create a veth pair +[ "$IFTYPE" = bridge ] && { + if [ -z "$LOCAL_IFNAME" ]; then + LOCAL_IFNAME="v${CONTAINER_IFNAME}pl${NSPID}" + fi + GUEST_IFNAME="v${CONTAINER_IFNAME}pg${NSPID}" + # Does the link already exist? + if ip link show "$LOCAL_IFNAME" >/dev/null 2>&1; then + # link exists, is it in use? + if ip link show "$LOCAL_IFNAME" up | grep -q "UP"; then + echo "Link $LOCAL_IFNAME exists and is up" + exit 1 + fi + # delete the link so we can re-add it afterwards + ip link del "$LOCAL_IFNAME" + fi + ip link add name "$LOCAL_IFNAME" mtu "$MTU" type veth peer name "$GUEST_IFNAME" mtu "$MTU" + case "$BRTYPE" in + linux) + (ip link set "$LOCAL_IFNAME" master "$IFNAME" > /dev/null 2>&1) || (brctl addif "$IFNAME" "$LOCAL_IFNAME") + ;; + openvswitch) + if ! ovs-vsctl list-ports "$IFNAME" | grep -q "^${LOCAL_IFNAME}$"; then + ovs-vsctl add-port "$IFNAME" "$LOCAL_IFNAME" ${VLAN:+tag="$VLAN"} \ + -- set Interface "$LOCAL_IFNAME" \ + external-ids:pipework.interface="$LOCAL_IFNAME" \ + external-ids:pipework.bridge="$IFNAME" \ + ${DOCKERCID:+external-ids:pipework.containerid="$DOCKERCID"} \ + ${DOCKERCNAME:+external-ids:pipework.containername="$DOCKERCNAME"} \ + ${NSPID:+external-ids:pipework.nspid="$NSPID"} \ + ${VLAN:+external-ids:pipework.vlan="$VLAN"} + fi + ;; + esac + ip link set "$LOCAL_IFNAME" up +} + +# If it's a physical interface, create a macvlan subinterface +[ "$IFTYPE" = phys ] && { + [ "$VLAN" ] && { + [ ! -d "/sys/class/net/${IFNAME}.${VLAN}" ] && { + ip link add link "$IFNAME" name "$IFNAME.$VLAN" mtu "$MTU" type vlan id "$VLAN" + } + ip link set "$IFNAME" up + IFNAME=$IFNAME.$VLAN + } + + if [ ! -z "$DIRECT_PHYS" ]; then + GUEST_IFNAME=$IFNAME + else + GUEST_IFNAME=ph$NSPID$CONTAINER_IFNAME + ip link add link "$IFNAME" dev "$GUEST_IFNAME" mtu "$MTU" type macvlan mode bridge + fi + + ip link set "$IFNAME" up +} + +# If it's an IPoIB interface, create a virtual IPoIB interface (the IPoIB +# equivalent of a macvlan device) +# +# Note: no macvlan subinterface nor Ethernet bridge can be created on top of an +# IPoIB interface. InfiniBand is not Ethernet. IPoIB is an IP layer on top of +# InfiniBand, without an intermediate Ethernet layer. +[ "$IFTYPE" = ipoib ] && { + GUEST_IFNAME="${IFNAME}.${NSPID}" + + # If a partition key is provided, use it + [ "$PKEY" ] && { + GUEST_IFNAME="${IFNAME}.${PKEY}.${NSPID}" + PKEY="pkey 0x$PKEY" + } + + ip link add link "$IFNAME" name "$GUEST_IFNAME" type ipoib $PKEY + ip link set "$IFNAME" up +} + +# If its a dummy interface, create a dummy interface. +[ "$IFTYPE" = dummy ] && { + GUEST_IFNAME=du$NSPID$CONTAINER_IFNAME + ip link add dev "$GUEST_IFNAME" type dummy +} + +# If the `route` command was specified ... +if [ "$IFTYPE" = route ]; then + # ... discard the first two arguments and pass the rest to the route command. + shift 2 + ip netns exec "$NSPID" ip route "$@" +elif [ "$IFTYPE" = rule ] ; then + shift 2 + ip netns exec "$NSPID" ip rule "$@" +elif [ "$IFTYPE" = tc ] ; then + shift 2 + ip netns exec "$NSPID" tc "$@" +else + # Otherwise, run normally. + ip link set "$GUEST_IFNAME" netns "$NSPID" + ip netns exec "$NSPID" ip link set "$GUEST_IFNAME" name "$CONTAINER_IFNAME" + [ "$MACADDR" ] && ip netns exec "$NSPID" ip link set dev "$CONTAINER_IFNAME" address "$MACADDR" + + # When using any of the DHCP methods, we start a DHCP client in the + # network namespace of the container. With the 'dhcp' method, the + # client used is taken from the Docker busybox image (therefore + # requiring no specific client installed on the host). Other methods + # use a locally installed client. + case "$DHCP_CLIENT" in + dhcp) + docker run -d --net container:$GUESTNAME --cap-add NET_ADMIN \ + busybox udhcpc -i "$CONTAINER_IFNAME" -x "hostname:$GUESTNAME" \ + $DHCP_OPTIONS \ + >/dev/null + ;; + udhcpc) + DHCP_Q="-q" + [ "$DHCP_FOREGROUND" ] && { + DHCP_OPTIONS="$DHCP_OPTIONS -f" + } + ip netns exec "$NSPID" "$DHCP_CLIENT" -qi "$CONTAINER_IFNAME" \ + -x "hostname:$GUESTNAME" \ + -p "/var/run/udhcpc.$GUESTNAME.pid" \ + $DHCP_OPTIONS + [ ! "$DHCP_FOREGROUND" ] && { + rm "/var/run/udhcpc.$GUESTNAME.pid" + } + ;; + dhclient) + ip netns exec "$NSPID" "$DHCP_CLIENT" "$CONTAINER_IFNAME" \ + -pf "/var/run/dhclient.$GUESTNAME.pid" \ + -lf "/etc/dhclient/dhclient.$GUESTNAME.leases" \ + $DHCP_OPTIONS + # kill dhclient after get ip address to prevent device be used after container close + [ ! "$DHCP_FOREGROUND" ] && { + kill "$(cat "/var/run/dhclient.$GUESTNAME.pid")" + rm "/var/run/dhclient.$GUESTNAME.pid" + } + ;; + dhcpcd) + ip netns exec "$NSPID" "$DHCP_CLIENT" -q "$CONTAINER_IFNAME" -h "$GUESTNAME" + ;; + "") + if installed ipcalc; then + eval $(ipcalc -b $IPADDR) + ip netns exec "$NSPID" ip "$FAMILY_FLAG" addr add "$IPADDR" brd "$BROADCAST" dev "$CONTAINER_IFNAME" + else + ip netns exec "$NSPID" ip "$FAMILY_FLAG" addr add "$IPADDR" dev "$CONTAINER_IFNAME" + fi + + [ "$GATEWAY" ] && { + ip netns exec "$NSPID" ip "$FAMILY_FLAG" route delete default >/dev/null 2>&1 && true + } + ip netns exec "$NSPID" ip "$FAMILY_FLAG" link set "$CONTAINER_IFNAME" up + [ "$GATEWAY" ] && { + ip netns exec "$NSPID" ip "$FAMILY_FLAG" route get "$GATEWAY" >/dev/null 2>&1 || \ + ip netns exec "$NSPID" ip "$FAMILY_FLAG" route add "$GATEWAY/32" dev "$CONTAINER_IFNAME" + ip netns exec "$NSPID" ip "$FAMILY_FLAG" route replace default via "$GATEWAY" dev "$CONTAINER_IFNAME" + } + ;; + esac + + # Give our ARP neighbors a nudge about the new interface + if installed arping; then + IPADDR=$(echo "$IPADDR" | cut -d/ -f1) + ip netns exec "$NSPID" arping -c 1 -A -I "$CONTAINER_IFNAME" "$IPADDR" > /dev/null 2>&1 || true + else + echo "Warning: arping not found; interface may not be immediately reachable" + fi +fi +# Remove NSPID to avoid `ip netns` catch it. +rm -f "/var/run/netns/$NSPID" + +# vim: set tabstop=2 shiftwidth=2 softtabstop=2 expandtab :