Add plugin code
This adds basic plugins. "main" types: veth, bridge, macvlan "ipam" type: host-local The code has been ported over from github.com/coreos/rkt project and adapted to fit the CNI spec.
This commit is contained in:
Eugene Yakubovich
86
plugins/ipam/host-local/README.md
Normal file
86
plugins/ipam/host-local/README.md
Normal file
@ -0,0 +1,86 @@
|
||||
# host-local IP address manager
|
||||
|
||||
host-local IPAM allocates IPv4 and IPv6 addresses out of a specified address range.
|
||||
|
||||
## Usage
|
||||
|
||||
### Obtain an IP
|
||||
|
||||
Given the following network configuration:
|
||||
|
||||
```
|
||||
{
|
||||
"name": "default",
|
||||
"ipam": {
|
||||
"type": "host-local",
|
||||
"subnet": "203.0.113.0/24"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
#### Using the command line interface
|
||||
|
||||
```
|
||||
$ export CNI_COMMAND=ADD
|
||||
$ export CNI_CONTAINERID=f81d4fae-7dec-11d0-a765-00a0c91e6bf6
|
||||
$ ./host-local < $conf
|
||||
```
|
||||
|
||||
```
|
||||
{
|
||||
"ip4": {
|
||||
"ip": "203.0.113.1/24"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Backends
|
||||
|
||||
By default ipmanager stores IP allocations on the local filesystem using the IP address as the file name and the ID as contents. For example:
|
||||
|
||||
```
|
||||
$ ls /var/lib/cni/networks/default
|
||||
```
|
||||
```
|
||||
203.0.113.1 203.0.113.2
|
||||
```
|
||||
|
||||
```
|
||||
$ cat /var/lib/cni/networks/default/203.0.113.1
|
||||
```
|
||||
```
|
||||
f81d4fae-7dec-11d0-a765-00a0c91e6bf6
|
||||
```
|
||||
|
||||
## Configuration Files
|
||||
|
||||
|
||||
```
|
||||
{
|
||||
"name": "ipv6",
|
||||
"ipam": {
|
||||
"type": "host-local",
|
||||
"subnet": "3ffe:ffff:0:01ff::/64",
|
||||
"range-start": "3ffe:ffff:0:01ff::0010",
|
||||
"range-end": "3ffe:ffff:0:01ff::0020",
|
||||
"routes": [
|
||||
"3ffe:ffff:0:01ff::1/64"
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
```
|
||||
{
|
||||
"name": "ipv4",
|
||||
"ipam": {
|
||||
"type": "host-local",
|
||||
"subnet": "203.0.113.1/24",
|
||||
"range-start": "203.0.113.10",
|
||||
"range-end": "203.0.113.20",
|
||||
"routes": [
|
||||
"203.0.113.0/24"
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
185
plugins/ipam/host-local/allocator.go
Normal file
185
plugins/ipam/host-local/allocator.go
Normal file
@ -0,0 +1,185 @@
|
||||
// Copyright 2015 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
|
||||
"github.com/appc/cni/pkg/ip"
|
||||
"github.com/appc/cni/pkg/plugin"
|
||||
"github.com/appc/cni/plugins/ipam/host-local/backend"
|
||||
)
|
||||
|
||||
type IPAllocator struct {
|
||||
start net.IP
|
||||
end net.IP
|
||||
conf *IPAMConfig
|
||||
store backend.Store
|
||||
}
|
||||
|
||||
func NewIPAllocator(conf *IPAMConfig, store backend.Store) (*IPAllocator, error) {
|
||||
var (
|
||||
start net.IP
|
||||
end net.IP
|
||||
err error
|
||||
)
|
||||
start, end, err = networkRange((*net.IPNet)(&conf.Subnet))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// skip the .0 address
|
||||
start = ip.NextIP(start)
|
||||
|
||||
if conf.RangeStart != nil {
|
||||
if err := validateRangeIP(conf.RangeStart, (*net.IPNet)(&conf.Subnet)); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
start = conf.RangeStart
|
||||
}
|
||||
if conf.RangeEnd != nil {
|
||||
if err := validateRangeIP(conf.RangeEnd, (*net.IPNet)(&conf.Subnet)); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// RangeEnd is inclusive
|
||||
end = ip.NextIP(conf.RangeEnd)
|
||||
}
|
||||
|
||||
return &IPAllocator{start, end, conf, store}, nil
|
||||
}
|
||||
|
||||
func validateRangeIP(ip net.IP, ipnet *net.IPNet) error {
|
||||
if !ipnet.Contains(ip) {
|
||||
return fmt.Errorf("%s not in network: %s", ip, ipnet)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Returns newly allocated IP along with its config
|
||||
func (a *IPAllocator) Get(id string) (*plugin.IPConfig, error) {
|
||||
a.store.Lock()
|
||||
defer a.store.Unlock()
|
||||
|
||||
gw := a.conf.Gateway
|
||||
if gw == nil {
|
||||
gw = ip.NextIP(a.conf.Subnet.IP)
|
||||
}
|
||||
|
||||
for cur := a.start; !cur.Equal(a.end); cur = ip.NextIP(cur) {
|
||||
// don't allocate gateway IP
|
||||
if gw != nil && cur.Equal(gw) {
|
||||
continue
|
||||
}
|
||||
|
||||
reserved, err := a.store.Reserve(id, cur)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if reserved {
|
||||
return &plugin.IPConfig{
|
||||
IP: net.IPNet{cur, a.conf.Subnet.Mask},
|
||||
Gateway: gw,
|
||||
Routes: a.conf.Routes,
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
return nil, fmt.Errorf("no IP addresses available in network: %s", a.conf.Name)
|
||||
}
|
||||
|
||||
// Allocates both an IP and the Gateway IP, i.e. a /31
|
||||
// This is used for Point-to-Point links
|
||||
func (a *IPAllocator) GetPtP(id string) (*plugin.IPConfig, error) {
|
||||
a.store.Lock()
|
||||
defer a.store.Unlock()
|
||||
|
||||
for cur := a.start; !cur.Equal(a.end); cur = ip.NextIP(cur) {
|
||||
// we're looking for unreserved even, odd pair
|
||||
if !evenIP(cur) {
|
||||
continue
|
||||
}
|
||||
|
||||
gw := cur
|
||||
reserved, err := a.store.Reserve(id, gw)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if reserved {
|
||||
cur = ip.NextIP(cur)
|
||||
if cur.Equal(a.end) {
|
||||
break
|
||||
}
|
||||
|
||||
reserved, err := a.store.Reserve(id, cur)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if reserved {
|
||||
// found them both!
|
||||
_, bits := a.conf.Subnet.Mask.Size()
|
||||
mask := net.CIDRMask(bits-1, bits)
|
||||
|
||||
return &plugin.IPConfig{
|
||||
IP: net.IPNet{cur, mask},
|
||||
Gateway: gw,
|
||||
Routes: a.conf.Routes,
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return nil, fmt.Errorf("no ip addresses available in network: %s", a.conf.Name)
|
||||
}
|
||||
|
||||
// Releases all IPs allocated for the container with given ID
|
||||
func (a *IPAllocator) Release(id string) error {
|
||||
a.store.Lock()
|
||||
defer a.store.Unlock()
|
||||
|
||||
return a.store.ReleaseByID(id)
|
||||
}
|
||||
|
||||
func networkRange(ipnet *net.IPNet) (net.IP, net.IP, error) {
|
||||
ip := ipnet.IP.To4()
|
||||
if ip == nil {
|
||||
ip = ipnet.IP.To16()
|
||||
if ip == nil {
|
||||
return nil, nil, fmt.Errorf("IP not v4 nor v6")
|
||||
}
|
||||
}
|
||||
|
||||
if len(ip) != len(ipnet.Mask) {
|
||||
return nil, nil, fmt.Errorf("IPNet IP and Mask version mismatch")
|
||||
}
|
||||
|
||||
var end net.IP
|
||||
for i := 0; i < len(ip); i++ {
|
||||
end = append(end, ip[i]|^ipnet.Mask[i])
|
||||
}
|
||||
return ipnet.IP, end, nil
|
||||
}
|
||||
|
||||
func evenIP(ip net.IP) bool {
|
||||
i := ip.To4()
|
||||
if i == nil {
|
||||
i = ip.To16()
|
||||
if i == nil {
|
||||
panic("IP is not v4 or v6")
|
||||
}
|
||||
}
|
||||
|
||||
return i[len(i)-1]%2 == 0
|
||||
}
|
||||
88
plugins/ipam/host-local/backend/disk/backend.go
Normal file
88
plugins/ipam/host-local/backend/disk/backend.go
Normal file
@ -0,0 +1,88 @@
|
||||
// Copyright 2015 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package disk
|
||||
|
||||
import (
|
||||
"io/ioutil"
|
||||
"net"
|
||||
"os"
|
||||
"path/filepath"
|
||||
)
|
||||
|
||||
var defaultDataDir = "/var/lib/cni/networks"
|
||||
|
||||
type Store struct {
|
||||
FileLock
|
||||
dataDir string
|
||||
}
|
||||
|
||||
func New(network string) (*Store, error) {
|
||||
dir := filepath.Join(defaultDataDir, network)
|
||||
if err := os.MkdirAll(dir, 0644); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
lk, err := NewFileLock(dir)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &Store{*lk, dir}, nil
|
||||
}
|
||||
|
||||
func (s *Store) Reserve(id string, ip net.IP) (bool, error) {
|
||||
fname := filepath.Join(s.dataDir, ip.String())
|
||||
f, err := os.OpenFile(fname, os.O_RDWR|os.O_EXCL|os.O_CREATE, 0644)
|
||||
if os.IsExist(err) {
|
||||
return false, nil
|
||||
}
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
if _, err := f.WriteString(id); err != nil {
|
||||
f.Close()
|
||||
os.Remove(f.Name())
|
||||
return false, err
|
||||
}
|
||||
if err := f.Close(); err != nil {
|
||||
os.Remove(f.Name())
|
||||
return false, err
|
||||
}
|
||||
return true, nil
|
||||
}
|
||||
|
||||
func (s *Store) Release(ip net.IP) error {
|
||||
return os.Remove(filepath.Join(s.dataDir, ip.String()))
|
||||
}
|
||||
|
||||
// N.B. This function eats errors to be tolerant and
|
||||
// release as much as possible
|
||||
func (s *Store) ReleaseByID(id string) error {
|
||||
err := filepath.Walk(s.dataDir, func(path string, info os.FileInfo, err error) error {
|
||||
if err != nil || info.IsDir() {
|
||||
return nil
|
||||
}
|
||||
data, err := ioutil.ReadFile(path)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
if string(data) == id {
|
||||
if err := os.Remove(path); err != nil {
|
||||
return nil
|
||||
}
|
||||
}
|
||||
return nil
|
||||
})
|
||||
return err
|
||||
}
|
||||
50
plugins/ipam/host-local/backend/disk/lock.go
Normal file
50
plugins/ipam/host-local/backend/disk/lock.go
Normal file
@ -0,0 +1,50 @@
|
||||
// Copyright 2015 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package disk
|
||||
|
||||
import (
|
||||
"os"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
// FileLock wraps os.File to be used as a lock using flock
|
||||
type FileLock struct {
|
||||
f *os.File
|
||||
}
|
||||
|
||||
// NewFileLock opens file/dir at path and returns unlocked FileLock object
|
||||
func NewFileLock(path string) (*FileLock, error) {
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &FileLock{f}, nil
|
||||
}
|
||||
|
||||
// Close closes underlying file
|
||||
func (l *FileLock) Close() error {
|
||||
return l.f.Close()
|
||||
}
|
||||
|
||||
// Lock acquires an exclusive lock
|
||||
func (l *FileLock) Lock() error {
|
||||
return syscall.Flock(int(l.f.Fd()), syscall.LOCK_EX)
|
||||
}
|
||||
|
||||
// Unlock releases the lock
|
||||
func (l *FileLock) Unlock() error {
|
||||
return syscall.Flock(int(l.f.Fd()), syscall.LOCK_UN)
|
||||
}
|
||||
26
plugins/ipam/host-local/backend/store.go
Normal file
26
plugins/ipam/host-local/backend/store.go
Normal file
@ -0,0 +1,26 @@
|
||||
// Copyright 2015 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package backend
|
||||
|
||||
import "net"
|
||||
|
||||
type Store interface {
|
||||
Lock() error
|
||||
Unlock() error
|
||||
Close() error
|
||||
Reserve(id string, ip net.IP) (bool, error)
|
||||
Release(ip net.IP) error
|
||||
ReleaseByID(id string) error
|
||||
}
|
||||
57
plugins/ipam/host-local/config.go
Normal file
57
plugins/ipam/host-local/config.go
Normal file
@ -0,0 +1,57 @@
|
||||
// Copyright 2015 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net"
|
||||
|
||||
"github.com/appc/cni/pkg/ip"
|
||||
"github.com/appc/cni/pkg/plugin"
|
||||
)
|
||||
|
||||
// IPAMConfig represents the IP related network configuration.
|
||||
type IPAMConfig struct {
|
||||
Name string
|
||||
Type string `json:"type"`
|
||||
RangeStart net.IP `json:"rangeStart"`
|
||||
RangeEnd net.IP `json:"rangeEnd"`
|
||||
Subnet ip.IPNet `json:"subnet"`
|
||||
Gateway net.IP `json:"gateway"`
|
||||
Routes []plugin.Route `json:"routes"`
|
||||
}
|
||||
|
||||
type Net struct {
|
||||
Name string `json:"name"`
|
||||
IPAM *IPAMConfig `json:"ipam"`
|
||||
}
|
||||
|
||||
// NewIPAMConfig creates a NetworkConfig from the given network name.
|
||||
func LoadIPAMConfig(bytes []byte) (*IPAMConfig, error) {
|
||||
n := Net{}
|
||||
if err := json.Unmarshal(bytes, &n); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if n.IPAM == nil {
|
||||
return nil, fmt.Errorf("%q missing 'ipam' key")
|
||||
}
|
||||
|
||||
// Copy net name into IPAM so not to drag Net struct around
|
||||
n.IPAM.Name = n.Name
|
||||
|
||||
return n.IPAM, nil
|
||||
}
|
||||
85
plugins/ipam/host-local/main.go
Normal file
85
plugins/ipam/host-local/main.go
Normal file
@ -0,0 +1,85 @@
|
||||
// Copyright 2015 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"errors"
|
||||
|
||||
"github.com/appc/cni/plugins/ipam/host-local/backend/disk"
|
||||
|
||||
"github.com/appc/cni/pkg/plugin"
|
||||
"github.com/appc/cni/pkg/skel"
|
||||
)
|
||||
|
||||
func main() {
|
||||
skel.PluginMain(cmdAdd, cmdDel)
|
||||
}
|
||||
|
||||
func cmdAdd(args *skel.CmdArgs) error {
|
||||
ipamConf, err := LoadIPAMConfig(args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
store, err := disk.New(ipamConf.Name)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer store.Close()
|
||||
|
||||
allocator, err := NewIPAllocator(ipamConf, store)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var ipConf *plugin.IPConfig
|
||||
|
||||
switch ipamConf.Type {
|
||||
case "host-local":
|
||||
ipConf, err = allocator.Get(args.Netns)
|
||||
case "host-local-ptp":
|
||||
ipConf, err = allocator.GetPtP(args.Netns)
|
||||
default:
|
||||
return errors.New("Unsupported IPAM plugin type")
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return plugin.PrintResult(&plugin.Result{
|
||||
IP4: ipConf,
|
||||
})
|
||||
}
|
||||
|
||||
func cmdDel(args *skel.CmdArgs) error {
|
||||
ipamConf, err := LoadIPAMConfig(args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
store, err := disk.New(ipamConf.Name)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer store.Close()
|
||||
|
||||
allocator, err := NewIPAllocator(ipamConf, store)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return allocator.Release(args.Netns)
|
||||
}
|
||||
243
plugins/main/bridge/bridge.go
Normal file
243
plugins/main/bridge/bridge.go
Normal file
@ -0,0 +1,243 @@
|
||||
// Copyright 2014 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"os"
|
||||
"runtime"
|
||||
"syscall"
|
||||
|
||||
"github.com/appc/cni/Godeps/_workspace/src/github.com/vishvananda/netlink"
|
||||
"github.com/appc/cni/pkg/ip"
|
||||
"github.com/appc/cni/pkg/ns"
|
||||
"github.com/appc/cni/pkg/plugin"
|
||||
"github.com/appc/cni/pkg/skel"
|
||||
)
|
||||
|
||||
const defaultBrName = "cni0"
|
||||
|
||||
type NetConf struct {
|
||||
plugin.NetConf
|
||||
BrName string `json:"bridge"`
|
||||
IsGW bool `json:"isGateway"`
|
||||
IPMasq bool `json:"ipMasq"`
|
||||
MTU int `json:"mtu"`
|
||||
}
|
||||
|
||||
func init() {
|
||||
// this ensures that main runs only on main thread (thread group leader).
|
||||
// since namespace ops (unshare, setns) are done for a single thread, we
|
||||
// must ensure that the goroutine does not jump from OS thread to thread
|
||||
runtime.LockOSThread()
|
||||
}
|
||||
|
||||
func loadNetConf(bytes []byte) (*NetConf, error) {
|
||||
n := &NetConf{
|
||||
BrName: defaultBrName,
|
||||
}
|
||||
if err := json.Unmarshal(bytes, n); err != nil {
|
||||
return nil, fmt.Errorf("failed to load netconf: %v", err)
|
||||
}
|
||||
return n, nil
|
||||
}
|
||||
|
||||
func ensureBridgeAddr(br *netlink.Bridge, ipn *net.IPNet) error {
|
||||
addrs, err := netlink.AddrList(br, syscall.AF_INET)
|
||||
if err != nil && err != syscall.ENOENT {
|
||||
return fmt.Errorf("could not get list of IP addresses: %v", err)
|
||||
}
|
||||
|
||||
// if there're no addresses on the bridge, it's ok -- we'll add one
|
||||
if len(addrs) > 0 {
|
||||
ipnStr := ipn.String()
|
||||
for _, a := range addrs {
|
||||
// string comp is actually easiest for doing IPNet comps
|
||||
if a.IPNet.String() == ipnStr {
|
||||
return nil
|
||||
}
|
||||
}
|
||||
return fmt.Errorf("%q already has an IP address different from %v", br.Name, ipn.String())
|
||||
}
|
||||
|
||||
addr := &netlink.Addr{IPNet: ipn, Label: ""}
|
||||
if err := netlink.AddrAdd(br, addr); err != nil {
|
||||
return fmt.Errorf("could not add IP address to %q: %v", br.Name, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func bridgeByName(name string) (*netlink.Bridge, error) {
|
||||
l, err := netlink.LinkByName(name)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("could not lookup %q: %v", name, err)
|
||||
}
|
||||
br, ok := l.(*netlink.Bridge)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("%q already exists but is not a bridge", name)
|
||||
}
|
||||
return br, nil
|
||||
}
|
||||
|
||||
func ensureBridge(brName string, mtu int, ipn *net.IPNet) (*netlink.Bridge, error) {
|
||||
br := &netlink.Bridge{
|
||||
LinkAttrs: netlink.LinkAttrs{
|
||||
Name: brName,
|
||||
MTU: mtu,
|
||||
},
|
||||
}
|
||||
|
||||
if err := netlink.LinkAdd(br); err != nil {
|
||||
if err != syscall.EEXIST {
|
||||
return nil, fmt.Errorf("could not add %q: %v", brName, err)
|
||||
}
|
||||
|
||||
// it's ok if the device already exists as long as config is similar
|
||||
br, err = bridgeByName(brName)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
if err := netlink.LinkSetUp(br); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if ipn != nil {
|
||||
return br, ensureBridgeAddr(br, ipn)
|
||||
}
|
||||
|
||||
return br, nil
|
||||
}
|
||||
|
||||
func setupVeth(netns string, br *netlink.Bridge, ifName string, mtu int, pr *plugin.Result) error {
|
||||
var hostVethName string
|
||||
|
||||
err := ns.WithNetNSPath(netns, func(hostNS *os.File) error {
|
||||
// create the veth pair in the container and move host end into host netns
|
||||
hostVeth, _, err := ip.SetupVeth(netns, ifName, mtu, hostNS)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err = plugin.ConfigureIface(ifName, pr); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
hostVethName = hostVeth.Attrs().Name
|
||||
return nil
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// need to lookup hostVeth again as its index has changed during ns move
|
||||
hostVeth, err := netlink.LinkByName(hostVethName)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to lookup %q: %v", hostVethName, err)
|
||||
}
|
||||
|
||||
// connect host veth end to the bridge
|
||||
if err = netlink.LinkSetMaster(hostVeth, br); err != nil {
|
||||
return fmt.Errorf("failed to connect %q to bridge %v: %v", hostVethName, br.Attrs().Name, err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func calcGatewayIP(ipn *net.IPNet) net.IP {
|
||||
nid := ipn.IP.Mask(ipn.Mask)
|
||||
return ip.NextIP(nid)
|
||||
}
|
||||
|
||||
func setupBridge(n *NetConf, ipConf *plugin.IPConfig) (*netlink.Bridge, error) {
|
||||
var gwn *net.IPNet
|
||||
if n.IsGW {
|
||||
gwn = &net.IPNet{
|
||||
IP: ipConf.Gateway,
|
||||
Mask: ipConf.IP.Mask,
|
||||
}
|
||||
}
|
||||
|
||||
// create bridge if necessary
|
||||
br, err := ensureBridge(n.BrName, n.MTU, gwn)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to create bridge %q: %v", n.BrName, err)
|
||||
}
|
||||
|
||||
return br, nil
|
||||
}
|
||||
|
||||
func cmdAdd(args *skel.CmdArgs) error {
|
||||
n, err := loadNetConf(args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// run the IPAM plugin and get back the config to apply
|
||||
result, err := plugin.ExecAdd(n.IPAM.Type, args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if result.IP4 == nil {
|
||||
return errors.New("IPAM plugin returned missing IPv4 config")
|
||||
}
|
||||
|
||||
if result.IP4.Gateway == nil && n.IsGW {
|
||||
result.IP4.Gateway = calcGatewayIP(&result.IP4.IP)
|
||||
}
|
||||
|
||||
br, err := setupBridge(n, result.IP4)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err = setupVeth(args.Netns, br, args.IfName, n.MTU, result); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if n.IPMasq {
|
||||
chain := "CNI-" + n.Name
|
||||
if err = ip.SetupIPMasq(ip.Network(&result.IP4.IP), chain); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return plugin.PrintResult(result)
|
||||
}
|
||||
|
||||
func cmdDel(args *skel.CmdArgs) error {
|
||||
n, err := loadNetConf(args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = ns.WithNetNSPath(args.Netns, func(hostNS *os.File) error {
|
||||
return ip.DelLinkByName(args.IfName)
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return plugin.ExecDel(n.IPAM.Type, args.StdinData)
|
||||
}
|
||||
|
||||
func main() {
|
||||
skel.PluginMain(cmdAdd, cmdDel)
|
||||
}
|
||||
177
plugins/main/macvlan/macvlan.go
Normal file
177
plugins/main/macvlan/macvlan.go
Normal file
@ -0,0 +1,177 @@
|
||||
// Copyright 2015 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"runtime"
|
||||
|
||||
"github.com/appc/cni/Godeps/_workspace/src/github.com/vishvananda/netlink"
|
||||
"github.com/appc/cni/pkg/ip"
|
||||
"github.com/appc/cni/pkg/ns"
|
||||
"github.com/appc/cni/pkg/plugin"
|
||||
"github.com/appc/cni/pkg/skel"
|
||||
)
|
||||
|
||||
type NetConf struct {
|
||||
plugin.NetConf
|
||||
Master string `json:"master"`
|
||||
Mode string `json:"mode"`
|
||||
IPMasq bool `json:"ipMasq"`
|
||||
MTU int `json:"mtu"`
|
||||
}
|
||||
|
||||
func init() {
|
||||
// this ensures that main runs only on main thread (thread group leader).
|
||||
// since namespace ops (unshare, setns) are done for a single thread, we
|
||||
// must ensure that the goroutine does not jump from OS thread to thread
|
||||
runtime.LockOSThread()
|
||||
}
|
||||
|
||||
func loadConf(bytes []byte) (*NetConf, error) {
|
||||
n := &NetConf{}
|
||||
if err := json.Unmarshal(bytes, n); err != nil {
|
||||
return nil, fmt.Errorf("failed to load netconf: %v", err)
|
||||
}
|
||||
if n.Master == "" {
|
||||
return nil, fmt.Errorf(`"master" field is required. It specifies the host interface name to virtualize`)
|
||||
}
|
||||
return n, nil
|
||||
}
|
||||
|
||||
func modeFromString(s string) (netlink.MacvlanMode, error) {
|
||||
switch s {
|
||||
case "":
|
||||
return netlink.MACVLAN_MODE_BRIDGE, nil
|
||||
case "private":
|
||||
return netlink.MACVLAN_MODE_PRIVATE, nil
|
||||
case "vepa":
|
||||
return netlink.MACVLAN_MODE_VEPA, nil
|
||||
case "bridge":
|
||||
return netlink.MACVLAN_MODE_BRIDGE, nil
|
||||
case "passthru":
|
||||
return netlink.MACVLAN_MODE_PASSTHRU, nil
|
||||
default:
|
||||
return 0, fmt.Errorf("unknown macvlan mode: %q", s)
|
||||
}
|
||||
}
|
||||
|
||||
func createMacvlan(conf *NetConf, ifName string, netns *os.File) error {
|
||||
mode, err := modeFromString(conf.Mode)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
m, err := netlink.LinkByName(conf.Master)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to lookup master %q: %v", conf.Master, err)
|
||||
}
|
||||
|
||||
mv := &netlink.Macvlan{
|
||||
LinkAttrs: netlink.LinkAttrs{
|
||||
MTU: conf.MTU,
|
||||
Name: ifName,
|
||||
ParentIndex: m.Attrs().Index,
|
||||
Namespace: netlink.NsFd(int(netns.Fd())),
|
||||
},
|
||||
Mode: mode,
|
||||
}
|
||||
|
||||
if err := netlink.LinkAdd(mv); err != nil {
|
||||
return fmt.Errorf("failed to create macvlan: %v", err)
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
func cmdAdd(args *skel.CmdArgs) error {
|
||||
n, err := loadConf(args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
netns, err := os.Open(args.Netns)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to open netns %q: %v", netns, err)
|
||||
}
|
||||
defer netns.Close()
|
||||
|
||||
tmpName := ip.RandomVethName(args.Netns)
|
||||
if err = createMacvlan(n, tmpName, netns); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// run the IPAM plugin and get back the config to apply
|
||||
result, err := plugin.ExecAdd(n.IPAM.Type, args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if result.IP4 == nil {
|
||||
return errors.New("IPAM plugin returned missing IPv4 config")
|
||||
}
|
||||
|
||||
err = ns.WithNetNS(netns, func(_ *os.File) error {
|
||||
err := renameLink(tmpName, args.IfName)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to rename macvlan to %q: %v", args.IfName, err)
|
||||
}
|
||||
|
||||
return plugin.ConfigureIface(args.IfName, result)
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if n.IPMasq {
|
||||
chain := "CNI-" + n.Name
|
||||
if err = ip.SetupIPMasq(ip.Network(&result.IP4.IP), chain); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return plugin.PrintResult(result)
|
||||
}
|
||||
|
||||
func cmdDel(args *skel.CmdArgs) error {
|
||||
n, err := loadConf(args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = plugin.ExecDel(n.IPAM.Type, args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return ns.WithNetNSPath(args.Netns, func(hostNS *os.File) error {
|
||||
return ip.DelLinkByName(args.IfName)
|
||||
})
|
||||
}
|
||||
|
||||
func renameLink(curName, newName string) error {
|
||||
link, err := netlink.LinkByName(curName)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return netlink.LinkSetName(link, newName)
|
||||
}
|
||||
|
||||
func main() {
|
||||
skel.PluginMain(cmdAdd, cmdDel)
|
||||
}
|
||||
158
plugins/main/veth/veth.go
Normal file
158
plugins/main/veth/veth.go
Normal file
@ -0,0 +1,158 @@
|
||||
// Copyright 2015 CoreOS, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/sha512"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"os"
|
||||
"runtime"
|
||||
|
||||
"github.com/appc/cni/Godeps/_workspace/src/github.com/vishvananda/netlink"
|
||||
|
||||
"github.com/appc/cni/pkg/ip"
|
||||
"github.com/appc/cni/pkg/ns"
|
||||
"github.com/appc/cni/pkg/plugin"
|
||||
"github.com/appc/cni/pkg/skel"
|
||||
)
|
||||
|
||||
func init() {
|
||||
// this ensures that main runs only on main thread (thread group leader).
|
||||
// since namespace ops (unshare, setns) are done for a single thread, we
|
||||
// must ensure that the goroutine does not jump from OS thread to thread
|
||||
runtime.LockOSThread()
|
||||
}
|
||||
|
||||
type NetConf struct {
|
||||
plugin.NetConf
|
||||
IPMasq bool `json:"ipMasq"`
|
||||
MTU int `json:"mtu"`
|
||||
}
|
||||
|
||||
func setupContainerVeth(netns, ifName string, mtu int, pr *plugin.Result) (string, error) {
|
||||
var hostVethName string
|
||||
err := ns.WithNetNSPath(netns, func(hostNS *os.File) error {
|
||||
entropy := netns + ifName
|
||||
|
||||
hostVeth, _, err := ip.SetupVeth(entropy, ifName, mtu, hostNS)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = plugin.ConfigureIface(ifName, pr)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
hostVethName = hostVeth.Attrs().Name
|
||||
|
||||
return nil
|
||||
})
|
||||
return hostVethName, err
|
||||
}
|
||||
|
||||
func setupHostVeth(vethName string, ipConf *plugin.IPConfig) error {
|
||||
// hostVeth moved namespaces and may have a new ifindex
|
||||
veth, err := netlink.LinkByName(vethName)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to lookup %q: %v", vethName, err)
|
||||
}
|
||||
|
||||
// TODO(eyakubovich): IPv6
|
||||
ipn := &net.IPNet{
|
||||
IP: ipConf.Gateway,
|
||||
Mask: net.CIDRMask(31, 32),
|
||||
}
|
||||
addr := &netlink.Addr{IPNet: ipn, Label: ""}
|
||||
if err = netlink.AddrAdd(veth, addr); err != nil {
|
||||
return fmt.Errorf("failed to add IP addr (%#v) to veth: %v", ipn, err)
|
||||
}
|
||||
|
||||
// dst happens to be the same as IP/net of host veth
|
||||
if err = ip.AddHostRoute(ipn, nil, veth); err != nil && !os.IsExist(err) {
|
||||
return fmt.Errorf("failed to add route on host: %v", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func cmdAdd(args *skel.CmdArgs) error {
|
||||
conf := NetConf{}
|
||||
if err := json.Unmarshal(args.StdinData, &conf); err != nil {
|
||||
return fmt.Errorf("failed to load netconf: %v", err)
|
||||
}
|
||||
|
||||
// run the IPAM plugin and get back the config to apply
|
||||
result, err := plugin.ExecAdd(conf.IPAM.Type, args.StdinData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if result.IP4 == nil {
|
||||
return errors.New("IPAM plugin returned missing IPv4 config")
|
||||
}
|
||||
|
||||
hostVethName, err := setupContainerVeth(args.Netns, args.IfName, conf.MTU, result)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err = setupHostVeth(hostVethName, result.IP4); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if conf.IPMasq {
|
||||
h := sha512.Sum512([]byte(args.Netns))
|
||||
chain := fmt.Sprintf("CNI-%s-%x", conf.Name, h[:8])
|
||||
if err = ip.SetupIPMasq(&result.IP4.IP, chain); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return plugin.PrintResult(result)
|
||||
}
|
||||
|
||||
func cmdDel(args *skel.CmdArgs) error {
|
||||
conf := NetConf{}
|
||||
if err := json.Unmarshal(args.StdinData, &conf); err != nil {
|
||||
return fmt.Errorf("failed to load netconf: %v", err)
|
||||
}
|
||||
|
||||
var ipn *net.IPNet
|
||||
err := ns.WithNetNSPath(args.Netns, func(hostNS *os.File) error {
|
||||
var err error
|
||||
ipn, err = ip.DelLinkByNameAddr(args.IfName, netlink.FAMILY_V4)
|
||||
return err
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if conf.IPMasq {
|
||||
h := sha512.Sum512([]byte(args.Netns))
|
||||
chain := fmt.Sprintf("CNI-%s-%x", conf.Name, h[:8])
|
||||
if err = ip.TeardownIPMasq(ipn, chain); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return plugin.ExecDel(conf.IPAM.Type, args.StdinData)
|
||||
}
|
||||
|
||||
func main() {
|
||||
skel.PluginMain(cmdAdd, cmdDel)
|
||||
}
|
||||
Reference in New Issue
Block a user