260 lines
6.5 KiB
Go
260 lines
6.5 KiB
Go
// Copyright 2015 CNI authors
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
"runtime"
|
|
|
|
"github.com/containernetworking/cni/pkg/skel"
|
|
"github.com/containernetworking/cni/pkg/types"
|
|
"github.com/containernetworking/cni/pkg/types/current"
|
|
"github.com/containernetworking/cni/pkg/version"
|
|
"github.com/containernetworking/plugins/pkg/ip"
|
|
"github.com/containernetworking/plugins/pkg/ipam"
|
|
"github.com/containernetworking/plugins/pkg/ns"
|
|
"github.com/containernetworking/plugins/pkg/utils/sysctl"
|
|
"github.com/j-keck/arping"
|
|
"github.com/vishvananda/netlink"
|
|
)
|
|
|
|
const (
|
|
IPv4InterfaceArpProxySysctlTemplate = "net.ipv4.conf.%s.proxy_arp"
|
|
)
|
|
|
|
type NetConf struct {
|
|
types.NetConf
|
|
Master string `json:"master"`
|
|
Mode string `json:"mode"`
|
|
MTU int `json:"mtu"`
|
|
}
|
|
|
|
func init() {
|
|
// this ensures that main runs only on main thread (thread group leader).
|
|
// since namespace ops (unshare, setns) are done for a single thread, we
|
|
// must ensure that the goroutine does not jump from OS thread to thread
|
|
runtime.LockOSThread()
|
|
}
|
|
|
|
func loadConf(bytes []byte) (*NetConf, string, error) {
|
|
n := &NetConf{}
|
|
if err := json.Unmarshal(bytes, n); err != nil {
|
|
return nil, "", fmt.Errorf("failed to load netconf: %v", err)
|
|
}
|
|
if n.Master == "" {
|
|
return nil, "", fmt.Errorf(`"master" field is required. It specifies the host interface name to virtualize`)
|
|
}
|
|
return n, n.CNIVersion, nil
|
|
}
|
|
|
|
func modeFromString(s string) (netlink.MacvlanMode, error) {
|
|
switch s {
|
|
case "", "bridge":
|
|
return netlink.MACVLAN_MODE_BRIDGE, nil
|
|
case "private":
|
|
return netlink.MACVLAN_MODE_PRIVATE, nil
|
|
case "vepa":
|
|
return netlink.MACVLAN_MODE_VEPA, nil
|
|
case "passthru":
|
|
return netlink.MACVLAN_MODE_PASSTHRU, nil
|
|
default:
|
|
return 0, fmt.Errorf("unknown macvlan mode: %q", s)
|
|
}
|
|
}
|
|
|
|
func createMacvlan(conf *NetConf, ifName string, netns ns.NetNS) (*current.Interface, error) {
|
|
macvlan := ¤t.Interface{}
|
|
|
|
mode, err := modeFromString(conf.Mode)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
m, err := netlink.LinkByName(conf.Master)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to lookup master %q: %v", conf.Master, err)
|
|
}
|
|
|
|
// due to kernel bug we have to create with tmpName or it might
|
|
// collide with the name on the host and error out
|
|
tmpName, err := ip.RandomVethName()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
mv := &netlink.Macvlan{
|
|
LinkAttrs: netlink.LinkAttrs{
|
|
MTU: conf.MTU,
|
|
Name: tmpName,
|
|
ParentIndex: m.Attrs().Index,
|
|
Namespace: netlink.NsFd(int(netns.Fd())),
|
|
},
|
|
Mode: mode,
|
|
}
|
|
|
|
if err := netlink.LinkAdd(mv); err != nil {
|
|
return nil, fmt.Errorf("failed to create macvlan: %v", err)
|
|
}
|
|
|
|
err = netns.Do(func(_ ns.NetNS) error {
|
|
// TODO: duplicate following lines for ipv6 support, when it will be added in other places
|
|
ipv4SysctlValueName := fmt.Sprintf(IPv4InterfaceArpProxySysctlTemplate, tmpName)
|
|
if _, err := sysctl.Sysctl(ipv4SysctlValueName, "1"); err != nil {
|
|
// remove the newly added link and ignore errors, because we already are in a failed state
|
|
_ = netlink.LinkDel(mv)
|
|
return fmt.Errorf("failed to set proxy_arp on newly added interface %q: %v", tmpName, err)
|
|
}
|
|
|
|
err := ip.RenameLink(tmpName, ifName)
|
|
if err != nil {
|
|
_ = netlink.LinkDel(mv)
|
|
return fmt.Errorf("failed to rename macvlan to %q: %v", ifName, err)
|
|
}
|
|
macvlan.Name = ifName
|
|
|
|
// Re-fetch macvlan to get all properties/attributes
|
|
contMacvlan, err := netlink.LinkByName(ifName)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to refetch macvlan %q: %v", ifName, err)
|
|
}
|
|
macvlan.Mac = contMacvlan.Attrs().HardwareAddr.String()
|
|
macvlan.Sandbox = netns.Path()
|
|
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return macvlan, nil
|
|
}
|
|
|
|
func cmdAdd(args *skel.CmdArgs) error {
|
|
n, cniVersion, err := loadConf(args.StdinData)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
netns, err := ns.GetNS(args.Netns)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to open netns %q: %v", netns, err)
|
|
}
|
|
defer netns.Close()
|
|
|
|
macvlanInterface, err := createMacvlan(n, args.IfName, netns)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Delete link if err to avoid link leak in this ns
|
|
defer func() {
|
|
if err != nil {
|
|
netns.Do(func(_ ns.NetNS) error {
|
|
return ip.DelLinkByName(args.IfName)
|
|
})
|
|
}
|
|
}()
|
|
|
|
// run the IPAM plugin and get back the config to apply
|
|
r, err := ipam.ExecAdd(n.IPAM.Type, args.StdinData)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Invoke ipam del if err to avoid ip leak
|
|
defer func() {
|
|
if err != nil {
|
|
ipam.ExecDel(n.IPAM.Type, args.StdinData)
|
|
}
|
|
}()
|
|
|
|
// Convert whatever the IPAM result was into the current Result type
|
|
result, err := current.NewResultFromResult(r)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if len(result.IPs) == 0 {
|
|
return errors.New("IPAM plugin returned missing IP config")
|
|
}
|
|
result.Interfaces = []*current.Interface{macvlanInterface}
|
|
|
|
for _, ipc := range result.IPs {
|
|
// All addresses apply to the container macvlan interface
|
|
ipc.Interface = current.Int(0)
|
|
}
|
|
|
|
err = netns.Do(func(_ ns.NetNS) error {
|
|
if err := ipam.ConfigureIface(args.IfName, result); err != nil {
|
|
return err
|
|
}
|
|
|
|
contVeth, err := net.InterfaceByName(args.IfName)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to look up %q: %v", args.IfName, err)
|
|
}
|
|
|
|
for _, ipc := range result.IPs {
|
|
if ipc.Version == "4" {
|
|
_ = arping.GratuitousArpOverIface(ipc.Address.IP, *contVeth)
|
|
}
|
|
}
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
result.DNS = n.DNS
|
|
|
|
return types.PrintResult(result, cniVersion)
|
|
}
|
|
|
|
func cmdDel(args *skel.CmdArgs) error {
|
|
n, _, err := loadConf(args.StdinData)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = ipam.ExecDel(n.IPAM.Type, args.StdinData)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if args.Netns == "" {
|
|
return nil
|
|
}
|
|
|
|
// There is a netns so try to clean up. Delete can be called multiple times
|
|
// so don't return an error if the device is already removed.
|
|
err = ns.WithNetNSPath(args.Netns, func(_ ns.NetNS) error {
|
|
if err := ip.DelLinkByName(args.IfName); err != nil {
|
|
if err != ip.ErrLinkNotFound {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
})
|
|
|
|
return err
|
|
}
|
|
|
|
func main() {
|
|
skel.PluginMain(cmdAdd, cmdDel, version.All)
|
|
}
|