mirror of
https://github.com/containers/podman.git
synced 2025-05-20 08:36:23 +08:00
Move slirp4netns functions into an extra file
This should make maintenance easier. Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
This commit is contained in:
Paul Holzinger
@ -3,18 +3,14 @@
|
||||
package libpod
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/rand"
|
||||
"fmt"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
@ -27,7 +23,6 @@ import (
|
||||
"github.com/containers/podman/v3/pkg/errorhandling"
|
||||
"github.com/containers/podman/v3/pkg/netns"
|
||||
"github.com/containers/podman/v3/pkg/rootless"
|
||||
"github.com/containers/podman/v3/pkg/rootlessport"
|
||||
"github.com/containers/podman/v3/pkg/util"
|
||||
"github.com/cri-o/ocicni/pkg/ocicni"
|
||||
"github.com/opencontainers/selinux/go-selinux/label"
|
||||
@ -430,57 +425,6 @@ func (r *Runtime) createNetNS(ctr *Container) (n ns.NetNS, q []*cnitypes.Result,
|
||||
return ctrNS, networkStatus, err
|
||||
}
|
||||
|
||||
type slirpFeatures struct {
|
||||
HasDisableHostLoopback bool
|
||||
HasMTU bool
|
||||
HasEnableSandbox bool
|
||||
HasEnableSeccomp bool
|
||||
HasCIDR bool
|
||||
HasOutboundAddr bool
|
||||
HasIPv6 bool
|
||||
}
|
||||
|
||||
type slirp4netnsCmdArg struct {
|
||||
Proto string `json:"proto,omitempty"`
|
||||
HostAddr string `json:"host_addr"`
|
||||
HostPort int32 `json:"host_port"`
|
||||
GuestAddr string `json:"guest_addr"`
|
||||
GuestPort int32 `json:"guest_port"`
|
||||
}
|
||||
|
||||
type slirp4netnsCmd struct {
|
||||
Execute string `json:"execute"`
|
||||
Args slirp4netnsCmdArg `json:"arguments"`
|
||||
}
|
||||
|
||||
type slirp4netnsNetworkOptions struct {
|
||||
cidr string
|
||||
disableHostLoopback bool
|
||||
enableIPv6 bool
|
||||
isSlirpHostForward bool
|
||||
noPivotRoot bool
|
||||
mtu int
|
||||
outboundAddr string
|
||||
outboundAddr6 string
|
||||
}
|
||||
|
||||
func checkSlirpFlags(path string) (*slirpFeatures, error) {
|
||||
cmd := exec.Command(path, "--help")
|
||||
out, err := cmd.CombinedOutput()
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "slirp4netns %q", out)
|
||||
}
|
||||
return &slirpFeatures{
|
||||
HasDisableHostLoopback: strings.Contains(string(out), "--disable-host-loopback"),
|
||||
HasMTU: strings.Contains(string(out), "--mtu"),
|
||||
HasEnableSandbox: strings.Contains(string(out), "--enable-sandbox"),
|
||||
HasEnableSeccomp: strings.Contains(string(out), "--enable-seccomp"),
|
||||
HasCIDR: strings.Contains(string(out), "--cidr"),
|
||||
HasOutboundAddr: strings.Contains(string(out), "--outbound-addr"),
|
||||
HasIPv6: strings.Contains(string(out), "--enable-ipv6"),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Configure the network namespace for a rootless container
|
||||
func (r *Runtime) setupRootlessNetNS(ctr *Container) error {
|
||||
if ctr.config.NetMode.IsSlirp4netns() {
|
||||
@ -499,470 +443,6 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func parseSlirp4netnsNetworkOptions(r *Runtime, extraOptions []string) (*slirp4netnsNetworkOptions, error) {
|
||||
slirpOptions := append(r.config.Engine.NetworkCmdOptions, extraOptions...)
|
||||
slirp4netnsOpts := &slirp4netnsNetworkOptions{
|
||||
// overwrite defaults
|
||||
disableHostLoopback: true,
|
||||
mtu: slirp4netnsMTU,
|
||||
noPivotRoot: r.config.Engine.NoPivotRoot,
|
||||
}
|
||||
for _, o := range slirpOptions {
|
||||
parts := strings.SplitN(o, "=", 2)
|
||||
if len(parts) < 2 {
|
||||
return nil, errors.Errorf("unknown option for slirp4netns: %q", o)
|
||||
}
|
||||
option, value := parts[0], parts[1]
|
||||
switch option {
|
||||
case "cidr":
|
||||
ipv4, _, err := net.ParseCIDR(value)
|
||||
if err != nil || ipv4.To4() == nil {
|
||||
return nil, errors.Errorf("invalid cidr %q", value)
|
||||
}
|
||||
slirp4netnsOpts.cidr = value
|
||||
case "port_handler":
|
||||
switch value {
|
||||
case "slirp4netns":
|
||||
slirp4netnsOpts.isSlirpHostForward = true
|
||||
case "rootlesskit":
|
||||
slirp4netnsOpts.isSlirpHostForward = false
|
||||
default:
|
||||
return nil, errors.Errorf("unknown port_handler for slirp4netns: %q", value)
|
||||
}
|
||||
case "allow_host_loopback":
|
||||
switch value {
|
||||
case "true":
|
||||
slirp4netnsOpts.disableHostLoopback = false
|
||||
case "false":
|
||||
slirp4netnsOpts.disableHostLoopback = true
|
||||
default:
|
||||
return nil, errors.Errorf("invalid value of allow_host_loopback for slirp4netns: %q", value)
|
||||
}
|
||||
case "enable_ipv6":
|
||||
switch value {
|
||||
case "true":
|
||||
slirp4netnsOpts.enableIPv6 = true
|
||||
case "false":
|
||||
slirp4netnsOpts.enableIPv6 = false
|
||||
default:
|
||||
return nil, errors.Errorf("invalid value of enable_ipv6 for slirp4netns: %q", value)
|
||||
}
|
||||
case "outbound_addr":
|
||||
ipv4 := net.ParseIP(value)
|
||||
if ipv4 == nil || ipv4.To4() == nil {
|
||||
_, err := net.InterfaceByName(value)
|
||||
if err != nil {
|
||||
return nil, errors.Errorf("invalid outbound_addr %q", value)
|
||||
}
|
||||
}
|
||||
slirp4netnsOpts.outboundAddr = value
|
||||
case "outbound_addr6":
|
||||
ipv6 := net.ParseIP(value)
|
||||
if ipv6 == nil || ipv6.To4() != nil {
|
||||
_, err := net.InterfaceByName(value)
|
||||
if err != nil {
|
||||
return nil, errors.Errorf("invalid outbound_addr6: %q", value)
|
||||
}
|
||||
}
|
||||
slirp4netnsOpts.outboundAddr6 = value
|
||||
case "mtu":
|
||||
var err error
|
||||
slirp4netnsOpts.mtu, err = strconv.Atoi(value)
|
||||
if slirp4netnsOpts.mtu < 68 || err != nil {
|
||||
return nil, errors.Errorf("invalid mtu %q", value)
|
||||
}
|
||||
default:
|
||||
return nil, errors.Errorf("unknown option for slirp4netns: %q", o)
|
||||
}
|
||||
}
|
||||
return slirp4netnsOpts, nil
|
||||
}
|
||||
|
||||
func createBasicSlirp4netnsCmdArgs(options *slirp4netnsNetworkOptions, features *slirpFeatures) ([]string, error) {
|
||||
cmdArgs := []string{}
|
||||
if options.disableHostLoopback && features.HasDisableHostLoopback {
|
||||
cmdArgs = append(cmdArgs, "--disable-host-loopback")
|
||||
}
|
||||
if options.mtu > -1 && features.HasMTU {
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("--mtu=%d", options.mtu))
|
||||
}
|
||||
if !options.noPivotRoot && features.HasEnableSandbox {
|
||||
cmdArgs = append(cmdArgs, "--enable-sandbox")
|
||||
}
|
||||
if features.HasEnableSeccomp {
|
||||
cmdArgs = append(cmdArgs, "--enable-seccomp")
|
||||
}
|
||||
|
||||
if options.cidr != "" {
|
||||
if !features.HasCIDR {
|
||||
return nil, errors.Errorf("cidr not supported")
|
||||
}
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("--cidr=%s", options.cidr))
|
||||
}
|
||||
|
||||
if options.enableIPv6 {
|
||||
if !features.HasIPv6 {
|
||||
return nil, errors.Errorf("enable_ipv6 not supported")
|
||||
}
|
||||
cmdArgs = append(cmdArgs, "--enable-ipv6")
|
||||
}
|
||||
|
||||
if options.outboundAddr != "" {
|
||||
if !features.HasOutboundAddr {
|
||||
return nil, errors.Errorf("outbound_addr not supported")
|
||||
}
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("--outbound-addr=%s", options.outboundAddr))
|
||||
}
|
||||
|
||||
if options.outboundAddr6 != "" {
|
||||
if !features.HasOutboundAddr || !features.HasIPv6 {
|
||||
return nil, errors.Errorf("outbound_addr6 not supported")
|
||||
}
|
||||
if !options.enableIPv6 {
|
||||
return nil, errors.Errorf("enable_ipv6=true is required for outbound_addr6")
|
||||
}
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("--outbound-addr6=%s", options.outboundAddr6))
|
||||
}
|
||||
|
||||
return cmdArgs, nil
|
||||
}
|
||||
|
||||
// setupSlirp4netns can be called in rootful as well as in rootless
|
||||
func (r *Runtime) setupSlirp4netns(ctr *Container) error {
|
||||
path := r.config.Engine.NetworkCmdPath
|
||||
if path == "" {
|
||||
var err error
|
||||
path, err = exec.LookPath("slirp4netns")
|
||||
if err != nil {
|
||||
logrus.Errorf("could not find slirp4netns, the network namespace won't be configured: %v", err)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
syncR, syncW, err := os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open pipe")
|
||||
}
|
||||
defer errorhandling.CloseQuiet(syncR)
|
||||
defer errorhandling.CloseQuiet(syncW)
|
||||
|
||||
havePortMapping := len(ctr.Config().PortMappings) > 0
|
||||
logPath := filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("slirp4netns-%s.log", ctr.config.ID))
|
||||
|
||||
ctrNetworkSlipOpts := []string{}
|
||||
if ctr.config.NetworkOptions != nil {
|
||||
ctrNetworkSlipOpts = append(ctrNetworkSlipOpts, ctr.config.NetworkOptions["slirp4netns"]...)
|
||||
}
|
||||
netOptions, err := parseSlirp4netnsNetworkOptions(r, ctrNetworkSlipOpts)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
slirpFeatures, err := checkSlirpFlags(path)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "error checking slirp4netns binary %s: %q", path, err)
|
||||
}
|
||||
cmdArgs, err := createBasicSlirp4netnsCmdArgs(netOptions, slirpFeatures)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// the slirp4netns arguments being passed are describes as follows:
|
||||
// from the slirp4netns documentation: https://github.com/rootless-containers/slirp4netns
|
||||
// -c, --configure Brings up the tap interface
|
||||
// -e, --exit-fd=FD specify the FD for terminating slirp4netns
|
||||
// -r, --ready-fd=FD specify the FD to write to when the initialization steps are finished
|
||||
cmdArgs = append(cmdArgs, "-c", "-e", "3", "-r", "4")
|
||||
|
||||
var apiSocket string
|
||||
if havePortMapping && netOptions.isSlirpHostForward {
|
||||
apiSocket = filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("%s.net", ctr.config.ID))
|
||||
cmdArgs = append(cmdArgs, "--api-socket", apiSocket)
|
||||
}
|
||||
netnsPath := ""
|
||||
if !ctr.config.PostConfigureNetNS {
|
||||
ctr.rootlessSlirpSyncR, ctr.rootlessSlirpSyncW, err = os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to create rootless network sync pipe")
|
||||
}
|
||||
netnsPath = ctr.state.NetNS.Path()
|
||||
cmdArgs = append(cmdArgs, "--netns-type=path", netnsPath, "tap0")
|
||||
} else {
|
||||
defer errorhandling.CloseQuiet(ctr.rootlessSlirpSyncR)
|
||||
defer errorhandling.CloseQuiet(ctr.rootlessSlirpSyncW)
|
||||
netnsPath = fmt.Sprintf("/proc/%d/ns/net", ctr.state.PID)
|
||||
// we don't use --netns-path here (unavailable for slirp4netns < v0.4)
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("%d", ctr.state.PID), "tap0")
|
||||
}
|
||||
|
||||
cmd := exec.Command(path, cmdArgs...)
|
||||
logrus.Debugf("slirp4netns command: %s", strings.Join(cmd.Args, " "))
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{
|
||||
Setpgid: true,
|
||||
}
|
||||
|
||||
// workaround for https://github.com/rootless-containers/slirp4netns/pull/153
|
||||
if !netOptions.noPivotRoot && slirpFeatures.HasEnableSandbox {
|
||||
cmd.SysProcAttr.Cloneflags = syscall.CLONE_NEWNS
|
||||
cmd.SysProcAttr.Unshareflags = syscall.CLONE_NEWNS
|
||||
}
|
||||
|
||||
// Leak one end of the pipe in slirp4netns, the other will be sent to conmon
|
||||
cmd.ExtraFiles = append(cmd.ExtraFiles, ctr.rootlessSlirpSyncR, syncW)
|
||||
|
||||
logFile, err := os.Create(logPath)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open slirp4netns log file %s", logPath)
|
||||
}
|
||||
defer logFile.Close()
|
||||
// Unlink immediately the file so we won't need to worry about cleaning it up later.
|
||||
// It is still accessible through the open fd logFile.
|
||||
if err := os.Remove(logPath); err != nil {
|
||||
return errors.Wrapf(err, "delete file %s", logPath)
|
||||
}
|
||||
cmd.Stdout = logFile
|
||||
cmd.Stderr = logFile
|
||||
if err := cmd.Start(); err != nil {
|
||||
return errors.Wrapf(err, "failed to start slirp4netns process")
|
||||
}
|
||||
defer func() {
|
||||
if err := cmd.Process.Release(); err != nil {
|
||||
logrus.Errorf("unable to release command process: %q", err)
|
||||
}
|
||||
}()
|
||||
|
||||
if err := waitForSync(syncR, cmd, logFile, 1*time.Second); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if havePortMapping {
|
||||
if netOptions.isSlirpHostForward {
|
||||
return r.setupRootlessPortMappingViaSlirp(ctr, cmd, apiSocket)
|
||||
}
|
||||
return r.setupRootlessPortMappingViaRLK(ctr, netnsPath)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func waitForSync(syncR *os.File, cmd *exec.Cmd, logFile io.ReadSeeker, timeout time.Duration) error {
|
||||
prog := filepath.Base(cmd.Path)
|
||||
if len(cmd.Args) > 0 {
|
||||
prog = cmd.Args[0]
|
||||
}
|
||||
b := make([]byte, 16)
|
||||
for {
|
||||
if err := syncR.SetDeadline(time.Now().Add(timeout)); err != nil {
|
||||
return errors.Wrapf(err, "error setting %s pipe timeout", prog)
|
||||
}
|
||||
// FIXME: return err as soon as proc exits, without waiting for timeout
|
||||
if _, err := syncR.Read(b); err == nil {
|
||||
break
|
||||
} else {
|
||||
if os.IsTimeout(err) {
|
||||
// Check if the process is still running.
|
||||
var status syscall.WaitStatus
|
||||
pid, err := syscall.Wait4(cmd.Process.Pid, &status, syscall.WNOHANG, nil)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to read %s process status", prog)
|
||||
}
|
||||
if pid != cmd.Process.Pid {
|
||||
continue
|
||||
}
|
||||
if status.Exited() {
|
||||
// Seek at the beginning of the file and read all its content
|
||||
if _, err := logFile.Seek(0, 0); err != nil {
|
||||
logrus.Errorf("could not seek log file: %q", err)
|
||||
}
|
||||
logContent, err := ioutil.ReadAll(logFile)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "%s failed", prog)
|
||||
}
|
||||
return errors.Errorf("%s failed: %q", prog, logContent)
|
||||
}
|
||||
if status.Signaled() {
|
||||
return errors.Errorf("%s killed by signal", prog)
|
||||
}
|
||||
continue
|
||||
}
|
||||
return errors.Wrapf(err, "failed to read from %s sync pipe", prog)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Runtime) setupRootlessPortMappingViaRLK(ctr *Container, netnsPath string) error {
|
||||
syncR, syncW, err := os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open pipe")
|
||||
}
|
||||
defer errorhandling.CloseQuiet(syncR)
|
||||
defer errorhandling.CloseQuiet(syncW)
|
||||
|
||||
logPath := filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("rootlessport-%s.log", ctr.config.ID))
|
||||
logFile, err := os.Create(logPath)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open rootlessport log file %s", logPath)
|
||||
}
|
||||
defer logFile.Close()
|
||||
// Unlink immediately the file so we won't need to worry about cleaning it up later.
|
||||
// It is still accessible through the open fd logFile.
|
||||
if err := os.Remove(logPath); err != nil {
|
||||
return errors.Wrapf(err, "delete file %s", logPath)
|
||||
}
|
||||
|
||||
if !ctr.config.PostConfigureNetNS {
|
||||
ctr.rootlessPortSyncR, ctr.rootlessPortSyncW, err = os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to create rootless port sync pipe")
|
||||
}
|
||||
}
|
||||
|
||||
childIP := slirp4netnsIP
|
||||
outer:
|
||||
for _, r := range ctr.state.NetworkStatus {
|
||||
for _, i := range r.IPs {
|
||||
ipv4 := i.Address.IP.To4()
|
||||
if ipv4 != nil {
|
||||
childIP = ipv4.String()
|
||||
break outer
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
cfg := rootlessport.Config{
|
||||
Mappings: ctr.config.PortMappings,
|
||||
NetNSPath: netnsPath,
|
||||
ExitFD: 3,
|
||||
ReadyFD: 4,
|
||||
TmpDir: ctr.runtime.config.Engine.TmpDir,
|
||||
ChildIP: childIP,
|
||||
}
|
||||
cfgJSON, err := json.Marshal(cfg)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
cfgR := bytes.NewReader(cfgJSON)
|
||||
var stdout bytes.Buffer
|
||||
cmd := exec.Command(fmt.Sprintf("/proc/%d/exe", os.Getpid()))
|
||||
cmd.Args = []string{rootlessport.ReexecKey}
|
||||
// Leak one end of the pipe in rootlessport process, the other will be sent to conmon
|
||||
|
||||
if ctr.rootlessPortSyncR != nil {
|
||||
defer errorhandling.CloseQuiet(ctr.rootlessPortSyncR)
|
||||
}
|
||||
|
||||
cmd.ExtraFiles = append(cmd.ExtraFiles, ctr.rootlessPortSyncR, syncW)
|
||||
cmd.Stdin = cfgR
|
||||
// stdout is for human-readable error, stderr is for debug log
|
||||
cmd.Stdout = &stdout
|
||||
cmd.Stderr = io.MultiWriter(logFile, &logrusDebugWriter{"rootlessport: "})
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{
|
||||
Setpgid: true,
|
||||
}
|
||||
if err := cmd.Start(); err != nil {
|
||||
return errors.Wrapf(err, "failed to start rootlessport process")
|
||||
}
|
||||
defer func() {
|
||||
if err := cmd.Process.Release(); err != nil {
|
||||
logrus.Errorf("unable to release rootlessport process: %q", err)
|
||||
}
|
||||
}()
|
||||
if err := waitForSync(syncR, cmd, logFile, 3*time.Second); err != nil {
|
||||
stdoutStr := stdout.String()
|
||||
if stdoutStr != "" {
|
||||
// err contains full debug log and too verbose, so return stdoutStr
|
||||
logrus.Debug(err)
|
||||
return errors.Errorf("rootlessport " + strings.TrimSuffix(stdoutStr, "\n"))
|
||||
}
|
||||
return err
|
||||
}
|
||||
logrus.Debug("rootlessport is ready")
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Runtime) setupRootlessPortMappingViaSlirp(ctr *Container, cmd *exec.Cmd, apiSocket string) (err error) {
|
||||
const pidWaitTimeout = 60 * time.Second
|
||||
chWait := make(chan error)
|
||||
go func() {
|
||||
interval := 25 * time.Millisecond
|
||||
for i := time.Duration(0); i < pidWaitTimeout; i += interval {
|
||||
// Check if the process is still running.
|
||||
var status syscall.WaitStatus
|
||||
pid, err := syscall.Wait4(cmd.Process.Pid, &status, syscall.WNOHANG, nil)
|
||||
if err != nil {
|
||||
break
|
||||
}
|
||||
if pid != cmd.Process.Pid {
|
||||
continue
|
||||
}
|
||||
if status.Exited() || status.Signaled() {
|
||||
chWait <- fmt.Errorf("slirp4netns exited with status %d", status.ExitStatus())
|
||||
}
|
||||
time.Sleep(interval)
|
||||
}
|
||||
}()
|
||||
defer close(chWait)
|
||||
|
||||
// wait that API socket file appears before trying to use it.
|
||||
if _, err := WaitForFile(apiSocket, chWait, pidWaitTimeout); err != nil {
|
||||
return errors.Wrapf(err, "waiting for slirp4nets to create the api socket file %s", apiSocket)
|
||||
}
|
||||
|
||||
// for each port we want to add we need to open a connection to the slirp4netns control socket
|
||||
// and send the add_hostfwd command.
|
||||
for _, i := range ctr.config.PortMappings {
|
||||
conn, err := net.Dial("unix", apiSocket)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot open connection to %s", apiSocket)
|
||||
}
|
||||
defer func() {
|
||||
if err := conn.Close(); err != nil {
|
||||
logrus.Errorf("unable to close connection: %q", err)
|
||||
}
|
||||
}()
|
||||
hostIP := i.HostIP
|
||||
if hostIP == "" {
|
||||
hostIP = "0.0.0.0"
|
||||
}
|
||||
apiCmd := slirp4netnsCmd{
|
||||
Execute: "add_hostfwd",
|
||||
Args: slirp4netnsCmdArg{
|
||||
Proto: i.Protocol,
|
||||
HostAddr: hostIP,
|
||||
HostPort: i.HostPort,
|
||||
GuestPort: i.ContainerPort,
|
||||
},
|
||||
}
|
||||
// create the JSON payload and send it. Mark the end of request shutting down writes
|
||||
// to the socket, as requested by slirp4netns.
|
||||
data, err := json.Marshal(&apiCmd)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot marshal JSON for slirp4netns")
|
||||
}
|
||||
if _, err := conn.Write([]byte(fmt.Sprintf("%s\n", data))); err != nil {
|
||||
return errors.Wrapf(err, "cannot write to control socket %s", apiSocket)
|
||||
}
|
||||
if err := conn.(*net.UnixConn).CloseWrite(); err != nil {
|
||||
return errors.Wrapf(err, "cannot shutdown the socket %s", apiSocket)
|
||||
}
|
||||
buf := make([]byte, 2048)
|
||||
readLength, err := conn.Read(buf)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot read from control socket %s", apiSocket)
|
||||
}
|
||||
// if there is no 'error' key in the received JSON data, then the operation was
|
||||
// successful.
|
||||
var y map[string]interface{}
|
||||
if err := json.Unmarshal(buf[0:readLength], &y); err != nil {
|
||||
return errors.Wrapf(err, "error parsing error status from slirp4netns")
|
||||
}
|
||||
if e, found := y["error"]; found {
|
||||
return errors.Errorf("error from slirp4netns while setting up port redirection: %v", e)
|
||||
}
|
||||
}
|
||||
logrus.Debug("slirp4netns port-forwarding setup via add_hostfwd is ready")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Configure the network namespace using the container process
|
||||
func (r *Runtime) setupNetNS(ctr *Container) error {
|
||||
nsProcess := fmt.Sprintf("/proc/%d/ns/net", ctr.state.PID)
|
||||
|
||||
538
libpod/networking_slirp4netns.go
Normal file
538
libpod/networking_slirp4netns.go
Normal file
@ -0,0 +1,538 @@
|
||||
// +build linux
|
||||
|
||||
package libpod
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"github.com/containers/podman/v3/pkg/errorhandling"
|
||||
"github.com/containers/podman/v3/pkg/rootlessport"
|
||||
"github.com/pkg/errors"
|
||||
"github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
type slirpFeatures struct {
|
||||
HasDisableHostLoopback bool
|
||||
HasMTU bool
|
||||
HasEnableSandbox bool
|
||||
HasEnableSeccomp bool
|
||||
HasCIDR bool
|
||||
HasOutboundAddr bool
|
||||
HasIPv6 bool
|
||||
}
|
||||
|
||||
type slirp4netnsCmdArg struct {
|
||||
Proto string `json:"proto,omitempty"`
|
||||
HostAddr string `json:"host_addr"`
|
||||
HostPort int32 `json:"host_port"`
|
||||
GuestAddr string `json:"guest_addr"`
|
||||
GuestPort int32 `json:"guest_port"`
|
||||
}
|
||||
|
||||
type slirp4netnsCmd struct {
|
||||
Execute string `json:"execute"`
|
||||
Args slirp4netnsCmdArg `json:"arguments"`
|
||||
}
|
||||
|
||||
type slirp4netnsNetworkOptions struct {
|
||||
cidr string
|
||||
disableHostLoopback bool
|
||||
enableIPv6 bool
|
||||
isSlirpHostForward bool
|
||||
noPivotRoot bool
|
||||
mtu int
|
||||
outboundAddr string
|
||||
outboundAddr6 string
|
||||
}
|
||||
|
||||
func checkSlirpFlags(path string) (*slirpFeatures, error) {
|
||||
cmd := exec.Command(path, "--help")
|
||||
out, err := cmd.CombinedOutput()
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "slirp4netns %q", out)
|
||||
}
|
||||
return &slirpFeatures{
|
||||
HasDisableHostLoopback: strings.Contains(string(out), "--disable-host-loopback"),
|
||||
HasMTU: strings.Contains(string(out), "--mtu"),
|
||||
HasEnableSandbox: strings.Contains(string(out), "--enable-sandbox"),
|
||||
HasEnableSeccomp: strings.Contains(string(out), "--enable-seccomp"),
|
||||
HasCIDR: strings.Contains(string(out), "--cidr"),
|
||||
HasOutboundAddr: strings.Contains(string(out), "--outbound-addr"),
|
||||
HasIPv6: strings.Contains(string(out), "--enable-ipv6"),
|
||||
}, nil
|
||||
}
|
||||
|
||||
func parseSlirp4netnsNetworkOptions(r *Runtime, extraOptions []string) (*slirp4netnsNetworkOptions, error) {
|
||||
slirpOptions := append(r.config.Engine.NetworkCmdOptions, extraOptions...)
|
||||
slirp4netnsOpts := &slirp4netnsNetworkOptions{
|
||||
// overwrite defaults
|
||||
disableHostLoopback: true,
|
||||
mtu: slirp4netnsMTU,
|
||||
noPivotRoot: r.config.Engine.NoPivotRoot,
|
||||
}
|
||||
for _, o := range slirpOptions {
|
||||
parts := strings.SplitN(o, "=", 2)
|
||||
if len(parts) < 2 {
|
||||
return nil, errors.Errorf("unknown option for slirp4netns: %q", o)
|
||||
}
|
||||
option, value := parts[0], parts[1]
|
||||
switch option {
|
||||
case "cidr":
|
||||
ipv4, _, err := net.ParseCIDR(value)
|
||||
if err != nil || ipv4.To4() == nil {
|
||||
return nil, errors.Errorf("invalid cidr %q", value)
|
||||
}
|
||||
slirp4netnsOpts.cidr = value
|
||||
case "port_handler":
|
||||
switch value {
|
||||
case "slirp4netns":
|
||||
slirp4netnsOpts.isSlirpHostForward = true
|
||||
case "rootlesskit":
|
||||
slirp4netnsOpts.isSlirpHostForward = false
|
||||
default:
|
||||
return nil, errors.Errorf("unknown port_handler for slirp4netns: %q", value)
|
||||
}
|
||||
case "allow_host_loopback":
|
||||
switch value {
|
||||
case "true":
|
||||
slirp4netnsOpts.disableHostLoopback = false
|
||||
case "false":
|
||||
slirp4netnsOpts.disableHostLoopback = true
|
||||
default:
|
||||
return nil, errors.Errorf("invalid value of allow_host_loopback for slirp4netns: %q", value)
|
||||
}
|
||||
case "enable_ipv6":
|
||||
switch value {
|
||||
case "true":
|
||||
slirp4netnsOpts.enableIPv6 = true
|
||||
case "false":
|
||||
slirp4netnsOpts.enableIPv6 = false
|
||||
default:
|
||||
return nil, errors.Errorf("invalid value of enable_ipv6 for slirp4netns: %q", value)
|
||||
}
|
||||
case "outbound_addr":
|
||||
ipv4 := net.ParseIP(value)
|
||||
if ipv4 == nil || ipv4.To4() == nil {
|
||||
_, err := net.InterfaceByName(value)
|
||||
if err != nil {
|
||||
return nil, errors.Errorf("invalid outbound_addr %q", value)
|
||||
}
|
||||
}
|
||||
slirp4netnsOpts.outboundAddr = value
|
||||
case "outbound_addr6":
|
||||
ipv6 := net.ParseIP(value)
|
||||
if ipv6 == nil || ipv6.To4() != nil {
|
||||
_, err := net.InterfaceByName(value)
|
||||
if err != nil {
|
||||
return nil, errors.Errorf("invalid outbound_addr6: %q", value)
|
||||
}
|
||||
}
|
||||
slirp4netnsOpts.outboundAddr6 = value
|
||||
case "mtu":
|
||||
var err error
|
||||
slirp4netnsOpts.mtu, err = strconv.Atoi(value)
|
||||
if slirp4netnsOpts.mtu < 68 || err != nil {
|
||||
return nil, errors.Errorf("invalid mtu %q", value)
|
||||
}
|
||||
default:
|
||||
return nil, errors.Errorf("unknown option for slirp4netns: %q", o)
|
||||
}
|
||||
}
|
||||
return slirp4netnsOpts, nil
|
||||
}
|
||||
|
||||
func createBasicSlirp4netnsCmdArgs(options *slirp4netnsNetworkOptions, features *slirpFeatures) ([]string, error) {
|
||||
cmdArgs := []string{}
|
||||
if options.disableHostLoopback && features.HasDisableHostLoopback {
|
||||
cmdArgs = append(cmdArgs, "--disable-host-loopback")
|
||||
}
|
||||
if options.mtu > -1 && features.HasMTU {
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("--mtu=%d", options.mtu))
|
||||
}
|
||||
if !options.noPivotRoot && features.HasEnableSandbox {
|
||||
cmdArgs = append(cmdArgs, "--enable-sandbox")
|
||||
}
|
||||
if features.HasEnableSeccomp {
|
||||
cmdArgs = append(cmdArgs, "--enable-seccomp")
|
||||
}
|
||||
|
||||
if options.cidr != "" {
|
||||
if !features.HasCIDR {
|
||||
return nil, errors.Errorf("cidr not supported")
|
||||
}
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("--cidr=%s", options.cidr))
|
||||
}
|
||||
|
||||
if options.enableIPv6 {
|
||||
if !features.HasIPv6 {
|
||||
return nil, errors.Errorf("enable_ipv6 not supported")
|
||||
}
|
||||
cmdArgs = append(cmdArgs, "--enable-ipv6")
|
||||
}
|
||||
|
||||
if options.outboundAddr != "" {
|
||||
if !features.HasOutboundAddr {
|
||||
return nil, errors.Errorf("outbound_addr not supported")
|
||||
}
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("--outbound-addr=%s", options.outboundAddr))
|
||||
}
|
||||
|
||||
if options.outboundAddr6 != "" {
|
||||
if !features.HasOutboundAddr || !features.HasIPv6 {
|
||||
return nil, errors.Errorf("outbound_addr6 not supported")
|
||||
}
|
||||
if !options.enableIPv6 {
|
||||
return nil, errors.Errorf("enable_ipv6=true is required for outbound_addr6")
|
||||
}
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("--outbound-addr6=%s", options.outboundAddr6))
|
||||
}
|
||||
|
||||
return cmdArgs, nil
|
||||
}
|
||||
|
||||
// setupSlirp4netns can be called in rootful as well as in rootless
|
||||
func (r *Runtime) setupSlirp4netns(ctr *Container) error {
|
||||
path := r.config.Engine.NetworkCmdPath
|
||||
if path == "" {
|
||||
var err error
|
||||
path, err = exec.LookPath("slirp4netns")
|
||||
if err != nil {
|
||||
logrus.Errorf("could not find slirp4netns, the network namespace won't be configured: %v", err)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
syncR, syncW, err := os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open pipe")
|
||||
}
|
||||
defer errorhandling.CloseQuiet(syncR)
|
||||
defer errorhandling.CloseQuiet(syncW)
|
||||
|
||||
havePortMapping := len(ctr.Config().PortMappings) > 0
|
||||
logPath := filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("slirp4netns-%s.log", ctr.config.ID))
|
||||
|
||||
ctrNetworkSlipOpts := []string{}
|
||||
if ctr.config.NetworkOptions != nil {
|
||||
ctrNetworkSlipOpts = append(ctrNetworkSlipOpts, ctr.config.NetworkOptions["slirp4netns"]...)
|
||||
}
|
||||
netOptions, err := parseSlirp4netnsNetworkOptions(r, ctrNetworkSlipOpts)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
slirpFeatures, err := checkSlirpFlags(path)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "error checking slirp4netns binary %s: %q", path, err)
|
||||
}
|
||||
cmdArgs, err := createBasicSlirp4netnsCmdArgs(netOptions, slirpFeatures)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// the slirp4netns arguments being passed are describes as follows:
|
||||
// from the slirp4netns documentation: https://github.com/rootless-containers/slirp4netns
|
||||
// -c, --configure Brings up the tap interface
|
||||
// -e, --exit-fd=FD specify the FD for terminating slirp4netns
|
||||
// -r, --ready-fd=FD specify the FD to write to when the initialization steps are finished
|
||||
cmdArgs = append(cmdArgs, "-c", "-e", "3", "-r", "4")
|
||||
|
||||
var apiSocket string
|
||||
if havePortMapping && netOptions.isSlirpHostForward {
|
||||
apiSocket = filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("%s.net", ctr.config.ID))
|
||||
cmdArgs = append(cmdArgs, "--api-socket", apiSocket)
|
||||
}
|
||||
netnsPath := ""
|
||||
if !ctr.config.PostConfigureNetNS {
|
||||
ctr.rootlessSlirpSyncR, ctr.rootlessSlirpSyncW, err = os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to create rootless network sync pipe")
|
||||
}
|
||||
netnsPath = ctr.state.NetNS.Path()
|
||||
cmdArgs = append(cmdArgs, "--netns-type=path", netnsPath, "tap0")
|
||||
} else {
|
||||
defer errorhandling.CloseQuiet(ctr.rootlessSlirpSyncR)
|
||||
defer errorhandling.CloseQuiet(ctr.rootlessSlirpSyncW)
|
||||
netnsPath = fmt.Sprintf("/proc/%d/ns/net", ctr.state.PID)
|
||||
// we don't use --netns-path here (unavailable for slirp4netns < v0.4)
|
||||
cmdArgs = append(cmdArgs, fmt.Sprintf("%d", ctr.state.PID), "tap0")
|
||||
}
|
||||
|
||||
cmd := exec.Command(path, cmdArgs...)
|
||||
logrus.Debugf("slirp4netns command: %s", strings.Join(cmd.Args, " "))
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{
|
||||
Setpgid: true,
|
||||
}
|
||||
|
||||
// workaround for https://github.com/rootless-containers/slirp4netns/pull/153
|
||||
if !netOptions.noPivotRoot && slirpFeatures.HasEnableSandbox {
|
||||
cmd.SysProcAttr.Cloneflags = syscall.CLONE_NEWNS
|
||||
cmd.SysProcAttr.Unshareflags = syscall.CLONE_NEWNS
|
||||
}
|
||||
|
||||
// Leak one end of the pipe in slirp4netns, the other will be sent to conmon
|
||||
cmd.ExtraFiles = append(cmd.ExtraFiles, ctr.rootlessSlirpSyncR, syncW)
|
||||
|
||||
logFile, err := os.Create(logPath)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open slirp4netns log file %s", logPath)
|
||||
}
|
||||
defer logFile.Close()
|
||||
// Unlink immediately the file so we won't need to worry about cleaning it up later.
|
||||
// It is still accessible through the open fd logFile.
|
||||
if err := os.Remove(logPath); err != nil {
|
||||
return errors.Wrapf(err, "delete file %s", logPath)
|
||||
}
|
||||
cmd.Stdout = logFile
|
||||
cmd.Stderr = logFile
|
||||
if err := cmd.Start(); err != nil {
|
||||
return errors.Wrapf(err, "failed to start slirp4netns process")
|
||||
}
|
||||
defer func() {
|
||||
if err := cmd.Process.Release(); err != nil {
|
||||
logrus.Errorf("unable to release command process: %q", err)
|
||||
}
|
||||
}()
|
||||
|
||||
if err := waitForSync(syncR, cmd, logFile, 1*time.Second); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if havePortMapping {
|
||||
if netOptions.isSlirpHostForward {
|
||||
return r.setupRootlessPortMappingViaSlirp(ctr, cmd, apiSocket)
|
||||
}
|
||||
return r.setupRootlessPortMappingViaRLK(ctr, netnsPath)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func waitForSync(syncR *os.File, cmd *exec.Cmd, logFile io.ReadSeeker, timeout time.Duration) error {
|
||||
prog := filepath.Base(cmd.Path)
|
||||
if len(cmd.Args) > 0 {
|
||||
prog = cmd.Args[0]
|
||||
}
|
||||
b := make([]byte, 16)
|
||||
for {
|
||||
if err := syncR.SetDeadline(time.Now().Add(timeout)); err != nil {
|
||||
return errors.Wrapf(err, "error setting %s pipe timeout", prog)
|
||||
}
|
||||
// FIXME: return err as soon as proc exits, without waiting for timeout
|
||||
if _, err := syncR.Read(b); err == nil {
|
||||
break
|
||||
} else {
|
||||
if os.IsTimeout(err) {
|
||||
// Check if the process is still running.
|
||||
var status syscall.WaitStatus
|
||||
pid, err := syscall.Wait4(cmd.Process.Pid, &status, syscall.WNOHANG, nil)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to read %s process status", prog)
|
||||
}
|
||||
if pid != cmd.Process.Pid {
|
||||
continue
|
||||
}
|
||||
if status.Exited() {
|
||||
// Seek at the beginning of the file and read all its content
|
||||
if _, err := logFile.Seek(0, 0); err != nil {
|
||||
logrus.Errorf("could not seek log file: %q", err)
|
||||
}
|
||||
logContent, err := ioutil.ReadAll(logFile)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "%s failed", prog)
|
||||
}
|
||||
return errors.Errorf("%s failed: %q", prog, logContent)
|
||||
}
|
||||
if status.Signaled() {
|
||||
return errors.Errorf("%s killed by signal", prog)
|
||||
}
|
||||
continue
|
||||
}
|
||||
return errors.Wrapf(err, "failed to read from %s sync pipe", prog)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Runtime) setupRootlessPortMappingViaRLK(ctr *Container, netnsPath string) error {
|
||||
syncR, syncW, err := os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open pipe")
|
||||
}
|
||||
defer errorhandling.CloseQuiet(syncR)
|
||||
defer errorhandling.CloseQuiet(syncW)
|
||||
|
||||
logPath := filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("rootlessport-%s.log", ctr.config.ID))
|
||||
logFile, err := os.Create(logPath)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to open rootlessport log file %s", logPath)
|
||||
}
|
||||
defer logFile.Close()
|
||||
// Unlink immediately the file so we won't need to worry about cleaning it up later.
|
||||
// It is still accessible through the open fd logFile.
|
||||
if err := os.Remove(logPath); err != nil {
|
||||
return errors.Wrapf(err, "delete file %s", logPath)
|
||||
}
|
||||
|
||||
if !ctr.config.PostConfigureNetNS {
|
||||
ctr.rootlessPortSyncR, ctr.rootlessPortSyncW, err = os.Pipe()
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "failed to create rootless port sync pipe")
|
||||
}
|
||||
}
|
||||
|
||||
childIP := slirp4netnsIP
|
||||
outer:
|
||||
for _, r := range ctr.state.NetworkStatus {
|
||||
for _, i := range r.IPs {
|
||||
ipv4 := i.Address.IP.To4()
|
||||
if ipv4 != nil {
|
||||
childIP = ipv4.String()
|
||||
break outer
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
cfg := rootlessport.Config{
|
||||
Mappings: ctr.config.PortMappings,
|
||||
NetNSPath: netnsPath,
|
||||
ExitFD: 3,
|
||||
ReadyFD: 4,
|
||||
TmpDir: ctr.runtime.config.Engine.TmpDir,
|
||||
ChildIP: childIP,
|
||||
}
|
||||
cfgJSON, err := json.Marshal(cfg)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
cfgR := bytes.NewReader(cfgJSON)
|
||||
var stdout bytes.Buffer
|
||||
cmd := exec.Command(fmt.Sprintf("/proc/%d/exe", os.Getpid()))
|
||||
cmd.Args = []string{rootlessport.ReexecKey}
|
||||
// Leak one end of the pipe in rootlessport process, the other will be sent to conmon
|
||||
|
||||
if ctr.rootlessPortSyncR != nil {
|
||||
defer errorhandling.CloseQuiet(ctr.rootlessPortSyncR)
|
||||
}
|
||||
|
||||
cmd.ExtraFiles = append(cmd.ExtraFiles, ctr.rootlessPortSyncR, syncW)
|
||||
cmd.Stdin = cfgR
|
||||
// stdout is for human-readable error, stderr is for debug log
|
||||
cmd.Stdout = &stdout
|
||||
cmd.Stderr = io.MultiWriter(logFile, &logrusDebugWriter{"rootlessport: "})
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{
|
||||
Setpgid: true,
|
||||
}
|
||||
if err := cmd.Start(); err != nil {
|
||||
return errors.Wrapf(err, "failed to start rootlessport process")
|
||||
}
|
||||
defer func() {
|
||||
if err := cmd.Process.Release(); err != nil {
|
||||
logrus.Errorf("unable to release rootlessport process: %q", err)
|
||||
}
|
||||
}()
|
||||
if err := waitForSync(syncR, cmd, logFile, 3*time.Second); err != nil {
|
||||
stdoutStr := stdout.String()
|
||||
if stdoutStr != "" {
|
||||
// err contains full debug log and too verbose, so return stdoutStr
|
||||
logrus.Debug(err)
|
||||
return errors.Errorf("rootlessport " + strings.TrimSuffix(stdoutStr, "\n"))
|
||||
}
|
||||
return err
|
||||
}
|
||||
logrus.Debug("rootlessport is ready")
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Runtime) setupRootlessPortMappingViaSlirp(ctr *Container, cmd *exec.Cmd, apiSocket string) (err error) {
|
||||
const pidWaitTimeout = 60 * time.Second
|
||||
chWait := make(chan error)
|
||||
go func() {
|
||||
interval := 25 * time.Millisecond
|
||||
for i := time.Duration(0); i < pidWaitTimeout; i += interval {
|
||||
// Check if the process is still running.
|
||||
var status syscall.WaitStatus
|
||||
pid, err := syscall.Wait4(cmd.Process.Pid, &status, syscall.WNOHANG, nil)
|
||||
if err != nil {
|
||||
break
|
||||
}
|
||||
if pid != cmd.Process.Pid {
|
||||
continue
|
||||
}
|
||||
if status.Exited() || status.Signaled() {
|
||||
chWait <- fmt.Errorf("slirp4netns exited with status %d", status.ExitStatus())
|
||||
}
|
||||
time.Sleep(interval)
|
||||
}
|
||||
}()
|
||||
defer close(chWait)
|
||||
|
||||
// wait that API socket file appears before trying to use it.
|
||||
if _, err := WaitForFile(apiSocket, chWait, pidWaitTimeout); err != nil {
|
||||
return errors.Wrapf(err, "waiting for slirp4nets to create the api socket file %s", apiSocket)
|
||||
}
|
||||
|
||||
// for each port we want to add we need to open a connection to the slirp4netns control socket
|
||||
// and send the add_hostfwd command.
|
||||
for _, i := range ctr.config.PortMappings {
|
||||
conn, err := net.Dial("unix", apiSocket)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot open connection to %s", apiSocket)
|
||||
}
|
||||
defer func() {
|
||||
if err := conn.Close(); err != nil {
|
||||
logrus.Errorf("unable to close connection: %q", err)
|
||||
}
|
||||
}()
|
||||
hostIP := i.HostIP
|
||||
if hostIP == "" {
|
||||
hostIP = "0.0.0.0"
|
||||
}
|
||||
apiCmd := slirp4netnsCmd{
|
||||
Execute: "add_hostfwd",
|
||||
Args: slirp4netnsCmdArg{
|
||||
Proto: i.Protocol,
|
||||
HostAddr: hostIP,
|
||||
HostPort: i.HostPort,
|
||||
GuestPort: i.ContainerPort,
|
||||
},
|
||||
}
|
||||
// create the JSON payload and send it. Mark the end of request shutting down writes
|
||||
// to the socket, as requested by slirp4netns.
|
||||
data, err := json.Marshal(&apiCmd)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot marshal JSON for slirp4netns")
|
||||
}
|
||||
if _, err := conn.Write([]byte(fmt.Sprintf("%s\n", data))); err != nil {
|
||||
return errors.Wrapf(err, "cannot write to control socket %s", apiSocket)
|
||||
}
|
||||
if err := conn.(*net.UnixConn).CloseWrite(); err != nil {
|
||||
return errors.Wrapf(err, "cannot shutdown the socket %s", apiSocket)
|
||||
}
|
||||
buf := make([]byte, 2048)
|
||||
readLength, err := conn.Read(buf)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "cannot read from control socket %s", apiSocket)
|
||||
}
|
||||
// if there is no 'error' key in the received JSON data, then the operation was
|
||||
// successful.
|
||||
var y map[string]interface{}
|
||||
if err := json.Unmarshal(buf[0:readLength], &y); err != nil {
|
||||
return errors.Wrapf(err, "error parsing error status from slirp4netns")
|
||||
}
|
||||
if e, found := y["error"]; found {
|
||||
return errors.Errorf("error from slirp4netns while setting up port redirection: %v", e)
|
||||
}
|
||||
}
|
||||
logrus.Debug("slirp4netns port-forwarding setup via add_hostfwd is ready")
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user