util-vserver:SplitSharedNetworks - Revision history

KornAndras: /* Namespace ramblings */ "albeit" is its own word

2019-01-03T15:25:46Z

‎Namespace ramblings: "albeit" is its own word

AlexanderS: /* The Script */

2013-09-27T12:13:59Z

‎The Script

AlexanderS: /* /proc/net/ */

2013-09-27T12:12:58Z

‎/proc/net/

AlexanderS: /* /proc/net/ */

2013-09-27T12:12:42Z

‎/proc/net/

AlexanderS: /* Namespace ramblings */

2013-09-27T12:12:23Z

‎Namespace ramblings

Groteblup: /* Explanation */

2012-12-31T13:13:20Z

‎Explanation

Groteblup: /* Explanation */

2012-12-31T13:12:04Z

‎Explanation

Groteblup: /* interface management */

2012-12-31T13:02:22Z

‎interface management

Groteblup: /* Useful interface creationism */

2012-12-26T13:37:59Z

‎Useful interface creationism

Groteblup: /* Useful interface creationism */

2012-12-26T13:29:59Z

‎Useful interface creationism

@@ Line 8: / Line 8: @@
 = Namespace ramblings =
-Playing with the latest and greatest ip route I discovered that ip supports the creation and naming of network namespaces, all be it with a trick.
+Playing with the latest and greatest ip route I discovered that ip supports the creation and naming of network namespaces, albeit with a trick.
 The current ip route utility manages network namespaces by creating a new namespace, and then bind-mounting /proc/self/ns/net (a file!) to /var/run/netns/<a file named after the namespace>.

@@ Line 127: / Line 127: @@
                          $_HIP link set dev fw-vlan2 address $(createMacVidId 2 0)
                          $_HIP link set dev fw-vlan2 netns ${2}
                  fi
                  ;;
@@ Line 176: / Line 177: @@
 esac
 </PRE>
 == Explanation ==
 The script uses a configuration fault (e.g: <vserver>/spaces/net contains it's

@@ Line 83: / Line 83: @@
 == /proc/net/ ==
-Initially the contents of /proc/net/ is not visible in the vserver. vprocunhide unhides only /proc/net from the host network namespace. So to be able to see /proc/net/* inside the vserver you will have to run vprocunhide in the created network namespace again. Something like that could be usefull:
+Initially the contents of /proc/net/ is not visible in the vserver. vprocunhide unhides only /proc/net from the host network namespace. So to be able to see /proc/net/* inside the vserver you will have to run vprocunhide in the created network namespace again. Something like that could be useful:
 <pre>
 ip netns exec $VSERVER /usr/lib/util-vserver/vprocunhide

@@ Line 83: / Line 83: @@
 == /proc/net/ ==
-Initially the contents of /proc/net/ is not visible in the vserver. vprocunhide unhides only /proc/net from the host network namespace. So to be able to see /proc/net/* inside the vserver you will have to run vprocunhide in the created network namespace again. Something like that would be usefull:
+Initially the contents of /proc/net/ is not visible in the vserver. vprocunhide unhides only /proc/net from the host network namespace. So to be able to see /proc/net/* inside the vserver you will have to run vprocunhide in the created network namespace again. Something like that could be usefull:
 <pre>
 ip netns exec $VSERVER /usr/lib/util-vserver/vprocunhide

@@ Line 81: / Line 81: @@
 Any vserver with a seperate network namespace should have it's lo brought up (in *that* namespace).
 Any link configuration should be done within that namespace. Util-vserver needs some patches for that.
 = Applied namespace ramblings =

@@ Line 172: / Line 172: @@
 == Explanation ==
 The script uses a configuration fault (e.g: <vserver>/spaces/net contains it's
-own name) to indicate that the script should create the network namespace. You
+own name) to indicate that the script should create the network namespace. Actually util-vserver will think that it is using a shared network namespace, and we replace that incantation of vspace with our own. You are expected to create and give the interfaces in the prepre-start section.
-are then expected to create and give the interfaces in the prepre-start section.
 Standard util-vserver functionality can configure those interfaces by prefixing
 $_IP with the vspace or ip netns prefix.

@@ Line 178: / Line 178: @@
 This way, the interfaces are UP *and* RUNNING before the vserver itself starts,
 hence making it ideal for f.i. DHCP servers on dedicated vlans.
 == future ==
 I will add functionality to allow shared network namespaces. It's not that hard.

← Older revision		Revision as of 13:02, 31 December 2012
Line 81:		Line 81:
	Any vserver with a seperate network namespace should have it's lo brought up (in that namespace).		Any vserver with a seperate network namespace should have it's lo brought up (in that namespace).
	Any link configuration should be done within that namespace. Util-vserver needs some patches for that.		Any link configuration should be done within that namespace. Util-vserver needs some patches for that.
		+
		+	= Applied namespace ramblings =
		+	== The Script ==
		+	This script should be symlinked from /etc/vservers/<name>/scripts/(initialiaze,prepre-start...).d .
		+	<PRE>
		+	function createMacVidId() {
		+	(
		+	printf "02"
		+	printf "%04x" $1 # I usually use VID
		+	printf "%04x" $S_CONTEXT
		+	printf "%02x" $2 # IFACE number f.i.
		+	)\|
		+	sed 's/\(..\)\(..\)\(..\)\(..\)\(..\)\(..\)/\1:\2:\3:\4:\5:\6/'
		+	}
		+	function usesipnetns() {
		+	local netspace
		+	if [ -s "$VSERVER_DIR/spaces/net" ]
		+	then
		+	read netspace < "$VSERVER_DIR/spaces/net"
		+	[ "$netspace" = "$VSERVER_NAME" ]
		+	return $?
		+	fi
		+	return 1
		+	}
		+	case "${1}" in
		+	initialize)
		+	if usesipnetns
		+	then
		+	_HIP="$_IP"
		+	_IP="$_HIP netns exec ${2} $_HIP"
		+	$_HIP netns add ${2}
		+	$_IP link set dev lo up
		+	fi
		+	;;
		+	prepre-start)
		+	if usesipnetns
		+	then
		+	$_HIP link add link eth0 name fw-vlan2 type vlan id 2
		+	$_HIP link set dev fw-vlan2 address $(createMacVidId 2 0)
		+	$_HIP link set dev fw-vlan2 netns ${2}
		+	fi
		+	;;
		+	# By now all options are generated, time to override them
		+	pre-start)
		+	# NICE_CMD=(/sbin/ip netns exec ${2} "${NICE_CMD[@]}")
		+	if usesipnetns
		+	then
		+	local index
		+	local NEWVSPACE_CMDS
		+	declare -a NEWVSPACE_CMDS
		+	index=0;
		+
		+	while [ $index -lt ${#VSPACE_SHARED_CMD[@]} ]
		+	do
		+	if
		+	[ "${VSPACE_SHARED_CMD[$((${index}+0))]}" = "$_VSPACE" ] &&
		+	[ "${VSPACE_SHARED_CMD[$((${index}+1))]}" = "--enter" ] &&
		+	[ "${VSPACE_SHARED_CMD[$((${index}+2))]}" = "${2}" ] &&
		+	[ "${VSPACE_SHARED_CMD[$((${index}+3))]}" = "--net" ]
		+	then
		+	NEWSPACE_CMDS=("${NEWSPACE_CMDS[@]}" $_HIP netns exec "$2")
		+	index=$(($index+5))
		+	else
		+	NEWSPACE_CMDS=("${NEWSPACE_CMDS[@]}" "${VSPACE_SHARED_CMD[$index]}")
		+	index=$(($index+1))
		+	fi
		+	done
		+	VSPACE_SHARED_CMD=("${NEWSPACE_CMDS[@]}")
		+	unset NEWVSPACE_CMDS
		+	unset index
		+	fi
		+	;;
		+	post-start)
		+	;;
		+	pre-stop)
		+	if usesipnetns
		+	then
		+	_HIP=_IP
		+	_IP="$_HIP netns exec ${2} $_HIP"
		+	$_HIP netns add ${2}
		+	$_IP link set dev lo up
		+	fi
		+	;;
		+	post-stop)
		+	$_IP link del fw-vlan2
		+	$_HIP netns delete ${2}
		+	;;
		+	esac
		+	</PRE>
		+	== Explanation ==
		+	The script uses a configuration fault (e.g: <vserver>/spaces/net contains it's
		+	own name) to indicate that the script should create the network namespace. You
		+	are then expected to create and give the interfaces in the prepre-start section.
		+	Standard util-vserver functionality can configure those interfaces by prefixing
		+	$_IP with the vspace or ip netns prefix.
		+	This way, the interfaces are UP and RUNNING before the vserver itself starts,
		+	hence making it ideal for f.i. DHCP servers on dedicated vlans.
		+
		+	== future ==
		+	I will add functionality to allow shared network namespaces. It's not that hard.

← Older revision		Revision as of 13:37, 26 December 2012
Line 71:		Line 71:
	ip link set address ${MACADDRC} dev ${CLIENTDEV}		ip link set address ${MACADDRC} dev ${CLIENTDEV}
	</PRE>		</PRE>
		+	== ip to vserver ==
		+	Turned around, could we create a namespace and use it in vserver? We can then prepare interfaces in the namespace before starting the vserver.
		+	If it works, it should go like this:
		+	<PRE>
		+	ip netns add $VSERVER
		+	ip netns exec $VSERVER vserver $VSERVER start
		+	</PRE>
		+	== interface management ==
		+	Any vserver with a seperate network namespace should have it's lo brought up (in that namespace).
		+	Any link configuration should be done within that namespace. Util-vserver needs some patches for that.

@@ Line 55: / Line 55: @@
 Remember though: all interfaces need valid mac-addresses, especially when going to the outside.
-I use this complex script to generate a pair of static mac-addresses:
+I use this complex script to generate a pair of static mac-addresses for a veth:
 <PRE>
 stringasmac() {
@@ Line 64: / Line 64: @@
 MACADDRC=$(stringasmac 02${MACSTRING}00)
 MACADDRH=$(stringasmac 02${MACSTRING}01)
 </PRE>