1#!/bin/sh 2#- 3# Copyright (c) 2016 Devin Teske 4# All rights reserved. 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26# 27# 28############################################################ IDENT(1) 29# 30# $Title: netgraph(4) management script for vnet jails $ 31# 32############################################################ INFORMATION 33# 34# Use this tool with jail.conf(5) (or rc.conf(5) ``legacy'' configuration) to 35# manage `vnet' interfaces for jails. Designed to automate the creation of vnet 36# interface(s) during jail `prestart' and destroy said interface(s) during jail 37# `poststop'. 38# 39# In jail.conf(5) format: 40# 41# ### BEGIN EXCERPT ### 42# 43# xxx { 44# host.hostname = "xxx.yyy"; 45# path = "/vm/xxx"; 46# 47# # 48# # NB: Below 2-lines required 49# # NB: The number of ngN_xxx interfaces should match the number of 50# # arguments given to `jng bridge xxx' in exec.prestart value. 51# # 52# vnet; 53# vnet.interface = ng0_xxx, ng1_xxx, ...; 54# 55# exec.clean; 56# exec.system_user = "root"; 57# exec.jail_user = "root"; 58# 59# # 60# # NB: Below 2-lines required 61# # NB: The number of arguments after `jng bridge xxx' should match 62# # the number of ngN_xxx arguments in vnet.interface value. 63# # 64# exec.prestart += "jng bridge xxx em0 em1 ..."; 65# exec.poststop += "jng shutdown xxx"; 66# 67# # Standard recipe 68# exec.start += "/bin/sh /etc/rc"; 69# exec.stop = "/bin/sh /etc/rc.shutdown jail"; 70# exec.consolelog = "/var/log/jail_xxx_console.log"; 71# mount.devfs; 72# 73# # Optional (default off) 74# #allow.mount; 75# #allow.set_hostname = 1; 76# #allow.sysvipc = 1; 77# #devfs_ruleset = "11"; # rule to unhide bpf for DHCP 78# } 79# 80# ### END EXCERPT ### 81# 82# In rc.conf(5) ``legacy'' format (used when /etc/jail.conf does not exist): 83# 84# ### BEGIN EXCERPT ### 85# 86# jail_enable="YES" 87# jail_list="xxx" 88# 89# # 90# # Global presets for all jails 91# # 92# jail_devfs_enable="YES" # mount devfs 93# 94# # 95# # Global options (default off) 96# # 97# #jail_mount_enable="YES" # mount /etc/fstab.{name} 98# #jail_set_hostname_allow="YES" # Allow hostname to change 99# #jail_sysvipc_allow="YES" # Allow SysV Interprocess Comm. 100# 101# # xxx 102# jail_xxx_hostname="xxx.shxd.cx" # hostname 103# jail_xxx_rootdir="/vm/xxx" # root directory 104# jail_xxx_vnet_interfaces="ng0_xxx ng1xxx ..." # vnet interface(s) 105# jail_xxx_exec_prestart0="jng bridge xxx em0 em1 ..." # bridge interface(s) 106# jail_xxx_exec_poststop0="jng shutdown xxx" # destroy interface(s) 107# #jail_xxx_mount_enable="YES" # mount /etc/fstab.xxx 108# #jail_xxx_devfs_ruleset="11" # rule to unhide bpf for DHCP 109# 110# ### END EXCERPT ### 111# 112# Note that the legacy rc.conf(5) format is converted to 113# /var/run/jail.{name}.conf by /etc/rc.d/jail if jail.conf(5) is missing. 114# 115# ASIDE: dhclient(8) inside a vnet jail... 116# 117# To allow dhclient(8) to work inside a vnet jail, make sure the following 118# appears in /etc/devfs.rules (which should be created if it doesn't exist): 119# 120# [devfsrules_jail=11] 121# add include $devfsrules_hide_all 122# add include $devfsrules_unhide_basic 123# add include $devfsrules_unhide_login 124# add path 'bpf*' unhide 125# 126# And set ether devfs.ruleset="11" (jail.conf(5)) or 127# jail_{name}_devfs_ruleset="11" (rc.conf(5)). 128# 129# NB: While this tool can't create every type of desirable topology, it should 130# handle most setups, minus some which considered exotic or purpose-built. 131# 132############################################################ GLOBALS 133 134pgm="${0##*/}" # Program basename 135 136# 137# Global exit status 138# 139SUCCESS=0 140FAILURE=1 141 142############################################################ FUNCTIONS 143 144usage() 145{ 146 local action usage descr 147 exec >&2 148 echo "Usage: $pgm action [arguments]" 149 echo "Actions:" 150 for action in \ 151 bridge \ 152 graph \ 153 show \ 154 show1 \ 155 shutdown \ 156 stats \ 157 ; do 158 eval usage=\"\$jng_${action}_usage\" 159 [ "$usage" ] || continue 160 eval descr=\"\$jng_${action}_descr\" 161 printf "\t%s\n\t\t%s\n" "$usage" "$descr" 162 done 163 exit $FAILURE 164} 165 166action_usage() 167{ 168 local usage descr action="$1" 169 eval usage=\"\$jng_${action}_usage\" 170 echo "Usage: $pgm $usage" >&2 171 eval descr=\"\$jng_${action}_descr\" 172 printf "\t%s\n" "$descr" 173 exit $FAILURE 174} 175 176derive_mac() 177{ 178 local OPTIND=1 OPTARG __flag 179 local __mac_num= __make_pair= 180 while getopts 2n: __flag; do 181 case "$__flag" in 182 2) __make_pair=1 ;; 183 n) __mac_num=${OPTARG%%[^0-9]*} ;; 184 esac 185 done 186 shift $(( $OPTIND - 1 )) 187 188 if [ ! "$__mac_num" ]; then 189 eval __mac_num=\${_${iface}_num:--1} 190 __mac_num=$(( $__mac_num + 1 )) 191 eval _${iface}_num=\$__mac_num 192 fi 193 194 local __iface="$1" __name="$2" __var_to_set="$3" __var_to_set_b="$4" 195 local __iface_devid __new_devid __num __new_devid_b 196 # 197 # Calculate MAC address derived from given iface. 198 # 199 # The formula I'm using is ``NP:SS:SS:II:II:II'' where: 200 # + N denotes 4 bits used as a counter to support branching 201 # each parent interface up to 15 times under the same jail 202 # name (see S below). 203 # + P denotes the special nibble whose value, if one of 204 # 2, 6, A, or E (but usually 2) denotes a privately 205 # administered MAC address (while remaining routable). 206 # + S denotes 16 bits, the sum(1) value of the jail name. 207 # + I denotes bits that are inherited from parent interface. 208 # 209 # The S bits are a CRC-16 checksum of NAME, allowing the jail 210 # to change link numbers in ng_bridge(4) without affecting the 211 # MAC address. Meanwhile, if... 212 # + the jail NAME changes (e.g., it was duplicated and given 213 # a new name with no other changes) 214 # + the underlying network interface changes 215 # + the jail is moved to another host 216 # the MAC address will be recalculated to a new, similarly 217 # unique value preventing conflict. 218 # 219 __iface_devid=$( ifconfig $__iface ether | awk '/ether/,$0=$2' ) 220 # ??:??:??:II:II:II 221 __new_devid=${__iface_devid#??:??:??} # => :II:II:II 222 # => :SS:SS:II:II:II 223 __num=$( set -- `echo -n "$__name" | sum` && echo $1 ) 224 __new_devid=$( printf :%02x:%02x \ 225 $(( $__num >> 8 & 255 )) $(( $__num & 255 )) )$__new_devid 226 # => P:SS:SS:II:II:II 227 case "$__iface_devid" in 228 ?2:*) __new_devid=a$__new_devid __new_devid_b=e$__new_devid ;; 229 ?[Ee]:*) __new_devid=2$__new_devid __new_devid_b=6$__new_devid ;; 230 *) __new_devid=2$__new_devid __new_devid_b=e$__new_devid 231 esac 232 # => NP:SS:SS:II:II:II 233 __new_devid=$( printf %x $(( $__mac_num & 15 )) )$__new_devid 234 __new_devid_b=$( printf %x $(( $__mac_num & 15 )) )$__new_devid_b 235 236 # 237 # Return derivative MAC address(es) 238 # 239 if [ "$__make_pair" ]; then 240 if [ "$__var_to_set" -a "$__var_to_set_b" ]; then 241 eval $__var_to_set=\$__new_devid 242 eval $__var_to_set_b=\$__new_devid_b 243 else 244 echo $__new_devid $__new_devid_b 245 fi 246 else 247 if [ "$__var_to_set" ]; then 248 eval $__var_to_set=\$__new_devid 249 else 250 echo $__new_devid 251 fi 252 fi 253} 254 255mustberoot_to_continue() 256{ 257 if [ "$( id -u )" -ne 0 ]; then 258 echo "Must run as root!" >&2 259 exit $FAILURE 260 fi 261} 262 263jng_bridge_usage="bridge [-b BRIDGE_NAME] NAME [!|=]iface0 [[!|=]iface1 ...]" 264jng_bridge_descr="Create ng0_NAME [ng1_NAME ...]" 265jng_bridge() 266{ 267 local OPTIND=1 OPTARG flag bridge=bridge 268 while getopts b: flag; do 269 case "$flag" in 270 b) bridge="$OPTARG" 271 [ "$bridge" ] || action_usage bridge ;; # NOTREACHED 272 *) action_usage bridge # NOTREACHED 273 esac 274 done 275 shift $(( $OPTIND - 1 )) 276 277 local name="$1" 278 [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -gt 1 ] || 279 action_usage bridge # NOTREACHED 280 shift 1 # name 281 282 mustberoot_to_continue 283 284 local iface parent eiface eiface_devid 285 local new clone_mac no_derive num quad i=0 286 for iface in $*; do 287 288 clone_mac= 289 no_derive= 290 case "$iface" in 291 =*) iface=${iface#=} clone_mac=1 ;; 292 !*) iface=${iface#!} no_derive=1 ;; 293 esac 294 295 # Make sure the interface doesn't exist already 296 eiface=ng${i}_$name 297 if ngctl msg "$eiface:" getifname > /dev/null 2>&1; then 298 i=$(( $i + 1 )) 299 continue 300 fi 301 302 # Bring the interface up 303 ifconfig $iface up || return 304 305 # Set promiscuous mode and don't overwrite src addr 306 ngctl msg $iface: setpromisc 1 || return 307 ngctl msg $iface: setautosrc 0 || return 308 309 # Make sure the interface has been bridged 310 if ! ngctl info ${iface}bridge: > /dev/null 2>&1; then 311 ngctl mkpeer $iface: bridge lower link0 || return 312 ngctl connect $iface: $iface:lower upper link1 || 313 return 314 ngctl name $iface:lower ${iface}bridge || return 315 fi 316 317 # Optionally create a secondary bridge 318 if [ "$bridge" != "bridge" ] && 319 ! ngctl info "$iface$bridge:" > /dev/null 2>&1 320 then 321 num=2 322 while ngctl msg ${iface}bridge: getstats $num \ 323 > /dev/null 2>&1 324 do 325 num=$(( $num + 1 )) 326 done 327 ngctl mkpeer $iface:lower bridge link$num link1 || 328 return 329 ngctl name ${iface}bridge:link$num "$iface$bridge" || 330 return 331 fi 332 333 # Create a new interface to the bridge 334 num=2 335 while ngctl msg "$iface$bridge:" getstats $num > /dev/null 2>&1 336 do 337 num=$(( $num + 1 )) 338 done 339 ngctl mkpeer "$iface$bridge:" eiface link$num ether || return 340 341 # Rename the new interface 342 while [ ${#eiface} -gt 15 ]; do # OS limitation 343 eiface=${eiface%?} 344 done 345 new=$( set -- `ngctl show -n "$iface$bridge:link$num"` && 346 echo $2 ) || return 347 ngctl name "$iface$bridge:link$num" $eiface || return 348 ifconfig $new name $eiface || return 349 ifconfig $eiface up || return 350 351 # 352 # Set the MAC address of the new interface using a sensible 353 # algorithm to prevent conflicts on the network. 354 # 355 eiface_devid= 356 if [ "$clone_mac" ]; then 357 eiface_devid=$( ifconfig $iface ether | 358 awk '/ether/,$0=$2' ) 359 elif [ ! "$no_derive" ]; then 360 derive_mac $iface "$name" eiface_devid 361 fi 362 [ "$eiface_devid" ] && 363 ifconfig $eiface ether $eiface_devid > /dev/null 2>&1 364 365 i=$(( $i + 1 )) 366 done # for iface 367} 368 369jng_graph_usage="graph [-f] [-T type] [-o output]" 370jng_graph_descr="Generate network graph (default output is \`jng.svg')" 371jng_graph() 372{ 373 local OPTIND=1 OPTARG flag 374 local output=jng.svg output_type= force= 375 while getopts fo:T: flag; do 376 case "$flag" in 377 f) force=1 ;; 378 o) output="$OPTARG" ;; 379 T) output_type="$OPTARG" ;; 380 *) action_usage graph # NOTREACHED 381 esac 382 done 383 shift $(( $OPTIND - 1 )) 384 [ $# -eq 0 -a "$output" ] || action_usage graph # NOTREACHED 385 mustberoot_to_continue 386 if [ -e "$output" -a ! "$force" ]; then 387 echo "$output: Already exists (use \`-f' to overwrite)" >&2 388 return $FAILURE 389 fi 390 if [ ! "$output_type" ]; then 391 local valid suffix 392 valid=$( dot -Txxx 2>&1 ) 393 for suffix in ${valid##*:}; do 394 [ "$output" != "${output%.$suffix}" ] || continue 395 output_type=$suffix 396 break 397 done 398 fi 399 ngctl dot | dot ${output_type:+-T "$output_type"} -o "$output" 400} 401 402jng_show_usage="show" 403jng_show_descr="List possible NAME values for \`show NAME'" 404jng_show1_usage="show NAME" 405jng_show1_descr="Lists ng0_NAME [ng1_NAME ...]" 406jng_show2_usage="show [NAME]" 407jng_show() 408{ 409 local OPTIND=1 OPTARG flag 410 while getopts "" flag; do 411 case "$flag" in 412 *) action_usage show2 # NOTREACHED 413 esac 414 done 415 shift $(( $OPTIND - 1 )) 416 mustberoot_to_continue 417 if [ $# -eq 0 ]; then 418 ngctl ls | awk '$4=="bridge",$0=$2' | 419 xargs -rn1 -Ibridge ngctl show bridge: | 420 awk 'sub(/^ng[[:digit:]]+_/, "", $2), $0 = $2' | 421 sort -u 422 return 423 fi 424 ngctl ls | awk -v name="$1" ' 425 match($2, /^ng[[:digit:]]+_/) && 426 substr($2, RSTART + RLENGTH) == name && 427 $4 == "eiface", $0 = $2 428 ' | sort 429} 430 431jng_shutdown_usage="shutdown NAME" 432jng_shutdown_descr="Shutdown ng0_NAME [ng1_NAME ...]" 433jng_shutdown() 434{ 435 local OPTIND=1 OPTARG flag 436 while getopts "" flag; do 437 case "$flag" in 438 *) action_usage shutdown # NOTREACHED 439 esac 440 done 441 shift $(( $OPTIND -1 )) 442 local name="$1" 443 [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -eq 1 ] || 444 action_usage shutdown # NOTREACHED 445 mustberoot_to_continue 446 jng_show "$name" | xargs -rn1 -I eiface ngctl shutdown eiface: 447} 448 449jng_stats_usage="stats NAME" 450jng_stats_descr="Show ng_bridge link statistics for NAME interfaces" 451jng_stats() 452{ 453 local OPTIND=1 OPTARG flag 454 while getopts "" flag; do 455 case "$flag" in 456 *) action_usage stats # NOTREACHED 457 esac 458 done 459 shift $(( $OPTIND -1 )) 460 local name="$1" 461 [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -eq 1 ] || 462 action_usage stats # NOTREACHED 463 mustberoot_to_continue 464 for eiface in $( jng_show "$name" ); do 465 echo "$eiface:" 466 ngctl show $eiface: | awk ' 467 $3 == "bridge" && $5 ~ /^link/ { 468 bridge = $2 469 link = substr($5, 5) 470 system(sprintf("ngctl msg %s: getstats %u", 471 bridge, link)) 472 }' | fmt 2 | awk ' 473 /=/ && fl = index($0, "=") { 474 printf "%20s = %s\n", 475 substr($0, 0, fl-1), 476 substr($0, 0, fl+1) 477 } 478 ' # END-QUOTE 479 done 480} 481 482############################################################ MAIN 483 484# 485# Command-line arguments 486# 487action="$1" 488[ "$action" ] || usage # NOTREACHED 489 490# 491# Validate action argument 492# 493if [ "$BASH_VERSION" ]; then 494 type="$( type -t "jng_$action" )" || usage # NOTREACHED 495else 496 type="$( type "jng_$action" 2> /dev/null )" || usage # NOTREACHED 497fi 498case "$type" in 499*function) 500 shift 1 # action 501 eval "jng_$action" \"\$@\" 502 ;; 503*) usage # NOTREACHED 504esac 505 506################################################################################ 507# END 508################################################################################ 509
