1#!/bin/sh 2#- 3# Copyright (c) 2016 Devin Teske 4# All rights reserved. 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26# 27# $FreeBSD$ 28# 29############################################################ IDENT(1) 30# 31# $Title: netgraph(4) management script for vnet jails $ 32# 33############################################################ INFORMATION 34# 35# Use this tool with jail.conf(5) (or rc.conf(5) ``legacy'' configuration) to 36# manage `vnet' interfaces for jails. Designed to automate the creation of vnet 37# interface(s) during jail `prestart' and destroy said interface(s) during jail 38# `poststop'. 39# 40# In jail.conf(5) format: 41# 42# ### BEGIN EXCERPT ### 43# 44# xxx { 45# host.hostname = "xxx.yyy"; 46# path = "/vm/xxx"; 47# 48# # 49# # NB: Below 2-lines required 50# # NB: The number of ngN_xxx interfaces should match the number of 51# # arguments given to `jng bridge xxx' in exec.prestart value. 52# # 53# vnet; 54# vnet.interface = "ng0_xxx ng1_xxx ..."; 55# 56# exec.clean; 57# exec.system_user = "root"; 58# exec.jail_user = "root"; 59# 60# # 61# # NB: Below 2-lines required 62# # NB: The number of arguments after `jng bridge xxx' should match 63# # the number of ngN_xxx arguments in vnet.interface value. 64# # 65# exec.prestart += "jng bridge xxx em0 em1 ..."; 66# exec.poststop += "jng shutdown xxx"; 67# 68# # Standard recipe 69# exec.start += "/bin/sh /etc/rc"; 70# exec.stop = "/bin/sh /etc/rc.shutdown"; 71# exec.consolelog = "/var/log/jail_xxx_console.log"; 72# mount.devfs; 73# 74# # Optional (default off) 75# #allow.mount; 76# #allow.set_hostname = 1; 77# #allow.sysvipc = 1; 78# #devfs_ruleset = "11"; # rule to unhide bpf for DHCP 79# } 80# 81# ### END EXCERPT ### 82# 83# In rc.conf(5) ``legacy'' format (used when /etc/jail.conf does not exist): 84# 85# ### BEGIN EXCERPT ### 86# 87# jail_enable="YES" 88# jail_list="xxx" 89# 90# # 91# # Global presets for all jails 92# # 93# jail_devfs_enable="YES" # mount devfs 94# 95# # 96# # Global options (default off) 97# # 98# #jail_mount_enable="YES" # mount /etc/fstab.{name} 99# #jail_set_hostname_allow="YES" # Allow hostname to change 100# #jail_sysvipc_allow="YES" # Allow SysV Interprocess Comm. 101# 102# # xxx 103# jail_xxx_hostname="xxx.shxd.cx" # hostname 104# jail_xxx_rootdir="/vm/xxx" # root directory 105# jail_xxx_vnet_interfaces="ng0_xxx ng1xxx ..." # vnet interface(s) 106# jail_xxx_exec_prestart0="jng bridge xxx em0 em1 ..." # bridge interface(s) 107# jail_xxx_exec_poststop0="jng shutdown xxx" # destroy interface(s) 108# #jail_xxx_mount_enable="YES" # mount /etc/fstab.xxx 109# #jail_xxx_devfs_ruleset="11" # rule to unhide bpf for DHCP 110# 111# ### END EXCERPT ### 112# 113# Note that the legacy rc.conf(5) format is converted to 114# /var/run/jail.{name}.conf by /etc/rc.d/jail if jail.conf(5) is missing. 115# 116# ASIDE: dhclient(8) inside a vnet jail... 117# 118# To allow dhclient(8) to work inside a vnet jail, make sure the following 119# appears in /etc/devfs.rules (which should be created if it doesn't exist): 120# 121# [devfsrules_jail=11] 122# add include $devfsrules_hide_all 123# add include $devfsrules_unhide_basic 124# add include $devfsrules_unhide_login 125# add path 'bpf*' unhide 126# 127# And set ether devfs.ruleset="11" (jail.conf(5)) or 128# jail_{name}_devfs_ruleset="11" (rc.conf(5)). 129# 130# NB: While this tool can't create every type of desirable topology, it should 131# handle most setups, minus some which considered exotic or purpose-built. 132# 133############################################################ GLOBALS 134 135pgm="${0##*/}" # Program basename 136 137# 138# Global exit status 139# 140SUCCESS=0 141FAILURE=1 142 143############################################################ FUNCTIONS 144 145usage() 146{ 147 local action usage descr 148 exec >&2 149 echo "Usage: $pgm action [arguments]" 150 echo "Actions:" 151 for action in \ 152 bridge \ 153 graph \ 154 show \ 155 show1 \ 156 shutdown \ 157 stats \ 158 ; do 159 eval usage=\"\$jng_${action}_usage\" 160 [ "$usage" ] || continue 161 eval descr=\"\$jng_${action}_descr\" 162 printf "\t%s\n\t\t%s\n" "$usage" "$descr" 163 done 164 exit $FAILURE 165} 166 167action_usage() 168{ 169 local usage action="$1" 170 eval usage=\"\$jng_${action}_usage\" 171 echo "Usage: $pgm $usage" >&2 172 exit $FAILURE 173} 174 175derive_mac() 176{ 177 local OPTIND=1 OPTARG __flag 178 local __mac_num= __make_pair= 179 while getopts 2n: __flag; do 180 case "$__flag" in 181 2) __make_pair=1 ;; 182 n) __mac_num=${OPTARG%%[^0-9]*} ;; 183 esac 184 done 185 shift $(( $OPTIND - 1 )) 186 187 if [ ! "$__mac_num" ]; then 188 eval __mac_num=\${_${iface}_num:--1} 189 __mac_num=$(( $__mac_num + 1 )) 190 eval _${iface}_num=\$__mac_num 191 fi 192 193 local __iface="$1" __name="$2" __var_to_set="$3" __var_to_set_b="$4" 194 local __iface_devid __new_devid __num __new_devid_b 195 # 196 # Calculate MAC address derived from given iface. 197 # 198 # The formula I'm using is ``NP:SS:SS:II:II:II'' where: 199 # + N denotes 4 bits used as a counter to support branching 200 # each parent interface up to 15 times under the same jail 201 # name (see S below). 202 # + P denotes the special nibble whose value, if one of 203 # 2, 6, A, or E (but usually 2) denotes a privately 204 # administered MAC address (while remaining routable). 205 # + S denotes 16 bits, the sum(1) value of the jail name. 206 # + I denotes bits that are inherited from parent interface. 207 # 208 # The S bits are a CRC-16 checksum of NAME, allowing the jail 209 # to change link numbers in ng_bridge(4) without affecting the 210 # MAC address. Meanwhile, if... 211 # + the jail NAME changes (e.g., it was duplicated and given 212 # a new name with no other changes) 213 # + the underlying network interface changes 214 # + the jail is moved to another host 215 # the MAC address will be recalculated to a new, similarly 216 # unique value preventing conflict. 217 # 218 __iface_devid=$( ifconfig $__iface ether | awk '/ether/,$0=$2' ) 219 __new_devid=${__iface_devid#??:??:??} 220 # :II:II:II => S:II:II:II 221 __num=$( set -- `echo -n "$__name" | sum` && echo $1 ) 222 __new_devid=$( printf %x $(( $__num & 15 )) )$__new_devid 223 # S:II:II:II => :SS:II:II:II 224 __num=$(( $__num >> 4 )) 225 __new_devid=:$( printf %x $(( $__num & 15 )) )$__new_devid 226 # :SS:II:II:II => S:SS:II:II:II 227 __num=$(( $__num >> 4 )) 228 __new_devid=$( printf %x $(( $__num & 15 )) )$__new_devid 229 # S:SS:II:II:II => :SS:SS:II:II:II 230 __new_devid=:$( printf %x $(( $__num & 15 )) )$__new_devid 231 # :SS:SS:II:II:II => P:SS:SS:II:II:II 232 case "$__iface_devid" in 233 ?2:*) __new_devid=a$__new_devid __new_devid_b=e$__new_devid ;; 234 ?[Ee]:*) __new_devid=2$__new_devid __new_devid_b=6$__new_devid ;; 235 *) __new_devid=2$__new_devid __new_devid_b=e$__new_devid 236 esac 237 # P:SS:SS:II:II:II => NP:SS:SS:II:II:II 238 __new_devid=$( printf %x $(( $__mac_num & 15 )) )$__new_devid 239 __new_devid_b=$( printf %x $(( $__mac_num & 15 )) )$__new_devid_b 240 241 # 242 # Return derivative MAC address(es) 243 # 244 if [ "$__make_pair" ]; then 245 if [ "$__var_to_set" -a "$__var_to_set_b" ]; then 246 eval $__var_to_set=\$__new_devid 247 eval $__var_to_set_b=\$__new_devid_b 248 else 249 echo $__new_devid $__new_devid_b 250 fi 251 else 252 if [ "$__var_to_set" ]; then 253 eval $__var_to_set=\$__new_devid 254 else 255 echo $__new_devid 256 fi 257 fi 258} 259 260mustberoot_to_continue() 261{ 262 if [ "$( id -u )" -ne 0 ]; then 263 echo "Must run as root!" >&2 264 exit $FAILURE 265 fi 266} 267 268jng_bridge_usage="bridge [-b BRIDGE_NAME] NAME [=]iface0 [[=]iface1 ...]" 269jng_bridge_descr="Create ng0_NAME [ng1_NAME ...]" 270jng_bridge() 271{ 272 local OPTIND=1 OPTARG flag bridge=bridge 273 while getopts b: flag; do 274 case "$flag" in 275 b) bridge="$OPTARG" 276 [ "$bridge" ] || action_usage bridge ;; # NOTREACHED 277 *) action_usage bridge # NOTREACHED 278 esac 279 done 280 shift $(( $OPTIND - 1 )) 281 282 local name="$1" 283 [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -gt 1 ] || 284 action_usage bridge # NOTREACHED 285 shift 1 # name 286 287 mustberoot_to_continue 288 289 local iface parent eiface eiface_devid 290 local new clone_mac num quad i=0 291 for iface in $*; do 292 293 clone_mac= 294 case "$iface" in 295 =*) iface=${iface#=} clone_mac=1 ;; 296 esac 297 298 # 0. Make sure the interface doesn't exist already 299 eiface=ng${i}_$name 300 ngctl msg "$eiface:" getifname > /dev/null 2>&1 && continue 301 302 # 1. Bring the interface up 303 ifconfig $iface up || return 304 305 # 2. Set promiscuous mode and don't overwrite src addr 306 ngctl msg $iface: setpromisc 1 || return 307 ngctl msg $iface: setautosrc 0 || return 308 309 # 3. Make sure the interface has been bridged 310 if ! ngctl info ${iface}bridge: > /dev/null 2>&1; then 311 ngctl mkpeer $iface: bridge lower link0 || return 312 ngctl connect $iface: $iface:lower upper link1 || 313 return 314 ngctl name $iface:lower ${iface}bridge || return 315 fi 316 317 # 3.5. Optionally create a secondary bridge 318 if [ "$bridge" != "bridge" ] && 319 ! ngctl info "$iface$bridge:" > /dev/null 2>&1 320 then 321 num=2 322 while ngctl msg ${iface}bridge: getstats $num \ 323 > /dev/null 2>&1 324 do 325 num=$(( $num + 1 )) 326 done 327 ngctl mkpeer $iface:lower bridge link$num link1 || 328 return 329 ngctl name ${iface}bridge:link$num "$iface$bridge" || 330 return 331 fi 332 333 # 4. Create a new interface to the bridge 334 num=2 335 while ngctl msg "$iface$bridge:" getstats $num > /dev/null 2>&1 336 do 337 num=$(( $num + 1 )) 338 done 339 ngctl mkpeer "$iface$bridge:" eiface link$num ether || return 340 341 # 5. Rename the new interface 342 while [ ${#eiface} -gt 15 ]; do # OS limitation 343 eiface=${eiface%?} 344 done 345 new=$( set -- `ngctl show -n "$iface$bridge:link$num"` && 346 echo $2 ) || return 347 ngctl name "$iface$bridge:link$num" $eiface || return 348 ifconfig $new name $eiface || return 349 ifconfig $eiface up || return 350 351 # 352 # 6. Set the MAC address of the new interface using a sensible 353 # algorithm to prevent conflicts on the network. 354 # 355 case "$iface" in 356 wlan[0-9]*) 357 parent=$( sysctl -n net.wlan.${iface#wlan}.%parent ) 358 case "$parent" in 359 iwn[0-9]*) 360 # iwn(4) supports only 1 virtual net at a time 361 # NB: Cloning MAC allows new interface to work 362 clone_mac=1 ;; 363 esac 364 esac 365 if [ "$clone_mac" ]; then 366 eiface_devid=$( 367 ifconfig $iface ether | awk '/ether/,$0=$2' 368 ) 369 else 370 derive_mac $iface "$name" eiface_devid 371 fi 372 ifconfig $eiface ether $eiface_devid 373 374 i=$(( $i + 1 )) # on to next ng{i}_name 375 done # for iface 376} 377 378jng_graph_usage="graph [-f] [-T type] [-o output]" 379jng_graph_descr="Generate network graph (default output is \`jng.svg')" 380jng_graph() 381{ 382 local OPTIND=1 OPTARG flag 383 local output=jng.svg output_type= force= 384 while getopts fo:T: flag; do 385 case "$flag" in 386 f) force=1 ;; 387 o) output="$OPTARG" ;; 388 T) output_type="$OPTARG" ;; 389 *) action_usage graph # NOTREACHED 390 esac 391 done 392 shift $(( $OPTIND - 1 )) 393 [ $# -eq 0 -a "$output" ] || action_usage graph # NOTREACHED 394 mustberoot_to_continue 395 if [ -e "$output" -a ! "$force" ]; then 396 echo "$output: Already exists (use \`-f' to overwrite)" >&2 397 return $FAILURE 398 fi 399 if [ ! "$output_type" ]; then 400 local valid suffix 401 valid=$( dot -Txxx 2>&1 ) 402 for suffix in ${valid##*:}; do 403 [ "$output" != "${output%.$suffix}" ] || continue 404 output_type=$suffix 405 break 406 done 407 fi 408 ngctl dot | dot ${output_type:+-T "$output_type"} -o "$output" 409} 410 411jng_show_usage="show" 412jng_show_descr="List possible NAME values for \`show NAME'" 413jng_show1_usage="show NAME" 414jng_show1_descr="Lists ng0_NAME [ng1_NAME ...]" 415jng_show2_usage="show [NAME]" 416jng_show() 417{ 418 local OPTIND=1 OPTARG flag 419 while getopts "" flag; do 420 case "$flag" in 421 *) action_usage show2 # NOTREACHED 422 esac 423 done 424 shift $(( $OPTIND - 1 )) 425 mustberoot_to_continue 426 if [ $# -eq 0 ]; then 427 ngctl ls | awk '$4=="bridge",$0=$2' | 428 xargs -rn1 -Ibridge ngctl show bridge: | 429 awk 'sub(/^ng[[:digit:]]+_/, "", $2), $0 = $2' | 430 sort -u 431 return 432 fi 433 ngctl ls | awk -v name="$1" ' 434 match($2, /^ng[[:digit:]]+_/) && 435 substr($2, RSTART + RLENGTH) == name && 436 $4 == "eiface", $0 = $2 437 ' | sort 438} 439 440jng_shutdown_usage="shutdown NAME" 441jng_shutdown_descr="Shutdown ng0_NAME [ng1_NAME ...]" 442jng_shutdown() 443{ 444 local OPTIND=1 OPTARG flag 445 while getopts "" flag; do 446 case "$flag" in 447 *) action_usage shutdown # NOTREACHED 448 esac 449 done 450 shift $(( $OPTIND -1 )) 451 local name="$1" 452 [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -eq 1 ] || 453 action_usage shutdown # NOTREACHED 454 mustberoot_to_continue 455 jng_show "$name" | xargs -rn1 -I eiface ngctl shutdown eiface: 456} 457 458jng_stats_usage="stats NAME" 459jng_stats_descr="Show ng_bridge link statistics for NAME interfaces" 460jng_stats() 461{ 462 local OPTIND=1 OPTARG flag 463 while getopts "" flag; do 464 case "$flag" in 465 *) action_usage stats # NOTREACHED 466 esac 467 done 468 shift $(( $OPTIND -1 )) 469 local name="$1" 470 [ "${name:-x}" = "${name#*[!0-9a-zA-Z_]}" -a $# -eq 1 ] || 471 action_usage stats # NOTREACHED 472 mustberoot_to_continue 473 for eiface in $( jng_show "$name" ); do 474 echo "$eiface:" 475 ngctl show $eiface: | awk ' 476 $3 == "bridge" && $5 ~ /^link/ { 477 bridge = $2 478 link = substr($5, 5) 479 system(sprintf("ngctl msg %s: getstats %u", 480 bridge, link)) 481 }' | fmt 2 | awk ' 482 /=/ && fl = index($0, "=") { 483 printf "%20s = %s\n", 484 substr($0, 0, fl-1), 485 substr($0, 0, fl+1) 486 } 487 ' # END-QUOTE 488 done 489} 490 491############################################################ MAIN 492 493# 494# Command-line arguments 495# 496action="$1" 497[ "$action" ] || usage # NOTREACHED 498 499# 500# Validate action argument 501# 502if [ "$BASH_VERSION" ]; then 503 type="$( type -t "jng_$action" )" || usage # NOTREACHED 504else 505 type="$( type "jng_$action" 2> /dev/null )" || usage # NOTREACHED 506fi 507case "$type" in 508*function) 509 shift 1 # action 510 eval "jng_$action" \"\$@\" 511 ;; 512*) usage # NOTREACHED 513esac 514 515################################################################################ 516# END 517################################################################################ 518
