├── LICENSE ├── README.md ├── if-down.d └── netns ├── if-pre-up.d └── netns └── if-up.d └── netns /LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2015 m0kct 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | 23 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # debian-netns 2 | 3 | Some simple scripts to simplify configuring network namespaces on 4 | Debian-like systems. Copy them into the corresponding directories under 5 | `/etc/network`. 6 | 7 | To configure a veth pair into a namespace: 8 | ``` 9 | auto ns0 10 | iface ns0 inet manual 11 | peer-netns myns 12 | peer-iface eth0 13 | ``` 14 | Running `ifup ns0` will then create the `myns` network namespace and a veth 15 | pair which joins `ns0` in the "real world" to `eth0` inside the namespace. 16 | 17 | There are two more things you can specify: 18 | ``` 19 | auto ns0 20 | iface ns0 inet manual 21 | peer-netns myns 22 | peer-iface eth0 23 | veth-mode l3 24 | configure-interfaces yes 25 | ``` 26 | `veth-mode l3` will configure the veth pair as a L3 point-to-point link 27 | (meaning that you can then add routes with the next-hop set to the 28 | interface, e.g., `ip route add 1.2.3.0/24 dev ns0`). 29 | 30 | `configure-interfaces yes` will run `ifup -a` (or `ifdown -a`) inside the 31 | `myns` namespace using interface config from `/etc/network/interfaces.myns`. 32 | 33 | ### Thoughts 34 | 35 | Ideally, the namespace interface config would be under 36 | `/etc/netns/myns/network/interfaces`, but thanks to this feature of `ip 37 | netns exec`: 38 | 39 | "ip netns exec automates handling of this configuration, file convention for 40 | network namespace unaware applications, by creating a mount namespace and 41 | bind mounting all of the per network namespace configure files into their 42 | traditional location in /etc." 43 | 44 | this means that when `ifup` runs, it won't see the `/etc/network/if-*.d` 45 | scripts (at least if they're not mirrored in `/etc/netns/myns`). 46 | 47 | It would be nice to have some better way to run `ifup` inside a namespace, 48 | but this would require hacking `ifupdown`. If you want to know how to run it 49 | by hand, look in `if-up.d/netns`. It's not as simple as you might think. 50 | 51 | -------------------------------------------------------------------------------- /if-down.d/netns: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | set -e 4 | 5 | if [ -n "${IF_PEER_NETNS}" -a -n "${IF_PEER_IFACE}" ] 6 | then 7 | # Take down the remote end of the veth 8 | ip netns exec ${IF_PEER_NETNS} ip link set ${IF_PEER_IFACE} down 9 | 10 | case "${IF_CONFIGURE_INTERFACES}" in 11 | true|yes|on) 12 | # Ifdown the interfaces inside the netns and inside 13 | # a mount namespace with /run/network.nsname mounted 14 | # on /run/network 15 | unshare -m /bin/sh <<-EOF 16 | mount --make-rprivate / 17 | mount --bind /run/network.${IF_PEER_NETNS} /run/network 18 | ip netns exec ${IF_PEER_NETNS} ifdown -i /etc/network/interfaces.${IF_PEER_NETNS} -a 19 | EOF 20 | ;; 21 | esac 22 | fi 23 | 24 | -------------------------------------------------------------------------------- /if-pre-up.d/netns: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | set -e 4 | 5 | if [ -n "${IF_PEER_NETNS}" -a -n "${IF_PEER_IFACE}" ] 6 | then 7 | # Create netns if it doesn't already exist, and bring up the loopback 8 | if ! (ip netns list | grep -qx ${IF_PEER_NETNS}) 9 | then 10 | mkdir -p /run/network.${IF_PEER_NETNS} 11 | rm -rf /run/network.${IF_PEER_NETNS}/* 12 | ip netns add ${IF_PEER_NETNS} 13 | ip netns exec ${IF_PEER_NETNS} ip link set lo up 14 | fi 15 | 16 | # Add the veth pair 17 | ip link add ${IFACE} type veth peer name ${IFACE}r 18 | 19 | # Put the remote end into the netns 20 | ip link set ${IFACE}r netns ${IF_PEER_NETNS} 21 | 22 | # Rename the remote end 23 | ip netns exec ${IF_PEER_NETNS} ip link set ${IFACE}r name ${IF_PEER_IFACE} 24 | 25 | case ${IF_VETH_MODE} in 26 | l3|layer3|layer-3) 27 | # Disable ARP on both ends of the veth 28 | ip link set ${IFACE} arp off 29 | ip netns exec ${IF_PEER_NETNS} ip link set ${IF_PEER_IFACE} arp off 30 | 31 | # Make the MAC addresses on both ends the same 32 | ip netns exec ${IF_PEER_NETNS} ip link set ${IF_PEER_IFACE} address $(cat /sys/class/net/${IFACE}/address) 33 | ;; 34 | l2|layer2|layer-2) 35 | # No additional config for layer 2 mode 36 | ;; 37 | '') 38 | # Don't do anything 39 | ;; 40 | *) 41 | echo "Unrecognized veth mode ${IF_VETH_MODE}" 1>&2 42 | exit 1 43 | ;; 44 | esac 45 | fi 46 | 47 | -------------------------------------------------------------------------------- /if-up.d/netns: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | set -e 4 | 5 | if [ -n "${IF_PEER_NETNS}" -a -n "${IF_PEER_IFACE}" ] 6 | then 7 | # Bring up the remote end of the veth 8 | ip netns exec ${IF_PEER_NETNS} ip link set ${IF_PEER_IFACE} up 9 | 10 | case "${IF_CONFIGURE_INTERFACES}" in 11 | true|yes|on) 12 | # Ifup the interfaces in the netns and inside 13 | # a mount namespace with /run/network.nsname mounted 14 | # on /run/network 15 | unshare -m /bin/sh <<-EOF 16 | mount --make-rprivate / 17 | mount --bind /run/network.${IF_PEER_NETNS} /run/network 18 | ip netns exec ${IF_PEER_NETNS} ifup -i /etc/network/interfaces.${IF_PEER_NETNS} -a 19 | EOF 20 | ;; 21 | esac 22 | fi 23 | 24 | --------------------------------------------------------------------------------