diff options
author | 2016-10-29 19:20:40 +0200 | |
---|---|---|
committer | 2016-10-29 19:20:40 +0200 | |
commit | 4109b0dc8c13eace4d143a4a5f59018f9e29785d (patch) | |
tree | 1b3d6f85fa6f6de4ab3f5b78815de9a3c00437e6 /src/fnet/veth.c | |
parent | added profile for wire (diff) | |
parent | Merge pull request #878 from msva/patch-1 (diff) | |
download | firejail-4109b0dc8c13eace4d143a4a5f59018f9e29785d.tar.gz firejail-4109b0dc8c13eace4d143a4a5f59018f9e29785d.tar.zst firejail-4109b0dc8c13eace4d143a4a5f59018f9e29785d.zip |
Merge remote-tracking branch 'upstream/master'
Diffstat (limited to 'src/fnet/veth.c')
-rw-r--r-- | src/fnet/veth.c | 230 |
1 files changed, 230 insertions, 0 deletions
diff --git a/src/fnet/veth.c b/src/fnet/veth.c new file mode 100644 index 000000000..d06bc9256 --- /dev/null +++ b/src/fnet/veth.c | |||
@@ -0,0 +1,230 @@ | |||
1 | /* code based on iproute2 ip/iplink.c, modified to be included in firejail project | ||
2 | * | ||
3 | * Original source code: | ||
4 | * | ||
5 | * Information: | ||
6 | * http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2 | ||
7 | * | ||
8 | * Download: | ||
9 | * http://www.kernel.org/pub/linux/utils/net/iproute2/ | ||
10 | * | ||
11 | * Repository: | ||
12 | * git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git | ||
13 | * | ||
14 | * License: GPL v2 | ||
15 | * | ||
16 | * Original copyright header | ||
17 | * | ||
18 | * iplink.c "ip link". | ||
19 | * | ||
20 | * This program is free software; you can redistribute it and/or | ||
21 | * modify it under the terms of the GNU General Public License | ||
22 | * as published by the Free Software Foundation; either version | ||
23 | * 2 of the License, or (at your option) any later version. | ||
24 | * | ||
25 | * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> | ||
26 | * | ||
27 | */ | ||
28 | /* | ||
29 | * Copyright (C) 2014-2016 Firejail Authors | ||
30 | * | ||
31 | * This file is part of firejail project | ||
32 | * | ||
33 | * This program is free software; you can redistribute it and/or modify | ||
34 | * it under the terms of the GNU General Public License as published by | ||
35 | * the Free Software Foundation; either version 2 of the License, or | ||
36 | * (at your option) any later version. | ||
37 | * | ||
38 | * This program is distributed in the hope that it will be useful, | ||
39 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
40 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
41 | * GNU General Public License for more details. | ||
42 | * | ||
43 | * You should have received a copy of the GNU General Public License along | ||
44 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
45 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
46 | */ | ||
47 | |||
48 | #include "fnet.h" | ||
49 | #include "../include/libnetlink.h" | ||
50 | #include <linux/veth.h> | ||
51 | #include <net/if.h> | ||
52 | |||
53 | struct iplink_req | ||
54 | { | ||
55 | struct nlmsghdr n; | ||
56 | struct ifinfomsg i; | ||
57 | char buf[1024]; | ||
58 | }; | ||
59 | |||
60 | static struct rtnl_handle rth = { .fd = -1 }; | ||
61 | |||
62 | int net_create_veth(const char *dev, const char *nsdev, unsigned pid) { | ||
63 | int len; | ||
64 | struct iplink_req req; | ||
65 | |||
66 | assert(dev); | ||
67 | assert(nsdev); | ||
68 | assert(pid); | ||
69 | |||
70 | if (rtnl_open(&rth, 0) < 0) { | ||
71 | fprintf(stderr, "cannot open netlink\n"); | ||
72 | exit(1); | ||
73 | } | ||
74 | |||
75 | memset(&req, 0, sizeof(req)); | ||
76 | |||
77 | req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg)); | ||
78 | req.n.nlmsg_flags = NLM_F_REQUEST|NLM_F_CREATE|NLM_F_EXCL; | ||
79 | req.n.nlmsg_type = RTM_NEWLINK; | ||
80 | req.i.ifi_family = 0; | ||
81 | |||
82 | if (dev) { | ||
83 | len = strlen(dev) + 1; | ||
84 | addattr_l(&req.n, sizeof(req), IFLA_IFNAME, dev, len); | ||
85 | } | ||
86 | |||
87 | struct rtattr *linkinfo = NLMSG_TAIL(&req.n); | ||
88 | addattr_l(&req.n, sizeof(req), IFLA_LINKINFO, NULL, 0); | ||
89 | addattr_l(&req.n, sizeof(req), IFLA_INFO_KIND, "veth", strlen("veth")); | ||
90 | |||
91 | struct rtattr * data = NLMSG_TAIL(&req.n); | ||
92 | addattr_l(&req.n, sizeof(req), IFLA_INFO_DATA, NULL, 0); | ||
93 | |||
94 | struct rtattr * peerdata = NLMSG_TAIL(&req.n); | ||
95 | addattr_l (&req.n, sizeof(req), VETH_INFO_PEER, NULL, 0); | ||
96 | req.n.nlmsg_len += sizeof(struct ifinfomsg); | ||
97 | |||
98 | // place the link in the child namespace | ||
99 | addattr_l (&req.n, sizeof(req), IFLA_NET_NS_PID, &pid, 4); | ||
100 | |||
101 | if (nsdev) { | ||
102 | int len = strlen(nsdev) + 1; | ||
103 | addattr_l(&req.n, sizeof(req), IFLA_IFNAME, nsdev, len); | ||
104 | } | ||
105 | peerdata->rta_len = (void *)NLMSG_TAIL(&req.n) - (void *)peerdata; | ||
106 | |||
107 | data->rta_len = (void *)NLMSG_TAIL(&req.n) - (void *)data; | ||
108 | linkinfo->rta_len = (void *)NLMSG_TAIL(&req.n) - (void *)linkinfo; | ||
109 | |||
110 | // send message | ||
111 | if (rtnl_talk(&rth, &req.n, 0, 0, NULL) < 0) | ||
112 | exit(2); | ||
113 | |||
114 | return 0; | ||
115 | } | ||
116 | |||
117 | |||
118 | int net_create_macvlan(const char *dev, const char *parent, unsigned pid) { | ||
119 | int len; | ||
120 | struct iplink_req req; | ||
121 | assert(dev); | ||
122 | assert(parent); | ||
123 | |||
124 | if (rtnl_open(&rth, 0) < 0) { | ||
125 | fprintf(stderr, "cannot open netlink\n"); | ||
126 | exit(1); | ||
127 | } | ||
128 | |||
129 | memset(&req, 0, sizeof(req)); | ||
130 | |||
131 | req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg)); | ||
132 | req.n.nlmsg_flags = NLM_F_REQUEST|NLM_F_CREATE|NLM_F_EXCL; | ||
133 | req.n.nlmsg_type = RTM_NEWLINK; | ||
134 | req.i.ifi_family = 0; | ||
135 | |||
136 | // find parent ifindex | ||
137 | int parent_ifindex = if_nametoindex(parent); | ||
138 | if (parent_ifindex <= 0) { | ||
139 | fprintf(stderr, "Error: cannot find network device %s\n", parent); | ||
140 | exit(1); | ||
141 | } | ||
142 | |||
143 | // add parent | ||
144 | addattr_l(&req.n, sizeof(req), IFLA_LINK, &parent_ifindex, 4); | ||
145 | |||
146 | // add new interface name | ||
147 | len = strlen(dev) + 1; | ||
148 | addattr_l(&req.n, sizeof(req), IFLA_IFNAME, dev, len); | ||
149 | |||
150 | // place the interface in child namespace | ||
151 | addattr_l (&req.n, sizeof(req), IFLA_NET_NS_PID, &pid, 4); | ||
152 | |||
153 | |||
154 | // add link info for the new interface | ||
155 | struct rtattr *linkinfo = NLMSG_TAIL(&req.n); | ||
156 | addattr_l(&req.n, sizeof(req), IFLA_LINKINFO, NULL, 0); | ||
157 | addattr_l(&req.n, sizeof(req), IFLA_INFO_KIND, "macvlan", strlen("macvlan")); | ||
158 | |||
159 | // set macvlan bridge mode | ||
160 | struct rtattr * data = NLMSG_TAIL(&req.n); | ||
161 | addattr_l(&req.n, sizeof(req), IFLA_INFO_DATA, NULL, 0); | ||
162 | int macvlan_type = MACVLAN_MODE_BRIDGE; | ||
163 | addattr_l (&req.n, sizeof(req), IFLA_INFO_KIND, &macvlan_type, 4); | ||
164 | |||
165 | data->rta_len = (void *)NLMSG_TAIL(&req.n) - (void *)data; | ||
166 | // req.n.nlmsg_len += sizeof(struct ifinfomsg); | ||
167 | |||
168 | |||
169 | data->rta_len = (void *)NLMSG_TAIL(&req.n) - (void *)data; | ||
170 | linkinfo->rta_len = (void *)NLMSG_TAIL(&req.n) - (void *)linkinfo; | ||
171 | |||
172 | // send message | ||
173 | if (rtnl_talk(&rth, &req.n, 0, 0, NULL) < 0) | ||
174 | exit(2); | ||
175 | |||
176 | return 0; | ||
177 | } | ||
178 | |||
179 | // move the interface dev in namespace of program pid | ||
180 | // when the interface is moved, netlink does not preserve interface configuration | ||
181 | int net_move_interface(const char *dev, unsigned pid) { | ||
182 | struct iplink_req req; | ||
183 | assert(dev); | ||
184 | |||
185 | if (rtnl_open(&rth, 0) < 0) { | ||
186 | fprintf(stderr, "cannot open netlink\n"); | ||
187 | exit(1); | ||
188 | } | ||
189 | |||
190 | memset(&req, 0, sizeof(req)); | ||
191 | |||
192 | req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg)); | ||
193 | req.n.nlmsg_flags = NLM_F_REQUEST; | ||
194 | req.n.nlmsg_type = RTM_NEWLINK; | ||
195 | req.i.ifi_family = 0; | ||
196 | |||
197 | // find ifindex | ||
198 | int ifindex = if_nametoindex(dev); | ||
199 | if (ifindex <= 0) { | ||
200 | fprintf(stderr, "Error: cannot find interface %s\n", dev); | ||
201 | exit(1); | ||
202 | } | ||
203 | req.i.ifi_index = ifindex; | ||
204 | |||
205 | // place the interface in child namespace | ||
206 | addattr_l (&req.n, sizeof(req), IFLA_NET_NS_PID, &pid, 4); | ||
207 | |||
208 | // send message | ||
209 | if (rtnl_talk(&rth, &req.n, 0, 0, NULL) < 0) | ||
210 | exit(2); | ||
211 | |||
212 | return 0; | ||
213 | } | ||
214 | |||
215 | /* | ||
216 | int main(int argc, char **argv) { | ||
217 | printf("Hello\n"); | ||
218 | |||
219 | |||
220 | char *dev = argv[3]; | ||
221 | char *nsdev = argv[8]; | ||
222 | unsigned pid; | ||
223 | sscanf(argv[10], "%u", &pid); | ||
224 | |||
225 | |||
226 | net_create_veth(dev, nsdev, pid); | ||
227 | |||
228 | return 0; | ||
229 | } | ||
230 | */ \ No newline at end of file | ||