On Fri, Dec 10, 2010 at 03:11:27PM +0100, Grzegorz Nosek wrote:
> This is basically what I'm after, making the host a virtual
> switch/router/firewall for the guests.
Script type 2:
ard@marvel:/root/vserver$ cat scripts/setup_network_namespace
#!/bin/bash -x
echo ARGS "$@"
VSERVER="$2"
VID="${VSERVER#v}"
CLIENTDEV=${VSERVER}-client
HOSTDEV=${VSERVER}-host
BRIDGEDEV=br-vlan${VID}
stringasmac() {
echo "$1"|sed 's/\(..\)\(..\)\(..\)\(..\)\(..\)\(..\)/\1:\2:\3:\4:\5:\6/'
}
case "$1" in
post-start)
echo a PID: $!
# Setup the vlan anyway you like it. I prefer ifup
#ifup "${DEVNAME}"
#ip link add link bond0 name "${DEVNAME}" type vlan id ${VID}
read CONTEXTID < /etc/vservers/${VSERVER}/context
echo $CONTEXTID
MACSTRING=$(printf "%04x" $VID)$(printf "%04x" $CONTEXTID)
MACADDRC=$(stringasmac 02${MACSTRING}00)
MACADDRH=$(stringasmac 02${MACSTRING}01)
ip link add name ${HOSTDEV} type veth peer name ${CLIENTDEV}
ip link set address ${MACADDRC} dev ${CLIENTDEV}
ip link set address ${MACADDRH} dev ${HOSTDEV}
brctl addif ${BRIDGEDEV} ${HOSTDEV}
vspace -e "$2" --net -- /usr/lib/util-vserver/vprocunhide
vspace -e "$2" --net -- ip li set up dev lo
vspace -e "$2" --net -- sh -c 'while echo $$;do :; done'|(read aPid;ip li set dev "$CLIENTDEV" netns $aPid)
vspace -e "$2" --net -- ip a add `awk '/me-'${CLIENTDEV}'/ { print $1 $4 }' /etc/hosts` dev "${CLIENTDEV}"
vspace -e "$2" --net -- ip li set up dev "${CLIENTDEV}"
vspace -e "$2" --net -- ip ro add default via `awk '/gw-'${CLIENTDEV}'/ { print $1 }' /etc/hosts`
ip li set up dev "${HOSTDEV}"
;;
pre-stop)
vspace -e "$2" --net -- ip li set down dev "${CLIENTDEV}"
vspace -e "$2" --net -- ip li set down dev lo
vspace -e "$2" --net -- ip link del "${CLIENTDEV}"
;;
esac
exit 0
Assumptions: guest is still called v${id} . In /etc/hosts a netmask is added behind the name:
1.1.1.1 me-vblaat-guest # /24
The only real difference with the other script is the creation of veth devices
and thinking up the mac address.
This was the part where I hit the wall when using post-start, while actually
some "daemon" must be started in pre-initialize which can give the guest it's
device when it exists, and the guest should have an init script that waits for
the device to appear.
I currently do not have a setup ready in which I can change and test the moving
of the script to preinit.
Anyway: have fun with it.
BTW: I was trying to document this, but nothing but
http://linux-vserver.org/util-vserver:SplitSharedNetworks
came out of my head. I usually have an interpreter with me when talking to
management and such, so that might explain a bit ;-).
Received on Fri Dec 10 15:17:40 2010