namespace_linux.go 6.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323
  1. package osl
  2. import (
  3. "fmt"
  4. "net"
  5. "os"
  6. "os/exec"
  7. "runtime"
  8. "sync"
  9. "syscall"
  10. "time"
  11. log "github.com/Sirupsen/logrus"
  12. "github.com/docker/docker/pkg/reexec"
  13. "github.com/docker/libnetwork/ns"
  14. "github.com/docker/libnetwork/types"
  15. "github.com/vishvananda/netlink"
  16. "github.com/vishvananda/netns"
  17. )
  18. const prefix = "/var/run/docker/netns"
  19. var (
  20. once sync.Once
  21. garbagePathMap = make(map[string]bool)
  22. gpmLock sync.Mutex
  23. gpmWg sync.WaitGroup
  24. gpmCleanupPeriod = 60 * time.Second
  25. gpmChan = make(chan chan struct{})
  26. nsOnce sync.Once
  27. )
  28. // The networkNamespace type is the linux implementation of the Sandbox
  29. // interface. It represents a linux network namespace, and moves an interface
  30. // into it when called on method AddInterface or sets the gateway etc.
  31. type networkNamespace struct {
  32. path string
  33. iFaces []*nwIface
  34. gw net.IP
  35. gwv6 net.IP
  36. staticRoutes []*types.StaticRoute
  37. neighbors []*neigh
  38. nextIfIndex int
  39. isDefault bool
  40. sync.Mutex
  41. }
  42. func init() {
  43. reexec.Register("netns-create", reexecCreateNamespace)
  44. }
  45. func createBasePath() {
  46. err := os.MkdirAll(prefix, 0755)
  47. if err != nil {
  48. panic("Could not create net namespace path directory")
  49. }
  50. // Start the garbage collection go routine
  51. go removeUnusedPaths()
  52. }
  53. func removeUnusedPaths() {
  54. gpmLock.Lock()
  55. period := gpmCleanupPeriod
  56. gpmLock.Unlock()
  57. ticker := time.NewTicker(period)
  58. for {
  59. var (
  60. gc chan struct{}
  61. gcOk bool
  62. )
  63. select {
  64. case <-ticker.C:
  65. case gc, gcOk = <-gpmChan:
  66. }
  67. gpmLock.Lock()
  68. pathList := make([]string, 0, len(garbagePathMap))
  69. for path := range garbagePathMap {
  70. pathList = append(pathList, path)
  71. }
  72. garbagePathMap = make(map[string]bool)
  73. gpmWg.Add(1)
  74. gpmLock.Unlock()
  75. for _, path := range pathList {
  76. os.Remove(path)
  77. }
  78. gpmWg.Done()
  79. if gcOk {
  80. close(gc)
  81. }
  82. }
  83. }
  84. func addToGarbagePaths(path string) {
  85. gpmLock.Lock()
  86. garbagePathMap[path] = true
  87. gpmLock.Unlock()
  88. }
  89. func removeFromGarbagePaths(path string) {
  90. gpmLock.Lock()
  91. delete(garbagePathMap, path)
  92. gpmLock.Unlock()
  93. }
  94. // GC triggers garbage collection of namespace path right away
  95. // and waits for it.
  96. func GC() {
  97. gpmLock.Lock()
  98. if len(garbagePathMap) == 0 {
  99. // No need for GC if map is empty
  100. gpmLock.Unlock()
  101. return
  102. }
  103. gpmLock.Unlock()
  104. // if content exists in the garbage paths
  105. // we can trigger GC to run, providing a
  106. // channel to be notified on completion
  107. waitGC := make(chan struct{})
  108. gpmChan <- waitGC
  109. // wait for GC completion
  110. <-waitGC
  111. }
  112. // GenerateKey generates a sandbox key based on the passed
  113. // container id.
  114. func GenerateKey(containerID string) string {
  115. maxLen := 12
  116. if len(containerID) < maxLen {
  117. maxLen = len(containerID)
  118. }
  119. return prefix + "/" + containerID[:maxLen]
  120. }
  121. // NewSandbox provides a new sandbox instance created in an os specific way
  122. // provided a key which uniquely identifies the sandbox
  123. func NewSandbox(key string, osCreate bool) (Sandbox, error) {
  124. err := createNetworkNamespace(key, osCreate)
  125. if err != nil {
  126. return nil, err
  127. }
  128. return &networkNamespace{path: key, isDefault: !osCreate}, nil
  129. }
  130. func (n *networkNamespace) InterfaceOptions() IfaceOptionSetter {
  131. return n
  132. }
  133. func (n *networkNamespace) NeighborOptions() NeighborOptionSetter {
  134. return n
  135. }
  136. func mountNetworkNamespace(basePath string, lnPath string) error {
  137. if err := syscall.Mount(basePath, lnPath, "bind", syscall.MS_BIND, ""); err != nil {
  138. return err
  139. }
  140. if err := loopbackUp(); err != nil {
  141. return err
  142. }
  143. return nil
  144. }
  145. // GetSandboxForExternalKey returns sandbox object for the supplied path
  146. func GetSandboxForExternalKey(basePath string, key string) (Sandbox, error) {
  147. var err error
  148. if err = createNamespaceFile(key); err != nil {
  149. return nil, err
  150. }
  151. n := &networkNamespace{path: basePath}
  152. n.InvokeFunc(func() {
  153. err = mountNetworkNamespace(basePath, key)
  154. })
  155. if err != nil {
  156. return nil, err
  157. }
  158. return &networkNamespace{path: key}, nil
  159. }
  160. func reexecCreateNamespace() {
  161. if len(os.Args) < 2 {
  162. log.Fatal("no namespace path provided")
  163. }
  164. if err := mountNetworkNamespace("/proc/self/ns/net", os.Args[1]); err != nil {
  165. log.Fatal(err)
  166. }
  167. }
  168. func createNetworkNamespace(path string, osCreate bool) error {
  169. if err := createNamespaceFile(path); err != nil {
  170. return err
  171. }
  172. cmd := &exec.Cmd{
  173. Path: reexec.Self(),
  174. Args: append([]string{"netns-create"}, path),
  175. Stdout: os.Stdout,
  176. Stderr: os.Stderr,
  177. }
  178. if osCreate {
  179. cmd.SysProcAttr = &syscall.SysProcAttr{}
  180. cmd.SysProcAttr.Cloneflags = syscall.CLONE_NEWNET
  181. }
  182. if err := cmd.Run(); err != nil {
  183. return fmt.Errorf("namespace creation reexec command failed: %v", err)
  184. }
  185. return nil
  186. }
  187. func unmountNamespaceFile(path string) {
  188. if _, err := os.Stat(path); err == nil {
  189. syscall.Unmount(path, syscall.MNT_DETACH)
  190. }
  191. }
  192. func createNamespaceFile(path string) (err error) {
  193. var f *os.File
  194. once.Do(createBasePath)
  195. // Remove it from garbage collection list if present
  196. removeFromGarbagePaths(path)
  197. // If the path is there unmount it first
  198. unmountNamespaceFile(path)
  199. // wait for garbage collection to complete if it is in progress
  200. // before trying to create the file.
  201. gpmWg.Wait()
  202. if f, err = os.Create(path); err == nil {
  203. f.Close()
  204. }
  205. return err
  206. }
  207. func loopbackUp() error {
  208. iface, err := netlink.LinkByName("lo")
  209. if err != nil {
  210. return err
  211. }
  212. return netlink.LinkSetUp(iface)
  213. }
  214. func (n *networkNamespace) InvokeFunc(f func()) error {
  215. return nsInvoke(n.nsPath(), func(nsFD int) error { return nil }, func(callerFD int) error {
  216. f()
  217. return nil
  218. })
  219. }
  220. // InitOSContext initializes OS context while configuring network resources
  221. func InitOSContext() func() {
  222. runtime.LockOSThread()
  223. nsOnce.Do(ns.Init)
  224. if err := ns.SetNamespace(); err != nil {
  225. log.Error(err)
  226. }
  227. return runtime.UnlockOSThread
  228. }
  229. func nsInvoke(path string, prefunc func(nsFD int) error, postfunc func(callerFD int) error) error {
  230. defer InitOSContext()()
  231. f, err := os.OpenFile(path, os.O_RDONLY, 0)
  232. if err != nil {
  233. return fmt.Errorf("failed get network namespace %q: %v", path, err)
  234. }
  235. defer f.Close()
  236. nsFD := f.Fd()
  237. // Invoked before the namespace switch happens but after the namespace file
  238. // handle is obtained.
  239. if err := prefunc(int(nsFD)); err != nil {
  240. return fmt.Errorf("failed in prefunc: %v", err)
  241. }
  242. if err = netns.Set(netns.NsHandle(nsFD)); err != nil {
  243. return err
  244. }
  245. defer ns.SetNamespace()
  246. // Invoked after the namespace switch.
  247. return postfunc(ns.ParseHandlerInt())
  248. }
  249. func (n *networkNamespace) nsPath() string {
  250. n.Lock()
  251. defer n.Unlock()
  252. return n.path
  253. }
  254. func (n *networkNamespace) Info() Info {
  255. return n
  256. }
  257. func (n *networkNamespace) Key() string {
  258. return n.path
  259. }
  260. func (n *networkNamespace) Destroy() error {
  261. // Assuming no running process is executing in this network namespace,
  262. // unmounting is sufficient to destroy it.
  263. if err := syscall.Unmount(n.path, syscall.MNT_DETACH); err != nil {
  264. return err
  265. }
  266. // Stash it into the garbage collection list
  267. addToGarbagePaths(n.path)
  268. return nil
  269. }