mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 02:30:03 +01:00
emellor@leeni.uk.xensource.com
af374bc7d2
hotplug ones. Added evalVariables and findCommand functions to that, which we use to clarify the handling of variables being passed in as command line variables. Make vif-bridge able to find the bridge for itself if only one bridge is in use. This means that it is not necessary to specify a bridge in many configurations. Allow the bridge to be specified on the command line, meaning that a default may be provided in the xend-config.sxp if desired. Added xenstore_read_default to xen-hotplug-common.sh, which reads from the store but uses a given default if the path in the store is not present. This is used by vif-bridge to allow the store details (i.e. those given to xm create) to override the default value given in the xend-config.sxp. Remove vif-bridge setting -- the value can be specified on the vif-script command line if necessary. Added examples for network-nat/vif-nat. Added lots of big comments. Signed-off-by: Ewan Mellor <ewan@xensource.com>
305 lines
7.8 KiB
Bash
Executable File
305 lines
7.8 KiB
Bash
Executable File
#!/bin/sh
|
|
#============================================================================
|
|
# Default Xen network start/stop script.
|
|
# Xend calls a network script when it starts.
|
|
# The script name to use is defined in /etc/xen/xend-config.sxp
|
|
# in the network-script field.
|
|
#
|
|
# This script creates a bridge (default xenbr${vifnum}), adds a device
|
|
# (default eth${vifnum}) to it, copies the IP addresses from the device
|
|
# to the bridge and adjusts the routes accordingly.
|
|
#
|
|
# If all goes well, this should ensure that networking stays up.
|
|
# However, some configurations are upset by this, especially
|
|
# NFS roots. If the bridged setup does not meet your needs,
|
|
# configure a different script, for example using routing instead.
|
|
#
|
|
# Usage:
|
|
#
|
|
# network (start|stop|status) {VAR=VAL}*
|
|
#
|
|
# Vars:
|
|
#
|
|
# vifnum Virtual device number to use (default 0). Numbers >=1
|
|
# require the netback driver to have nloopbacks set to a
|
|
# higher value than its default of 1.
|
|
# bridge The bridge to use (default xenbr${vifnum}).
|
|
# netdev The interface to add to the bridge (default eth${vifnum}).
|
|
# antispoof Whether to use iptables to prevent spoofing (default no).
|
|
#
|
|
# start:
|
|
# Creates the bridge and enslaves netdev to it.
|
|
# Copies the IP addresses from netdev to the bridge.
|
|
# Deletes the routes to netdev and adds them on bridge.
|
|
#
|
|
# stop:
|
|
# Removes netdev from the bridge.
|
|
# Deletes the routes to bridge and adds them to netdev.
|
|
#
|
|
# status:
|
|
# Print ifconfig for netdev and bridge.
|
|
# Print routes.
|
|
#
|
|
#============================================================================
|
|
|
|
|
|
dir=$(dirname "$0")
|
|
. "$dir/xen-script-common.sh"
|
|
. "$dir/xen-network-common.sh"
|
|
|
|
findCommand "$@"
|
|
evalVariables "$@"
|
|
|
|
vifnum=${vifnum:-0}
|
|
bridge=${bridge:-xenbr${vifnum}}
|
|
netdev=${netdev:-eth${vifnum}}
|
|
antispoof=${antispoof:-no}
|
|
|
|
pdev="p${netdev}"
|
|
vdev="veth${vifnum}"
|
|
vif0="vif0.${vifnum}"
|
|
|
|
legacy_mask_to_prefix() {
|
|
mask=$1
|
|
first=${mask%%.*}
|
|
second=${mask#*.}
|
|
third=${second#*.}
|
|
fourth=${third#*.}
|
|
second=${second%%.*}
|
|
third=${third%%.*}
|
|
declare -i INT FULLMASK BIT
|
|
INT=$((((($first*256)+$second)*256+$third)*256+$fourth))
|
|
FULLMASK=4294967295
|
|
BIT=1
|
|
for bit in `seq 32 -1 0`; do
|
|
if test $FULLMASK -eq $INT; then PREFIX=$bit; return; fi
|
|
FULLMASK=$(($FULLMASK-$BIT))
|
|
BIT=$((BIT*2))
|
|
done
|
|
echo "ERROR converting netmask $mask to prefix"
|
|
exit 1
|
|
}
|
|
|
|
# Usage: transfer_addrs src dst
|
|
# Copy all IP addresses (including aliases) from device $src to device $dst.
|
|
transfer_addrs () {
|
|
local src=$1
|
|
local dst=$2
|
|
# Don't bother if $dst already has IP addresses.
|
|
if ip addr show dev ${dst} | egrep -q '^ *inet ' ; then
|
|
return
|
|
fi
|
|
# Address lines start with 'inet' and have the device in them.
|
|
# Replace 'inet' with 'ip addr add' and change the device name $src
|
|
# to 'dev $src'.
|
|
ip addr show dev ${src} | egrep '^ *inet ' | sed -e "
|
|
s/inet/ip addr add/
|
|
s@\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+/[0-9]\+\)@\1@
|
|
s/${src}/dev ${dst}/
|
|
" | sh -e
|
|
# Remove automatic routes on destionation device
|
|
ip route list | sed -ne "
|
|
/dev ${dst}\( \|$\)/ {
|
|
s/^/ip route del /
|
|
p
|
|
}" | sh -e
|
|
}
|
|
|
|
# Usage: del_addrs src
|
|
del_addrs () {
|
|
local src=$1
|
|
ip addr show dev ${src} | egrep '^ *inet ' | sed -e "
|
|
s/inet/ip addr del/
|
|
s@\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\)/[0-9]\+@\1@
|
|
s/${src}/dev ${src}/
|
|
" | sh -e
|
|
ip link set dev ${dst} up
|
|
}
|
|
|
|
# Usage: transfer_routes src dst
|
|
# Get all IP routes to device $src, delete them, and
|
|
# add the same routes to device $dst.
|
|
# The original routes have to be deleted, otherwise adding them
|
|
# for $dst fails (duplicate routes).
|
|
transfer_routes () {
|
|
local src=$1
|
|
local dst=$2
|
|
# List all routes and grep the ones with $src in.
|
|
# Stick 'ip route del' on the front to delete.
|
|
# Change $src to $dst and use 'ip route add' to add.
|
|
ip route list | sed -ne "
|
|
/dev ${src}\( \|$\)/ {
|
|
h
|
|
s/^/ip route del /
|
|
P
|
|
g
|
|
s/${src}/${dst}/
|
|
s/^/ip route add /
|
|
P
|
|
d
|
|
}" | sh -e
|
|
}
|
|
|
|
# Usage: create_bridge bridge
|
|
create_bridge () {
|
|
local bridge=$1
|
|
|
|
# Don't create the bridge if it already exists.
|
|
if ! brctl show | grep -q ${bridge} ; then
|
|
brctl addbr ${bridge}
|
|
brctl stp ${bridge} off
|
|
brctl setfd ${bridge} 0
|
|
fi
|
|
ip link set ${bridge} up
|
|
}
|
|
|
|
# Usage: add_to_bridge bridge dev
|
|
add_to_bridge () {
|
|
local bridge=$1
|
|
local dev=$2
|
|
# Don't add $dev to $bridge if it's already on a bridge.
|
|
if ! brctl show | grep -q ${dev} ; then
|
|
brctl addif ${bridge} ${dev}
|
|
fi
|
|
}
|
|
|
|
# Set the default forwarding policy for $dev to drop.
|
|
# Allow forwarding to the bridge.
|
|
antispoofing () {
|
|
iptables -P FORWARD DROP
|
|
iptables -F FORWARD
|
|
iptables -A FORWARD -m physdev --physdev-in ${pdev} -j ACCEPT
|
|
iptables -A FORWARD -m physdev --physdev-in ${vif0} -j ACCEPT
|
|
}
|
|
|
|
# Usage: show_status dev bridge
|
|
# Print ifconfig and routes.
|
|
show_status () {
|
|
local dev=$1
|
|
local bridge=$2
|
|
|
|
echo '============================================================'
|
|
ip addr show ${dev}
|
|
ip addr show ${bridge}
|
|
echo ' '
|
|
brctl show ${bridge}
|
|
echo ' '
|
|
ip route list
|
|
echo ' '
|
|
route -n
|
|
echo '============================================================'
|
|
}
|
|
|
|
op_start () {
|
|
if [ "${bridge}" == "null" ] ; then
|
|
return
|
|
fi
|
|
|
|
create_bridge ${bridge}
|
|
|
|
if ! ip link show 2>/dev/null | grep -q "^[0-9]*: ${vdev}"; then
|
|
return
|
|
fi
|
|
|
|
if ip link show ${vdev} 2>/dev/null >/dev/null; then
|
|
mac=`ip link show ${netdev} | grep 'link\/ether' | sed -e 's/.*ether \(..:..:..:..:..:..\).*/\1/'`
|
|
preiftransfer ${netdev}
|
|
transfer_addrs ${netdev} ${vdev}
|
|
if ! ifdown ${netdev}; then
|
|
# if ifup didn't work, see if we have an ip= on cmd line
|
|
if egrep 'ip=[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:' /proc/cmdline; then
|
|
kip=`sed -e 's!.*ip=\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\):.*!\1!' /proc/cmdline`
|
|
kmask=`sed -e 's!.*ip=[^:]*:[^:]*:[^:]*:\([^:]*\):.*!\1!' /proc/cmdline`
|
|
kgate=`sed -e 's!.*ip=[^:]*:[^:]*:\([^:]*\):.*!\1!' /proc/cmdline`
|
|
ip link set ${netdev} down
|
|
ip addr flush ${netdev}
|
|
fi
|
|
fi
|
|
ip link set ${netdev} name ${pdev}
|
|
ip link set ${vdev} name ${netdev}
|
|
ip link set ${pdev} down arp off
|
|
ip link set ${pdev} addr fe:ff:ff:ff:ff:ff
|
|
ip addr flush ${pdev}
|
|
ip link set ${netdev} addr ${mac} arp on
|
|
add_to_bridge ${bridge} ${vif0}
|
|
add_to_bridge ${bridge} ${pdev}
|
|
ip link set ${bridge} up
|
|
ip link set ${vif0} up
|
|
ip link set ${pdev} up
|
|
if ! ifup ${netdev} ; then
|
|
if [ ${kip} ] ; then
|
|
# use the addresses we grocked from /proc/cmdline
|
|
if [ -z "${kmask}" ]; then
|
|
PREFIX=32;
|
|
else
|
|
legacy_to_prefix ${kmask};
|
|
fi
|
|
ip addr add ${kip}/${PREFIX} dev ${netdev}
|
|
ip link set dev ${netdev} up
|
|
[ ${kgate} ] && ip route add default via ${kgate}
|
|
fi
|
|
fi
|
|
else
|
|
# old style without ${vdev}
|
|
transfer_addrs ${netdev} ${bridge}
|
|
transfer_routes ${netdev} ${bridge}
|
|
fi
|
|
|
|
if [ ${antispoof} == 'yes' ] ; then
|
|
antispoofing
|
|
fi
|
|
}
|
|
|
|
op_stop () {
|
|
if [ "${bridge}" == "null" ]; then
|
|
return
|
|
fi
|
|
if ! ip link show ${bridge} >/dev/null 2>&1; then
|
|
return
|
|
fi
|
|
|
|
if ip link show ${pdev} 2>/dev/null >/dev/null; then
|
|
ip link set dev ${vif0} down
|
|
mac=`ip link show ${netdev} | grep 'link\/ether' | sed -e 's/.*ether \(..:..:..:..:..:..\).*/\1/'`
|
|
transfer_addrs ${netdev} ${pdev}
|
|
ifdown ${netdev}
|
|
ip link set ${netdev} down arp off
|
|
ip link set ${netdev} addr fe:ff:ff:ff:ff:ff
|
|
ip link set ${pdev} down
|
|
ip addr flush ${netdev}
|
|
ip link set ${pdev} addr ${mac} arp on
|
|
|
|
brctl delif ${bridge} ${pdev}
|
|
brctl delif ${bridge} ${vif0}
|
|
ip link set ${bridge} down
|
|
|
|
ip link set ${netdev} name ${vdev}
|
|
ip link set ${pdev} name ${netdev}
|
|
ifup ${netdev}
|
|
|
|
else
|
|
transfer_routes ${bridge} ${netdev}
|
|
ip link set ${bridge} down
|
|
fi
|
|
brctl delbr ${bridge}
|
|
}
|
|
|
|
case "$command" in
|
|
start)
|
|
op_start
|
|
;;
|
|
|
|
stop)
|
|
op_stop
|
|
;;
|
|
|
|
status)
|
|
show_status ${netdev} ${bridge}
|
|
;;
|
|
|
|
*)
|
|
echo "Unknown command: $command" >&2
|
|
echo 'Valid commands are: start, stop, status' >&2
|
|
exit 1
|
|
esac
|