mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 10:40:03 +01:00
emellor@leeni.uk.xensource.com
72bb6de0e0
it, when using ip on the kernel command line and not using the installed ifup / ifdown. This stops the script bailing out if there is already an address attached to that device, which was leaving the device without routing (since this has already been removed). Fix the stop action under the same circumstances. No attempt was made to restore the kernel command line details to the interfaces if the ifdown failed in that case. Signed-off-by: Ewan Mellor <ewan@xensource.com>
344 lines
8.6 KiB
Bash
Executable File
344 lines
8.6 KiB
Bash
Executable File
#!/bin/sh
|
|
#============================================================================
|
|
# Default Xen network start/stop script.
|
|
# Xend calls a network script when it starts.
|
|
# The script name to use is defined in /etc/xen/xend-config.sxp
|
|
# in the network-script field.
|
|
#
|
|
# This script creates a bridge (default xenbr${vifnum}), adds a device
|
|
# (default eth${vifnum}) to it, copies the IP addresses from the device
|
|
# to the bridge and adjusts the routes accordingly.
|
|
#
|
|
# If all goes well, this should ensure that networking stays up.
|
|
# However, some configurations are upset by this, especially
|
|
# NFS roots. If the bridged setup does not meet your needs,
|
|
# configure a different script, for example using routing instead.
|
|
#
|
|
# Usage:
|
|
#
|
|
# network-bridge (start|stop|status) {VAR=VAL}*
|
|
#
|
|
# Vars:
|
|
#
|
|
# vifnum Virtual device number to use (default 0). Numbers >=8
|
|
# require the netback driver to have nloopbacks set to a
|
|
# higher value than its default of 8.
|
|
# bridge The bridge to use (default xenbr${vifnum}).
|
|
# netdev The interface to add to the bridge (default eth${vifnum}).
|
|
# antispoof Whether to use iptables to prevent spoofing (default no).
|
|
#
|
|
# Internal Vars:
|
|
# pdev="p${netdev}"
|
|
# vdev="veth${vifnum}"
|
|
# vif0="vif0.${vifnum}"
|
|
#
|
|
# start:
|
|
# Creates the bridge
|
|
# Copies the IP and MAC addresses from netdev to vdev
|
|
# Renames netdev to be pdev
|
|
# Renames vdev to be netdev
|
|
# Enslaves pdev, vdev to bridge
|
|
#
|
|
# stop:
|
|
# Removes netdev from the bridge
|
|
# Transfers addresses, routes from netdev to pdev
|
|
# Renames netdev to vdev
|
|
# Renames pdev to netdev
|
|
# Deletes bridge
|
|
#
|
|
# status:
|
|
# Print addresses, interfaces, routes
|
|
#
|
|
#============================================================================
|
|
|
|
|
|
dir=$(dirname "$0")
|
|
. "$dir/xen-script-common.sh"
|
|
. "$dir/xen-network-common.sh"
|
|
|
|
findCommand "$@"
|
|
evalVariables "$@"
|
|
|
|
vifnum=${vifnum:-0}
|
|
bridge=${bridge:-xenbr${vifnum}}
|
|
netdev=${netdev:-eth${vifnum}}
|
|
antispoof=${antispoof:-no}
|
|
|
|
pdev="p${netdev}"
|
|
vdev="veth${vifnum}"
|
|
vif0="vif0.${vifnum}"
|
|
|
|
legacy_mask_to_prefix() {
|
|
mask=$1
|
|
first=${mask%%.*}
|
|
second=${mask#*.}
|
|
third=${second#*.}
|
|
fourth=${third#*.}
|
|
second=${second%%.*}
|
|
third=${third%%.*}
|
|
declare -i INT FULLMASK BIT
|
|
INT=$((((($first*256)+$second)*256+$third)*256+$fourth))
|
|
FULLMASK=4294967295
|
|
BIT=1
|
|
for bit in `seq 32 -1 0`; do
|
|
if test $FULLMASK -eq $INT; then PREFIX=$bit; return; fi
|
|
FULLMASK=$(($FULLMASK-$BIT))
|
|
BIT=$((BIT*2))
|
|
done
|
|
echo "ERROR converting netmask $mask to prefix"
|
|
exit 1
|
|
}
|
|
|
|
parse_kernel_ip() {
|
|
if egrep 'ip=[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:' /proc/cmdline; then
|
|
kip=`sed -e 's!.*ip=\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\):.*!\1!' /proc/cmdline`
|
|
kmask=`sed -e 's!.*ip=[^:]*:[^:]*:[^:]*:\([^:]*\):.*!\1!' /proc/cmdline`
|
|
kgate=`sed -e 's!.*ip=[^:]*:[^:]*:\([^:]*\):.*!\1!' /proc/cmdline`
|
|
fi
|
|
}
|
|
|
|
do_ifup() {
|
|
if ! ifup $1 ; then
|
|
if [ ${kip} ] ; then
|
|
# use the addresses we grocked from /proc/cmdline
|
|
if [ -z "${kmask}" ]; then
|
|
PREFIX=32
|
|
else
|
|
legacy_mask_to_prefix ${kmask}
|
|
fi
|
|
ip addr flush $1
|
|
ip addr add ${kip}/${PREFIX} dev $1
|
|
ip link set dev $1 up
|
|
[ ${kgate} ] && ip route add default via ${kgate}
|
|
fi
|
|
fi
|
|
}
|
|
|
|
# Usage: transfer_addrs src dst
|
|
# Copy all IP addresses (including aliases) from device $src to device $dst.
|
|
transfer_addrs () {
|
|
local src=$1
|
|
local dst=$2
|
|
# Don't bother if $dst already has IP addresses.
|
|
if ip addr show dev ${dst} | egrep -q '^ *inet ' ; then
|
|
return
|
|
fi
|
|
# Address lines start with 'inet' and have the device in them.
|
|
# Replace 'inet' with 'ip addr add' and change the device name $src
|
|
# to 'dev $src'.
|
|
ip addr show dev ${src} | egrep '^ *inet ' | sed -e "
|
|
s/inet/ip addr add/
|
|
s@\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+/[0-9]\+\)@\1@
|
|
s/${src}/dev ${dst}/
|
|
" | sh -e
|
|
# Remove automatic routes on destination device
|
|
ip route list | sed -ne "
|
|
/dev ${dst}\( \|$\)/ {
|
|
s/^/ip route del /
|
|
p
|
|
}" | sh -e
|
|
}
|
|
|
|
# Usage: transfer_routes src dst
|
|
# Get all IP routes to device $src, delete them, and
|
|
# add the same routes to device $dst.
|
|
# The original routes have to be deleted, otherwise adding them
|
|
# for $dst fails (duplicate routes).
|
|
transfer_routes () {
|
|
local src=$1
|
|
local dst=$2
|
|
# List all routes and grep the ones with $src in.
|
|
# Stick 'ip route del' on the front to delete.
|
|
# Change $src to $dst and use 'ip route add' to add.
|
|
ip route list | sed -ne "
|
|
/dev ${src}\( \|$\)/ {
|
|
h
|
|
s/^/ip route del /
|
|
P
|
|
g
|
|
s/${src}/${dst}/
|
|
s/^/ip route add /
|
|
P
|
|
d
|
|
}" | sh -e
|
|
}
|
|
|
|
|
|
##
|
|
# link_exists interface
|
|
#
|
|
# Returns 0 if the interface named exists (whether up or down), 1 otherwise.
|
|
#
|
|
link_exists()
|
|
{
|
|
if ip link show "$1" >&/dev/null
|
|
then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
|
|
# Usage: create_bridge bridge
|
|
create_bridge () {
|
|
local bridge=$1
|
|
|
|
# Don't create the bridge if it already exists.
|
|
if ! brctl show | grep -q ${bridge} ; then
|
|
brctl addbr ${bridge}
|
|
brctl stp ${bridge} off
|
|
brctl setfd ${bridge} 0
|
|
fi
|
|
ip link set ${bridge} up
|
|
}
|
|
|
|
# Usage: add_to_bridge bridge dev
|
|
add_to_bridge () {
|
|
local bridge=$1
|
|
local dev=$2
|
|
# Don't add $dev to $bridge if it's already on a bridge.
|
|
if ! brctl show | grep -q ${dev} ; then
|
|
brctl addif ${bridge} ${dev}
|
|
fi
|
|
}
|
|
|
|
# Set the default forwarding policy for $dev to drop.
|
|
# Allow forwarding to the bridge.
|
|
antispoofing () {
|
|
iptables -P FORWARD DROP
|
|
iptables -F FORWARD
|
|
iptables -A FORWARD -m physdev --physdev-in ${pdev} -j ACCEPT
|
|
iptables -A FORWARD -m physdev --physdev-in ${vif0} -j ACCEPT
|
|
}
|
|
|
|
# Usage: show_status dev bridge
|
|
# Print ifconfig and routes.
|
|
show_status () {
|
|
local dev=$1
|
|
local bridge=$2
|
|
|
|
echo '============================================================'
|
|
ip addr show ${dev}
|
|
ip addr show ${bridge}
|
|
echo ' '
|
|
brctl show ${bridge}
|
|
echo ' '
|
|
ip route list
|
|
echo ' '
|
|
route -n
|
|
echo '============================================================'
|
|
}
|
|
|
|
op_start () {
|
|
if [ "${bridge}" == "null" ] ; then
|
|
return
|
|
fi
|
|
|
|
if ! link_exists "$vdev"; then
|
|
if link_exists "$pdev"; then
|
|
# The device is already up.
|
|
return
|
|
else
|
|
echo "
|
|
Link $vdev is missing.
|
|
This may be because you have reached the limit of the number of interfaces
|
|
that the loopback driver supports. If the loopback driver is a module, you
|
|
may raise this limit by passing it as a parameter (nloopbacks=<N>); if the
|
|
driver is compiled statically into the kernel, then you may set the parameter
|
|
using loopback.nloopbacks=<N> on the domain 0 kernel command line.
|
|
" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
create_bridge ${bridge}
|
|
|
|
if link_exists "$vdev"; then
|
|
mac=`ip link show ${netdev} | grep 'link\/ether' | sed -e 's/.*ether \(..:..:..:..:..:..\).*/\1/'`
|
|
preiftransfer ${netdev}
|
|
transfer_addrs ${netdev} ${vdev}
|
|
if ! ifdown ${netdev}; then
|
|
# If ifdown fails, take the IP details from the kernel command
|
|
# line.
|
|
parse_kernel_ip
|
|
ip link set ${netdev} down
|
|
ip addr flush ${netdev}
|
|
fi
|
|
ip link set ${netdev} name ${pdev}
|
|
ip link set ${vdev} name ${netdev}
|
|
ip link set ${pdev} down arp off
|
|
ip link set ${pdev} addr fe:ff:ff:ff:ff:ff
|
|
ip addr flush ${pdev}
|
|
ip link set ${netdev} addr ${mac} arp on
|
|
add_to_bridge ${bridge} ${vif0}
|
|
add_to_bridge ${bridge} ${pdev}
|
|
ip link set ${bridge} up
|
|
ip link set ${vif0} up
|
|
ip link set ${pdev} up
|
|
do_ifup ${netdev}
|
|
else
|
|
# old style without ${vdev}
|
|
transfer_addrs ${netdev} ${bridge}
|
|
transfer_routes ${netdev} ${bridge}
|
|
fi
|
|
|
|
if [ ${antispoof} == 'yes' ] ; then
|
|
antispoofing
|
|
fi
|
|
}
|
|
|
|
op_stop () {
|
|
if [ "${bridge}" == "null" ]; then
|
|
return
|
|
fi
|
|
if ! link_exists "$bridge"; then
|
|
return
|
|
fi
|
|
|
|
if link_exists "$pdev"; then
|
|
ip link set dev ${vif0} down
|
|
mac=`ip link show ${netdev} | grep 'link\/ether' | sed -e 's/.*ether \(..:..:..:..:..:..\).*/\1/'`
|
|
transfer_addrs ${netdev} ${pdev}
|
|
if ! ifdown ${netdev}; then
|
|
parse_kernel_ip
|
|
fi
|
|
ip link set ${netdev} down arp off
|
|
ip link set ${netdev} addr fe:ff:ff:ff:ff:ff
|
|
ip link set ${pdev} down
|
|
ip addr flush ${netdev}
|
|
ip link set ${pdev} addr ${mac} arp on
|
|
|
|
brctl delif ${bridge} ${pdev}
|
|
brctl delif ${bridge} ${vif0}
|
|
ip link set ${bridge} down
|
|
|
|
ip link set ${netdev} name ${vdev}
|
|
ip link set ${pdev} name ${netdev}
|
|
do_ifup ${netdev}
|
|
else
|
|
transfer_routes ${bridge} ${netdev}
|
|
ip link set ${bridge} down
|
|
fi
|
|
brctl delbr ${bridge}
|
|
}
|
|
|
|
case "$command" in
|
|
start)
|
|
op_start
|
|
;;
|
|
|
|
stop)
|
|
op_stop
|
|
;;
|
|
|
|
status)
|
|
show_status ${netdev} ${bridge}
|
|
;;
|
|
|
|
*)
|
|
echo "Unknown command: $command" >&2
|
|
echo 'Valid commands are: start, stop, status' >&2
|
|
exit 1
|
|
esac
|